]>
Commit | Line | Data |
---|---|---|
d1458ac8 SH |
1 | #!/bin/bash |
2 | ||
3eecde70 | 3 | # template script for generating ubuntu container for LXC based on released cloud |
d1458ac8 SH |
4 | # images |
5 | # | |
6 | # Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com> | |
7 | # | |
8 | # This program is free software; you can redistribute it and/or modify | |
9 | # it under the terms of the GNU General Public License version 2, as | |
10 | # published by the Free Software Foundation. | |
11 | ||
12 | # This program is distributed in the hope that it will be useful, | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | # GNU General Public License for more details. | |
16 | ||
17 | # You should have received a copy of the GNU General Public License along | |
18 | # with this program; if not, write to the Free Software Foundation, Inc., | |
19 | # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
20 | # | |
21 | ||
22 | set -e | |
23 | ||
24 | if [ -r /etc/default/lxc ]; then | |
25 | . /etc/default/lxc | |
26 | fi | |
27 | ||
28 | copy_configuration() | |
29 | { | |
30 | path=$1 | |
31 | rootfs=$2 | |
32 | name=$3 | |
33 | arch=$4 | |
42ff5f0f | 34 | release=$5 |
d1458ac8 SH |
35 | |
36 | if [ $arch = "i386" ]; then | |
37 | arch="i686" | |
38 | fi | |
39 | ||
4759162d SH |
40 | # if there is exactly one veth network entry, make sure it has an |
41 | # associated hwaddr. | |
42 | nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l` | |
43 | if [ $nics -eq 1 ]; then | |
44 | grep -q "^lxc.network.hwaddr" $path/config || cat <<EOF >> $path/config | |
b08ee0ce | 45 | lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//') |
4759162d SH |
46 | EOF |
47 | fi | |
48 | ||
d1458ac8 SH |
49 | cat <<EOF >> $path/config |
50 | lxc.utsname = $name | |
51 | ||
52 | lxc.tty = 4 | |
53 | lxc.pts = 1024 | |
54 | lxc.rootfs = $rootfs | |
55 | lxc.mount = $path/fstab | |
56 | lxc.arch = $arch | |
57 | lxc.cap.drop = sys_module mac_admin | |
58 | ||
59 | lxc.cgroup.devices.deny = a | |
60 | # Allow any mknod (but not using the node) | |
61 | lxc.cgroup.devices.allow = c *:* m | |
62 | lxc.cgroup.devices.allow = b *:* m | |
63 | # /dev/null and zero | |
64 | lxc.cgroup.devices.allow = c 1:3 rwm | |
65 | lxc.cgroup.devices.allow = c 1:5 rwm | |
66 | # consoles | |
67 | lxc.cgroup.devices.allow = c 5:1 rwm | |
68 | lxc.cgroup.devices.allow = c 5:0 rwm | |
69 | #lxc.cgroup.devices.allow = c 4:0 rwm | |
70 | #lxc.cgroup.devices.allow = c 4:1 rwm | |
71 | # /dev/{,u}random | |
72 | lxc.cgroup.devices.allow = c 1:9 rwm | |
73 | lxc.cgroup.devices.allow = c 1:8 rwm | |
74 | lxc.cgroup.devices.allow = c 136:* rwm | |
75 | lxc.cgroup.devices.allow = c 5:2 rwm | |
76 | # rtc | |
77 | lxc.cgroup.devices.allow = c 254:0 rwm | |
78 | #fuse | |
79 | lxc.cgroup.devices.allow = c 10:229 rwm | |
80 | #tun | |
81 | lxc.cgroup.devices.allow = c 10:200 rwm | |
82 | #full | |
83 | lxc.cgroup.devices.allow = c 1:7 rwm | |
84 | #hpet | |
85 | lxc.cgroup.devices.allow = c 10:228 rwm | |
86 | #kvm | |
87 | lxc.cgroup.devices.allow = c 10:232 rwm | |
88 | EOF | |
89 | ||
90 | cat <<EOF > $path/fstab | |
80a881b2 SH |
91 | proc proc proc nodev,noexec,nosuid 0 0 |
92 | sysfs sys sysfs defaults 0 0 | |
d1458ac8 SH |
93 | EOF |
94 | ||
b8bced69 | 95 | # rmdir /dev/shm in precise and quantal containers. |
42ff5f0f SH |
