mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-07-27 06:21:08 +00:00
1897e3bcd3
1. implement bdev->create: python and lua: send NULL for bdevtype and bdevspecs. They'll want to be updated to pass those in in a way that makes sense, but I can't think about that right now. 2. templates: pass --rootfs If the container is backed by a device which must be mounted (i.e. lvm) then pass the actual rootfs mount destination to the templates. Note that the lxc.rootfs can be a mounted block device. The template should actually be installing the rootfs under the path where the lxc.rootfs is *mounted*. Still, some people like to run templates by hand and assume purely directory backed containers, so continue to support that use case (i.e. if no --rootfs is listed). Make sure the templates don't re-write lxc.rootfs if it is already in the config. (Most were already checking for that) 3. Replace lxc-create script with lxc_create.c program. Changelog: May 24: when creating a container, create $lxcpath/$name/partial, and flock it. When done, close that file and unlink it. In lxc_container_new() and lxcapi_start(), check for this file. If it is locked, create is ongoing. If it exists but is not locked, create() was killed - remove the container. May 24: dont disk-lock during lxcapi_create. The partial lock is sufficient. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
347 lines
8.1 KiB
Bash
347 lines
8.1 KiB
Bash
#!/bin/bash
|
|
|
|
#
|
|
# lxc: linux Container library
|
|
|
|
# Authors:
|
|
# Daniel Lezcano <daniel.lezcano@free.fr>
|
|
|
|
# This library is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
# License as published by the Free Software Foundation; either
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
|
|
# This library is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# Lesser General Public License for more details.
|
|
|
|
# You should have received a copy of the GNU Lesser General Public
|
|
# License along with this library; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
install_busybox()
|
|
{
|
|
rootfs=$1
|
|
name=$2
|
|
res=0
|
|
tree="\
|
|
$rootfs/selinux \
|
|
$rootfs/dev \
|
|
$rootfs/home \
|
|
$rootfs/root \
|
|
$rootfs/etc \
|
|
$rootfs/etc/init.d \
|
|
$rootfs/bin \
|
|
$rootfs/usr/bin \
|
|
$rootfs/sbin \
|
|
$rootfs/usr/sbin \
|
|
$rootfs/proc \
|
|
$rootfs/mnt \
|
|
$rootfs/tmp \
|
|
$rootfs/var/log \
|
|
$rootfs/usr/share/udhcpc \
|
|
$rootfs/dev/pts \
|
|
$rootfs/dev/shm \
|
|
$rootfs/lib \
|
|
$rootfs/usr/lib \
|
|
$rootfs/lib64 \
|
|
$rootfs/usr/lib64"
|
|
|
|
mkdir -p $tree || return 1
|
|
chmod 755 $tree || return 1
|
|
|
|
pushd $rootfs/dev > /dev/null || return 1
|
|
|
|
# minimal devices needed for busybox
|
|
mknod tty c 5 0 || res=1
|
|
mknod console c 5 1 || res=1
|
|
chmod 666 tty console || res=1
|
|
mknod tty0 c 4 0 || res=1
|
|
mknod tty1 c 4 0 || res=1
|
|
mknod tty5 c 4 0 || res=1
|
|
chmod 666 tty0 || res=1
|
|
mknod ram0 b 1 0 || res=1
|
|
chmod 600 ram0 || res=1
|
|
mknod null c 1 3 || res=1
|
|
chmod 666 null || res=1
|
|
mknod urandom c 1 9 || res=1
|
|
chmod 666 urandom || res=1
|
|
|
|
popd > /dev/null
|
|
|
|
# root user defined
|
|
cat <<EOF >> $rootfs/etc/passwd
|
|
root:x:0:0:root:/root:/bin/sh
