环境：使用CentOS5.6_x86_64操作系统安装在DELL的一台PC机上。
官网（http://wiki.openvz.org/）给出了一个yum的源来在CentOS上进行安装，我们来调整yum源，且为了安全问题，支持OpenVZ对于CentOS5的内核补丁支持的内核版本必须大于等于2.6.18.308.8.2.el5，可以到此处查看支持的内核版本http://wiki.openvz.org/Download/kernel。
[root@openvz yum.repos.d]# cd /etc/yum.repos.d
[root@openvz yum.repos.d]# wget http://download.openvz.org/openvz.repo
[root@openvz yum.repos.d]#uname -r
2.6.18-238.9.1.el5
[root@openvz yum.repos.d]#yum install kernel.x86_64 #升级内核到2.6.18.308，
[root@openvz yum.repos.d]#uname -r
2.6.18-308.8.2.el5
[root@openvz yum.repos.d]#cat openvz.repo #修改openvz源，确保如下默认选择的是6.2的版本
[openvz-utils]
name=OpenVZ utilities
#baseurl=<a href="http://download.openvz.org/current/">http://download.openvz.org/current/</bir>
mirrorlist=<a href="http://download.openvz.org/mirrors-current">http://download.openvz.org/mirrors-current</bir>
enabled=1
gpgcheck=1
gpgkey=http://download.openvz.org/RPM-GPG-Key-OpenVZ
[openvz-kernel-rhel5]
name=OpenVZ RHEL5-based kernel
#baseurl=http://download.openvz.org/kernel/branches/rhel5-2.6.18/current/
mirrorlist=http://download.openvz.org/kernel/mirrors-rhel5-2.6.18
enabled=1
gpgcheck=1
gpgkey=http://download.openvz.org/RPM-GPG-Key-OpenVZ
[root@openvz ~]# yum install ovzkernel -y#安装openvz内核
[root@openvz ~]# yum install vzctl vzquota#安装openvz的2个常用工具
由于我们的VE需要访问外部网络，所以这里先打开包转发，在后面会说到。
[root@openvz ~]# grep ip_forward /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@openvz ~]#
查看grub.conf设置的默认启动内核
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title OpenVZ (2.6.18-308.8.2.el5.028stab101.1)
kök (hd0,0)
kernel /vmlinuz-2.6.18-308.8.2.el5.028stab101.1 ro root=LABEL=/ selinux=0#已经自动设置关闭selinux了
initrd /initrd-2.6.18-308.8.2.el5.028stab101.1.img
[root@openvz ~]# init 6确保vz服务开机启动
[root@openvz ~]# service vz status
OpenVZ is running...
[root@openvz ~]# chkconfig --list vz
vz 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@openvz ~]#
安装管理VE
OpenVZ是使用vzctl来管理VE的，我们来看其详细命令。
[root@openvz ~]# vzctl
vzctl version 3.3
Copyright (C) 2000-2012, Parallels, Inc.
This program may be distributed under the terms of the GNU GPL License.
Usage: vzctl [options] <komut> <ctid> [parameters]
vzctl create <ctid> [--ostemplate <name>] [--config <name>]
[--layout ploop|simfs] [--hostname <name>] [--name <name>] [--ipadd <addr>]
[--diskspace <kbytes>] [--private <path>] [--kök <path>]#创建VE
vzctl start <ctid> [--force] [--wait]#启动VE
vzctl destroy | mount | umount | stop | restart | status <ctid>#关闭VE
vzctl convert <ctid> [--layout ploop[:mode]] [--diskspace <kbytes>]
vzctl quotaon | quotaoff | quotainit <ctid>#设置qutoa
vzctl console <ctid> [ttyno]#进入VE
vzctl enter <ctid> [--exec <komut> [arg ...]]#进入VE
vzctl exec | exec2 <ctid> <komut> [arg ...]#不进入VE执行VE下的命令
vzctl runscript <ctid> <script>#为VE执行脚本
vzctl chkpnt <ctid> [--dumpfile <name>]#保存VE的状态到文件
vzctl restore <ctid> [--dumpfile <name>]#从恢复文件恢复VE的状态
vzctl set <ctid> [--save] [--force] [--setmode restart|ignore]
[--ram <bytes>[KMG]] [--swap <bytes>[KMG]]#设置RAM
[--ipadd <addr>] [--ipdel <addr>|all] [--hostname <name>]#添加和删除IP
[--nameserver <addr>] [--searchdomain <name>]#指定nameserber和sercherdomain
[--onboot yes|no] [--bootorder <N>]#设置开机启动
[--userpasswd <user>:<passwd>]#修改VE的用户密码
[--cpuunits <N>] [--cpulimit <N>] [--cpus <N>] [--cpumask <cpus>]
[--diskspace <soft>[:<hard>]] [--diskinodes <soft>[:<hard>]]
[--quotatime <N>] [--quotaugidlimit <N>]
[--noatime yes|no] [--capability <name>:on|off ...]