96 | # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did |
97 | # get bind mounted to the host's /run/shm. So try to rmdir | |
98 | # it, and in case that fails move it out of the way. | |
b8bced69 | 99 | if [ $release = "precise" ] || [ $release = "quantal" ]; then |
42ff5f0f SH |
100 | [ -d "$rootfs/dev/shm" ] && rmdir $rootfs/dev/shm |
101 | [ -e "$rootfs/dev/shm" ] && mv $rootfs/dev/shm $rootfs/dev/shm.bak | |
102 | ln -s /run/shm $rootfs/dev/shm | |
103 | fi | |
104 | ||
d1458ac8 SH |
105 | return 0 |
106 | } | |
107 | ||
108 | usage() | |
109 | { | |
110 | cat <<EOF | |
4759162d SH |
111 | LXC Container configuration for Ubuntu Cloud images. |
112 | ||
113 | Generic Options | |
114 | [ -r | --release <release> ]: Release name of container, defaults to host | |
115 | [ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture | |
116 | [ -C | --cloud ]: Configure container for use with meta-data service, defaults to no | |
117 | [ -T | --tarball ]: Location of tarball | |
52c8f624 | 118 | [ -d | --debug ]: Run with 'set -x' to debug errors |
427bffc7 | 119 | [ -s | --stream]: Use specified stream rather than 'released' |
4759162d SH |
120 | |
121 | Options, mutually exclusive of "-C" and "--cloud": | |
122 | [ -i | --hostid ]: HostID for cloud-init, defaults to random string | |
123 | [ -u | --userdata ]: Cloud-init user-data file to configure container on start | |
52c8f624 | 124 | [ -S | --auth-key ]: SSH Public key file to inject into container |
4759162d SH |
125 | [ -L | --nolocales ]: Do not copy host's locales into container |
126 | ||
d1458ac8 SH |
127 | EOF |
128 | return 0 | |
129 | } | |
130 | ||
5a0f7f3c | 131 | options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds: -l arch:,help,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata: -- "$@") |
d1458ac8 SH |
132 | if [ $? -ne 0 ]; then |
133 | usage $(basename $0) | |
134 | exit 1 | |
135 | fi | |
136 | eval set -- "$options" | |
137 | ||
138 | release=lucid | |
139 | if [ -f /etc/lsb-release ]; then | |
140 | . /etc/lsb-release | |
141 | case "$DISTRIB_CODENAME" in | |
f34ff296 | 142 | lucid|natty|oneiric|precise|quantal) |
d1458ac8 SH |
143 | release=$DISTRIB_CODENAME |
144 | ;; | |
145 | esac | |
146 | fi | |
147 | ||
148 | arch=$(arch) | |
149 | ||
150 | # Code taken from debootstrap | |
151 | if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then | |
152 | arch=`/usr/bin/dpkg --print-architecture` | |
153 | elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then | |
154 | arch=`/usr/bin/udpkg --print-architecture` | |
155 | else | |
156 | arch=$(arch) | |
157 | if [ "$arch" = "i686" ]; then | |
158 | arch="i386" | |
159 | elif [ "$arch" = "x86_64" ]; then | |
160 | arch="amd64" | |
161 | elif [ "$arch" = "armv7l" ]; then | |
3eecde70 | 162 | # note: arm images don't exist before oneiric; are called armhf in |
b8bced69 | 163 | # precise and later; and are not supported by the query, so we don't actually |
3eecde70 SH |
164 | # support them yet (see check later on). When Query2 is available, |
165 | # we'll use that to enable arm images. | |
d1458ac8 SH |
166 | arch="armel" |
167 | fi | |
168 | fi | |
169 | ||
52c8f624 | 170 | debug=0 |
d1458ac8 SH |
171 | hostarch=$arch |
172 | cloud=0 | |
4759162d | 173 | locales=1 |
d1458ac8 | 174 | flushcache=0 |
427bffc7 | 175 | stream="released" |
d1458ac8 SH |
176 | while true |
177 | do | |
