]>
Commit | Line | Data |
---|---|---|
164105f6 MW |
1 | #!/bin/bash |
2 | ||
3 | # | |
4 | # template script for generating centos container for LXC | |
5 | ||
6 | # | |
7 | # lxc: linux Container library | |
8 | ||
9 | # Authors: | |
10 | # Daniel Lezcano <daniel.lezcano@free.fr> | |
11 | # Ramez Hanna <rhanna@informatiq.org> | |
12 | # Fajar A. Nugraha <github@fajar.net> | |
13 | # Michael H. Warfield <mhw@WittsEnd.com> | |
14 | ||
15 | # This library is free software; you can redistribute it and/or | |
16 | # modify it under the terms of the GNU Lesser General Public | |
17 | # License as published by the Free Software Foundation; either | |
18 | # version 2.1 of the License, or (at your option) any later version. | |
19 | ||
20 | # This library is distributed in the hope that it will be useful, | |
21 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
23 | # Lesser General Public License for more details. | |
24 | ||
25 | # You should have received a copy of the GNU Lesser General Public | |
26 | # License along with this library; if not, write to the Free Software | |
27 | # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
28 | ||
29 | #Configurations | |
30 | arch=$(arch) | |
31 | cache_base=@LOCALSTATEDIR@/cache/lxc/centos/$arch | |
32 | default_path=@LXCPATH@ | |
33 | # We really need something better here! | |
34 | root_password=root | |
35 | ||
36 | lxc_network_type=veth | |
37 | lxc_network_link=lxcbr0 | |
38 | ||
39 | # is this centos? | |
40 | # Alow for weird remixes like the Raspberry Pi | |
41 | # | |
42 | # Use the Mitre standard CPE identifier for the release ID if possible... | |
43 | # This may be in /etc/os-release or /etc/system-release-cpe. We | |
44 | # should be able to use EITHER. Give preference to /etc/os-release for now. | |
45 | ||
46 | if [ -e /etc/os-release ] | |
47 | then | |
48 | # This is a shell friendly configuration file. We can just source it. | |
49 | # What we're looking for in here is the ID, VERSION_ID and the CPE_NAME | |
50 | . /etc/os-release | |
51 | echo "Host CPE ID from /etc/os-release: ${CPE_NAME}" | |
52 | fi | |
53 | ||
54 | if [ "${CPE_NAME}" = "" -a -e /etc/system-release-cpe ] | |
55 | then | |
56 | CPE_NAME=$(head -n1 /etc/system-release-cpe) | |
c6df5ca4 | 57 | CPE_URI=$(expr ${CPE_NAME} : '\([^:]*:[^:]*\)') |
164105f6 MW |
58 | if [ "${CPE_URI}" != "cpe:/o" ] |
59 | then | |
60 | CPE_NAME= | |
61 | else | |
164105f6 MW |
62 | # Probably a better way to do this but sill remain posix |
63 | # compatible but this works, shrug... | |
64 | # Must be nice and not introduce convenient bashisms here. | |
c6df5ca4 MW |
65 | # |
66 | # According to the official registration at Mitre and NIST, | |
67 | # this should have been something like this for CentOS: | |
68 | # cpe:/o:centos:centos:6 | |
69 | # or this: | |
70 | # cpe:/o:centos:centos:6.5 | |
71 | # | |
164105f6 | 72 | ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:\([^:]*\)') |
c6df5ca4 MW |
73 | # The "enterprise_linux" is a bone toss back to RHEL. |
74 | # Since CentOS and RHEL are so tightly coupled, we'll | |
75 | # take the RHEL version if we're running on it and do the | |
76 | # equivalent version for CentOS. | |
