[mirror_lxc.git] / templates / lxc-download.in

#!/bin/sh

# Client script for LXC container images.
#
# Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
#
#  This library is free software; you can redistribute it and/or
#  modify it under the terms of the GNU Lesser General Public
#  License as published by the Free Software Foundation; either
#  version 2.1 of the License, or (at your option) any later version.

#  This library is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
#  Lesser General Public License for more details.

#  You should have received a copy of the GNU Lesser General Public
#  License along with this library; if not, write to the Free Software
#  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
#  USA

set -eu

LOCALSTATEDIR="@LOCALSTATEDIR@"
LXC_HOOK_DIR="@LXCHOOKDIR@"
LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"

# Defaults
DOWNLOAD_ARCH=
DOWNLOAD_BUILD=
DOWNLOAD_COMPAT_LEVEL=4
DOWNLOAD_DIST=
DOWNLOAD_FLUSH_CACHE="false"
DOWNLOAD_FORCE_CACHE="false"
DOWNLOAD_INTERACTIVE="false"
DOWNLOAD_KEYID="0xE7FB0CAEC8173D669066514CBAEFF88C22F6E216"
DOWNLOAD_LIST_IMAGES="false"
DOWNLOAD_MODE="system"
DOWNLOAD_READY_GPG="false"
DOWNLOAD_RELEASE=
DOWNLOAD_SERVER="images.linuxcontainers.org"
DOWNLOAD_SHOW_GPG_WARNING="true"
DOWNLOAD_SHOW_HTTP_WARNING="true"
DOWNLOAD_TARGET="system"
DOWNLOAD_URL=
DOWNLOAD_USE_CACHE="false"
DOWNLOAD_VALIDATE="true"
DOWNLOAD_VARIANT="default"

LXC_MAPPED_GID=
LXC_MAPPED_UID=
LXC_NAME=
LXC_PATH=
LXC_ROOTFS=

if [ -z "${DOWNLOAD_KEYSERVER+x}" ]; then
	DOWNLOAD_KEYSERVER="hkp://pool.sks-keyservers.net"

	# Deal with GPG over http proxy
	if [ -n "${http_proxy:-}" ]; then
	    DOWNLOAD_KEYSERVER="hkp://p80.pool.sks-keyservers.net:80"
	fi
fi

# Make sure the usual locations are in PATH
export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin

# Some useful functions
cleanup() {
    if [ -d "$DOWNLOAD_TEMP" ]; then
        rm -Rf $DOWNLOAD_TEMP
    fi
}

wget_wrapper() {
    for i in $(seq 3); do
        if wget $@; then
            return 0
        fi
    done

    return 1
}

download_file() {
    if ! wget_wrapper -T 30 -q https://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
        if ! wget_wrapper -T 30 -q http://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
            if [ "$3" = "noexit" ]; then
                return 1
            else
                echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
                exit 1
            fi
        elif [ "$DOWNLOAD_SHOW_HTTP_WARNING" = "true" ]; then
            DOWNLOAD_SHOW_HTTP_WARNING="false"
            echo "WARNING: Failed to download the file over HTTPs." 1>&2
            echo -n "         The file was instead download over HTTP. " 1>&2
            echo "A server replay attack may be possible!" 1>&2
        fi
    fi
}

download_sig() {
    if ! download_file $1 $2 noexit; then
        if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
            if [ "$3" = "normal" ]; then
                echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
                exit 1
            else
                return 1
            fi
        else
            return 0
        fi
    fi
}

gpg_setup() {
    if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
        return
    fi

    if [ "$DOWNLOAD_READY_GPG" = "true" ]; then
        return
    fi

    echo "Setting up the GPG keyring"

    mkdir -p "$DOWNLOAD_TEMP/gpg"
    chmod 700 "$DOWNLOAD_TEMP/gpg"
    export GNUPGHOME="$DOWNLOAD_TEMP/gpg"

    success=
    for i in $(seq 3); do
        if gpg --keyserver $DOWNLOAD_KEYSERVER \
            --recv-keys ${DOWNLOAD_KEYID} >/dev/null 2>&1; then
            success=1
            break
        fi
    done

    if [ -z "$success" ]; then
        echo "ERROR: Unable to fetch GPG key from keyserver."
        exit 1
    fi

    DOWNLOAD_READY_GPG="true"
}

gpg_validate() {
    if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
        if [ "$DOWNLOAD_SHOW_GPG_WARNING" = "true" ]; then
            echo "WARNING: Running without gpg validation!" 1>&2
        fi
        DOWNLOAD_SHOW_GPG_WARNING="false"
        return 0
    fi

    if ! gpg --verify $1 >/dev/zero 2>&1; then
        echo "ERROR: Invalid signature for $1" 1>&2
        exit 1
    fi
}

in_userns() {
    [ -e /proc/self/uid_map ] || { echo no; return; }
    while read line; do
        fields=$(echo $line | awk '{ print $1 " " $2 " " $3 }')
        [ "$fields" = "0 0 4294967295" ] && { echo no; return; } || true
        echo $fields | grep -q " 0 1$" && { echo userns-root; return; } || true
    done < /proc/self/uid_map

    [ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && \
        { echo userns-root; return; }
    echo yes
}

relevant_file() {
    FILE_PATH="${LXC_CACHE_PATH}/$1"
    if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
        FILE_PATH="${FILE_PATH}-${DOWNLOAD_MODE}"
    fi
    if [ -e "$FILE_PATH.${DOWNLOAD_COMPAT_LEVEL}" ]; then
        FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
    fi

    echo $FILE_PATH
}

usage() {
    cat <<EOF
LXC container image downloader

Special arguments:
[ -h | --help ]: Print this help message and exit.
[ -l | --list ]: List all available images and exit.