178 | case "$1" in | |
4759162d SH |
179 | -h|--help) usage $0 && exit 0;; |
180 | -p|--path) path=$2; shift 2;; | |
181 | -n|--name) name=$2; shift 2;; | |
182 | -F|--flush-cache) flushcache=1; shift 1;; | |
183 | -r|--release) release=$2; shift 2;; | |
184 | -a|--arch) arch=$2; shift 2;; | |
185 | -i|--hostid) host_id=$2; shift 2;; | |
186 | -u|--userdata) userdata=$2; shift 2;; | |
187 | -C|--cloud) cloud=1; shift 1;; | |
52c8f624 | 188 | -S|--auth-key) auth_key=$2; shift 2;; |
4759162d SH |
189 | -L|--no_locales) locales=0; shift 2;; |
190 | -T|--tarball) tarball=$2; shift 2;; | |
52c8f624 | 191 | -d|--debug) debug=1; shift 1;; |
427bffc7 | 192 | -s|--stream) stream=$2; shift 2;; |
4759162d | 193 | --) shift 1; break ;; |
d1458ac8 SH |
194 | *) break ;; |
195 | esac | |
196 | done | |
197 | ||
3eecde70 | 198 | if [ $debug -eq 1 ]; then |
52c8f624 SH |
199 | set -x |
200 | fi | |
201 | ||
d1458ac8 SH |
202 | if [ "$arch" == "i686" ]; then |
203 | arch=i386 | |
204 | fi | |
205 | ||
206 | if [ $hostarch = "i386" -a $arch = "amd64" ]; then | |
207 | echo "can't create amd64 container on i386" | |
208 | exit 1 | |
209 | fi | |
210 | ||
211 | if [ $arch != "i386" -a $arch != "amd64" ]; then | |
212 | echo "Only i386 and amd64 are supported by the ubuntu cloud template." | |
213 | exit 1 | |
214 | fi | |
215 | ||
427bffc7 SH |
216 | if [ "$stream" != "daily" -a "$stream" != "released" ]; then |
217 | echo "Only 'daily' and 'released' streams are supported" | |
218 | exit 1 | |
219 | fi | |
220 | ||
5a0f7f3c SH |
221 | if [ -n "$userdata" -a ! -f "$userdata" ]; then |
222 | echo "Userdata does not exist" | |
223 | exit 1 | |
224 | fi | |
225 | ||
d1458ac8 SH |
226 | if [ -z "$path" ]; then |
227 | echo "'path' parameter is required" | |
228 | exit 1 | |
229 | fi | |
230 | ||
231 | if [ "$(id -u)" != "0" ]; then | |
232 | echo "This script should be run as 'root'" | |
233 | exit 1 | |
234 | fi | |
235 | ||
236 | rootfs=$path/rootfs | |
237 | ||
238 | type ubuntu-cloudimg-query | |
239 | type wget | |
240 | ||
241 | # determine the url, tarball, and directory names | |
242 | # download if needed | |
243 | cache="/var/cache/lxc/cloud-$release" | |
244 | ||
245 | mkdir -p $cache | |
246 | ||
4759162d SH |
247 | if [ -n "$tarball" ]; then |
248 | url2="$tarball" | |
249 | else | |
427bffc7 | 250 | url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"` |
4759162d SH |
251 | url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/'` |
252 | fi | |
253 | ||
d1458ac8 SH |
254 | filename=`basename $url2` |
255 | ||
3eecde70 SH |
256 | buildcleanup() |
257 | { | |
258 | cd $rootfs | |
259 | umount -l $cache/$xdir || true | |
260 | rm -rf $cache | |
261 | } | |
262 | ||
263 | # if the release doesn't have a *-rootfs.tar.gz, then create one from the | |
264 | # cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating | |
265 | # a tarball from the mounted image. | |
266 | build_root_tgz() | |
267 | { | |
268 | url=$1 | |
269 | filename=$2 | |
270 | ||
271 | xdir=`mktemp -d -p .` | |
272 | tarname=`basename $url` | |
edd3810e | 273 | imgname="$release-*-cloudimg-$arch.img" |
3eecde70 SH |
274 | trap buildcleanup EXIT |
275 | if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then | |
276 | rm -f $tarname | |
277 | echo "Downloading cloud image from $url" | |
278 | wget $url || { echo "Couldn't find cloud image $url."; exit 1; } | |
