src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::DataCenterConfig;
   9 use PVE::GuestHelpers;
  10 use PVE::INotify;
  11 use PVE::JSONSchema qw(get_standard_option);
  12 use PVE::Tools;
  13
  14 use base qw(PVE::AbstractConfig);
  15
  16 my $nodename = PVE::INotify::nodename();
  17 my $lock_handles =  {};
  18 my $lockdir = "/run/lock/lxc";
  19 mkdir $lockdir;
  20 mkdir "/etc/pve/nodes/$nodename/lxc";
  21 my $MAX_MOUNT_POINTS = 256;
  22 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  23
  24 # BEGIN implemented abstract methods from PVE::AbstractConfig
  25
  26 sub guest_type {
  27     return "CT";
  28 }
  29
  30 sub __config_max_unused_disks {
  31     my ($class) = @_;
  32
  33     return $MAX_UNUSED_DISKS;
  34 }
  35
  36 sub config_file_lock {
  37     my ($class, $vmid) = @_;
  38
  39     return "$lockdir/pve-config-${vmid}.lock";
  40 }
  41
  42 sub cfs_config_path {
  43     my ($class, $vmid, $node) = @_;
  44
  45     $node = $nodename if !$node;
  46     return "nodes/$node/lxc/$vmid.conf";
  47 }
  48
  49 sub mountpoint_backup_enabled {
  50     my ($class, $mp_key, $mountpoint) = @_;
  51
  52     my $enabled;
  53     my $reason;
  54
  55     if ($mp_key eq 'rootfs') {
  56         $enabled = 1;
  57         $reason = 'rootfs';
  58     } elsif ($mountpoint->{type} ne 'volume') {
  59         $enabled = 0;
  60         $reason = 'not a volume';
  61     } elsif ($mountpoint->{backup}) {
  62         $enabled = 1;
  63         $reason = 'enabled';
  64     } else {
  65         $enabled = 0;
  66         $reason = 'disabled';
  67     }
  68     return wantarray ? ($enabled, $reason) : $enabled;
  69 }
  70
  71 sub has_feature {
  72     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  73     my $err;
  74
  75     my $opts;
  76     if ($feature eq 'copy' || $feature eq 'clone') {
  77         $opts = {'valid_target_formats' => ['raw', 'subvol']};
  78     }
  79
  80     $class->foreach_volume($conf, sub {
  81         my ($ms, $mountpoint) = @_;
  82
  83         return if $err; # skip further test
  84         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  85
  86         $err = 1
  87             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  88                                                  $mountpoint->{volume},
  89                                                  $snapname, $running, $opts);
  90     });
  91
  92     return $err ? 0 : 1;
  93 }
  94
  95 sub __snapshot_save_vmstate {
  96     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  97     die "implement me - snapshot_save_vmstate\n";
  98 }
  99
 100 sub __snapshot_check_running {
 101     my ($class, $vmid) = @_;
 102     return PVE::LXC::check_running($vmid);
 103 }
 104
 105 sub __snapshot_check_freeze_needed {
 106     my ($class, $vmid, $config, $save_vmstate) = @_;
 107
 108     my $ret = $class->__snapshot_check_running($vmid);
 109     return ($ret, $ret);
 110 }
 111
 112 sub __snapshot_freeze {
 113     my ($class, $vmid, $unfreeze) = @_;
 114
 115     if ($unfreeze) {
 116         eval { PVE::LXC::thaw($vmid); };
 117         warn $@ if $@;
 118     } else {
 119         PVE::LXC::freeze($vmid);
 120         PVE::LXC::sync_container_namespace($vmid);
 121     }
 122 }
 123
 124 sub __snapshot_create_vol_snapshot {
 125     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 126
 127     my $storecfg = PVE::Storage::config();
 128
 129     return if $snapname eq 'vzdump' &&
 130         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 131
 132     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 133 }
 134
 135 sub __snapshot_delete_remove_drive {
 136     my ($class, $snap, $remove_drive) = @_;
 137
 138     if ($remove_drive eq 'vmstate') {
 139         die "implement me - saving vmstate\n";
 140     } else {
 141         my $value = $snap->{$remove_drive};
 142         my $mountpoint = $class->parse_volume($remove_drive, $value, 1);
 143         delete $snap->{$remove_drive};
 144
 145         $class->add_unused_volume($snap, $mountpoint->{volume})
 146             if ($mountpoint->{type} eq 'volume');
 147     }
 148 }
 149
 150 sub __snapshot_delete_vmstate_file {
 151     my ($class, $snap, $force) = @_;
 152
 153     die "implement me - saving vmstate\n";
 154 }
 155
 156 sub __snapshot_delete_vol_snapshot {