Required arguments:
[ -d | --dist <distribution> ]: The name of the distribution
[ -r | --release <release> ]: Release name/version
[ -a | --arch <architecture> ]: Architecture of the container

Optional arguments:
[ --variant <variant> ]: Variant of the image (default: "default")
[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
[ --keyid <keyid> ]: GPG keyid (default: 0x...)
[ --keyserver <keyserver> ]: GPG keyserver to use. Environment variable: DOWNLOAD_KEYSERVER
[ --no-validate ]: Disable GPG validation (not recommended)
[ --flush-cache ]: Flush the local copy (if present)
[ --force-cache ]: Force the use of the local copy even if expired

LXC internal arguments (do not pass manually!):
[ --name <name> ]: The container name
[ --path <path> ]: The path to the container
[ --rootfs <rootfs> ]: The path to the container's rootfs
[ --mapped-uid <map> ]: A uid map (user namespaces)
[ --mapped-gid <map> ]: A gid map (user namespaces)

Environment Variables:
DOWNLOAD_KEYSERVER : The URL of the key server to use, instead of the default.
                     Can be further overridden by using optional argument --keyserver

EOF
    return 0
}

options=$(getopt -o d:r:a:hl -l dist:,release:,arch:,help,list,variant:,\
server:,keyid:,keyserver:,no-validate,flush-cache,force-cache,name:,path:,\
rootfs:,mapped-uid:,mapped-gid: -- "$@")

if [ $? -ne 0 ]; then
    usage
    exit 1
fi
eval set -- "$options"

while :; do
    case "$1" in
        -h|--help)          usage && exit 1;;
        -l|--list)          DOWNLOAD_LIST_IMAGES="true"; shift 1;;
        -d|--dist)          DOWNLOAD_DIST=$2; shift 2;;
        -r|--release)       DOWNLOAD_RELEASE=$2; shift 2;;
        -a|--arch)          DOWNLOAD_ARCH=$2; shift 2;;
        --variant)          DOWNLOAD_VARIANT=$2; shift 2;;
        --server)           DOWNLOAD_SERVER=$2; shift 2;;
        --keyid)            DOWNLOAD_KEYID=$2; shift 2;;
        --keyserver)        DOWNLOAD_KEYSERVER=$2; shift 2;;
        --no-validate)      DOWNLOAD_VALIDATE="false"; shift 1;;
        --flush-cache)      DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
        --force-cache)      DOWNLOAD_FORCE_CACHE="true"; shift 1;;
        --name)             LXC_NAME=$2; shift 2;;
        --path)             LXC_PATH=$2; shift 2;;
        --rootfs)           LXC_ROOTFS=$2; shift 2;;
        --mapped-uid)       LXC_MAPPED_UID=$2; shift 2;;
        --mapped-gid)       LXC_MAPPED_GID=$2; shift 2;;
        *)                  break;;
    esac
done

# Check for required binaries
for bin in tar xz wget; do
    if ! type $bin >/dev/null 2>&1; then
        echo "ERROR: Missing required tool: $bin" 1>&2
        exit 1
    fi
done

# Check for GPG
if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
    if ! type gpg >/dev/null 2>&1; then
        echo "ERROR: Missing recommended tool: gpg" 1>&2
        echo "You can workaround this by using --no-validate." 1>&2
        exit 1
    fi
fi

# Check that we have all variables we need
if [ -z "$LXC_NAME" ] || [ -z "$LXC_PATH" ] || [ -z "$LXC_ROOTFS" ]; then
    if [ "$DOWNLOAD_LIST_IMAGES" != "true" ]; then
        echo "ERROR: Not running through LXC." 1>&2
        exit 1
    fi
fi

USERNS=$(in_userns)

if [ "$USERNS" != "no" ]; then
    if [ "$USERNS" = "yes" ]; then
        if [ -z "$LXC_MAPPED_UID" ] || [ "$LXC_MAPPED_UID" = "-1" ]; then
            echo "ERROR: In a user namespace without a map." 1>&2
            exit 1
        fi
        DOWNLOAD_MODE="user"
        DOWNLOAD_TARGET="user"
    else
        DOWNLOAD_MODE="user"
        DOWNLOAD_TARGET="system"
    fi
fi

if [ -z "$DOWNLOAD_DIST" ] || [ -z "$DOWNLOAD_RELEASE" ] || \
   [ -z "$DOWNLOAD_ARCH" ]; then
    DOWNLOAD_INTERACTIVE="true"
fi

# Trap all exit signals
trap cleanup EXIT HUP INT TERM

if ! type mktemp >/dev/null 2>&1; then
    DOWNLOAD_TEMP=/tmp/lxc-download.$$
    mkdir -p $DOWNLOAD_TEMP
else
    DOWNLOAD_TEMP=$(mktemp -d)
fi

# Simply list images
if [ "$DOWNLOAD_LIST_IMAGES" = "true" ] || \
   [ "$DOWNLOAD_INTERACTIVE" = "true" ]; then
    # Initialize GPG
    gpg_setup

    # Grab the index
    DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}

    echo "Downloading the image index"
    if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
         ${DOWNLOAD_TEMP}/index noexit ||
       ! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
            ${DOWNLOAD_TEMP}/index.asc noexit; then
        download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
        download_sig  ${DOWNLOAD_INDEX_PATH}.asc \
            ${DOWNLOAD_TEMP}/index.asc normal
    fi

    gpg_validate ${DOWNLOAD_TEMP}/index.asc

    # Parse it
    echo ""
    echo "---"
    printf "DIST\tRELEASE\tARCH\tVARIANT\tBUILD\n"
    echo "---"
    while read line; do
        # Basic CSV parser
        OLD_IFS=$IFS
        IFS=";"
        set -- $line
        IFS=$OLD_IFS

