OpenVZ Forum


Home » General » Support » Why does chkpnt require iptables?
Why does chkpnt require iptables? [message #35106] Sun, 01 March 2009 10:01 Go to next message
rlawley is currently offline  rlawley
Messages: 2
Registered: January 2009
Junior Member
We're running the latest stable versions of OpenVZ on a Debian 4 HN, and one thing keeps confusing me - if I try and suspend a VPS using vzctl chkpnt CTID, this fails if the container does not have iptables installed.

The first thing I did when finding this out was to ensure that all of our templates come with iptables installed. However, this does not account for the fact that users are still in control of their containers - one of ours has removed iptables from his container and it can no longer be suspended using the chkpnt command...

Can not dump container: Invalid argument
Error: iptables-save exited with 255
Checkpointing failed

Is there a reason why chkpnt requires iptables to be present? I assume it is used to take a running copy of the iptables rules that are running prior to saving the machine, but if iptables isn't present then it stands to reason that there are no iptables rules to save, and this step could be skipped.

If there's something else I'm missing here, please point me in the right direction!

Regards,

Richard
Re: Why does chkpnt require iptables? [message #35157 is a reply to message #35106] Fri, 06 March 2009 11:01 Go to previous messageGo to next message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Hello,

please read this thread.
A workaround is proposed there
http://forum.openvz.org/index.php?t=msg&goto=29169&& amp;srch=iptables-save+exited+with+255
Re: Why does chkpnt require iptables? [message #35158 is a reply to message #35106] Fri, 06 March 2009 11:08 Go to previous messageGo to next message
rlawley is currently offline  rlawley
Messages: 2
Registered: January 2009
Junior Member
I've raised this as a bug since starting this forum post, since I don't believe that a user (within the container) should be able to prevent an external script from running. The workaround in that thread involves changing files on the container.

We use the chkpnt function to suspend a VPS if we need to disable access to the VPS, and it is not ideal that the user can prevent us from doing this. My workaround has been to call vzctl stop if suspend fails, but I wanted to avoid shutting the user's VPS down if possible.
Re: Why does chkpnt require iptables? [message #35163 is a reply to message #35158] Fri, 06 March 2009 14:12 Go to previous message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Please, don't hesitate filing a bug giving your point of view.
Previous Topic: Network problem:I cant't ping the VE from HN
Next Topic: Debug Kernel Question
Goto Forum:
  


Current Time: Fri Aug 01 22:36:20 GMT 2025

Total time taken to generate the page: 1.10355 seconds