]>
git.proxmox.com Git - pve-container.git/blob - src/PVE/CLI/pct.pm
11 use PVE
::Tools
qw(extract_param);
14 use PVE
::RPCEnvironment
;
15 use PVE
::JSONSchema
qw(get_standard_option);
18 use PVE
::API2
::LXC
::Config
;
19 use PVE
::API2
::LXC
::Status
;
20 use PVE
::API2
::LXC
::Snapshot
;
24 use base
qw(PVE::CLIHandler);
26 my $nodename = PVE
::INotify
::nodename
();
30 my $status = PVE
::Tools
::upid_read_status
($upid);
31 exit($status eq 'OK' ?
0 : -1);
34 __PACKAGE__-
>register_method ({
38 description
=> "Unlock the VM.",
40 additionalProperties
=> 0,
42 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid
}),
45 returns
=> { type
=> 'null'},
49 my $vmid = $param->{vmid
};
51 PVE
::LXC
::Config-
>remove_lock($vmid);
56 __PACKAGE__-
>register_method ({
60 description
=> "Launch a console for the specified container.",
62 additionalProperties
=> 0,
64 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid_running
}),
67 returns
=> { type
=> 'null' },
72 # test if container exists on this node
73 my $conf = PVE
::LXC
::Config-
>load_config($param->{vmid
});
75 my $cmd = PVE
::LXC
::get_console_command
($param->{vmid
}, $conf);
79 __PACKAGE__-
>register_method ({
83 description
=> "Launch a shell for the specified container.",
85 additionalProperties
=> 0,
87 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid_running
}),
90 returns
=> { type
=> 'null' },
95 my $vmid = $param->{vmid
};
97 # test if container exists on this node
98 PVE
::LXC
::Config-
>load_config($vmid);
100 die "Error: container '$vmid' not running!\n" if !PVE
::LXC
::check_running
($vmid);
102 exec('lxc-attach', '-n', $vmid);
105 __PACKAGE__-
>register_method ({
109 description
=> "Launch a command inside the specified container.",
111 additionalProperties
=> 0,
113 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid_running
}),
114 'extra-args' => get_standard_option
('extra-args'),
117 returns
=> { type
=> 'null' },
122 # test if container exists on this node
123 PVE
::LXC
::Config-
>load_config($param->{vmid
});
125 if (!@{$param->{'extra-args'}}) {
126 die "missing command";
128 exec('lxc-attach', '-n', $param->{vmid
}, '--', @{$param->{'extra-args'}});
131 __PACKAGE__-
>register_method ({
135 description
=> "Run a filesystem check (fsck) on a container volume.",
137 additionalProperties
=> 0,
139 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid_stopped
}),
143 description
=> "Force checking, even if the filesystem seems clean",
149 description
=> "A volume on which to run the filesystem check",
150 enum
=> [PVE
::LXC
::Config-
>mountpoint_names()],
154 returns
=> { type
=> 'null' },
158 my $vmid = $param->{'vmid'};
159 my $device = defined($param->{'device'}) ?
$param->{'device'} : 'rootfs';
161 my $command = ['fsck', '-a', '-l'];
162 push(@$command, '-f') if $param->{force
};
164 # critical path: all of this will be done while the container is locked
167 my $conf = PVE
::LXC
::Config-
>load_config($vmid);
168 my $storage_cfg = PVE
::Storage
::config
();
170 defined($conf->{$device}) || die "cannot run command on unexisting mountpoint $device\n";
172 my $mount_point = $device eq 'rootfs' ? PVE
::LXC
::Config-
>parse_ct_rootfs($conf->{$device}) :
173 PVE
::LXC
::Config-
>parse_ct_mountpoint($conf->{$device});
175 my $volid = $mount_point->{volume
};
178 my $storage_id = PVE
::Storage
::parse_volume_id
($volid, 1);
181 my (undef, undef, undef, undef, undef, undef, $format) =
182 PVE
::Storage
::parse_volname
($storage_cfg, $volid);
184 die "unable to run fsck for '$volid' (format == $format)\n"
187 $path = PVE
::Storage
::path
($storage_cfg, $volid);
190 if (($volid =~ m
|^/.+|) && (-b
$volid)) {
191 # pass block devices directly
194 die "path '$volid' does not point to a block device\n";
198 push(@$command, $path);
200 PVE
::LXC
::check_running
($vmid) &&
201 die "cannot run fsck on active container\n";
203 PVE
::Tools
::run_command
($command);
206 PVE
::LXC
::Config-
>lock_config($vmid, $do_fsck);
210 __PACKAGE__-
>register_method({
214 description
=> "Mount the container's filesystem on the host. " .