        [ -n "$DOWNLOAD_DIST" ] && [ "$1" != "$DOWNLOAD_DIST" ] && continue
        [ -n "$DOWNLOAD_RELEASE" ] && [ "$2" != "$DOWNLOAD_RELEASE" ] && continue
        [ -n "$DOWNLOAD_ARCH" ] && [ "$3" != "$DOWNLOAD_ARCH" ] && continue
        [ -n "$DOWNLOAD_VARIANT" ] && [ "$4" != "$DOWNLOAD_VARIANT" ] && continue
        [ -z "$5" ] || [ -z "$6" ] && continue

        printf "$1\t$2\t$3\t$4\t$5\n"
    done < ${DOWNLOAD_TEMP}/index
    echo "---"

    if [ "$DOWNLOAD_LIST_IMAGES" = "true" ]; then
        exit 1
    fi

    # Interactive mode
    echo ""

    if [ -z "$DOWNLOAD_DIST" ]; then
        echo -n "Distribution: "
        read DOWNLOAD_DIST
    fi

    if [ -z "$DOWNLOAD_RELEASE" ]; then
        echo -n "Release: "
        read DOWNLOAD_RELEASE
    fi

    if [ -z "$DOWNLOAD_ARCH" ]; then
        echo -n "Architecture: "
        read DOWNLOAD_ARCH
    fi

    echo ""
fi

# Setup the cache
if [ "$DOWNLOAD_TARGET" = "system" ]; then
    LXC_CACHE_BASE="$LOCALSTATEDIR/cache/lxc/"
else
    LXC_CACHE_BASE="$HOME/.cache/lxc/"
fi

# Allow the setting of the LXC_CACHE_PATH with the usage of environment variables.
LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LXC_CACHE_BASE"}
LXC_CACHE_PATH=$LXC_CACHE_PATH/download/$DOWNLOAD_DIST
LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH/"
LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_VARIANT"

if [ -d "$LXC_CACHE_PATH" ]; then
    if [ "$DOWNLOAD_FLUSH_CACHE" = "true" ]; then
        echo "Flushing the cache..."
        rm -Rf $LXC_CACHE_PATH
    elif [ "$DOWNLOAD_FORCE_CACHE" = "true" ]; then
        DOWNLOAD_USE_CACHE="true"
    else
        DOWNLOAD_USE_CACHE="true"
        if [ -e "$(relevant_file expiry)" ]; then
            if [ "$(cat $(relevant_file expiry))" -lt $(date +%s) ]; then
                echo "The cached copy has expired, re-downloading..."
                DOWNLOAD_USE_CACHE="false"
            fi
        fi
    fi
fi

# Download what's needed
if [ "$DOWNLOAD_USE_CACHE" = "false" ]; then
    # Initialize GPG
    gpg_setup

    # Grab the index
    DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}

    echo "Downloading the image index"
    if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
         ${DOWNLOAD_TEMP}/index noexit ||
       ! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
            ${DOWNLOAD_TEMP}/index.asc noexit; then
        download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
        download_sig  ${DOWNLOAD_INDEX_PATH}.asc \
            ${DOWNLOAD_TEMP}/index.asc normal
    fi

    gpg_validate ${DOWNLOAD_TEMP}/index.asc

    # Parse it
    while read line; do
        # Basic CSV parser
        OLD_IFS=$IFS
        IFS=";"
        set -- $line
        IFS=$OLD_IFS

        if [ "$1" != "$DOWNLOAD_DIST" ] || \
           [ "$2" != "$DOWNLOAD_RELEASE" ] || \
           [ "$3" != "$DOWNLOAD_ARCH" ] || \
           [ "$4" != "$DOWNLOAD_VARIANT" ] || \
           [ -z "$6" ]; then
            continue
        fi

        DOWNLOAD_BUILD=$5
        DOWNLOAD_URL=$6
        break
    done < ${DOWNLOAD_TEMP}/index

    if [ -z "$DOWNLOAD_URL" ]; then
        echo "ERROR: Couldn't find a matching image." 1>&1
        exit 1
    fi

    if [ -d "$LXC_CACHE_PATH" ] && [ -f "$LXC_CACHE_PATH/build_id" ] && \
       [ "$(cat $LXC_CACHE_PATH/build_id)" = "$DOWNLOAD_BUILD" ]; then
        echo "The cache is already up to date."
        echo "Using image from local cache"
    else
        # Download the actual files
        echo "Downloading the rootfs"
        download_file $DOWNLOAD_URL/rootfs.tar.xz \
            ${DOWNLOAD_TEMP}/rootfs.tar.xz normal
        download_sig  $DOWNLOAD_URL/rootfs.tar.xz.asc \
             ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc normal
        gpg_validate ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc

        echo "Downloading the metadata"
        download_file $DOWNLOAD_URL/meta.tar.xz \
            ${DOWNLOAD_TEMP}/meta.tar.xz normal
        download_sig  $DOWNLOAD_URL/meta.tar.xz.asc \
            ${DOWNLOAD_TEMP}/meta.tar.xz.asc normal
        gpg_validate ${DOWNLOAD_TEMP}/meta.tar.xz.asc

        if [ -d $LXC_CACHE_PATH ]; then
            rm -Rf $LXC_CACHE_PATH
        fi
        mkdir -p $LXC_CACHE_PATH
        mv ${DOWNLOAD_TEMP}/rootfs.tar.xz $LXC_CACHE_PATH
        if ! tar Jxf ${DOWNLOAD_TEMP}/meta.tar.xz -C $LXC_CACHE_PATH; then
            echo "ERROR: Invalid rootfs tarball." 2>&1
            exit 1
        fi

        echo $DOWNLOAD_BUILD > $LXC_CACHE_PATH/build_id

        if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
            chown -R $LXC_MAPPED_UID $LXC_CACHE_BASE >/dev/null 2>&1 || true
        fi
        if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
            chgrp -R $LXC_MAPPED_GID $LXC_CACHE_BASE >/dev/null 2>&1 || true
        fi
        echo "The image cache is now ready"
    fi
else
    echo "Using image from local cache"
fi

# Unpack the rootfs
echo "Unpacking the rootfs"

EXCLUDES=""
excludelist=$(relevant_file excludes)
if [ -f "${excludelist}" ]; then
    while read line; do
        EXCLUDES="$EXCLUDES --exclude=$line"
    done < $excludelist
fi

tar  --anchored ${EXCLUDES} --numeric-owner -xpJf \
    ${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}

mkdir -p ${LXC_ROOTFS}/dev/pts/

# Setup the configuration
configfile=$(relevant_file config)
fstab=$(relevant_file fstab)
if [ ! -e $configfile ]; then
    echo "ERROR: meta tarball is missing the configuration file" 1>&2
    exit 1
fi

## Extract all the network config entries
sed -i -e "/lxc.network/{w ${LXC_PATH}/config-network" -e "d}" \
    ${LXC_PATH}/config

