six demon bag

2019-05-06

Run a time server in an LXC container

Running a network time server in an LXC container normally doesn't work even if you run the container in privileged mode. The reason is that containers drop certain capabilities upon startup for security reasons (sys_module, mac_admin, mac_override, sys_time).

---

For running an NTP server in a container remove sys_time from the list of dropped capabilities by adding the following settings to the config section of your container config (lxc config edit CONTAINER_NAME):

config:
  raw.lxc: |-
    lxc.cap.drop =
    lxc.cap.drop = sys_module mac_admin mac_override
  security.privileged: "true"
  ...

Also make sure that the host system (as well as others containers on that host) will NOT modify the system time. This can be achieved by configuring the NTP service to use the undisciplined local clock driver.

# /etc/ntpd.conf
restrict default ignore
restrict 127.0.0.1
server 127.127.1.0 prefer    # local clock
fudge  127.127.1.0 stratum 10
driftfile /var/lib/ntp/drift

Alternatively remove the NTP service entirely. The latter isn't always an option, though. Cloudera's Hadoop distribution for instance demands that you are running an NTP service on all nodes.

Posted 21:38 [permalink]

Archives