215 "This will hold a lock on the container and is meant for emergency maintenance only " .
216 "as it will prevent further operations on the container other than start and stop.",
218 additionalProperties
=> 0,
220 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid
}),
223 returns
=> { type
=> 'null' },
227 my $rpcenv = PVE
::RPCEnvironment
::get
();
229 my $vmid = extract_param
($param, 'vmid');
230 my $storecfg = PVE
::Storage
::config
();
231 PVE
::LXC
::Config-
>lock_config($vmid, sub {
232 my $conf = PVE
::LXC
::Config-
>set_lock($vmid, 'mounted');
233 PVE
::LXC
::mount_all
($vmid, $storecfg, $conf);
238 __PACKAGE__-
>register_method({
242 description
=> "Unmount the container's filesystem.",
244 additionalProperties
=> 0,
246 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid
}),
249 returns
=> { type
=> 'null' },
253 my $rpcenv = PVE
::RPCEnvironment
::get
();
255 my $vmid = extract_param
($param, 'vmid');
256 my $storecfg = PVE
::Storage
::config
();
257 PVE
::LXC
::Config-
>lock_config($vmid, sub {
258 my $conf = PVE
::LXC
::Config-
>load_config($vmid);
259 PVE
::LXC
::umount_all
($vmid, $storecfg, $conf, 0);
260 PVE
::LXC
::Config-
>remove_lock($vmid, 'mounted');
265 # File creation with specified ownership and permissions.
266 # User and group can be names or decimal numbers.
267 # Permissions are explicit (not affected by umask) and can be numeric with the
268 # usual 0/0x prefixes for octal/hex.
270 my ($path, $perms, $user, $group) = @_;
272 if (defined($user)) {
273 if ($user =~ /^\d+$/) {
276 $uid = getpwnam($user) or die "failed to get uid for: $user\n"
279 if (defined($group)) {
280 if ($group =~ /^\d+$/) {
283 $gid = getgrnam($group) or die "failed to get gid for: $group\n"
287 if (defined($perms)) {
289 my ($mode, $unparsed) = POSIX
::strtoul
($perms, 0);
290 die "invalid mode: '$perms'\n" if $perms eq '' || $unparsed > 0 || $!;
295 if (sysopen($fd, $path, O_WRONLY
| O_CREAT
| O_EXCL
, 0)) {
296 $perms = 0666 & ~umask if !defined($perms);
298 # If the path previously existed then we do not care about left-over
299 # file descriptors even if the permissions/ownership is changed.
300 sysopen($fd, $path, O_WRONLY
| O_CREAT
| O_TRUNC
)
301 or die "failed to create file: $path: $!\n";
306 if (defined($perms)) {
311 if (defined($uid) || defined($gid)) {
313 my ($fuid, $fgid) = (stat($fd))[4,5] if !defined($uid) || !defined($gid);
314 $uid = $fuid if !defined($uid);
315 $gid = $fgid if !defined($gid);
316 chown($uid, $gid, $fd)
317 or die "failed to change file owner: $!\n";
322 __PACKAGE__-
>register_method({
326 description
=> "Copy a file from the container to the local system.",
328 additionalProperties
=> 0,
330 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid
}),
333 description
=> "Path to a file inside the container to pull.",
337 description
=> "Destination",
341 description
=> 'Owner user name or id.',
346 description
=> 'Owner group name or id.',
351 description
=> 'File permissions to use.',
358 description
=> "the task ID.",
363 my $rpcenv = PVE
::RPCEnvironment
::get
();
365 my $vmid = extract_param
($param, 'vmid');
366 my $path = extract_param
($param, 'path');
367 my $dest = extract_param
($param, 'destination');
369 my $perms = extract_param
($param, 'perms');
370 my $user = extract_param
($param, 'user');
371 my $group = extract_param
($param, 'group');
374 my $running = PVE
::LXC
::check_running
($vmid);
375 die "can only pull files from a running VM" if !$running;
378 my $pid = PVE
::LXC
::find_lxc_pid
($vmid);
379 # Avoid symlink issues by opening the files from inside the
380 # corresponding namespaces.