## Extract any other config entry
sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" ${LXC_PATH}/config

## Append the defaults
echo "" >> ${LXC_PATH}/config
echo "# Distribution configuration" >> ${LXC_PATH}/config
cat $configfile >> ${LXC_PATH}/config

## Add the container-specific config
echo "" >> ${LXC_PATH}/config
echo "# Container specific configuration" >> ${LXC_PATH}/config
if [ -e "${LXC_PATH}/config-auto" ]; then
    cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
    rm ${LXC_PATH}/config-auto
fi
if [ -e "$fstab" ]; then
    echo "lxc.mount = ${LXC_PATH}/fstab" >> ${LXC_PATH}/config
fi
echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config

## Re-add the previously removed network config
if [ -e "${LXC_PATH}/config-network" ]; then
    echo "" >> ${LXC_PATH}/config
    echo "# Network configuration" >> ${LXC_PATH}/config
    cat ${LXC_PATH}/config-network >> ${LXC_PATH}/config
    rm ${LXC_PATH}/config-network
fi

TEMPLATE_FILES="${LXC_PATH}/config"

# Setup the fstab
if [ -e $fstab ]; then
    cp ${fstab} ${LXC_PATH}/fstab
    TEMPLATE_FILES="$TEMPLATE_FILES ${LXC_PATH}/fstab"
fi

# Look for extra templates
if [ -e "$(relevant_file templates)" ]; then
    while read line; do
        fullpath=${LXC_ROOTFS}/$line
        [ ! -e "$fullpath" ] && continue
        TEMPLATE_FILES="$TEMPLATE_FILES $fullpath"
    done < $(relevant_file templates)
fi

# Replace variables in all templates
for file in $TEMPLATE_FILES; do
    [ ! -f "$file" ] && continue

    sed -i "s#LXC_NAME#$LXC_NAME#g" $file
    sed -i "s#LXC_PATH#$LXC_PATH#g" $file
    sed -i "s#LXC_ROOTFS#$LXC_ROOTFS#g" $file
    sed -i "s#LXC_TEMPLATE_CONFIG#$LXC_TEMPLATE_CONFIG#g" $file
    sed -i "s#LXC_HOOK_DIR#$LXC_HOOK_DIR#g" $file
done

# prevent mingetty from calling vhangup(2) since it fails with userns on CentOS / Oracle
if [ -f ${LXC_ROOTFS}/etc/init/tty.conf ]; then
    sed -i 's|mingetty|mingetty --nohangup|' ${LXC_ROOTFS}/etc/init/tty.conf
fi

if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
    chown $LXC_MAPPED_UID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 || true
fi
if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
    chgrp $LXC_MAPPED_GID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 || true
fi

if [ -e "$(relevant_file create-message)" ]; then
    echo ""
    echo "---"
    cat "$(relevant_file create-message)"
fi