[--devices b|c:major:minor|all:r |w|rw]
[--devnodes device:r |w|rw|none]
[--netif_add <ifname[,mac,host_ifname,host_mac,bridge]]>]#添加桥接设备
[--netif_del <ifname>]#删除桥接设备
[--applyconfig <name>] [--applyconfig_map <name>]
[--features <name:on|off>] [--name <vename>] [--ioprio <N>]
[--pci_add [<domain>:]<bus>:<slot>.<func>] [--pci_del <d:b:s.f>]
[--iptables <name>] [--disabled <yes|no>]#VE的防火墙设置
[UBC parameters]
安装一个Guest，OpenVZ官方建议的安装方法，是下载其优化过的操作系统压缩包，来进行安装。在OpenVZ上保存操作系统压缩包的位置是/vz/template/cache/。操作系统压缩包的下载地址为http://wiki.openvz.org/Download/template/precreated 。我这里下载的是CentOS5_X84_64，用来安装测试。
[root@openvz ~]# ll /vz/template/cache/
total 188092
-rw-r--r-- 1 kök kök 192411846 Temmuz 19 02:08 centos-5-x86_64.tar.gz
[root@openvz ~]# vzctl create 2 --ostemplate centos-5-x86_64 --hostname centos01
Creating container private area (centos-5-x86_64)
Performing postcreate actions
CT configuration saved to /etc/vz/conf/2.conf#配置文件保存为/etc/vz/下的2.conf
Container private area was created
[root@openvz ~]#
使用OS模版centos-5-x86_64 安装ID为2的VE，主机名为centos01，安装完成后需要修改默认的配置文件，再启动VE。
设置VE开机自启动、设置IP、设置DNS、内存、设置磁盘大小
[root@openvz ~]# vzctl set 2 --onboot yes
WARNING: Settings were not saved to config (use --save flag) #提示保存到配置文件需要--save
[root@openvz ~]# vzctl set 2 --onboot yes --save
CT configuration saved to /etc/vz/conf/2.conf
[root@openvz ~]# vzctl set 2 --ipadd 10.20.100.146 --save#此时还不能使用
CT configuration saved to /etc/vz/conf/2.conf
[root@openvz ~]# vzctl set 2 --nameserver 10.20.1.6 --save
CT configuration saved to /etc/vz/conf/2.conf
[root@openvz ~]# vzctl set 2 --ram 345 --save
Error: kernel does not support vswap, unable to use --ram/--swap parameters
Error parsing options #内核不支持
[root@openvz ~]# vzctl set 2 --diskspace 3G:3G --save
CT configuration saved to /etc/vz/conf/2.conf
[root@openvz ~]# vzctl start 2#启动ID为2的VE
Starting container ...
Container is mounted
Adding IP address(es): 192.168.221.2
Setting CPU units: 1000
Container start in progress...
