doc: Update Japanese lxc.container.conf(5) for lxc.cap.keep = none

[mirror_lxc.git] / templates / lxc-archlinux.in

#!/bin/bash

#
# template script for generating Arch linux container for LXC
#

#
# lxc: linux Container library

# Authors:
# Alexander Vladimirov <idkfa@vlan1.ru>
# John Lane <lxc@jelmail.com>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.

# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

# Detect use under userns (unsupported)
for arg in "$@"; do
    [ "$arg" = "--" ] && break
    if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1
    fi
done

# Make sure the usual locations are in PATH
export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin

# defaults
arch=$(uname -m)
lxc_network_type="veth"
lxc_network_link="br0"
default_path="@LXCPATH@"
default_locale="en-US.UTF-8"
default_timezone="UTC"
pacman_config="/etc/pacman.conf"

# by default, install 'base' except the kernel
pkg_blacklist="linux"
base_packages=()
for pkg in $(pacman -Sqg base); do
   [ "${pkg_blacklist#*$pkg}" = "$pkg_blacklist" ] && base_packages+=($pkg)
done
declare -a additional_packages

# split comma-separated string into an array
# ${1} - string to split
# ${2} - separator (default is ",")
# ${result} - result value on success
split_string() {
    local ifs=${IFS}
    IFS="${2:-,}"
    read -a result < <(echo "${1}")
    IFS=${ifs}
    return 0
}

[ -f /etc/arch-release ] && is_arch=true

# Arch-specific preconfiguration for container
configure_arch() {
    # on ArchLinux, read defaults from host systemd configuration
    if [ "${is_arch}" ]; then
        cp -p /etc/vconsole.conf /etc/locale.conf /etc/locale.gen \
		"${rootfs_path}/etc/"
    else
        echo "LANG=${default_lang}" > "${rootfs_path}/etc/locale.conf"
        echo "KEYMAP=us" > "${rootfs_path}/etc/vconsole.conf"
        cat > "${rootfs_path}/etc/adjtime" << EOF
0.0 0.0 0.0
0
LOCAL
EOF
        if [ -e "${rootfs_path}/etc/locale.gen" ]; then
            sed -i 's@^#\(en_US\.UTF-8\)@\1@' "${rootfs_path}/etc/locale.gen"
            if [ ! "${default_locale}" = "en_US.UTF-8" ]; then
                echo "${default_locale} ${default_locale##*.}" >> "${rootfs_path}/etc/locale.gen"
            fi
        fi
    fi

    # hostname and nameservers
    echo "${name}" > "${rootfs_path}/etc/hostname"
    while read r; do
       [ "${r#nameserver}" = "$r" ] || echo "$r"
    done < /etc/resolv.conf > "${rootfs_path}/etc/resolv.conf"

    # chroot and configure system
    arch-chroot "${rootfs_path}" /bin/bash -s << EOF
mkdir /run/lock
locale-gen
ln -s /usr/share/zoneinfo/${default_timezone} /etc/localtime
# disable services unavailable for container
for i in systemd-udevd.service \
	systemd-udevd-control.socket \
	systemd-udevd-kernel.socket \
	proc-sys-fs-binfmt_misc.automount; do
   ln -s /dev/null /etc/systemd/system/\$i
done
# set default systemd target
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
# enable sigpwr signal handling in systemd as otherwise lxc-stop won't work
ln -s /usr/lib/systemd/system/poweroff.target /etc/systemd/system/sigpwr.target
# initialize pacman keyring
pacman-key --init
pacman-key --populate archlinux
EOF
    return 0
}

# write container configuration files
copy_configuration() {
    mkdir -p "${config_path}"
    cat > "${config_path}/config" << EOF
lxc.utsname=${name}
lxc.autodev=1
lxc.tty=1
lxc.pts=1024
lxc.mount=${config_path}/fstab
lxc.cap.drop=sys_module mac_admin mac_override sys_time
lxc.kmsg=0
lxc.stopsignal=SIGRTMIN+4
#networking
lxc.network.type=${lxc_network_type}
lxc.network.link=${lxc_network_link}
lxc.network.flags=up
lxc.network.name=eth0
lxc.network.mtu=1500
#cgroups
lxc.cgroup.devices.deny = a
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
lxc.cgroup.devices.allow = c 1:7 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:2 rwm
lxc.cgroup.devices.allow = c 136:* rwm
EOF

    grep -q "^lxc.rootfs" ${config_path}/config 2>/dev/null || echo "lxc.rootfs = ${path}/rootfs" >> ${config_path}/config

    cat > "${config_path}/fstab" << EOF
sysfs sys sysfs defaults 0 0
proc proc proc nodev,noexec,nosuid 0 0
EOF

    return 0
}

# install packages within container chroot
install_arch() {
    [ "${arch}" != "$(uname -m)" ] && different_arch=true

    if [ "${different_arch}" = "true" ]; then
        container_pacman_config=$(mktemp)
        container_mirrorlist=$(mktemp)
        sed -e "s:Architecture =.*:Architecture = ${arch}:g"  \
            -e "s:/etc/pacman.d/mirrorlist:${container_mirrorlist}:g" \
            "${pacman_config}" > "${container_pacman_config}"
        sed -e "s:\(x86_64\|\$arch\):${arch}:g" \
            /etc/pacman.d/mirrorlist > "${container_mirrorlist}"

        pacman_config="${container_pacman_config}"
    fi

    if ! pacstrap -dcGC "${pacman_config}" "${rootfs_path}" \
	    ${base_packages[@]}; then
        echo "Failed to install container packages"
        return 1
    fi

    if [ "${different_arch}" = "true" ]; then
        sed -i -e "s:Architecture =.*:Architecture = ${arch}:g" \
            "${rootfs_path}"/etc/pacman.conf
        cp "${container_mirrorlist}" "${rootfs_path}"/etc/pacman.d/mirrorlist
        rm "${container_pacman_config}" "${container_mirrorlist}"
    fi