77 | if [ ${ID} = "linux" -o ${ID} = "enterprise_linux" ] | |
78 | then | |
79 | # Instead we got this: cpe:/o:centos:linux:6 | |
80 | ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:\([^:]*\)') | |
81 | fi | |
82 | ||
164105f6 | 83 | VERSION_ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:[^:]*:\([^:]*\)') |
c6df5ca4 | 84 | echo "Host CPE ID from /etc/system-release-cpe: ${CPE_NAME}" |
164105f6 MW |
85 | fi |
86 | fi | |
87 | ||
88 | if [ "${CPE_NAME}" != "" -a "${ID}" = "centos" -a "${VERSION_ID}" != "" ] | |
89 | then | |
90 | centos_host_ver=${VERSION_ID} | |
91 | is_centos=true | |
c6df5ca4 MW |
92 | elif [ "${CPE_NAME}" != "" -a "${ID}" = "redhat" -a "${VERSION_ID}" != "" ] |
93 | then | |
94 | redhat_host_ver=${VERSION_ID} | |
95 | is_redhat=true | |
96 | elif [ -e /etc/centos-release ] | |
164105f6 MW |
97 | then |
98 | # Only if all other methods fail, try to parse the redhat-release file. | |
c6df5ca4 | 99 | centos_host_ver=$( sed -e '/^CentOS /!d' -e 's/CentOS.*\srelease\s*\([0-9][0-9.]*\)\s.*/\1/' < /etc/centos-release ) |
164105f6 MW |
100 | if [ "$centos_host_ver" != "" ] |
101 | then | |
102 | is_centos=true | |
103 | fi | |
104 | fi | |
105 | ||
106 | # Map a few architectures to their generic Centos repository archs. | |
107 | # | |
108 | # CentOS currently doesn't support ARM but it's copied here from | |
109 | # the Fedora template for completeness and that it will in the future. | |
110 | # | |
111 | # The two ARM archs are a bit of a guesstimate for the v5 and v6 | |
112 | # archs. V6 should have hardware floating point (Rasberry Pi). | |
113 | # The "arm" arch is safer (no hardware floating point). So | |
114 | # there may be cases where we "get it wrong" for some v6 other | |
115 | # than RPi. | |
116 | case "$arch" in | |
117 | i686) arch=i386 ;; | |
118 | armv3l|armv4l|armv5l) arch=arm ;; | |
119 | armv6l|armv7l|armv8l) arch=armhfp ;; | |
120 | esac | |
121 | ||
122 | force_mknod() | |
123 | { | |
124 | # delete a device node if exists, and create a new one | |
125 | rm -f $2 && mknod -m $1 $2 $3 $4 $5 | |
126 | } | |
127 | ||
128 | configure_centos() | |
129 | { | |
130 | ||
131 | # disable selinux in centos | |
132 | mkdir -p $rootfs_path/selinux | |
133 | echo 0 > $rootfs_path/selinux/enforce | |
134 | ||
135 | # Also kill it in the /etc/selinux/config file if it's there... | |
136 | if [[ -f $rootfs_path/etc/selinux/config ]] | |
137 | then | |
138 | sed -i '/^SELINUX=/s/.*/SELINUX=disabled/' $rootfs_path/etc/selinux/config | |
139 | fi | |
140 | ||
141 | # Nice catch from Dwight Engen in the Oracle template. | |
142 | # Wantonly plagerized here with much appreciation. | |
143 | if [ -f $rootfs_path/usr/sbin/selinuxenabled ]; then | |
144 | mv $rootfs_path/usr/sbin/selinuxenabled $rootfs_path/usr/sbin/selinuxenabled.lxcorig | |
145 | ln -s /bin/false $rootfs_path/usr/sbin/selinuxenabled | |
146 | fi | |
147 | ||
148 | # This is a known problem and documented in RedHat bugzilla as relating | |
149 | # to a problem with auditing enabled. This prevents an error in | |
150 | # the container "Cannot make/remove an entry for the specified session" | |
151 | sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/login | |