279 | fi | |
280 | echo "Creating new cached cloud image rootfs" | |
edd3810e | 281 | tar --wildcards -zxf $tarname $imgname |
3eecde70 SH |
282 | mount -o loop $imgname $xdir |
283 | (cd $xdir; tar zcf ../$filename .) | |
284 | umount $xdir | |
285 | rm -f $tarname $imgname | |
286 | rmdir $xdir | |
287 | echo "New cloud image cache created" | |
288 | trap EXIT | |
289 | } | |
290 | ||
d1458ac8 SH |
291 | mkdir -p /var/lock/subsys/ |
292 | ( | |
add1d118 | 293 | flock -x 200 |
d1458ac8 SH |
294 | |
295 | cd $cache | |
296 | if [ $flushcache -eq 1 ]; then | |
297 | echo "Clearing the cached images" | |
298 | rm -f $filename | |
299 | fi | |
300 | ||
301 | if [ ! -f $filename ]; then | |
3eecde70 | 302 | wget $url2 || build_root_tgz $url1 $filename |
d1458ac8 SH |
303 | fi |
304 | ||
3eecde70 | 305 | echo "Extracting container rootfs" |
d1458ac8 SH |
306 | mkdir -p $rootfs |
307 | cd $rootfs | |
308 | tar -zxf $cache/$filename | |
309 | ||
310 | ||
311 | if [ $cloud -eq 0 ]; then | |
312 | echo "Configuring for running outside of a cloud environment" | |
313 | echo "If you want to configure for a cloud evironment, please use '-- -C' to create the container" | |
314 | ||
315 | seed_d=$rootfs/var/lib/cloud/seed/nocloud-net | |
316 | rhostid=$(uuidgen | cut -c -8) | |
4759162d SH |
317 | host_id=${hostid:-$rhostid} |
318 | mkdir -p $seed_d | |
d1458ac8 SH |
319 | |
320 | cat > "$seed_d/meta-data" <<EOF | |
321 | instance_id: lxc-$host_id | |
322 | EOF | |
323 | ||
4759162d SH |
324 | rm $rootfs/etc/hostname |
325 | ||
326 | if [ $locales -eq 1 ]; then | |
327 | cp /usr/lib/locale/locale-archive $rootfs/usr/lib/locale/locale-archive | |
328 | fi | |
329 | ||
330 | ||
331 | if [ -n "$auth_key" -a -f "$auth_key" ]; then | |
332 | u_path="/home/ubuntu/.ssh" | |
333 | root_u_path="$rootfs/$u_path" | |
334 | mkdir -p $root_u_path | |
335 | cp $auth_key "$root_u_path/authorized_keys" | |
336 | chroot $rootfs chown -R ubuntu: "$u_path" | |
337 | ||
338 | echo "Inserted SSH public key from $auth_key into /home/ubuntu/.ssh/authorized_keys" | |
339 | fi | |
340 | ||
5a0f7f3c SH |
341 | if [ -f "$userdata" ]; then |
342 | echo "Using custom user-data" | |
343 | cp $userdata $seed_d/user-data | |
d1458ac8 | 344 | else |
4759162d | 345 | |
d1458ac8 SH |
346 | if [ -z "$MIRROR" ]; then |
347 | MIRROR="http://archive.ubuntu.com/ubuntu" | |
348 | fi | |
4759162d SH |
349 | |
350 | cat > "$seed_d/user-data" <<EOF | |
351 | #cloud-config | |
352 | output: {all: '| tee -a /var/log/cloud-init-output.log'} | |
353 | apt-mirror: $MIRROR | |
354 | manage_etc_hosts: localhost | |
355 | locale: $(/usr/bin/locale | awk -F= '/LANG=/ {print$NF}') | |
356 | EOF | |
d1458ac8 SH |
357 | fi |
358 | ||
359 | chroot $rootfs /usr/sbin/usermod -U ubuntu | |
3eecde70 | 360 | echo "ubuntu:ubuntu" | chroot $rootfs chpasswd |
d1458ac8 SH |
361 | echo "Please login as user ubuntu with password ubuntu." |
362 | ||
363 | else | |
364 | ||
365 | echo "Configured for running in a cloud environment." | |
366 | echo "If you do not have a meta-data service, this container will likely be useless." | |
367 | ||
368 | fi | |
369 | ||
370 | ) 200>/var/lock/subsys/lxc-ubucloud | |
371 | ||
42ff5f0f | 372 | copy_configuration $path $rootfs $name $arch $release |
d1458ac8 SH |
373 | |
374 | echo "Container $name created." | |
375 | exit 0 |