 157     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 158
 159     return if $snapname eq 'vzdump' &&
 160         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 161
 162     my $storecfg = PVE::Storage::config();
 163     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 164     push @$unused, $mountpoint->{volume};
 165 }
 166
 167 sub __snapshot_rollback_vol_possible {
 168     my ($class, $mountpoint, $snapname) = @_;
 169
 170     my $storecfg = PVE::Storage::config();
 171     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 172 }
 173
 174 sub __snapshot_rollback_vol_rollback {
 175     my ($class, $mountpoint, $snapname) = @_;
 176
 177     my $storecfg = PVE::Storage::config();
 178     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 179 }
 180
 181 sub __snapshot_rollback_vm_stop {
 182     my ($class, $vmid) = @_;
 183
 184     PVE::LXC::vm_stop($vmid, 1)
 185         if $class->__snapshot_check_running($vmid);
 186 }
 187
 188 sub __snapshot_rollback_vm_start {
 189     my ($class, $vmid, $vmstate, $data);
 190
 191     die "implement me - save vmstate\n";
 192 }
 193
 194 sub __snapshot_rollback_get_unused {
 195     my ($class, $conf, $snap) = @_;
 196
 197     my $unused = [];
 198
 199     $class->foreach_volume($conf, sub {
 200         my ($vs, $volume) = @_;
 201
 202         return if $volume->{type} ne 'volume';
 203
 204         my $found = 0;
 205         my $volid = $volume->{volume};
 206
 207         $class->foreach_volume($snap, sub {
 208             my ($ms, $mountpoint) = @_;
 209
 210             return if $found;
 211             return if ($mountpoint->{type} ne 'volume');
 212
 213             $found = 1
 214                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 215         });
 216
 217         push @$unused, $volid if !$found;
 218     });
 219
 220     return $unused;
 221 }
 222
 223 # END implemented abstract methods from PVE::AbstractConfig
 224
 225 # BEGIN JSON config code
 226
 227 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 228
 229
 230 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 231
 232 sub is_valid_mount_option {
 233     my ($option) = @_;
 234     return $option =~ $valid_mount_option_re;
 235 }
 236
 237 my $rootfs_desc = {
 238     volume => {
 239         type => 'string',
 240         default_key => 1,
 241         format => 'pve-lxc-mp-string',
 242         format_description => 'volume',
 243         description => 'Volume, device or directory to mount into the container.',
 244     },
 245     size => {
 246         type => 'string',
 247         format => 'disk-size',
 248         format_description => 'DiskSize',
 249         description => 'Volume size (read only value).',
 250         optional => 1,
 251     },
 252     acl => {
 253         type => 'boolean',
 254         description => 'Explicitly enable or disable ACL support.',
 255         optional => 1,
 256     },
 257     mountoptions => {
 258         optional => 1,
 259         type => 'string',
 260         description => 'Extra mount options for rootfs/mps.',
 261         format_description => 'opt[;opt...]',
 262         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 263     },
 264     ro => {
 265         type => 'boolean',
 266         description => 'Read-only mount point',
 267         optional => 1,
 268     },
 269     quota => {
 270         type => 'boolean',
 271         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 272         optional => 1,
 273     },
 274     replicate => {
 275         type => 'boolean',
 276         description => 'Will include this volume to a storage replica job.',
 277         optional => 1,
 278         default => 1,
 279     },
 280     shared => {
 281         type => 'boolean',
 282         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 283         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 284         optional => 1,
 285         default => 0,
 286     },
 287 };
 288
 289 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 290     type => 'string', format => $rootfs_desc,
 291     description => "Use volume as container root.",
 292     optional => 1,
 293 });
 294
 295 my $features_desc = {
 296     mount => {
 297         optional => 1,
 298         type => 'string',
 299         description => "Allow mounting file systems of specific types."