152 | sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/sshd | |
153 | ||
c6df5ca4 MW |
154 | if [ -f ${rootfs_path}/etc/pam.d/crond ] |
155 | then | |
156 | sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/crond | |
157 | fi | |
158 | ||
159 | # In addition to disabling pam_loginuid in the above config files | |
160 | # we'll also disable it by linking it to pam_permit to catch any | |
161 | # we missed or any that get installed after the container is built. | |
162 | # | |
163 | # Catch either or both 32 and 64 bit archs. | |
164 | if [ -f ${rootfs_path}/lib/security/pam_loginuid.so ] | |
165 | then | |
166 | ( cd ${rootfs_path}/lib/security/ | |
167 | mv pam_loginuid.so pam_loginuid.so.disabled | |
168 | ln -s pam_permit.so pam_loginuid.so | |
169 | ) | |
170 | fi | |
171 | ||
172 | if [ -f ${rootfs_path}/lib64/security/pam_loginuid.so ] | |
173 | then | |
174 | ( cd ${rootfs_path}/lib64/security/ | |
175 | mv pam_loginuid.so pam_loginuid.so.disabled | |
176 | ln -s pam_permit.so pam_loginuid.so | |
177 | ) | |
178 | fi | |
179 | ||
99c2fb07 MW |
180 | # Deal with some dain bramage in the /etc/init.d/halt script. |
181 | # Trim it and make it our own and link it in before the default | |
182 | # halt script so we can intercept it. This also preventions package | |
183 | # updates from interferring with our interferring with it. | |
184 | # | |
185 | # There's generally not much in the halt script that useful but what's | |
186 | # in there from resetting the hardware clock down is generally very bad. | |
187 | # So we just eliminate the whole bottom half of that script in making | |
188 | # ourselves a copy. That way a major update to the init scripts won't | |
189 | # trash what we've set up. | |
190 | if [ -f ${rootfs_path}/etc/init.d/halt ] | |
191 | then | |
192 | sed -e '/hwclock/,$d' \ | |
193 | < ${rootfs_path}/etc/init.d/halt \ | |
194 | > ${rootfs_path}/etc/init.d/lxc-halt | |
195 | ||
196 | echo '$command -f' >> ${rootfs_path}/etc/init.d/lxc-halt | |
197 | chmod 755 ${rootfs_path}/etc/init.d/lxc-halt | |
198 | ||
199 | # Link them into the rc directories... | |
200 | ( | |
201 | cd ${rootfs_path}/etc/rc.d/rc0.d | |
202 | ln -s ../init.d/lxc-halt S00lxc-halt | |
203 | cd ${rootfs_path}/etc/rc.d/rc6.d | |
204 | ln -s ../init.d/lxc-halt S00lxc-reboot | |
205 | ) | |
206 | fi | |
207 | ||
208 | # configure the network using the dhcp | |
164105f6 MW |
209 | cat <<EOF > ${rootfs_path}/etc/sysconfig/network-scripts/ifcfg-eth0 |
210 | DEVICE=eth0 | |
211 | BOOTPROTO=dhcp | |
212 | ONBOOT=yes | |
213 | HOSTNAME=${UTSNAME} | |
214 | NM_CONTROLLED=no | |
215 | TYPE=Ethernet | |
216 | MTU=${MTU} | |
217 | EOF | |
218 | ||
219 | # set the hostname | |
220 | cat <<EOF > ${rootfs_path}/etc/sysconfig/network | |
221 | NETWORKING=yes | |
222 | HOSTNAME=${UTSNAME} | |
223 | EOF | |
224 | ||
225 | # set minimal hosts | |
226 | cat <<EOF > $rootfs_path/etc/hosts | |
227 | 127.0.0.1 localhost $name | |
228 | EOF | |
229 | ||
230 | # set minimal fstab | |
231 | cat <<EOF > $rootfs_path/etc/fstab | |
232 | /dev/root / rootfs defaults 0 0 | |
233 | none /dev/shm tmpfs nosuid,nodev 0 0 | |
234 | EOF | |
235 | ||
236 | # create lxc compatibility init script | |
