mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-08-13 23:52:30 +00:00
add yum plugin to repatch rootfs on yum update
oracle-template: Split patching rootfs vs one time setup into separate shell functions so the template can be run with --patch. oracle-template: Update to install the yum plugin and itself (as lxc-patch) into a container. The plugin just runs lxc-patch --patch <path> so it is fairly generic, but in this case it is running a copy of the template inside the container. Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Dwight Engen
Serge Hallyn
parent
261658e800
commit
7ceebfd12a
@ -1 +1 @@
|
||||
SUBDIRS = apparmor bash etc init templates
|
||||
SUBDIRS = apparmor bash etc init templates yum
|
||||
|
||||
6
config/yum/Makefile.am
Normal file
6
config/yum/Makefile.am
Normal file
@ -0,0 +1,6 @@
|
||||
yumpluginsdir=$(datadir)/lxc
|
||||
|
||||
yumplugins_SCRIPTS = \
|
||||
lxc-patch.py
|
||||
|
||||
EXTRA_DIST = $(yumplugins_SCRIPTS)
|
||||
56
config/yum/lxc-patch.py
Normal file
56
config/yum/lxc-patch.py
Normal file
@ -0,0 +1,56 @@
|
||||
# Yum plugin to re-patch container rootfs after a yum update is done
|
||||
#
|
||||
# Copyright (C) 2012 Oracle
|
||||
#
|
||||
# Authors:
|
||||
# Dwight Engen <dwight.engen@oracle.com>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Library General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
#
|
||||
|
||||
import os
|
||||
from fnmatch import fnmatch
|
||||
from yum.plugins import TYPE_INTERACTIVE
|
||||
from yum.plugins import PluginYumExit
|
||||
|
||||
requires_api_version = '2.0'
|
||||
plugin_type = (TYPE_INTERACTIVE,)
|
||||
|
||||
def posttrans_hook(conduit):
|
||||
pkgs = []
|
||||
patch_required = False
|
||||
|
||||
# If we aren't root, we can't have updated anything
|
||||
if os.geteuid():
|
||||
return
|
||||
|
||||
# See what packages have files that were patched
|
||||
confpkgs = conduit.confString('main', 'packages')
|
||||
if not confpkgs:
|
||||
return
|
||||
|
||||
tmp = confpkgs.split(",")
|
||||
for confpkg in tmp:
|
||||
pkgs.append(confpkg.strip())
|
||||
|
||||
conduit.info(2, "lxc-patch: checking if updated pkgs need patching...")
|
||||
ts = conduit.getTsInfo()
|
||||
for tsmem in ts.getMembers():
|
||||
for pkg in pkgs:
|
||||
if fnmatch(pkg, tsmem.po.name):
|
||||
patch_required = True
|
||||
if patch_required:
|
||||
conduit.info(2, "lxc-patch: patching container...")
|
||||
os.spawnlp(os.P_WAIT, "lxc-patch", "lxc-patch", "--patch", "/")
|
||||
@ -588,6 +588,7 @@ AC_CONFIG_FILES([
|
||||
config/templates/ubuntu.common.conf
|
||||
config/templates/ubuntu.lucid.conf
|
||||
config/templates/ubuntu.userns.conf
|
||||
config/yum/Makefile
|
||||
|
||||
doc/Makefile
|
||||
doc/api/Makefile
|
||||
|
||||
@ -69,9 +69,44 @@ can_chcon()
|
||||
}
|
||||
|
||||
# fix up the container_rootfs
|
||||
container_rootfs_configure()
|
||||
container_rootfs_patch()
|
||||
{
|
||||
echo "Configuring container for Oracle Linux $container_release_major.$container_release_minor"
|
||||
echo "Patching container rootfs $container_rootfs for Oracle Linux $container_release_major.$container_release_minor"
