mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-07-15 12:24:09 +00:00
fb7460fe60
The lxc-debian is epurated and consolidated with a better error handling. This script is no longer interactive but it installs in a specified place the debian rootfs. This script is not supposed to be called directly so it will fall in libexec path very soon. This script is called by lxc-create as a template with the right option and the right place. The debian network configuration is by dhcp. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
323 lines
6.7 KiB
Bash
Executable File
323 lines
6.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
#
|
|
# lxc: linux Container library
|
|
|
|
# Authors:
|
|
# Daniel Lezcano <daniel.lezcano@free.fr>
|
|
|
|
# This library is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
# License as published by the Free Software Foundation; either
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
|
|
# This library is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# Lesser General Public License for more details.
|
|
|
|
# You should have received a copy of the GNU Lesser General Public
|
|
# License along with this library; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
configure_debian()
|
|
{
|
|
rootfs=$1
|
|
hostname=$2
|
|
|
|
# configure the inittab
|
|
cat <<EOF > $rootfs/etc/inittab
|
|
id:3:initdefault:
|
|
si::sysinit:/etc/init.d/rcS
|
|
l0:0:wait:/etc/init.d/rc 0
|
|
l1:1:wait:/etc/init.d/rc 1
|
|
l2:2:wait:/etc/init.d/rc 2
|
|
l3:3:wait:/etc/init.d/rc 3
|
|
l4:4:wait:/etc/init.d/rc 4
|
|
l5:5:wait:/etc/init.d/rc 5
|
|
l6:6:wait:/etc/init.d/rc 6
|
|
# Normally not reached, but fallthrough in case of emergency.
|
|
z6:6:respawn:/sbin/sulogin
|
|
1:2345:respawn:/sbin/getty 38400 console
|
|
c1:12345:respawn:/sbin/getty 38400 tty1 linux
|
|
c2:12345:respawn:/sbin/getty 38400 tty2 linux
|
|
c3:12345:respawn:/sbin/getty 38400 tty3 linux
|
|
c4:12345:respawn:/sbin/getty 38400 tty4 linux
|
|
EOF
|
|
|
|
# disable selinux in debian
|
|
mkdir -p $rootfs/selinux
|
|
echo 0 > $rootfs/selinux/enforce
|
|
|
|
# by default setup root password with no password
|
|
cat <<EOF > $rootfs/etc/ssh/sshd_config
|
|
Port 22
|
|
Protocol 2
|
|
HostKey /etc/ssh/ssh_host_rsa_key
|
|
HostKey /etc/ssh/ssh_host_dsa_key
|
|
UsePrivilegeSeparation yes
|
|
KeyRegenerationInterval 3600
|
|
ServerKeyBits 768
|
|
SyslogFacility AUTH
|
|
LogLevel INFO
|
|
LoginGraceTime 120
|
|
PermitRootLogin yes
|
|
StrictModes yes
|
|
RSAAuthentication yes
|
|
PubkeyAuthentication yes
|
|
IgnoreRhosts yes
|
|
RhostsRSAAuthentication no
|
|
HostbasedAuthentication no
|
|
PermitEmptyPasswords yes
|
|
ChallengeResponseAuthentication no
|
|
EOF
|
|
|
|
# configure the network using the dhcp
|
|
cat <<EOF > $rootfs/etc/network/interfaces
|
|
auto lo
|
|
iface lo inet loopback
|
|
|
|
auto eth0
|
|
iface eth0 inet dhcp
|
|
EOF
|
|
|
|
# set the hostname
|
|
cat <<EOF > $rootfs/etc/hostname
|
|
$hostname
|
|
EOF
|
|
|
|
# reconfigure some services
|
|
chroot $rootfs /usr/sbin/dpkg-reconfigure locales
|
|
|
|
# remove pointless services in a container
|
|
chroot $rootfs /usr/sbin/update-rc.d -f umountfs remove
|
|
chroot $rootfs /usr/sbin/update-rc.d -f hwclock.sh remove
|
|
chroot $rootfs /usr/sbin/update-rc.d -f hwclockfirst.sh remove
|
|
}
|
|
|
|
download_debian()
|
|
{
|
|
packages=\
|
|
ifupdown,\
|
|
locales,\
|
|
libui-dialog-perl,\
|
|
dialog,\
|
|
dhcp-client,\
|
|
netbase,\
|
|
net-tools,\
|
|
iproute,\
|
|
openssh-server
|
|
|
|
cache=$1
|
|
arch=$2
|
|
|
|
# check the mini debian was not already downloaded
|
|
mkdir -p "$cache/partial-$arch"
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to create '$cache/partial-$arch' directory"
|
|
return 1
|
|
fi
|
|
|
|
# download a mini debian into a cache
|
|
echo "Downloading debian minimal ..."
|
|
debootstrap --verbose --variant=minbase --arch=$arch \
|
|
--include $packages \
|
|
lenny $cache/partial-$arch http://ftp.debian.org/debian
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to download the rootfs, aborting."
|
|
return 1
|
|
fi
|
|
|
|
mv "$1/partial-$arch" "$1/rootfs-$arch"
|
|
echo "Download complete."
