About OpenVZ: There is always one HN (Hardware Node) and >= 0 VEs (Virtual Environments). More info here http://sunoano.name/ws/public_xhtml/openvz.html
Now that I am getting serious about setting up IRM, it seems it does not work with OpenVZ simply because ACL can not be set from within a VE but only on the HN. Many of us need to run IRM inside VEs so we need to find a solution; below some screendump showing the problem inside a VE where I am trying to install IRM:
mail:/home/sa/iRedMail-0.5.0# lsb_release -ric
Distributor ID: Debian
Release: 5.0.2
Codename: lenny
mail:/home/sa/iRedMail-0.5.0# whoami
root
mail:/home/sa/iRedMail-0.5.0# type dpl; dpl acl* | grep ii
dpl is aliased to `dpkg -l'
ii acl 2.2.47-2 Access control list utilities
mail:/home/sa/iRedMail-0.5.0#
mount: permission denied
mail:/home/sa/iRedMail-0.5.0# rm /tmp/tBhm5r9533BFy673hJvNnyKmJ47RIw
mail:/home/sa/iRedMail-0.5.0# touch /tmp/somethingafqrr34r24rfrwesfsr2
mail:/home/sa/iRedMail-0.5.0# setfacl -m u:bin:--- /tmp/somethingafqrr34r24rfrwesfsr2
setfacl: /tmp/somethingafqrr34r24rfrwesfsr2: Operation not supported
mail:/home/sa/iRedMail-0.5.0# cat /etc/fstab
# UNCONFIGURED FSTAB FOR BASE SYSTEM
mail:/home/sa/iRedMail-0.5.0#
The simple fact is, that as of now irm is unusable with OpenVZ. We need to get this fixed by either
- making IRM not rely on ACL or
- find a way to make it (ACL that is) work on OpenVZ
There are a few post on the forum as well as the Install Guide for Debian mentions it e.g. to issue mount -o remount,rw,acl / or they say with OpenVZ it works out of the box and things like that. All that suggestions do not work. IRM does currently not work with OpenVZ; thereby it does not matter which Linux Distribution is used on the HN or within a VE e.g. Debian on the HN and CentOS within the VE etc.
One thing I will test tomorrow is to activate ACL on the HN. However, this should not be necessary -- I dislike the idea since the HN I use for testing currently runs 23 other VEs with various other software like for example Plone, Joomla, GITosis, CouchDB, etc. In other words, whatever goes inside a VE should not affect the HN or other VEs for that matter.