exit 0
Commit	Line	Data
71d3a659 SG	1	#!/bin/sh
	2
	3	# Client script for LXC container images.
	4	#
	5	# Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
	6	#
	7	# This library is free software; you can redistribute it and/or
	8	# modify it under the terms of the GNU Lesser General Public
	9	# License as published by the Free Software Foundation; either
	10	# version 2.1 of the License, or (at your option) any later version.
	11
	12	# This library is distributed in the hope that it will be useful,
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	# Lesser General Public License for more details.
	16
	17	# You should have received a copy of the GNU Lesser General Public
	18	# License along with this library; if not, write to the Free Software
	19	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
	20	# USA
	21
	22	set -eu
	23
71d3a659	24	LOCALSTATEDIR="@LOCALSTATEDIR@"
f74e080c SG	25	LXC_HOOK_DIR="@LXCHOOKDIR@"
f74e080c SG	26	LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
71d3a659 SG	27
71d3a659 SG	28	# Defaults
71d3a659	29	DOWNLOAD_ARCH=
f74e080c	30	DOWNLOAD_BUILD=
3ab18243	31	DOWNLOAD_COMPAT_LEVEL=4
f74e080c	32	DOWNLOAD_DIST=
71d3a659	33	DOWNLOAD_FLUSH_CACHE="false"
41670b35	34	DOWNLOAD_FORCE_CACHE="false"
f74e080c	35	DOWNLOAD_INTERACTIVE="false"
dd2dbcb9	36	DOWNLOAD_KEYID="0xE7FB0CAEC8173D669066514CBAEFF88C22F6E216"
f74e080c	37	DOWNLOAD_LIST_IMAGES="false"
71d3a659	38	DOWNLOAD_MODE="system"
b0f0932a	39	DOWNLOAD_READY_GPG="false"
f74e080c SG	40	DOWNLOAD_RELEASE=
	41	DOWNLOAD_SERVER="images.linuxcontainers.org"
	42	DOWNLOAD_SHOW_GPG_WARNING="true"
	43	DOWNLOAD_SHOW_HTTP_WARNING="true"
	44	DOWNLOAD_TARGET="system"
	45	DOWNLOAD_URL=
	46	DOWNLOAD_USE_CACHE="false"
	47	DOWNLOAD_VALIDATE="true"
	48	DOWNLOAD_VARIANT="default"
71d3a659	49
f74e080c SG	50	LXC_MAPPED_GID=
f74e080c SG	51	LXC_MAPPED_UID=
71d3a659 SG	52	LXC_NAME=
	53	LXC_PATH=
	54	LXC_ROOTFS=
71d3a659	55
a6a7c7d1 TK	56	if [ -z "${DOWNLOAD_KEYSERVER+x}" ]; then
	57	DOWNLOAD_KEYSERVER="hkp://pool.sks-keyservers.net"
	58
	59	# Deal with GPG over http proxy
	60	if [ -n "${http_proxy:-}" ]; then
	61	DOWNLOAD_KEYSERVER="hkp://p80.pool.sks-keyservers.net:80"
	62	fi
4eb706b3 SG	63	fi
4eb706b3 SG	64
207bf0e4 SG	65	# Make sure the usual locations are in PATH
	66	export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
	67
71d3a659 SG	68	# Some useful functions
	69	cleanup() {
	70	if [ -d "$DOWNLOAD_TEMP" ]; then
	71	rm -Rf $DOWNLOAD_TEMP
	72	fi
	73	}
	74
acabe1fa SG	75	wget_wrapper() {
	76	for i in $(seq 3); do
	77	if wget $@; then
	78	return 0
	79	fi
	80	done
	81
	82	return 1
	83	}
	84
71d3a659	85	download_file() {
acabe1fa SG	86	if ! wget_wrapper -T 30 -q https://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
acabe1fa SG	87	if ! wget_wrapper -T 30 -q http://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
71d3a659 SG	88	if [ "$3" = "noexit" ]; then
	89	return 1
	90	else
fad96766	91	echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
71d3a659 SG	92	exit 1
	93	fi
	94	elif [ "$DOWNLOAD_SHOW_HTTP_WARNING" = "true" ]; then
	95	DOWNLOAD_SHOW_HTTP_WARNING="false"
	96	echo "WARNING: Failed to download the file over HTTPs." 1>&2
	97	echo -n " The file was instead download over HTTP. " 1>&2
	98	echo "A server replay attack may be possible!" 1>&2
	99	fi
	100	fi
	101	}
	102
fad96766	103	download_sig() {
33aa351a SG	104	if ! download_file $1 $2 noexit; then
	105	if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
	106	if [ "$3" = "normal" ]; then
	107	echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
	108	exit 1
	109	else
	110	return 1
	111	fi
	112	else
	113	return 0
	114	fi
fad96766 DE	115	fi
	116	}
	117
71d3a659 SG	118	gpg_setup() {
	119	if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
	120	return
	121	fi
	122
b0f0932a SG	123	if [ "$DOWNLOAD_READY_GPG" = "true" ]; then
	124	return
	125	fi
	126
71d3a659 SG	127	echo "Setting up the GPG keyring"
	128
	129	mkdir -p "$DOWNLOAD_TEMP/gpg"
	130	chmod 700 "$DOWNLOAD_TEMP/gpg"
	131	export GNUPGHOME="$DOWNLOAD_TEMP/gpg"
809a1539 SG	132
	133	success=
	134	for i in $(seq 3); do
	135	if gpg --keyserver $DOWNLOAD_KEYSERVER \
71d3a659	136	--recv-keys ${DOWNLOAD_KEYID} >/dev/null 2>&1; then
809a1539 SG	137	success=1
	138	break
	139	fi
	140	done
	141
	142	if [ -z "$success" ]; then
71d3a659 SG	143	echo "ERROR: Unable to fetch GPG key from keyserver."
	144	exit 1
	145	fi
b0f0932a SG	146
b0f0932a SG	147	DOWNLOAD_READY_GPG="true"
71d3a659 SG	148	}
	149
	150	gpg_validate() {
	151	if [ "$DOWNLOAD_VALIDATE" = "false" ]; then
	152	if [ "$DOWNLOAD_SHOW_GPG_WARNING" = "true" ]; then
	153	echo "WARNING: Running without gpg validation!" 1>&2
	154	fi
	155	DOWNLOAD_SHOW_GPG_WARNING="false"
	156	return 0
	157	fi
	158
	159	if ! gpg --verify $1 >/dev/zero 2>&1; then
	160	echo "ERROR: Invalid signature for $1" 1>&2
	161	exit 1
	162	fi
	163	}
	164
	165	in_userns() {
	166	[ -e /proc/self/uid_map ] \|\| { echo no; return; }
9f15e86a SG	167	while read line; do
	168	fields=$(echo $line \| awk '{ print $1 " " $2 " " $3 }')