    [ -d "${rootfs_path}/lib/modules" ] && ldconfig -r "${rootfs_path}"
    return 0
}

usage() {
    cat <<EOF
usage:
    ${1} -n|--name=<container_name>
        [-P|--packages=<pkg1,pkg2,...>] [-p|--path=<path>] [-t|--network_type=<type>] [-l|--network_link=<link>] [-h|--help]
Mandatory args:
  -n,--name         container name, used to as an identifier for that container from now on
Optional args:
  -p,--path         path to where the container rootfs will be created, defaults to ${default_path}/rootfs. The container config will go under ${default_path} in that case
  -P,--packages     preinstall additional packages, comma-separated list
  -e,--enable_units Enable additional systemd units, comma-separated list
  -c,--config       use specified pacman config when installing container packages
  -a,--arch         use specified architecture instead of host's architecture
  -t,--network_type set container network interface type (${lxc_network_type})
  -l,--network_link set network link device (${lxc_network_link})
  -r,--root_passwd  set container root password
  -h,--help         print this help
EOF
    return 0
}

options=$(getopt -o hp:P:e:n:c:a:l:t:r: -l help,rootfs:,path:,packages:,enable_units:,name:,config:,arch:,network_type:,network_link:,root_passwd: -- "${@}")
if [ ${?} -ne 0 ]; then
    usage $(basename ${0})
    exit 1
fi
eval set -- "${options}"

while true
do
    case "${1}" in
    -h|--help)          usage ${0} && exit 0;;
    -p|--path)          path=${2}; shift 2;;
    -n|--name)          name=${2}; shift 2;;
    --rootfs)           rootfs_path=${2}; shift 2;;
    -P|--packages)      additional_packages=${2}; shift 2;;
    -e|--enable_units)  enable_units=${2}; shift 2;;
    -c|--config)        pacman_config=${2}; shift 2;;
    -a|--arch)          arch=${2}; shift 2;;
    -t|--network_type)  lxc_network_type=${2}; shift 2;;
    -l|--network_link)  lxc_network_link=${2}; shift 2;;
    -r|--root_passwd)   root_passwd=${2}; shift 2;;
    --)             shift 1; break ;;
    *)              break ;;
    esac
done

if [ -z "${name}" ]; then
    echo "missing required 'name' parameter"
    exit 1
fi

if [ ! -e /sys/class/net/${lxc_network_link} ]; then
    echo "network link interface, ${lxc_network_link}, does not exist"
    exit 1
fi

type pacman >/dev/null 2>&1
if [ ${?} -ne 0 ]; then
    echo "'pacman' command is missing, refer to wiki.archlinux.org for information about installing pacman"
    exit 1
fi

if [ -z "${path}" ]; then
    path="${default_path}/${name}"
fi

if [ "${EUID}" != "0" ]; then
    echo "This script should be run as 'root'"
    exit 1
fi

if [ -z "$rootfs_path" ]; then
    rootfs_path="${path}/rootfs"
fi
config_path="${default_path}/${name}"

revert() {
    echo "Interrupted, cleaning up"
    lxc-destroy -n "${name}"
    rm -rf "${path}/${name}"
    rm -rf "${default_path}/${name}"
    exit 1
}

trap revert SIGHUP SIGINT SIGTERM

copy_configuration
if [ ${?} -ne 0 ]; then
    echo "failed to write configuration file"
    rm -rf "${config_path}"
    exit 1
fi

if [ ${#additional_packages[@]} -gt 0 ]; then
    split_string ${additional_packages}
    base_packages+=(${result[@]})
fi

mkdir -p "${rootfs_path}"
install_arch
if [ ${?} -ne 0 ]; then
    echo "failed to install Arch Linux"
    rm -rf "${config_path}" "${path}"
    exit 1
fi

configure_arch
if [ ${?} -ne 0 ]; then
    echo "failed to configure Arch Linux for a container"
    rm -rf "${config_path}" "${path}"
    exit 1
fi

if [ ${#enable_units[@]} -gt 0 ]; then
    split_string ${enable_units}
    for unit in ${result[@]}; do
        [ "${unit}" = *'.'* ] || unit="${unit}.service"
        ln -s /usr/lib/systemd/system/"${unit}" \
            "${rootfs_path}"/etc/systemd/system/multi-user.target.wants
    done
fi

if [ -n "${root_passwd}" ]; then
    echo "root:${root_passwd}" | chroot "${rootfs_path}" chpasswd
fi

cat << EOF
ArchLinux container ${name} is successfully created! The configuration is
stored in ${config_path}/config. Please refer to https://wiki.archlinux.org for
information about configuring ArchLinux.
EOF