237 | if [ "$release" = "6" ]; then | |
238 | cat <<EOF > $rootfs_path/etc/init/lxc-sysinit.conf | |
239 | start on startup | |
240 | env container | |
241 | ||
242 | pre-start script | |
243 | if [ "x$container" != "xlxc" -a "x$container" != "xlibvirt" ]; then | |
244 | stop; | |
245 | fi | |
246 | initctl start tty TTY=console | |
247 | rm -f /var/lock/subsys/* | |
248 | rm -f /var/run/*.pid | |
249 | telinit 3 | |
250 | exit 0; | |
251 | end script | |
252 | EOF | |
253 | elif [ "$release" = "5" ]; then | |
254 | cat <<EOF > $rootfs_path/etc/rc.d/lxc.sysinit | |
255 | #! /bin/bash | |
256 | rm -f /etc/mtab /var/run/*.{pid,lock} /var/lock/subsys/* | |
257 | rm -rf {/,/var}/tmp/* | |
258 | echo "/dev/root / rootfs defaults 0 0" > /etc/mtab | |
259 | exit 0 | |
260 | EOF | |
261 | chmod 755 $rootfs_path/etc/rc.d/lxc.sysinit | |
262 | sed -i 's|si::sysinit:/etc/rc.d/rc.sysinit|si::bootwait:/etc/rc.d/lxc.sysinit|' $rootfs_path/etc/inittab | |
263 | sed -i 's|^1:|co:2345:respawn:/sbin/mingetty console\n1:|' $rootfs_path/etc/inittab | |
264 | sed -i 's|^\([56]:\)|#\1|' $rootfs_path/etc/inittab | |
265 | fi | |
266 | ||
267 | dev_path="${rootfs_path}/dev" | |
268 | rm -rf $dev_path | |
269 | mkdir -p $dev_path | |
270 | mknod -m 666 ${dev_path}/null c 1 3 | |
271 | mknod -m 666 ${dev_path}/zero c 1 5 | |
272 | mknod -m 666 ${dev_path}/random c 1 8 | |
273 | mknod -m 666 ${dev_path}/urandom c 1 9 | |
274 | mkdir -m 755 ${dev_path}/pts | |
275 | mkdir -m 1777 ${dev_path}/shm | |
276 | mknod -m 666 ${dev_path}/tty c 5 0 | |
277 | mknod -m 666 ${dev_path}/tty0 c 4 0 | |
278 | mknod -m 666 ${dev_path}/tty1 c 4 1 | |
279 | mknod -m 666 ${dev_path}/tty2 c 4 2 | |
280 | mknod -m 666 ${dev_path}/tty3 c 4 3 | |
281 | mknod -m 666 ${dev_path}/tty4 c 4 4 | |
282 | mknod -m 600 ${dev_path}/console c 5 1 | |
283 | mknod -m 666 ${dev_path}/full c 1 7 | |
284 | mknod -m 600 ${dev_path}/initctl p | |
285 | mknod -m 666 ${dev_path}/ptmx c 5 2 | |
286 | ||
287 | echo "setting root passwd to $root_password" | |
288 | echo "root:$root_password" | chroot $rootfs_path chpasswd | |
289 | ||
290 | # This will need to be enhanced for CentOS 7 when systemd | |
291 | # comes into play... /\/\|=mhw=|\/\/ | |
292 | ||
293 | return 0 | |
294 | } | |
295 | ||
296 | configure_centos_init() | |
297 | { | |
298 | sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc/rc.sysinit | |
299 | sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc/rc.d/rc.sysinit | |
300 | if [ "$release" = "6" ]; then | |
301 | chroot ${rootfs_path} chkconfig udev-post off | |
302 | fi | |
303 | chroot ${rootfs_path} chkconfig network on | |
304 | } | |
305 | ||
306 | download_centos() | |
307 | { | |
308 | ||
309 | # check the mini centos was not already downloaded | |
310 | INSTALL_ROOT=$cache/partial | |
311 | mkdir -p $INSTALL_ROOT | |
312 | if [ $? -ne 0 ]; then | |
313 | echo "Failed to create '$INSTALL_ROOT' directory" | |
314 | return 1 | |
315 | fi | |
316 | ||
317 | # download a mini centos into a cache | |
318 | echo "Downloading centos minimal ..." | |
319 | YUM="yum --installroot $INSTALL_ROOT -y --nogpgcheck" | |
320 | PKG_LIST="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils" | |
321 | ||