	169	[ "$fields" = "0 0 4294967295" ] && { echo no; return; } \|\| true
	170	echo $fields \| grep -q " 0 1$" && { echo userns-root; return; } \|\| true
	171	done < /proc/self/uid_map
a1b6244e	172
f74e080c SG	173	[ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && \
f74e080c SG	174	{ echo userns-root; return; }
71d3a659 SG	175	echo yes
	176	}
	177
	178	relevant_file() {
	179	FILE_PATH="${LXC_CACHE_PATH}/$1"
	180	if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
	181	FILE_PATH="${FILE_PATH}-${DOWNLOAD_MODE}"
	182	fi
	183	if [ -e "$FILE_PATH.${DOWNLOAD_COMPAT_LEVEL}" ]; then
	184	FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
	185	fi
	186
	187	echo $FILE_PATH
	188	}
	189
	190	usage() {
	191	cat <<EOF
	192	LXC container image downloader
	193
7d540a26 MA	194	Special arguments:
	195	[ -h \| --help ]: Print this help message and exit.
	196	[ -l \| --list ]: List all available images and exit.
	197
71d3a659 SG	198	Required arguments:
	199	[ -d \| --dist <distribution> ]: The name of the distribution
	200	[ -r \| --release <release> ]: Release name/version
	201	[ -a \| --arch <architecture> ]: Architecture of the container
71d3a659 SG	202
	203	Optional arguments:
	204	[ --variant <variant> ]: Variant of the image (default: "default")
	205	[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
	206	[ --keyid <keyid> ]: GPG keyid (default: 0x...)
d2e5c5d1	207	[ --keyserver <keyserver> ]: GPG keyserver to use. Environment variable: DOWNLOAD_KEYSERVER
71d3a659 SG	208	[ --no-validate ]: Disable GPG validation (not recommended)
71d3a659 SG	209	[ --flush-cache ]: Flush the local copy (if present)
e145b7bb	210	[ --force-cache ]: Force the use of the local copy even if expired
71d3a659 SG	211
	212	LXC internal arguments (do not pass manually!):
	213	[ --name <name> ]: The container name
	214	[ --path <path> ]: The path to the container
	215	[ --rootfs <rootfs> ]: The path to the container's rootfs
2133f58c SH	216	[ --mapped-uid <map> ]: A uid map (user namespaces)
2133f58c SH	217	[ --mapped-gid <map> ]: A gid map (user namespaces)
d2e5c5d1 TK	218
	219	Environment Variables:
	220	DOWNLOAD_KEYSERVER : The URL of the key server to use, instead of the default.
	221	Can be further overridden by using optional argument --keyserver
	222
71d3a659 SG	223	EOF
	224	return 0
	225	}
	226
10a5fab6	227	options=$(getopt -o d:r:a:hl -l dist:,release:,arch:,help,list,variant:,\
3cd988cc	228	server:,keyid:,keyserver:,no-validate,flush-cache,force-cache,name:,path:,\
2133f58c	229	rootfs:,mapped-uid:,mapped-gid: -- "$@")
71d3a659 SG	230
	231	if [ $? -ne 0 ]; then
	232	usage
	233	exit 1
	234	fi
	235	eval set -- "$options"
	236
	237	while :; do
	238	case "$1" in
10a5fab6 SG	239	-h\|--help) usage && exit 1;;
10a5fab6 SG	240	-l\|--list) DOWNLOAD_LIST_IMAGES="true"; shift 1;;
71d3a659 SG	241	-d\|--dist) DOWNLOAD_DIST=$2; shift 2;;
	242	-r\|--release) DOWNLOAD_RELEASE=$2; shift 2;;
	243	-a\|--arch) DOWNLOAD_ARCH=$2; shift 2;;
	244	--variant) DOWNLOAD_VARIANT=$2; shift 2;;
	245	--server) DOWNLOAD_SERVER=$2; shift 2;;
	246	--keyid) DOWNLOAD_KEYID=$2; shift 2;;
3cd988cc	247	--keyserver) DOWNLOAD_KEYSERVER=$2; shift 2;;
71d3a659 SG	248	--no-validate) DOWNLOAD_VALIDATE="false"; shift 1;;
71d3a659 SG	249	--flush-cache) DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
9accc2ef	250	--force-cache) DOWNLOAD_FORCE_CACHE="true"; shift 1;;
71d3a659 SG	251	--name) LXC_NAME=$2; shift 2;;
	252	--path) LXC_PATH=$2; shift 2;;
	253	--rootfs) LXC_ROOTFS=$2; shift 2;;
	254	--mapped-uid) LXC_MAPPED_UID=$2; shift 2;;
2133f58c	255	--mapped-gid) LXC_MAPPED_GID=$2; shift 2;;
71d3a659 SG	256	*) break;;
	257	esac
	258	done
	259
	260	# Check for required binaries
	261	for bin in tar xz wget; do
	262	if ! type $bin >/dev/null 2>&1; then
	263	echo "ERROR: Missing required tool: $bin" 1>&2
	264	exit 1
	265	fi
	266	done
	267
	268	# Check for GPG
	269	if [ "$DOWNLOAD_VALIDATE" = "true" ]; then
	270	if ! type gpg >/dev/null 2>&1; then
	271	echo "ERROR: Missing recommended tool: gpg" 1>&2
	272	echo "You can workaround this by using --no-validate." 1>&2
	273	exit 1
	274	fi
	275	fi
	276
	277	# Check that we have all variables we need
	278	if [ -z "$LXC_NAME" ] \|\| [ -z "$LXC_PATH" ] \|\| [ -z "$LXC_ROOTFS" ]; then
308f4f39 MA	279	if [ "$DOWNLOAD_LIST_IMAGES" != "true" ]; then
	280	echo "ERROR: Not running through LXC." 1>&2
	281	exit 1
	282	fi
71d3a659 SG	283	fi
71d3a659 SG	284
f74e080c SG	285	USERNS=$(in_userns)
	286
	287	if [ "$USERNS" != "no" ]; then
	288	if [ "$USERNS" = "yes" ]; then
	289	if [ -z "$LXC_MAPPED_UID" ] \|\| [ "$LXC_MAPPED_UID" = "-1" ]; then
	290	echo "ERROR: In a user namespace without a map." 1>&2
	291	exit 1
	292	fi
	293	DOWNLOAD_MODE="user"
	294	DOWNLOAD_TARGET="user"
	295	else
	296	DOWNLOAD_MODE="user"
	297	DOWNLOAD_TARGET="system"
71d3a659	298	fi
71d3a659 SG	299	fi
71d3a659 SG	300
b0f0932a SG	301	if [ -z "$DOWNLOAD_DIST" ] \|\| [ -z "$DOWNLOAD_RELEASE" ] \|\| \
	302	[ -z "$DOWNLOAD_ARCH" ]; then
	303	DOWNLOAD_INTERACTIVE="true"
71d3a659 SG	304	fi
	305