|
|
|
|
return 0
|
|
}
|
|
|
|
copy_debian()
|
|
{
|
|
cache=$1
|
|
arch=$2
|
|
rootfs=$3
|
|
|
|
# make a local copy of the minidebian
|
|
echo -n "Copying rootfs to $rootfs..."
|
|
cp -a $cache/rootfs-$arch $rootfs || return 1
|
|
return 0
|
|
}
|
|
|
|
install_debian()
|
|
{
|
|
cache="@LOCALSTATEDIR@/cache/lxc/debian"
|
|
rootfs=$1
|
|
mkdir -p @LOCALSTATEDIR@/lock/subsys/
|
|
(
|
|
flock -n -x 200
|
|
if [ $? -ne 0 ]; then
|
|
echo "Cache repository is busy."
|
|
return 1
|
|
fi
|
|
|
|
arch=$(arch)
|
|
if [ "$arch" == "x86_64" ]; then
|
|
arch=amd64
|
|
fi
|
|
|
|
if [ "$arch" == "i686" ]; then
|
|
arch=i386
|
|
fi
|
|
|
|
echo "Checking cache download in $cache/rootfs-$arch ... "
|
|
if [ ! -e "$cache/rootfs-$arch" ]; then
|
|
download_debian $cache $arch
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to download 'debian base'"
|
|
return 1
|
|
fi
|
|
fi
|
|
|
|
copy_debian $cache $arch $rootfs
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to copy rootfs"
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
|
|
) 200>@LOCALSTATEDIR@/lock/subsys/lxc
|
|
|
|
return $?
|
|
}
|
|
|
|
copy_configuration()
|
|
{
|
|
path=$1
|
|
rootfs=$2
|
|
name=$3
|
|
|
|
cat <<EOF >> $path/config
|
|
lxc.tty = 4
|
|
lxc.pts = 1024
|
|
lxc.rootfs = $rootfs
|
|
lxc.cgroup.devices.deny = a
|
|
# /dev/null and zero
|
|
lxc.cgroup.devices.allow = c 1:3 rwm
|
|
lxc.cgroup.devices.allow = c 1:5 rwm
|
|
# consoles
|
|
lxc.cgroup.devices.allow = c 5:1 rwm
|
|
lxc.cgroup.devices.allow = c 5:0 rwm
|
|
lxc.cgroup.devices.allow = c 4:0 rwm
|
|
lxc.cgroup.devices.allow = c 4:1 rwm
|
|
# /dev/{,u}random
|
|
lxc.cgroup.devices.allow = c 1:9 rwm
|
|
lxc.cgroup.devices.allow = c 1:8 rwm
|
|
lxc.cgroup.devices.allow = c 136:* rwm
|
|
lxc.cgroup.devices.allow = c 5:2 rwm
|
|
# rtc
|
|
lxc.cgroup.devices.allow = c 254:0 rwm
|
|
EOF
|
|
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to add configuration"
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
clean()
|
|
{
|
|
cache="@LOCALSTATEDIR@/cache/lxc/debian"
|
|
|
|
if [ ! -e $cache ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# lock, so we won't purge while someone is creating a repository
|
|
(
|
|
flock -n -x 200
|
|
if [ $? != 0 ]; then
|
|
echo "Cache repository is busy."
|
|
exit 1
|
|
fi
|
|
|
|
echo -n "Purging the download cache..."
|
|
rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
|
|
exit 0
|
|
|
|
) 200>@LOCALSTATEDIR@/lock/subsys/lxc
|
|
}
|
|
|
|
usage()
|
|
{
|
|
cat <<EOF
|
|
$1 -h|--help -p|--path=<path> --clean
|
|
EOF
|
|
return 0
|
|
}
|
|
|
|
options=$(getopt -o hp:n:c -l help,path:,name:,clean -- "$@")
|
|
if [ $? -ne 0 ]; then
|
|
usage $(basename $0)
|
|
exit 1
|
|
fi
|
|
eval set -- "$options"
|
|
|
|
while true
|
|
do
|
|
case "$1" in
|
|
-h|--help) usage $0 && exit 0;;
|
|
-p|--path) path=$2; shift 2;;
|
|
-n|--name) name=$2; shift 2;;
|
|
-c|--clean) clean=$2; shift 2;;
|
|
--) shift 1; break ;;
|
|
*) break ;;
|
|
esac
|
|
done
|
|
|
|
if [ ! -z "$clean" -a -z "$path" ]; then
|
|
clean || exit 1
|
|
exit 0
|
|
fi
|
|
|
|
type debootstrap
|
|
if [ $? -ne 0 ]; then
|
|
echo "'debootstrap' command is missing"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$path" ]; then
|
|
echo "'path' parameter is required"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(id -u)" != "0" ]; then
|
|
echo "This script should be run as 'root'"
|
|
exit 1
|
|
fi
|
|
|
|
rootfs=$path/rootfs
|
|
|
|
install_debian $rootfs
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to install debian"
|
|
exit 1
|
|
fi
|
|
|
|
configure_debian $rootfs $name
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to configure debian for a container"
|
|
exit 1
|
|
fi
|
|
|
|
copy_configuration $path $rootfs
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed write configuration file"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -z $clean ]; then
|
|
clean || exit 1
|
|
exit 0
|
|
fi
|