322 | # use temporary repository definition | |
323 | REPO_FILE=$INSTALL_ROOT/etc/yum.repos.d/lxc-centos-temp.repo | |
324 | mkdir -p $(dirname $REPO_FILE) | |
325 | cat <<EOF > $REPO_FILE | |
326 | [base] | |
327 | name=CentOS-$release - Base | |
328 | mirrorlist=http://mirrorlist.centos.org/?release=$release&arch=$arch&repo=os | |
329 | ||
330 | [updates] | |
331 | name=CentOS-$release - Updates | |
332 | mirrorlist=http://mirrorlist.centos.org/?release=$release&arch=$arch&repo=updates | |
333 | EOF | |
334 | ||
335 | # create minimal device nodes, needed for "yum install" and "yum update" process | |
336 | mkdir -p $INSTALL_ROOT/dev | |
337 | force_mknod 666 $INSTALL_ROOT/dev/null c 1 3 | |
338 | force_mknod 666 $INSTALL_ROOT/dev/urandom c 1 9 | |
339 | ||
340 | $YUM install $PKG_LIST | |
341 | ||
342 | if [ $? -ne 0 ]; then | |
343 | echo "Failed to download the rootfs, aborting." | |
344 | return 1 | |
345 | fi | |
346 | ||
347 | # use same nameservers as hosts, needed for "yum update later" | |
348 | cp /etc/resolv.conf $INSTALL_ROOT/etc/ | |
349 | ||
350 | # check whether rpmdb is under $HOME | |
351 | if [ ! -e $INSTALL_ROOT/var/lib/rpm/Packages -a -e $INSTALL_ROOT/$HOME/.rpmdb/Packages ]; then | |
352 | echo "Fixing rpmdb location ..." | |
353 | mv $INSTALL_ROOT/$HOME/.rpmdb/[A-Z]* $INSTALL_ROOT/var/lib/rpm/ | |
354 | rm -rf $INSTALL_ROOT/$HOME/.rpmdb | |
355 | chroot $INSTALL_ROOT rpm --rebuilddb 2>/dev/null | |
356 | fi | |
357 | ||
358 | # check whether rpmdb version is correct | |
359 | chroot $INSTALL_ROOT rpm --quiet -q yum 2>/dev/null | |
360 | ret=$? | |
361 | ||
362 | # if "rpm -q" doesn't work due to rpmdb version difference, | |
363 | # then we need to redo the process using the newly-installed yum | |
364 | if [ $ret -gt 0 ]; then | |
365 | echo "Reinstalling packages ..." | |
366 | mv $REPO_FILE $REPO_FILE.tmp | |
367 | mkdir $INSTALL_ROOT/etc/yum.repos.disabled | |
368 | mv $INSTALL_ROOT/etc/yum.repos.d/*.repo $INSTALL_ROOT/etc/yum.repos.disabled/ | |
369 | mv $REPO_FILE.tmp $REPO_FILE | |
370 | mkdir -p $INSTALL_ROOT/$INSTALL_ROOT/etc | |
371 | cp /etc/resolv.conf $INSTALL_ROOT/$INSTALL_ROOT/etc/ | |
372 | mkdir -p $INSTALL_ROOT/$INSTALL_ROOT/dev | |
373 | mknod -m 666 $INSTALL_ROOT/$INSTALL_ROOT/dev/null c 1 3 | |
374 | mknod -m 666 $INSTALL_ROOT/$INSTALL_ROOT/dev/urandom c 1 9 | |
375 | mkdir -p $INSTALL_ROOT/$INSTALL_ROOT/var/cache/yum | |
376 | cp -al $INSTALL_ROOT/var/cache/yum/* $INSTALL_ROOT/$INSTALL_ROOT/var/cache/yum/ | |
377 | chroot $INSTALL_ROOT $YUM install $PKG_LIST | |
378 | if [ $? -ne 0 ]; then | |
379 | echo "Failed to download the rootfs, aborting." | |
380 | return 1 | |
381 | fi | |
382 | mv $INSTALL_ROOT/$INSTALL_ROOT $INSTALL_ROOT.tmp | |
383 | rm -rf $INSTALL_ROOT | |
384 | mv $INSTALL_ROOT.tmp $INSTALL_ROOT | |
385 | fi | |
386 | ||
387 | rm -f $REPO_FILE | |
388 | rm -rf $INSTALL_ROOT/var/cache/yum/* | |
389 | ||
390 | mv "$INSTALL_ROOT" "$cache/rootfs" | |
391 | echo "Download complete." | |
392 | ||
393 | return 0 | |
394 | } | |
395 | ||
396 | copy_centos() | |
397 | { | |
398 | ||
399 | # make a local copy of the mini centos | |
400 | echo -n "Copying rootfs to $rootfs_path ..." | |
401 | #cp -a $cache/rootfs-$arch $rootfs_path || return 1 | |