[root@openvz ~]#
使用vzlist查看VE
[root@openvz ~]# vzlist 2
CTID NPROC STATUS IP_ADDR HOSTNAME
2 12 running 192.168.221.2 centos01登入VE、退出VE、重启VE、启动VE、关闭VE、断电VE
[root@openvz ~]# vzctl enter 2
[root@centos01 /]# çıkış
[root@openvz ~]# vzctl restart 2
[root@openvz ~]# vzctl start 2
[root@openvz ~]# vzctl stop 2
[root@openvz ~]# vzctl destroy 2
不登陆VE，Bir emrin yerine getirilmesi、执行脚本
[root@openvz ~]# vzctl exec 2 ifconfig#不登录VE查看网卡信息
[root@openvz ~]# vzctl runscript 2 scriptname#script在服务器上
计算VE的耗用
[root@openvz ~]# vzcalc -v 2
修改VE的root密码
[root@openvz ~]# vzctl exec 2 passwd#输入2次密码
[root@openvz ~]# vzctl set 2 --userpasswd root:123456#直接修改密码为123456
VE的网络
按照直接添加IP的方法，VE访问外网有2种方式来实现。一种是开启母机（用母机一词，果然比较好区分）的包转发功能，VE使用和母机同一段的IP，独立IP的VPS就是使用的这种方式，VE有自己的外网IP，用户可以登录自己的VPS进行管理；另外一种是使用路由转发功能，防火墙做snat源地址转换，VE使用私有IP，这样的话，VE可以访问外网,但是外网不能直接访问内网的VE。
方式一：公有IP
开启包转发
[root@openvz ~]# grep ip_forward /etc/sysctl.conf
net.ipv4.ip_forward = 1
使其生效
[root@openvz ~]# /sbin/sysctl -p
net.ipv4.ip_forward = 1
配置或修改VE的IP，此IP和母机在同一段（VPS中使用的是公有IP）。
[root@openvz ~]# ifconfig#母机的IP
eth0 Link encap:Ethernet HWaddr 00:0C:29:FD:E4:AA
inet addr:10.20.100.141 Bcast:10.20.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:35535 errors:0 dropped:0 overruns:0 frame:0
TX packets:8399 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3534995 (3.3 MiB) TX bytes:934525 (912.6 KiB)
Interrupt:59 Base address:0x2000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:10 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:784 (784.0 b) TX bytes:784 (784.0 b)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:494 errors:0 dropped:0 overruns:0 frame:0
TX packets:283 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:37807 (36.9 KiB) TX bytes:23312 (22.7 KiB)
[root@openvz ~]# vzctl set 2 --ipadd 10.20.100.146 --save#修改或设置VE的IP，测试VE的网络
[root@openvz ~]# vzctl exec 2 ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:224 errors:0 dropped:0 overruns:0 frame:0
TX packets:292 errors:0 dropped:53 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:18572 (18.1 KiB) TX bytes:23106 (22.5 KiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.20.100.146 P-t-P:10.20.100.146 Bcast:10.20.100.146 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
[root@openvz ~]# vzctl exec 2 ping www.baidu.com
PING www.a.shifen.com (220.181.111.147) 56(84) bytes of data.
64 bytes from 220.181.111.147: icmp_seq=1 ttl=54 time=35.2 ms
64 bytes from 220.181.111.147: icmp_seq=2 ttl=54 time=34.9 ms方式二：私有IP，SNAT
开启包转发
[root@openvz ~]# grep ip_forward /etc/sysctl.conf
net.ipv4.ip_forward = 1
使其生效
[root@openvz ~]# /sbin/sysctl -p
net.ipv4.ip_forward = 1
修改VE的IP，此IP为私有IP
[root@openvz ~]# vzctl set 2 --ipdel 10.20.100.146 --save#删除之前的100段IP
[root@openvz ~]# vzctl set 2 --ipadd 10.20.102.146 --save#修改或设置IP，与母机的IP段不同
开启SNAT
[root@openvz ~]# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
veya
[root@openvz ~]# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 10.20.100.141
[root@openvz ~]# iptables -t nat -L#查看NAT策略
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:10.20.100.141
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
查看VE网络
[root@openvz ~]# vzctl exec 2 ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:330 errors:0 dropped:0 overruns:0 frame:0
TX packets:407 errors:0 dropped:53 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:26810 (26.1 KiB) TX bytes:33397 (32.6 KiB)
venet0:1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.20.102.146 P-t-P:10.20.102.146 Bcast:10.20.102.146 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
[root@openvz ~]#测试VE网络
[root@openvz ~]# vzctl exec 2 ping www.baidu.com
PING www.a.shifen.com (220.181.111.147) 56(84) bytes of data.
64 bytes from 220.181.111.147: icmp_seq=1 ttl=54 time=35.0 ms
64 bytes from 220.181.111.147: icmp_seq=2 ttl=54 time=34.9 ms
[root@openvz ~]#