|
|
EOF
|
|
|
|
cat <<EOF >> $rootfs/etc/group
|
|
root:x:0:root
|
|
EOF
|
|
|
|
# mount everything
|
|
cat <<EOF >> $rootfs/etc/init.d/rcS
|
|
#!/bin/sh
|
|
/bin/syslogd
|
|
/bin/mount -a
|
|
/bin/udhcpc
|
|
EOF
|
|
|
|
# executable
|
|
chmod 744 $rootfs/etc/init.d/rcS || return 1
|
|
|
|
# mount points
|
|
cat <<EOF >> $rootfs/etc/fstab
|
|
proc /proc proc defaults 0 0
|
|
shm /dev/shm tmpfs defaults 0 0
|
|
EOF
|
|
|
|
# writable and readable for other
|
|
chmod 644 $rootfs/etc/fstab || return 1
|
|
|
|
# launch rcS first then make a console available
|
|
# and propose a shell on the tty, the last one is
|
|
# not needed
|
|
cat <<EOF >> $rootfs/etc/inittab
|
|
::sysinit:/etc/init.d/rcS
|
|
tty1::respawn:/bin/getty -L tty1 115200 vt100
|
|
console::askfirst:/bin/sh
|
|
EOF
|
|
# writable and readable for other
|
|
chmod 644 $rootfs/etc/inittab || return 1
|
|
|
|
cat <<EOF >> $rootfs/usr/share/udhcpc/default.script
|
|
#!/bin/sh
|
|
case "\$1" in
|
|
deconfig)
|
|
ip addr flush dev \$interface
|
|
;;
|
|
|
|
renew|bound)
|
|
# flush all the routes
|
|
if [ -n "\$router" ]; then
|
|
ip route del default 2> /dev/null
|
|
fi
|
|
|
|
# check broadcast
|
|
if [ -n "\$broadcast" ]; then
|
|
broadcast="broadcast \$broadcast"
|
|
fi
|
|
|
|
# add a new ip address
|
|
ip addr add \$ip/\$mask \$broadcast dev \$interface
|
|
|
|
if [ -n "\$router" ]; then
|
|
ip route add default via \$router dev \$interface
|
|
fi
|
|
|
|
[ -n "\$domain" ] && echo search \$domain > /etc/resolv.conf
|
|
for i in \$dns ; do
|
|
echo nameserver \$i >> /etc/resolv.conf
|
|
done
|
|
;;
|
|
esac
|
|
exit 0
|
|
EOF
|
|
|
|
chmod 744 $rootfs/usr/share/udhcpc/default.script
|
|
|
|
return $res
|
|
}
|
|
|
|
configure_busybox()
|
|
{
|
|
rootfs=$1
|
|
|
|
which busybox >/dev/null 2>&1
|
|
|
|
if [ $? -ne 0 ]; then
|
|
echo "busybox executable is not accessible"
|
|
return 1
|
|
fi
|
|
|
|
file $(which busybox) | grep -q "statically linked"
|
|
if [ $? -ne 0 ]; then
|
|
echo "warning : busybox is not statically linked."
|
|
echo "warning : The template script may not correctly"
|
|
echo "warning : setup the container environment."
|
|
fi
|
|
|
|
# copy busybox in the rootfs
|
|
cp $(which busybox) $rootfs/bin
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to copy busybox in the rootfs"
|
|
return 1
|
|
fi
|
|
|
|
# symlink busybox for the commands it supports
|
|
# it would be nice to just use "chroot $rootfs busybox --install -s /bin"
|
|
# but that only works right in a chroot with busybox >= 1.19.0
|
|
pushd $rootfs/bin > /dev/null || return 1
|
|
./busybox --help | grep 'Currently defined functions:' -A300 | \
|
|
grep -v 'Currently defined functions:' | tr , '\n' | \
|
|
xargs -n1 ln -s busybox
|
|
popd > /dev/null
|
|
|
|
# relink /sbin/init
|
|
ln $rootfs/bin/busybox $rootfs/sbin/init
|
|
|
|
# passwd exec must be setuid
|
|
chmod +s $rootfs/bin/passwd
|
|
touch $rootfs/etc/shadow
|
|
|
|
# setting passwd for root
|
|
CHPASSWD_FILE=$rootfs/root/chpasswd.sh
|
|
|
|
cat <<EOF >$CHPASSWD_FILE
|
|
echo "setting root password to \"root\""
|
|
|
|
mount --bind /lib $rootfs/lib
|
|
if [ \$? -ne 0 ]; then
|
|
echo "Failed bind-mounting /lib at $rootfs/lib"
|
|
exit 1
|
|
fi
|
|