402 | # i prefer rsync (no reason really) | |
403 | mkdir -p $rootfs_path | |
404 | rsync -a $cache/rootfs/ $rootfs_path/ | |
405 | return 0 | |
406 | } | |
407 | ||
408 | update_centos() | |
409 | { | |
410 | YUM="chroot $cache/rootfs yum -y --nogpgcheck" | |
411 | $YUM update | |
412 | if [ $? -ne 0 ]; then | |
413 | return 1 | |
414 | fi | |
415 | $YUM clean packages | |
416 | } | |
417 | ||
418 | install_centos() | |
419 | { | |
420 | mkdir -p /var/lock/subsys/ | |
421 | ( | |
422 | flock -x 200 | |
423 | if [ $? -ne 0 ]; then | |
424 | echo "Cache repository is busy." | |
425 | return 1 | |
426 | fi | |
427 | ||
428 | echo "Checking cache download in $cache/rootfs ... " | |
429 | if [ ! -e "$cache/rootfs" ]; then | |
430 | download_centos | |
431 | if [ $? -ne 0 ]; then | |
432 | echo "Failed to download 'centos base'" | |
433 | return 1 | |
434 | fi | |
435 | else | |
436 | echo "Cache found. Updating..." | |
437 | update_centos | |
438 | if [ $? -ne 0 ]; then | |
439 | echo "Failed to update 'centos base', continuing with last known good cache" | |
440 | else | |
441 | echo "Update finished" | |
442 | fi | |
443 | fi | |
444 | ||
445 | echo "Copy $cache/rootfs to $rootfs_path ... " | |
446 | copy_centos | |
447 | if [ $? -ne 0 ]; then | |
448 | echo "Failed to copy rootfs" | |
449 | return 1 | |
450 | fi | |
451 | ||
452 | return 0 | |
453 | ||
826eb798 | 454 | ) 200>/var/lock/subsys/lxc-centos |
164105f6 MW |
455 | |
456 | return $? | |
457 | } | |
458 | ||
459 | copy_configuration() | |
460 | { | |
461 | ||
462 | mkdir -p $config_path | |
463 | cat <<EOF >> $config_path/config | |
464 | lxc.utsname = $utsname | |
465 | lxc.tty = 4 | |
466 | lxc.pts = 1024 | |
467 | lxc.rootfs = $rootfs_path | |
468 | lxc.mount = $config_path/fstab | |
469 | lxc.cap.drop = sys_module mac_admin mac_override sys_time | |
470 | ||
471 | lxc.autodev = $auto_dev | |
472 | ||
473 | # example simple networking setup, uncomment to enable | |
474 | #lxc.network.type = $lxc_network_type | |
475 | #lxc.network.flags = up | |
476 | #lxc.network.link = $lxc_network_link | |
477 | #lxc.network.name = eth0 | |
478 | # additional example for veth network type, static MAC address, | |
479 | # and persistent veth device name on host side | |
480 | #lxc.network.hwaddr = 00:16:3e:77:52:20 | |
481 | #lxc.network.veth.pair = v-$name-e0 | |
482 | ||
483 | #cgroups | |
484 | lxc.cgroup.devices.deny = a | |
485 | # /dev/null and zero | |
486 | lxc.cgroup.devices.allow = c 1:3 rwm | |
487 | lxc.cgroup.devices.allow = c 1:5 rwm | |
488 | # consoles | |
489 | lxc.cgroup.devices.allow = c 5:1 rwm | |
490 | lxc.cgroup.devices.allow = c 5:0 rwm | |
491 | lxc.cgroup.devices.allow = c 4:0 rwm | |
492 | lxc.cgroup.devices.allow = c 4:1 rwm | |
493 | # /dev/{,u}random | |
494 | lxc.cgroup.devices.allow = c 1:9 rwm | |
495 | lxc.cgroup.devices.allow = c 1:8 rwm | |
496 | lxc.cgroup.devices.allow = c 136:* rwm | |
497 | lxc.cgroup.devices.allow = c 5:2 rwm | |
498 | # rtc | |
499 | lxc.cgroup.devices.allow = c 254:0 rwm | |
500 | EOF | |
501 | ||
502 | cat <<EOF > $config_path/fstab | |
503 | proc proc proc nodev,noexec,nosuid 0 0 | |
504 | devpts dev/pts devpts defaults 0 0 | |
