Guest Shell Overview
Guestshell is a virtualized Linux-based environment, designed to run custom Linux applications, including Python for automated control and management of Cisco devices. Using Guest Shell, customers can also install, update, and operate third-party Linux applications. It is bundled with the system image and can be installed using the guestshell enable IOS command.
The Guest Shell environment is intended for tools, Linux utilities, and manageability rather than networking.
Guest Shell shares the kernel with the host (Cisco switches and routers) system. Users can access the Linux shell of Guest Shell and update scripts and software packages in the container rootfs. However, users within the Guest Shell cannot modify the host file system and processes.
Guest Shell container is managed using IOx. IOx is Cisco's Application Hosting Infrastructure for Cisco IOS XE devices. IOx enables hosting of applications and services developed by Cisco, partners, and third-party developers in network edge devices, seamlessly across diverse and disparate hardware platforms.
This table provides information about the various Guest Shell capabilities and the supported platforms.
Guest Shell Lite (Limited LXC Container) |
Guest Shell (LXC Container) |
|
---|---|---|
Operating System |
Cisco IOS XE |
Cisco IOS XE |
Supported Platforms |
|
|
Guest Shell Environment |
Montavista CGE7 |
CentOS 7 |
Python 2.7 |
Supported (Python V2.7.11) |
Supported (Python V2.7.5) |
Custom Python Libraries |
|
|
Supported Rootfs |
Busybox, SSH, and Python PIP install |
SSH, Yum install, and Python PIP install |
GNU C Compiler |
Not supported |
Not supported |
RPM Install |
Not supported |
Supported |
Architecture |
MIPS |
x86 |
Guest Shell Vs Guest Shell Lite
The Guest Shell container allows users to run their scripts and apps on the system. The Guest Shell container on Intel x86 platforms will be a Linux container (LXC) with a CentOS 7.0 minimal rootfs. You can install other Python libraries such as, Python Version 3.0 during runtime using the Yum utility in CentOS 7.0. You can also install or update python packages using PIP.
The Guest Shell Lite container on MIPS platforms such as, Catalyst 3650 and Catalyst 3850 Series Switches have the Montavista Carrier Grade Edition (CGE) 7.0 rootfs. You can only install or run scripts in Guest Shell Lite. Yum install is not supported on these devices.
Guest Shell Security
Cisco provides security to ensure that users or apps in the Guest Shell do not compromise the host system. Guest Shell is isolated from the host kernel, and it runs as an unprivileged container.
Hardware Requirements for Guestshell
This section provides information about the hardware requirements for supported platforms.
Platforms |
Default DRAM |
Guest Shell Support |
---|---|---|
WS-3650-xxx (all) |
4 GB |
Supported |
WS-3850-xxx (all) |
4 GB |
Supported |
C9300-xx-x (all) |
8 GB |
Supported |
C9500-24Q-x (all) |
16 GB |
Supported |
The minimum system requirement for Catalyst 3850 Series Switches is 4 GB DRAM.
Platform |
Default DRAM |
Guest Shell Support |
---|---|---|
ISR 4221 |
4GB |
Not Supported |
ISR 4321 |
4 GB |
Not Supported |
8 GB |
Supported |
|
ISR 4331 |
8 GB |
Supported |
16 GB |
Supported |
|
ISR 4351 |
8 GB |
Supported |
16 GB |
Supported |
|
ISR 4431 |
8 GB |
Supported |
16 GB |
Supported |
|
ISR 4451 |
8 GB |
Supported |
16 GB |
Supported |
The minimum system requirement for ISR 4000 Series Integrated Services Routers is 8 GB DRAM.
Note |
Virtual-service installed applications and Guest Shell container cannot co-exist. |
Guest Shell Storage Requirements
On Catalyst 3650 and Catalyst 3850 Series Switches, Guest Shell can only be installed on the flash filesystem. Bootflash of Catalyst 3850 Series Switches require 75 MB free disk space for Guest Shell to install successfully.
On Cisco 4000 Series Integrated Services Routers, Guest Shell is installed on the Network Interface Module (NIM)-Service Set Identifier (SSD) (hard disk), if available. If the hard disk drive is available, there is no option to select bootflash to install Guest Shell. Cisco 4000 Series Integrated Services Routers require 1100 MB free hard disk (NIM-SSID) space for Guest Shell to install successfully.
During Guest Shell installation, if enough hard disk space is not available, an error message is displayed.
% Error:guestshell_setup.sh returned error:255, message:
Not enough storage for installing guestshell. Need 1100 MB free space.
Bootflash or hard disk space can be used to store additional data by Guest Shell. On Cisco Catalyst 3850 Series Switches, Guest Shell has 18 MB of storage space available and on Cisco 4000 Series Integrated Services Routers, Guest Shell has 800 MB of storage space available. Because Guest Shell accesses the bootflash, it can use the entire space available.
Resource |
Default |
Minimum/Maximum |
||
---|---|---|---|---|
CPU |
1%
|
1/100% |
||
Memory |
256 MB |
256/256 MB |
Accessing Guest Shell on a Device
Network administrators can use IOS commands to manage files and utilities in the Guest Shell.
During the Guest Shell installation, SSH access is setup with a key-based authentication. The access to the Guest Shell is restricted to the user with the highest privilege (15) in IOS. This user is granted access into the Linux container as the guestshell Linux user, who is a sudoer, and can perform all root operations. Commands executed through the Guest Shell are executed with the same privilege that a user has when logged into the IOS terminal.
At the Guest Shell prompt, you can execute standard Linux commands.
Accessing Guest Shell Through the Management Port
By default, Guest Shell allows applications to access the management network. Users cannot change the management VRF networking configurations from inside the Guest Shell.
Note |
For platforms without a management port, a VirtualPortGroup can be associated with Guest Shell in the IOS configuration. For more information, see the Sample VirtualPortGroup Configuration section. |
Stacking with Guest Shell
When Guest Shell is installed, a directory is automatically created in the flash filesystem. This directory is synchronized across stack members. During a switchover, only contents of the this directory are synchronized across all stack members. To preserve data during high availability switchover, place data in this directory.
During a high availability switchover, the new active device creates its own Guest Shell installation and restores Guest Shell to the synchronized state; the old filesystem is not maintained. Guestshell state is internally synchronized across all stack members.