|
|
chroot $rootfs chpasswd <<EOFF 2>/dev/null
|
|
root:root
|
|
EOFF
|
|
|
|
|
|
if [ \$? -ne 0 ]; then
|
|
echo "Failed to change root password"
|
|
exit 1
|
|
fi
|
|
|
|
umount $rootfs/lib
|
|
|
|
EOF
|
|
|
|
lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE
|
|
rm $CHPASSWD_FILE
|
|
|
|
# add ssh functionality if dropbear package available on host
|
|
which dropbear >/dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
# copy dropbear binary
|
|
cp $(which dropbear) $rootfs/usr/sbin
|
|
if [ $? -ne 0 ]; then
|
|
echo "Failed to copy dropbear in the rootfs"
|
|
return 1
|
|
fi
|
|
|
|
# make symlinks to various ssh utilities
|
|
utils="\
|
|
$rootfs/usr/bin/dbclient \
|
|
$rootfs/usr/bin/scp \
|
|
$rootfs/usr/bin/ssh \
|
|
$rootfs/usr/sbin/dropbearkey \
|
|
$rootfs/usr/sbin/dropbearconvert \
|
|
"
|
|
echo $utils | xargs -n1 ln -s /usr/sbin/dropbear
|
|
|
|
# add necessary config files
|
|
mkdir $rootfs/etc/dropbear
|
|
dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key &> /dev/null
|
|
dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key &> /dev/null
|
|
|
|
echo "'dropbear' ssh utility installed"
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
copy_configuration()
|
|
{
|
|
path=$1
|
|
rootfs=$2
|
|
name=$3
|
|
|
|
grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
|
|
cat <<EOF >> $path/config
|
|
lxc.utsname = $name
|
|
lxc.tty = 1
|
|
lxc.pts = 1
|
|
lxc.cap.drop = sys_module mac_admin mac_override sys_time
|
|
|
|
# When using LXC with apparmor, uncomment the next line to run unconfined:
|
|
#lxc.aa_profile = unconfined
|
|
EOF
|
|
|
|
libdirs="\
|
|
lib \
|
|
usr/lib \
|
|
lib64 \
|
|
usr/lib64"
|
|
|
|
for dir in $libdirs; do
|
|
if [ -d "/$dir" ] && [ -d "$rootfs/$dir" ]; then
|
|
echo "lxc.mount.entry = /$dir $dir none ro,bind 0 0" >> $path/config
|
|
fi
|
|
done
|
|
}
|
|
|
|
usage()
|
|
{
|
|
cat <<EOF
|
|
$1 -h|--help -p|--path=<path>
|
|
EOF
|
|
return 0
|
|
}
|
|
|
|
options=$(getopt -o hp:n: -l help,rootfs:,path:,name: -- "$@")
|
|
if [ $? -ne 0 ]; then
|
|
usage $(basename $0)
|
|
exit 1
|
|
fi
|
|
eval set -- "$options"
|
|
|
|
while true
|
|
do
|
|
case "$1" in
|
|
-h|--help) usage $0 && exit 0;;
|
|
-p|--path) path=$2; shift 2;;
|
|
--rootfs) rootfs=$2; shift 2;;
|
|
-n|--name) name=$2; shift 2;;
|
|
--) shift 1; break ;;
|
|
*) break ;;
|
|
esac
|
|
done
|
|
|
|
if [ "$(id -u)" != "0" ]; then
|
|
echo "This script should be run as 'root'"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$path" ]; then
|
|
echo "'path' parameter is required"
|
|
exit 1
|
|
fi
|
|
|
|
# detect rootfs
|
|
config="$path/config"
|
|
if [ -z "$rootfs" ]; then
|
|
if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
|
|
rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
|
|
else
|
|
rootfs=$path/rootfs
|
|
fi
|
|
fi
|
|
|
|
install_busybox $rootfs $name
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to install busybox's rootfs"
|
|
exit 1
|
|
fi
|
|
|
|
configure_busybox $rootfs
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to configure busybox template"
|
|
exit 1
|
|
fi
|
|
|
|
copy_configuration $path $rootfs $name
|
|
if [ $? -ne 0 ]; then
|
|
echo "failed to write configuration file"
|
|
exit 1
|
|
fi
|