|
||||
|
||||
# copy ourself into the container to be used to --patch the rootfs when
|
||||
# yum update on certain packages is done. we do this here instead of in
|
||||
# container_rootfs_configure() in case the patching done in this function
|
||||
# is updated in the future, we can inject the updated version of ourself
|
||||
# into older containers.
|
||||
if [ $container_rootfs != "/" ]; then
|
||||
cp -f `readlink -f $0` $container_rootfs/usr/bin/lxc-patch
|
||||
if [ $container_release_major -lt "6" ]; then
|
||||
mkdir -p $container_rootfs/usr/lib/yum-plugins
|
||||
cp @DATADIR@/lxc/lxc-patch.py $container_rootfs/usr/lib/yum-plugins
|
||||
fi
|
||||
if [ $container_release_major = "6" ]; then
|
||||
mkdir -p $container_rootfs/usr/share/yum-plugins
|
||||
cp @DATADIR@/lxc/lxc-patch.py $container_rootfs/usr/share/yum-plugins
|
||||
fi
|
||||
mkdir -p $container_rootfs/etc/yum/pluginconf.d
|
||||
cat <<EOF > $container_rootfs/etc/yum/pluginconf.d/lxc-patch.conf
|
||||
[main]
|
||||
enabled=1
|
||||
packages=initscripts,iptables,selinux-policy,readahead,udev,util-linux-ng
|
||||
EOF
|
||||
fi
|
||||
|
||||
if [ $container_release_major = "4" ]; then
|
||||
# yum plugin type of TYPE_INTERFACE works in all releases but gives a
|
||||
# deprecation warning on major > 4, so we default to TYPE_INTERACTIVE
|
||||
# and fix it up here
|
||||
sed -i 's|TYPE_INTERACTIVE|TYPE_INTERFACE|' $container_rootfs/usr/lib/yum-plugins/lxc-patch.py
|
||||
if [ -f $container_rootfs/etc/yum.repos.d/ULN-Base.repo ]; then
|
||||
mv $container_rootfs/etc/yum.repos.d/ULN-Base.repo \
|
||||
$container_rootfs/etc/yum.repos.d/ULN-Base.repo.lxc-disabled
|
||||
fi
|
||||
echo "plugins = 1" >>$container_rootfs/etc/yum.conf
|
||||
fi
|
||||
|
||||
# "disable" selinux in the guest. The policy in the container isn't
|
||||
# likely to match the hosts (unless host == guest exactly) and the
|
||||
@ -114,48 +149,26 @@ container_rootfs_configure()
|
||||
sed -i 's|session[ \t]*required[ \t]*/lib/security/\$ISA/pam_limits.so|#session required /lib/security/$ISA/pam_limits.so|' $container_rootfs/etc/pam.d/system-auth
|
||||
fi
|
||||
|
||||
# configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
|
||||
# will report its name and be resolv'able by the hosts dnsmasq
|
||||
cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
DEVICE=eth0
|
||||
BOOTPROTO=dhcp
|
||||
ONBOOT=yes
|
||||
HOSTNAME=$name
|
||||
DHCP_HOSTNAME=$name
|
||||
NM_CONTROLLED=no
|
||||
TYPE=Ethernet
|
||||
EOF
|
||||
|
||||
# avoid error in ol5 attempting to copy non-existent resolv.conf
|
||||
if [ $container_release_major = "5" ]; then
|
||||
sed -i 's|resolv.conf.predhclient|resolv.conf.predhclient 2>/dev/null|' $container_rootfs/sbin/dhclient-script
|
||||
fi
|
||||
|
||||
# set the hostname
|
||||
cat <<EOF > $container_rootfs/etc/sysconfig/network
|
||||
NETWORKING=yes
|
||||
NETWORKING_IPV6=no
|
||||
HOSTNAME=$name
|
||||
EOF
|
||||
|
||||
# disable interactive ovmd asking questions
|
||||
if [ -f $container_rootfs/etc/sysconfig/ovmd ]; then
|
||||
sed -i 's|INITIAL_CONFIG=yes|INITIAL_CONFIG=no|' $container_rootfs/etc/sysconfig/ovmd
|
||||
fi
|
||||
|
||||
# set minimal hosts
|
||||
echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
|
||||
# disable disabling of ipv4 forwarding and defrag on shutdown since
|
||||
# we mount /proc/sys ro
|
||||
if [ $container_release_major = "5" ]; then
|
||||
sed -i 's|-f /proc/sys/net/ipv4/ip_forward|-w /proc/sys/net/ipv4/ip_forward|' $container_rootfs/etc/rc.d/init.d/network
|
||||
sed -i 's|-f /proc/sys/net/ipv4/ip_always_defrag|-w /proc/sys/net/ipv4/ip_always_defrag|' $container_rootfs/etc/rc.d/init.d/network
|
||||
fi
|
||||
|
||||
# disable ipv6 on ol6
|
||||
rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
|
||||
|
||||
# this file has to exist for libvirt/Virtual machine monitor to boot the container
|
||||
touch $container_rootfs/etc/mtab
|
||||
|
||||
# don't put devpts,proc, nor sysfs in here, it will already be mounted for us by lxc/libvirt
|
||||
cat <<EOF > $container_rootfs/etc/fstab
|
||||
EOF
|
||||
|
||||
# remove module stuff for iptables it just shows errors that are not
|