505 | sysfs sys sysfs defaults 0 0 | |
506 | EOF | |
507 | ||
508 | if [ $? -ne 0 ]; then | |
509 | echo "Failed to add configuration" | |
510 | return 1 | |
511 | fi | |
512 | ||
513 | return 0 | |
514 | } | |
515 | ||
516 | clean() | |
517 | { | |
518 | ||
519 | if [ ! -e $cache ]; then | |
520 | exit 0 | |
521 | fi | |
522 | ||
523 | # lock, so we won't purge while someone is creating a repository | |
524 | ( | |
525 | flock -x 200 | |
526 | if [ $? != 0 ]; then | |
527 | echo "Cache repository is busy." | |
528 | exit 1 | |
529 | fi | |
530 | ||
531 | echo -n "Purging the download cache for centos-$release..." | |
532 | rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1 | |
533 | exit 0 | |
534 | ||
826eb798 | 535 | ) 200>/var/lock/subsys/lxc-centos |
164105f6 MW |
536 | } |
537 | ||
538 | usage() | |
539 | { | |
540 | cat <<EOF | |
541 | usage: | |
542 | $1 -n|--name=<container_name> | |
543 | [-p|--path=<path>] [-c|--clean] [-R|--release=<CentOS_release>] [-A|--arch=<arch of the container>] | |
544 | [-h|--help] | |
545 | Mandatory args: | |
546 | -n,--name container name, used to as an identifier for that container from now on | |
547 | Optional args: | |
548 | -p,--path path to where the container rootfs will be created, defaults to /var/lib/lxc. The container config will go under /var/lib/lxc in that case | |
549 | -c,--clean clean the cache | |
550 | -R,--release Centos release for the new container. if the host is Centos, then it will defaultto the host's release. | |
551 | --fqdn fully qualified domain name (FQDN) for DNS and system naming | |
552 | -A,--arch NOT USED YET. Define what arch the container will be [i686,x86_64] | |
553 | -h,--help print this help | |
554 | EOF | |
555 | return 0 | |
556 | } | |
557 | ||
558 | options=$(getopt -o hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,fqdn: -- "$@") | |
559 | if [ $? -ne 0 ]; then | |
560 | usage $(basename $0) | |
561 | exit 1 | |
562 | fi | |
563 | eval set -- "$options" | |
564 | ||
565 | while true | |
566 | do | |
567 | case "$1" in | |
568 | -h|--help) usage $0 && exit 0;; | |
569 | -p|--path) path=$2; shift 2;; | |
570 | --rootfs) rootfs=$2; shift 2;; | |
571 | -n|--name) name=$2; shift 2;; | |
572 | -c|--clean) clean=$2; shift 2;; | |
573 | -R|--release) release=$2; shift 2;; | |
574 | --fqdn) utsname=$2; shift 2;; | |
575 | --) shift 1; break ;; | |
576 | *) break ;; | |
577 | esac | |
578 | done | |
579 | ||
580 | if [ ! -z "$clean" -a -z "$path" ]; then | |
581 | clean || exit 1 | |
582 | exit 0 | |
583 | fi | |
584 | ||
585 | if [ -z "${utsname}" ]; then | |
586 | utsname=${name} | |
587 | fi | |
588 | ||
589 | # This follows a standard "resolver" convention that an FQDN must have | |
590 | # at least two dots or it is considered a local relative host name. | |
591 | # If it doesn't, append the dns domain name of the host system. | |
592 | # | |
593 | # This changes one significant behavior when running | |
594 | # "lxc_create -n Container_Name" without using the | |
595 | # --fqdn option. | |
596 | # | |
597 | # Old behavior: | |
598 | # utsname and hostname = Container_Name | |
599 | # New behavior: | |
600 | # utsname and hostname = Container_Name.Domain_Name | |
601 | ||