381 my $destfd = create_file
($dest, $perms, $user, $group);
383 sysopen my $mntnsfd, "/proc/$pid/ns/mnt", O_RDONLY
384 or die "failed to open the container's mount namespace\n";
385 PVE
::Tools
::setns
(fileno($mntnsfd), PVE
::Tools
::CLONE_NEWNS
)
386 or die "failed to enter the container's mount namespace\n";
388 chdir('/') or die "failed to change to container root directory\n";
390 open my $srcfd, '<', $path
391 or die "failed to open $path: $!\n";
393 copy
($srcfd, $destfd);
396 # This avoids having to setns() back to our namespace.
397 return $rpcenv->fork_worker('pull_file', $vmid, undef, $realcmd);
400 return PVE
::LXC
::Config-
>lock_config($vmid, $code);
403 __PACKAGE__-
>register_method({
407 description
=> "Copy a local file to the container.",
409 additionalProperties
=> 0,
411 vmid
=> get_standard_option
('pve-vmid', { completion
=> \
&PVE
::LXC
::complete_ctid
}),
414 description
=> "Path to a local file.",
418 description
=> "Destination inside the container to write to.",
422 description
=> 'Owner user name or id. When using a name it must exist inside the container.',
427 description
=> 'Owner group name or id. When using a name it must exist inside the container.',
432 description
=> 'File permissions to use.',
439 description
=> "the task ID.",
444 my $rpcenv = PVE
::RPCEnvironment
::get
();
446 my $vmid = extract_param
($param, 'vmid');
447 my $file = extract_param
($param, 'file');
448 my $dest = extract_param
($param, 'destination');
450 my $perms = extract_param
($param, 'perms');
451 my $user = extract_param
($param, 'user');
452 my $group = extract_param
($param, 'group');
455 my $running = PVE
::LXC
::check_running
($vmid);
456 die "can only push files to a running VM" if !$running;
458 my $conf = PVE
::LXC
::Config-
>load_config($vmid);
459 my $unprivileged = $conf->{unprivileged
};
462 my $pid = PVE
::LXC
::find_lxc_pid
($vmid);
463 # We open the file then enter the container's mount - and for
464 # unprivileged containers - user namespace and then create the
465 # file. This avoids symlink attacks as a symlink cannot point
466 # outside the namespace and our own access is equivalent to the
467 # container-local's root user. Also the user-passed -user and
468 # -group parameters will use the container-local's user and
470 sysopen my $srcfd, $file, O_RDONLY
471 or die "failed to open $file for reading\n";
473 sysopen my $mntnsfd, "/proc/$pid/ns/mnt", O_RDONLY
474 or die "failed to open the container's mount namespace\n";
477 sysopen $usernsfd, "/proc/$pid/ns/user", O_RDONLY
478 or die "failed to open the container's user namespace\n";
481 PVE
::Tools
::setns
(fileno($mntnsfd), PVE
::Tools
::CLONE_NEWNS
)
482 or die "failed to enter the container's mount namespace\n";
484 chdir('/') or die "failed to change to container root directory\n";
487 PVE
::Tools
::setns
(fileno($usernsfd), PVE
::Tools
::CLONE_NEWUSER
)
488 or die "failed to enter the container's user namespace\n";
490 POSIX
::setgid
(0) or die "setgid failed: $!\n";
491 POSIX
::setuid
(0) or die "setuid failed: $!\n";
494 my $destfd = create_file
($dest, $perms, $user, $group);
495 copy
($srcfd, $destfd);
498 # This avoids having to setns() back to our namespace.