||||
# relevant in a container
|
||||
if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
|
||||
@ -182,17 +195,6 @@ EOF
|
||||
sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/NetworkManager 2>/dev/null
|
||||
fi
|
||||
|
||||
# sem_open(3) checks that /dev/shm is SHMFS_SUPER_MAGIC, so make sure to mount /dev/shm (normally done by dracut initrd) as tmpfs
|
||||
if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
|
||||
echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
|
||||
echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
|
||||
fi
|
||||
|
||||
if [ $container_release_major = "6" ]; then
|
||||
sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
|
||||
sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
|
||||
fi
|
||||
|
||||
# no need to attempt to mount /
|
||||
sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.sysinit
|
||||
sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.d/rc.sysinit
|
||||
@ -231,8 +233,12 @@ EOF
|
||||
sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.d/rc.sysinit
|
||||
|
||||
# dont start lvm
|
||||
sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
|
||||
sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
|
||||
if [ $container_release_major -lt "6" -a -f $container_rootfs/sbin/lvm.static ]; then
|
||||
mv $container_rootfs/sbin/lvm.static $container_rootfs/sbin/lvm.static.lxc-disabled
|
||||
fi
|
||||
if [ $container_release_major = "6" ]; then
|
||||
touch $container_rootfs/.nolvm
|
||||
fi
|
||||
|
||||
# fix assumptions that plymouth is available
|
||||
sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
|
||||
@ -241,6 +247,80 @@ EOF
|
||||
rm -f $container_rootfs/etc/init/quit-plymouth.conf
|
||||
rm -f $container_rootfs/etc/init/splash-manager.conf
|
||||
|
||||
# dont try to unmount /dev/lxc devices
|
||||
sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
|
||||
|
||||
# don't try to unmount swap
|
||||
sed -i 's|\[ -f /proc/swaps \]|# LXC [ -f /proc/swaps ]|' $container_rootfs/etc/init.d/halt
|
||||
|
||||
# there might be other services that are useless but the below set is a good start
|
||||
# some of these might not exist in the image, so we silence chkconfig complaining
|
||||
# about the service file not being found
|
||||
for service in \
|
||||
acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd \
|
||||
ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
|
||||
lm_sensors lvm2-monitor mdmonitor microcode_ctl \
|
||||
ntpd pcmcia postfix sendmail udev-post xfs ;
|
||||
do
|
||||
chroot $container_rootfs chkconfig 2>/dev/null $service off
|
||||
done
|
||||
|
||||
for service in rsyslog ;
|
||||
do
|
||||
chroot $container_rootfs chkconfig 2>/dev/null $service on
|
||||
done
|
||||
|
||||
# ensure /dev/ptmx refers to the newinstance devpts of the container, or
|
||||
# pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
|
||||
rm -f $container_rootfs/dev/ptmx
|
||||
ln -s pts/ptmx $container_rootfs/dev/ptmx
|
||||
}
|
||||
|
||||
container_rootfs_configure()
|
||||
{
|
||||
container_rootfs_patch
|
||||
echo "Configuring container for Oracle Linux $container_release_major.$container_release_minor"
|
||||
|
||||
# configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
|
||||
# will report its name and be resolv'able by the hosts dnsmasq
|
||||
cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
|
||||
DEVICE=eth0
|
||||
BOOTPROTO=dhcp
|
||||
ONBOOT=yes
|
||||
HOSTNAME=$name
|
||||
DHCP_HOSTNAME=$name
|
||||
NM_CONTROLLED=no
|
||||
TYPE=Ethernet
|
||||
EOF
|
||||
|
||||
# set the hostname
|
||||
cat <<EOF > $container_rootfs/etc/sysconfig/network
|
||||
NETWORKING=yes
|
||||
NETWORKING_IPV6=no
|
||||
HOSTNAME=$name
|
||||
EOF
|
||||
|
||||
# set minimal hosts
|
||||
echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
|
||||
|
||||
# this file has to exist for libvirt/Virtual machine monitor to boot the container
|
||||
touch $container_rootfs/etc/mtab
|
||||
|
||||
# don't put devpts,proc, nor sysfs in here, it will already be mounted for us by lxc/libvirt
|
||||
cat <<EOF > $container_rootfs/etc/fstab
|
||||
EOF
|
||||
|
||||
