NetBSD 的 Cells:内核强制、类似 jail 的隔离
Cells for NetBSD: kernel-enforced, jail-like isolation

原始链接: https://netbsd-cells.petermann-digital.de/

本文档详细介绍了一个使用`cellmgr`部署和管理简单HTTP服务的基本流程。过程从引导宿主机开始,然后定义服务的“期望状态”清单——在本例中,一个名为`mysite-edge-httpd`的基本Web服务器。该清单指定了端口、日志记录、执行命令和健康检查等参数。 接下来,创建一个声明式的“应用计划”来填充单元格的初始内容(一个`index.html`文件)。`cellmgr apply`然后协调期望状态,执行应用计划,启动服务并验证其健康状况。 该示例通过列出正在运行的单元格并通过Web浏览器验证访问(`http://vhost.local:8080/`)来确认成功部署。最后,它演示了导出Prometheus兼容的指标以进行监控。这展示了`cellmgr`管理应用程序生命周期(从初始设置到运行时监控)的能力,重点是声明式配置和自动调和。更多文档和示例,包括更复杂的部署,可供参考。

对不起。
相关文章

原文

This section demonstrates a minimal, reproducible workflow with the current cellmgr command surface.

The example bootstraps the host, creates a desired cell manifest for a simple HTTP service, adds a declarative apply plan, converges runtime state, and checks that the cell is running.


1. Bootstrap Host Integration

Initialize host integration, prepare base layers, and verify that required kernel/runtime prerequisites are present.

vhost# cellmgr system bootstrap 

2. Create Desired Cell Manifest

Create the desired-state manifest for one HTTP workload. This writes configuration into /etc/cellmgr only (--scope desired) and does not yet start the service.

vhost# cellmgr cell create mysite-edge-httpd \
  --autostart YES \
  --profile medium \
  --reserved-ports 8080 \
  --log-facility local1 \
  --stdout-level info \
  --stderr-level err \
  --log-tag cell-mysite-edge-httpd \
  --cmd '/usr/libexec/httpd -I 8080 -X -f -s /var/www/mysite-edge-httpd' \
  --healthcheck 'test -f /var/www/mysite-edge-httpd/index.html' \
  --scope desired
Created manifest /etc/cellmgr/mysite-edge-httpd.cell

3. Add Declarative Apply Plan

Define a small apply plan that creates the initial web content inside the cell. Plans are declarative, versionable, and executed by cellmgr apply during reconciliation.

vhost# vi /etc/cellmgr/mysite-edge-httpd.apply

Plan content:

FILE_BEGIN /var/www/mysite-edge-httpd/index.html
<html>
        Hello NetBSD
</html>
FILE_END

4. Converge Desired to Runtime

Run reconciliation to render runtime state from manifests, execute the apply plan, start supervised service processes, and run the configured healthcheck.

vhost# cellmgr apply
apply: dry-run=NO reapply=NO restart-changed=NO verbose=NO
cell mysite-edge-httpd
  CREATE       render runtime cell state
  APPLY        run /etc/cellmgr/mysite-edge-httpd.apply
  START        supervised service after apply
  HEALTHCHECK  test -f /var/www/mysite-edge-httpd/index.html
  RESULT       changed

summary: cells=1 changed=1 failed=0 dry-run=NO

5. Verify Runtime State

Inspect the live cell view and confirm that the instance is running with an assigned CID and increasing age.

vhost# cellmgr cell list -o name,running,cid,age
NAME               RUNNING  CID  AGE
mysite-edge-httpd  YES      1    31s

6. Open the Service

Confirm the HTTP endpoint from your client or browser:

http://vhost.local:8080/


7. Export Prometheus-Compatible Metrics

cellctl stats -P -h emits Prometheus text format with a minimal HTTP header. This can be wired into inetd for a very lightweight metrics endpoint without additional exporter software.

vhost# cellctl stats -P -h
HTTP/1.1 200 OK
Content-Type: text/plain

# TYPE cell_cpu_ticks_1s gauge
# TYPE cell_cpu_ticks_10s_avg gauge
# TYPE cell_processes_current gauge
# TYPE cell_references_current gauge
# TYPE cell_memory_vmsize_bytes gauge
# TYPE cell_age_seconds gauge
cell_cpu_ticks_1s{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 0
cell_cpu_ticks_10s_avg{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 0
cell_processes_current{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 1
cell_references_current{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 1
cell_memory_vmsize_bytes{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 137601024
cell_age_seconds{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 596

Next Steps

For deeper operational guides and reference material, continue in the documentation.

The docs are still being built out, but they already include polished end-to-end recipes, including a MantisBT 3-tier setup (three cells, multiple volumes) and a Luanti gameserver example.

联系我们 contact @ memedata.com