499 return $rpcenv->fork_worker('push_file', $vmid, undef, $realcmd);
502 return PVE
::LXC
::Config-
>lock_config($vmid, $code);
506 list
=> [ 'PVE::API2::LXC', 'vmlist', [], { node
=> $nodename }, sub {
508 return if !scalar(@$res);
509 my $format = "%-10s %-10s %-12s %-20s\n";
510 printf($format, 'VMID', 'Status', 'Lock', 'Name');
511 foreach my $d (sort {$a->{vmid
} <=> $b->{vmid
} } @$res) {
512 printf($format, $d->{vmid
}, $d->{status
}, $d->{lock}, $d->{name
});
515 config
=> [ "PVE::API2::LXC::Config", 'vm_config', ['vmid'],
516 { node
=> $nodename }, sub {
518 foreach my $k (sort (keys %$config)) {
519 next if $k eq 'digest';
520 my $v = $config->{$k};
521 if ($k eq 'description') {
522 $v = PVE
::Tools
::encode_text
($v);
527 set
=> [ 'PVE::API2::LXC::Config', 'update_vm', ['vmid'], { node
=> $nodename }],
529 resize
=> [ "PVE::API2::LXC", 'resize_vm', ['vmid', 'disk', 'size'], { node
=> $nodename } ],
531 create
=> [ 'PVE::API2::LXC', 'create_vm', ['vmid', 'ostemplate'], { node
=> $nodename }, $upid_exit ],
532 restore
=> [ 'PVE::API2::LXC', 'create_vm', ['vmid', 'ostemplate'], { node
=> $nodename, restore
=> 1 }, $upid_exit ],
534 start
=> [ 'PVE::API2::LXC::Status', 'vm_start', ['vmid'], { node
=> $nodename }, $upid_exit],
535 suspend
=> [ 'PVE::API2::LXC::Status', 'vm_suspend', ['vmid'], { node
=> $nodename }, $upid_exit],
536 resume
=> [ 'PVE::API2::LXC::Status', 'vm_resume', ['vmid'], { node
=> $nodename }, $upid_exit],
537 shutdown => [ 'PVE::API2::LXC::Status', 'vm_shutdown', ['vmid'], { node
=> $nodename }, $upid_exit],
538 stop
=> [ 'PVE::API2::LXC::Status', 'vm_stop', ['vmid'], { node
=> $nodename }, $upid_exit],
540 clone
=> [ "PVE::API2::LXC", 'clone_vm', ['vmid', 'newid'], { node
=> $nodename }, $upid_exit ],
541 migrate
=> [ "PVE::API2::LXC", 'migrate_vm', ['vmid', 'target'], { node
=> $nodename }, $upid_exit],
543 console
=> [ __PACKAGE__
, 'console', ['vmid']],
544 enter
=> [ __PACKAGE__
, 'enter', ['vmid']],
545 unlock
=> [ __PACKAGE__
, 'unlock', ['vmid']],
546 exec => [ __PACKAGE__
, 'exec', ['vmid', 'extra-args']],
547 fsck
=> [ __PACKAGE__
, 'fsck', ['vmid']],
549 mount
=> [ __PACKAGE__
, 'mount', ['vmid']],
550 unmount
=> [ __PACKAGE__
, 'unmount', ['vmid']],
551 push => [ __PACKAGE__
, 'push', ['vmid', 'file', 'destination']],
552 pull
=> [ __PACKAGE__
, 'pull', ['vmid', 'path', 'destination']],
554 destroy
=> [ 'PVE::API2::LXC', 'destroy_vm', ['vmid'],
555 { node
=> $nodename }, $upid_exit ],
557 snapshot
=> [ "PVE::API2::LXC::Snapshot", 'snapshot', ['vmid', 'snapname'],
558 { node
=> $nodename } , $upid_exit ],
560 delsnapshot
=> [ "PVE::API2::LXC::Snapshot", 'delsnapshot', ['vmid', 'snapname'], { node
=> $nodename } , $upid_exit ],
562 listsnapshot
=> [ "PVE::API2::LXC::Snapshot", 'list', ['vmid'], { node
=> $nodename },
565 foreach my $e (@$res) {
566 my $headline = $e->{description
} || 'no-description';
567 $headline =~ s/\n.*//sg;
568 my $parent = $e->{parent
} // 'no-parent';
569 printf("%-20s %-20s %s\n", $e->{name
}, $parent, $headline);
573 rollback
=> [ "PVE::API2::LXC::Snapshot", 'rollback', ['vmid', 'snapname'], { node
=> $nodename } , $upid_exit ],
575 template
=> [ "PVE::API2::LXC", 'template', ['vmid'], { node
=> $nodename }],
585 pct - Tool to manage Linux Containers (LXC) on Proxmox VE
593 pct is a tool to manages Linux Containers (LXC). You can create
594 and destroy containers, and control execution
595 (start/stop/suspend/resume). Besides that, you can use pct to set
596 parameters in the associated config file, like network configuration or
601 Create a container based on a Debian template
602 (provided you downloaded the template via the webgui before)
604 pct create 100 /var/lib/vz/template/cache/debian-8.0-standard_8.0-1_amd64.tar.gz
610 Start a login session via getty
614 Enter the lxc namespace and run a shell as root user
618 Display the configuration
622 Add a network interface called eth0, bridged to the host bridge vmbr0,
623 set the address and gateway, while it's running
625 pct set 100 -net0 name=eth0,bridge=vmbr0,ip=192.168.15.147/24,gw=192.168.15.1
627 Reduce the memory of the container to 512MB
629 pct set -memory 512 100
633 /etc/pve/lxc/<vmid>.conf
635 Configuration file for the container <vmid>
639 L<B<qm(1)>>, L<B<pvesh(1)>>
641 =include pve_copyright