# sem_open(3) checks that /dev/shm is SHMFS_SUPER_MAGIC, so make sure to mount /dev/shm (normally done by dracut initrd) as tmpfs
|
||||
if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
|
||||
echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
|
||||
echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
|
||||
fi
|
||||
|
||||
if [ $container_release_major = "6" ]; then
|
||||
sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
|
||||
sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
|
||||
fi
|
||||
|
||||
# setup console and tty[1-4] for login. note that /dev/console and
|
||||
# /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
|
||||
# /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
|
||||
@ -262,12 +342,6 @@ EOF
|
||||
sed -i 's|mingetty|mingetty --nohangup|' $container_rootfs/etc/init/tty.conf
|
||||
fi
|
||||
|
||||
# dont try to unmount /dev/lxc devices
|
||||
sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
|
||||
|
||||
# don't try to unmount swap
|
||||
sed -i 's|\[ -f /proc/swaps \]|# LXC [ -f /proc/swaps ]|' $container_rootfs/etc/init.d/halt
|
||||
|
||||
# start a getty on /dev/console, /dev/tty[1-4]
|
||||
if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
|
||||
sed -i 's|mingetty|mingetty --nohangup|' $container_rootfs/etc/inittab
|
||||
@ -312,23 +386,6 @@ exec init 0
|
||||
EOF
|
||||
fi
|
||||
|
||||
# there might be other services that are useless but the below set is a good start
|
||||
# some of these might not exist in the image, so we silence chkconfig complaining
|
||||
# about the service file not being found
|
||||
for service in \
|
||||
acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd \
|
||||
ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
|
||||
lm_sensors lvm2-monitor mdmonitor microcode_ctl \
|
||||
ntpd pcmcia postfix sendmail udev-post xfs ;
|
||||
do
|
||||
chroot $container_rootfs chkconfig 2>/dev/null $service off
|
||||
done
|
||||
|
||||
for service in rsyslog ;
|
||||
do
|
||||
chroot $container_rootfs chkconfig 2>/dev/null $service on
|
||||
done
|
||||
|
||||
# create required devices. note that /dev/console will be created by lxc
|
||||
# or libvirt itself to be a symlink to the right pty.
|
||||
# take care to not nuke /dev in case $container_rootfs isn't set
|
||||
@ -365,11 +422,6 @@ EOF
|
||||
done
|
||||
fi
|
||||
|
||||
# ensure /dev/ptmx refers to the newinstance devpts of the container, or
|
||||
# pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
|
||||
rm -f $container_rootfs/dev/ptmx
|
||||
ln -s pts/ptmx $container_rootfs/dev/ptmx
|
||||
|
||||
# start with a clean /var/log/messages
|
||||
rm -f $container_rootfs/var/log/messages
|
||||
|
||||
@ -631,6 +683,7 @@ usage()
|
||||
-r|--rpms=<rpm name> additional rpms to install into container
|
||||
-u|--url=<url> replace yum repo url (ie. local yum mirror)
|
||||
-t|--templatefs=<path> copy/clone rootfs at path instead of downloading
|
||||
-P|--patch=<path> only patch the rootfs at path for use as a container
|
||||
-h|--help
|
||||
|
||||
Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
|
||||
@ -638,7 +691,7 @@ EOF
|
||||
return 0
|
||||
}
|
||||
|
||||
options=$(getopt -o hp:n:a:R:r:u:t: -l help,rootfs:,path:,name:,arch:,release:,rpms:,url:,templatefs: -- "$@")
|
||||
options=$(getopt -o hp:n:a:R:r:u:t: -l help,rootfs:,path:,name:,arch:,release:,rpms:,url:,templatefs:,patch: -- "$@")
|
||||
if [ $? -ne 0 ]; then
|
||||
usage $(basename $0)
|
||||
exit 1
|
||||
@ -658,6 +711,7 @@ do
|
||||
-r|--rpms) user_pkgs=$2; shift 2;;
|
||||
-u|--url) repourl=$2; shift 2;;
|
||||
-t|--templatefs) template_rootfs=$2; shift 2;;
|
||||
--patch) patch_rootfs=$2; shift 2;;
|
||||
--) shift 1; break ;;
|
||||
*) break ;;
|
||||
esac
|
||||
@ -669,6 +723,13 @@ if [ "$(id -u)" != "0" ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$patch_rootfs" ]; then
|
||||
container_rootfs="$patch_rootfs"
|
||||
container_release_get $container_rootfs
|
||||
container_rootfs_patch
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -z $name ]; then
|
||||
echo "Container name must be given"
|
||||
usage
|
||||
|
||||
Loading…
Reference in New Issue
Block a user