602 | if [ $(expr "$utsname" : '.*\..*\.') = 0 ]; then | |
603 | if [ -n "$(dnsdomainname)" ]; then | |
604 | utsname=${utsname}.$(dnsdomainname) | |
605 | fi | |
606 | fi | |
607 | ||
608 | type yum >/dev/null 2>&1 | |
609 | if [ $? -ne 0 ]; then | |
610 | echo "'yum' command is missing" | |
611 | exit 1 | |
612 | fi | |
613 | ||
614 | if [ -z "$path" ]; then | |
615 | path=$default_path/$name | |
616 | fi | |
617 | ||
618 | if [ -z "$release" ]; then | |
619 | if [ "$is_centos" -a "$centos_host_ver" ]; then | |
620 | release=$centos_host_ver | |
c6df5ca4 MW |
621 | elif [ "$is_redhat" -a "$redhat_host_ver" ]; then |
622 | # This is needed to clean out bullshit like 6workstation and 6server. | |
623 | release=$(expr $redhat_host_ver : '\([0-9.]*\)') | |
164105f6 | 624 | else |
c6df5ca4 | 625 | echo "This is not a CentOS or Redhat host and release is missing, defaulting to 6 use -R|--release to specify release" |
164105f6 MW |
626 | release=6 |
627 | fi | |
628 | fi | |
629 | ||
630 | # CentOS 7 and above should run systemd. We need autodev enabled to keep | |
631 | # systemd from causing problems. | |
c6df5ca4 MW |
632 | # |
633 | # There is some ambiguity here due to the differnce between versioning | |
634 | # of point specific releases such as 6.5 and the rolling release 6. We | |
635 | # only want the major number here if it's a point release... | |
636 | ||
637 | mrelease=$(expr $release : '\([0-9]*\)') | |
638 | if [ $mrelease -gt 6 ]; then | |
164105f6 MW |
639 | auto_dev="1" |
640 | else | |
641 | auto_dev="0" | |
642 | fi | |
643 | ||
644 | if [ "$(id -u)" != "0" ]; then | |
645 | echo "This script should be run as 'root'" | |
646 | exit 1 | |
647 | fi | |
648 | ||
649 | ||
650 | if [ -z "$rootfs_path" ]; then | |
651 | rootfs_path=$path/rootfs | |
652 | # check for 'lxc.rootfs' passed in through default config by lxc-create | |
653 | if grep -q '^lxc.rootfs' $path/config 2>/dev/null ; then | |
654 | rootfs_path=`grep 'lxc.rootfs =' $path/config | awk -F= '{ print $2 }'` | |
655 | fi | |
656 | fi | |
657 | config_path=$default_path/$name | |
658 | cache=$cache_base/$release | |
659 | ||
660 | revert() | |
661 | { | |
662 | echo "Interrupted, so cleaning up" | |
663 | lxc-destroy -n $name | |
664 | # maybe was interrupted before copy config | |
665 | rm -rf $path | |
666 | rm -rf $default_path/$name | |
667 | echo "exiting..." | |
668 | exit 1 | |
669 | } | |
670 | ||
671 | trap revert SIGHUP SIGINT SIGTERM | |
672 | ||
673 | copy_configuration | |
674 | if [ $? -ne 0 ]; then | |
675 | echo "failed write configuration file" | |
676 | exit 1 | |
677 | fi | |
678 | ||
679 | install_centos | |
680 | if [ $? -ne 0 ]; then | |
681 | echo "failed to install centos" | |
682 | exit 1 | |
683 | fi | |
684 | ||
685 | configure_centos | |
686 | if [ $? -ne 0 ]; then | |
687 | echo "failed to configure centos for a container" | |
688 | exit 1 | |
689 | fi | |
690 | ||
691 | configure_centos_init | |
692 | ||
693 | if [ ! -z $clean ]; then | |
694 | clean || exit 1 | |
695 | exit 0 | |
696 | fi | |
697 | echo "container rootfs and config created, default root password is '$root_password'" | |
698 | echo "edit the config file to check/enable networking setup" |