	306	# Trap all exit signals
	307	trap cleanup EXIT HUP INT TERM
843a5874 SG	308
	309	if ! type mktemp >/dev/null 2>&1; then
	310	DOWNLOAD_TEMP=/tmp/lxc-download.$$
	311	mkdir -p $DOWNLOAD_TEMP
	312	else
	313	DOWNLOAD_TEMP=$(mktemp -d)
	314	fi
71d3a659	315
10a5fab6	316	# Simply list images
b0f0932a SG	317	if [ "$DOWNLOAD_LIST_IMAGES" = "true" ] \|\| \
b0f0932a SG	318	[ "$DOWNLOAD_INTERACTIVE" = "true" ]; then
10a5fab6 SG	319	# Initialize GPG
	320	gpg_setup
	321
	322	# Grab the index
	323	DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}
	324
	325	echo "Downloading the image index"
	326	if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
	327	${DOWNLOAD_TEMP}/index noexit \|\|
	328	! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
	329	${DOWNLOAD_TEMP}/index.asc noexit; then
	330	download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
	331	download_sig ${DOWNLOAD_INDEX_PATH}.asc \
	332	${DOWNLOAD_TEMP}/index.asc normal
	333	fi
	334
	335	gpg_validate ${DOWNLOAD_TEMP}/index.asc
	336
	337	# Parse it
	338	echo ""
	339	echo "---"
96283b54	340	printf "DIST\tRELEASE\tARCH\tVARIANT\tBUILD\n"
10a5fab6 SG	341	echo "---"
	342	while read line; do
	343	# Basic CSV parser
	344	OLD_IFS=$IFS
	345	IFS=";"
	346	set -- $line
	347	IFS=$OLD_IFS
	348
	349	[ -n "$DOWNLOAD_DIST" ] && [ "$1" != "$DOWNLOAD_DIST" ] && continue
	350	[ -n "$DOWNLOAD_RELEASE" ] && [ "$2" != "$DOWNLOAD_RELEASE" ] && continue
	351	[ -n "$DOWNLOAD_ARCH" ] && [ "$3" != "$DOWNLOAD_ARCH" ] && continue
	352	[ -n "$DOWNLOAD_VARIANT" ] && [ "$4" != "$DOWNLOAD_VARIANT" ] && continue
	353	[ -z "$5" ] \|\| [ -z "$6" ] && continue
	354
96283b54	355	printf "$1\t$2\t$3\t$4\t$5\n"
10a5fab6 SG	356	done < ${DOWNLOAD_TEMP}/index
	357	echo "---"
	358
b0f0932a SG	359	if [ "$DOWNLOAD_LIST_IMAGES" = "true" ]; then
	360	exit 1
	361	fi
	362
	363	# Interactive mode
	364	echo ""
	365
	366	if [ -z "$DOWNLOAD_DIST" ]; then
	367	echo -n "Distribution: "
	368	read DOWNLOAD_DIST
	369	fi
	370
	371	if [ -z "$DOWNLOAD_RELEASE" ]; then
	372	echo -n "Release: "
	373	read DOWNLOAD_RELEASE
	374	fi
	375
	376	if [ -z "$DOWNLOAD_ARCH" ]; then
	377	echo -n "Architecture: "
	378	read DOWNLOAD_ARCH
	379	fi
	380
	381	echo ""
10a5fab6 SG	382	fi
10a5fab6 SG	383
71d3a659	384	# Setup the cache
f74e080c	385	if [ "$DOWNLOAD_TARGET" = "system" ]; then
b56661fe	386	LXC_CACHE_BASE="$LOCALSTATEDIR/cache/lxc/"
71d3a659 SG	387	else
71d3a659 SG	388	LXC_CACHE_BASE="$HOME/.cache/lxc/"
71d3a659 SG	389	fi
71d3a659 SG	390
6dc6f80b KC	391	# Allow the setting of the LXC_CACHE_PATH with the usage of environment variables.
	392	LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LXC_CACHE_BASE"}
	393	LXC_CACHE_PATH=$LXC_CACHE_PATH/download/$DOWNLOAD_DIST
b56661fe SG	394	LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH/"
	395	LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_VARIANT"
	396
71d3a659 SG	397	if [ -d "$LXC_CACHE_PATH" ]; then
	398	if [ "$DOWNLOAD_FLUSH_CACHE" = "true" ]; then
	399	echo "Flushing the cache..."
	400	rm -Rf $LXC_CACHE_PATH
9accc2ef SG	401	elif [ "$DOWNLOAD_FORCE_CACHE" = "true" ]; then
9accc2ef SG	402	DOWNLOAD_USE_CACHE="true"
71d3a659 SG	403	else
	404	DOWNLOAD_USE_CACHE="true"
	405	if [ -e "$(relevant_file expiry)" ]; then
	406	if [ "$(cat $(relevant_file expiry))" -lt $(date +%s) ]; then
	407	echo "The cached copy has expired, re-downloading..."
	408	DOWNLOAD_USE_CACHE="false"
71d3a659 SG	409	fi
	410	fi
	411	fi
	412	fi
	413
	414	# Download what's needed
	415	if [ "$DOWNLOAD_USE_CACHE" = "false" ]; then
	416	# Initialize GPG
	417	gpg_setup
	418
	419	# Grab the index
	420	DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}
	421
	422	echo "Downloading the image index"
	423	if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
	424	${DOWNLOAD_TEMP}/index noexit \|\|
33aa351a	425	! download_sig ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
71d3a659 SG	426	${DOWNLOAD_TEMP}/index.asc noexit; then
71d3a659 SG	427	download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
fad96766	428	download_sig ${DOWNLOAD_INDEX_PATH}.asc \
33aa351a	429	${DOWNLOAD_TEMP}/index.asc normal
71d3a659 SG	430	fi
	431
	432	gpg_validate ${DOWNLOAD_TEMP}/index.asc
	433
	434	# Parse it
	435	while read line; do
	436	# Basic CSV parser
	437	OLD_IFS=$IFS
	438	IFS=";"
	439	set -- $line
	440	IFS=$OLD_IFS
	441
	442	if [ "$1" != "$DOWNLOAD_DIST" ] \|\| \
	443	[ "$2" != "$DOWNLOAD_RELEASE" ] \|\| \
	444	[ "$3" != "$DOWNLOAD_ARCH" ] \|\| \
	445	[ "$4" != "$DOWNLOAD_VARIANT" ] \|\| \
	446	[ -z "$6" ]; then
	447	continue
	448	fi
	449
9accc2ef	450	DOWNLOAD_BUILD=$5
71d3a659 SG	451	DOWNLOAD_URL=$6
	452	break
	453	done < ${DOWNLOAD_TEMP}/index
	454
	455	if [ -z "$DOWNLOAD_URL" ]; then
	456	echo "ERROR: Couldn't find a matching image." 1>&1
	457	exit 1
	458	fi
	459
9accc2ef SG	460	if [ -d "$LXC_CACHE_PATH" ] && [ -f "$LXC_CACHE_PATH/build_id" ] && \
	461	[ "$(cat $LXC_CACHE_PATH/build_id)" = "$DOWNLOAD_BUILD" ]; then
	462	echo "The cache is already up to date."
	463	echo "Using image from local cache"
	464	else
