Search Knowledge Base Articles

Linux Containers

Overview

Warning:

WebPros International, LLC recommends that only experienced system administrators attempt to perform the steps in this document. WebPros International, LLC is not responsible for any data loss that an attempt to perform these steps causes.

WebPros International, LLC supports the use of cPanel & WHM inside of a Linux Container (LXC). An LXC container provides an environment that resembles a standard Linux installation, but does not require a separate kernel. For more information about LXC containers, read the Linux Containers documentation.

Run in a Linux Container

To run cPanel & WHM inside an LXC container, we strongly recommend that you use the following settings:

Host

We strongly recommend that you use Red Hat® Enterprise Linux® (RHEL) 7 or CentOS 7 as your server’s LXC host. This configuration ensures the best compatibility with cPanel & WHM. While other Linux distributions may work, they require that the system administrator perform additional steps that we do not support.

Warning:

We have not tested LXC on CloudLinux 8 or higher, AlmaLinux OS, or Rocky Linux™ servers.

Guest

A CentOS 7 or an RHEL 7 installation require additional steps to use as a guest.

Privileged vs unprivileged containers

cPanel & WHM functions in both privileged and unprivileged containers. We strongly recommend that you run cPanel & WHM in a privileged container, because it expects unrestricted access to the system.

The following limitations are inherent to an unprivileged container:

  • The host operating system treats the root user as a non-root user.

  • You cannot raise the hard limit of a process if you previously lowered it. This action could cause EasyApache 4 to fail.

  • Subtle behavior differences may occur.

Required changes for CentOS 7 or RHEL 7

You must make the following configuration changes to run cPanel & WHM inside an LXC container:

  1. After you create the LXC container, change the lxc.include line in the lxc.conf file to the following line:

    lxc.include = /usr/share/lxc/config/fedora.common.conf

  2. Edit the lxc.conf file to drop setfcap and setpcap capabilities. To do this, comment out the following lines:

    1
2

    # lxc.cap.drop = setpcap
# lxc.cap.drop = setfcap

Note:

Some system configurations will not run properly with cron inside an LXC container. Individual cron jobs fail to execute even though the cron daemon is active. This issue is a direct result of the incompatibility between the container environment and the pam_loginuid module.

To resolve this conflict, disable the pam_loginuid module for cron with the following comment in the /etc/pam.d/crond directory:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
account     required    pam_access.so
account     include     password-auth
#session    required    pam_loginuid.so
session     include     password-auth
auth        include     password-auth

Updates to your cron package may cause the service to reactivate. Inspect this file for changes after each system update.

AppArmor

If your system uses AppArmor, you must also uncomment the following line in the lxc.conf file:

AppArmor version 2.0 and earlier

lxc.aa_profile = unconfined

AppArmor version 2.1 and later

lxc.apparmor.profile = unconfined

Did you find this article useful?


Related Articles

  • What Is Cpanel?

    cPanel, short for "control panel," is a web-based graphical interface that simplifies and streamlines the management of web hosting servers and websit...

  • How To Update DNS Settings in Cpanel?

    cPanel, a popular web hosting control panel, makes it easy for website owners and administrators to update DNS settings for their domains. Whether you...

  • Account Creation Errors

    Overview This document contains common account creation errors and the steps to troubleshoot them. Note: For more information about account creation...

  • Account Suspension Versus Bandwidth Limiting and Account Termination

    Overview This document explains the differences between account suspension, bandwidth limiting, and account termination. This document also describes ...

  • Addon Domain Conversion List

    Overview The following lists contain a brief overview of the data that the Convert Addon Domain to Account interface (WHM » Home »...