	465	# Download the actual files
	466	echo "Downloading the rootfs"
	467	download_file $DOWNLOAD_URL/rootfs.tar.xz \
	468	${DOWNLOAD_TEMP}/rootfs.tar.xz normal
	469	download_sig $DOWNLOAD_URL/rootfs.tar.xz.asc \
	470	${DOWNLOAD_TEMP}/rootfs.tar.xz.asc normal
	471	gpg_validate ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc
	472
	473	echo "Downloading the metadata"
	474	download_file $DOWNLOAD_URL/meta.tar.xz \
	475	${DOWNLOAD_TEMP}/meta.tar.xz normal
	476	download_sig $DOWNLOAD_URL/meta.tar.xz.asc \
	477	${DOWNLOAD_TEMP}/meta.tar.xz.asc normal
	478	gpg_validate ${DOWNLOAD_TEMP}/meta.tar.xz.asc
	479
	480	if [ -d $LXC_CACHE_PATH ]; then
	481	rm -Rf $LXC_CACHE_PATH
	482	fi
	483	mkdir -p $LXC_CACHE_PATH
	484	mv ${DOWNLOAD_TEMP}/rootfs.tar.xz $LXC_CACHE_PATH
	485	if ! tar Jxf ${DOWNLOAD_TEMP}/meta.tar.xz -C $LXC_CACHE_PATH; then
	486	echo "ERROR: Invalid rootfs tarball." 2>&1
	487	exit 1
	488	fi
71d3a659	489
9accc2ef SG	490	echo $DOWNLOAD_BUILD > $LXC_CACHE_PATH/build_id
	491
	492	if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
0d656b05	493	chown -R $LXC_MAPPED_UID $LXC_CACHE_BASE >/dev/null 2>&1 \|\| true
9accc2ef	494	fi
2133f58c SH	495	if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
	496	chgrp -R $LXC_MAPPED_GID $LXC_CACHE_BASE >/dev/null 2>&1 \|\| true
	497	fi
9accc2ef	498	echo "The image cache is now ready"
71d3a659	499	fi
71d3a659 SG	500	else
	501	echo "Using image from local cache"
	502	fi
	503
	504	# Unpack the rootfs
	505	echo "Unpacking the rootfs"
fecf101c SG	506
	507	EXCLUDES=""
	508	excludelist=$(relevant_file excludes)
	509	if [ -f "${excludelist}" ]; then
	510	while read line; do
	511	EXCLUDES="$EXCLUDES --exclude=$line"
	512	done < $excludelist
71d3a659 SG	513	fi
71d3a659 SG	514
fecf101c SG	515	tar --anchored ${EXCLUDES} --numeric-owner -xpJf \
	516	${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}
	517
	518	mkdir -p ${LXC_ROOTFS}/dev/pts/
	519
71d3a659 SG	520	# Setup the configuration
	521	configfile=$(relevant_file config)
	522	fstab=$(relevant_file fstab)
	523	if [ ! -e $configfile ]; then
	524	echo "ERROR: meta tarball is missing the configuration file" 1>&2
	525	exit 1
	526	fi
	527
	528	## Extract all the network config entries
	529	sed -i -e "/lxc.network/{w ${LXC_PATH}/config-network" -e "d}" \
	530	${LXC_PATH}/config
	531
	532	## Extract any other config entry
	533	sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" ${LXC_PATH}/config
	534
	535	## Append the defaults
	536	echo "" >> ${LXC_PATH}/config
	537	echo "# Distribution configuration" >> ${LXC_PATH}/config
	538	cat $configfile >> ${LXC_PATH}/config
	539
	540	## Add the container-specific config
	541	echo "" >> ${LXC_PATH}/config
	542	echo "# Container specific configuration" >> ${LXC_PATH}/config
	543	if [ -e "${LXC_PATH}/config-auto" ]; then
	544	cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
	545	rm ${LXC_PATH}/config-auto
	546	fi
	547	if [ -e "$fstab" ]; then
	548	echo "lxc.mount = ${LXC_PATH}/fstab" >> ${LXC_PATH}/config
	549	fi
	550	echo "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config
	551
	552	## Re-add the previously removed network config
	553	if [ -e "${LXC_PATH}/config-network" ]; then
	554	echo "" >> ${LXC_PATH}/config
	555	echo "# Network configuration" >> ${LXC_PATH}/config
	556	cat ${LXC_PATH}/config-network >> ${LXC_PATH}/config
	557	rm ${LXC_PATH}/config-network
	558	fi
	559
	560	TEMPLATE_FILES="${LXC_PATH}/config"
	561
	562	# Setup the fstab
	563	if [ -e $fstab ]; then
	564	cp ${fstab} ${LXC_PATH}/fstab
	565	TEMPLATE_FILES="$TEMPLATE_FILES ${LXC_PATH}/fstab"
	566	fi
	567
	568	# Look for extra templates
	569	if [ -e "$(relevant_file templates)" ]; then
	570	while read line; do
	571	fullpath=${LXC_ROOTFS}/$line
	572	[ ! -e "$fullpath" ] && continue
	573	TEMPLATE_FILES="$TEMPLATE_FILES $fullpath"
	574	done < $(relevant_file templates)
	575	fi
	576
	577	# Replace variables in all templates
	578	for file in $TEMPLATE_FILES; do
fad96766	579	[ ! -f "$file" ] && continue
71d3a659 SG	580
	581	sed -i "s#LXC_NAME#$LXC_NAME#g" $file
	582	sed -i "s#LXC_PATH#$LXC_PATH#g" $file
	583	sed -i "s#LXC_ROOTFS#$LXC_ROOTFS#g" $file
	584	sed -i "s#LXC_TEMPLATE_CONFIG#$LXC_TEMPLATE_CONFIG#g" $file
	585	sed -i "s#LXC_HOOK_DIR#$LXC_HOOK_DIR#g" $file
	586	done
	587
491a01cf	588	# prevent mingetty from calling vhangup(2) since it fails with userns on CentOS / Oracle
6e53ca56 SC	589	if [ -f ${LXC_ROOTFS}/etc/init/tty.conf ]; then
	590	sed -i 's\|mingetty\|mingetty --nohangup\|' ${LXC_ROOTFS}/etc/init/tty.conf
	591	fi
	592
71d3a659	593	if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
0d656b05	594	chown $LXC_MAPPED_UID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 \|\| true
71d3a659	595	fi
2133f58c SH	596	if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
	597	chgrp $LXC_MAPPED_GID $LXC_PATH/config $LXC_PATH/fstab >/dev/null 2>&1 \|\| true
	598	fi
71d3a659 SG	599
	600	if [ -e "$(relevant_file create-message)" ]; then
	601	echo ""
	602	echo "---"
	603	cat "$(relevant_file create-message)"
	604	fi
	605
	606	exit 0