 300             ." This should be a list of file system types as used with the mount command."
 301             ." Note that this can have negative effects on the container's security."
 302             ." With access to a loop device, mounting a file can circumvent the mknod"
 303             ." permission of the devices cgroup, mounting an NFS file system can"
 304             ." block the host's I/O completely and prevent it from rebooting, etc.",
 305         format_description => 'fstype;fstype;...',
 306         pattern => qr/[a-zA-Z0-9_; ]+/,
 307     },
 308     nesting => {
 309         optional => 1,
 310         type => 'boolean',
 311         default => 0,
 312         description => "Allow nesting."
 313             ." Best used with unprivileged containers with additional id mapping."
 314             ." Note that this will expose procfs and sysfs contents of the host"
 315             ." to the guest.",
 316     },
 317     keyctl => {
 318         optional => 1,
 319         type => 'boolean',
 320         default => 0,
 321         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 322             ." This is required to use docker inside a container."
 323             ." By default unprivileged containers will see this system call as non-existent."
 324             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 325             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 326             ." Essentially, you can choose between running systemd-networkd or docker.",
 327     },
 328     fuse => {
 329         optional => 1,
 330         type => 'boolean',
 331         default => 0,
 332         description => "Allow using 'fuse' file systems in a container."
 333             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 334     },
 335     mknod => {
 336         optional => 1,
 337         type => 'boolean',
 338         default => 0,
 339         description => "Allow unprivileged containers to use mknod() to add certain device nodes."
 340             ." This requires a kernel with seccomp trap to user space support (5.3 or newer)."
 341             ." This is experimental.",
 342     },
 343     force_rw_sys => {
 344         optional => 1,
 345         type => 'boolean',
 346         default => 0,
 347         description => "Mount /sys in unprivileged containers as `rw` instead of `mixed`."
 348             ." This can break networking under newer (>= v245) systemd-network use."
 349     },
 350 };
 351
 352 my $confdesc = {
 353     lock => {
 354         optional => 1,
 355         type => 'string',
 356         description => "Lock/unlock the VM.",
 357         enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 358     },
 359     onboot => {
 360         optional => 1,
 361         type => 'boolean',
 362         description => "Specifies whether a VM will be started during system bootup.",
 363         default => 0,
 364     },
 365     startup => get_standard_option('pve-startup-order'),
 366     template => {
 367         optional => 1,
 368         type => 'boolean',
 369         description => "Enable/disable Template.",
 370         default => 0,
 371     },
 372     arch => {
 373         optional => 1,
 374         type => 'string',
 375         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 376         description => "OS architecture type.",
 377         default => 'amd64',
 378     },
 379     ostype => {
 380         optional => 1,
 381         type => 'string',
 382         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 383         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 384     },
 385     console => {
 386         optional => 1,
 387         type => 'boolean',
 388         description => "Attach a console device (/dev/console) to the container.",
 389         default => 1,
 390     },
 391     tty => {
 392         optional => 1,
 393         type => 'integer',
 394         description => "Specify the number of tty available to the container",
 395         minimum => 0,
 396         maximum => 6,
 397         default => 2,
 398     },
 399     cores => {
 400         optional => 1,
 401         type => 'integer',
 402         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 403         minimum => 1,
 404         maximum => 128,
 405     },
 406     cpulimit => {
 407         optional => 1,
 408         type => 'number',
 409         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 410         minimum => 0,
 411         maximum => 128,
 412         default => 0,
 413     },
 414     cpuunits => {
 415         optional => 1,
 416         type => 'integer',
 417         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 418         minimum => 0,
 419         maximum => 500000,
 420         default => 1024,
 421     },
 422     memory => {
 423         optional => 1,
 424         type => 'integer',
 425         description => "Amount of RAM for the VM in MB.",
 426         minimum => 16,
 427         default => 512,
 428     },
 429     swap => {
 430         optional => 1,
 431         type => 'integer',
 432         description => "Amount of SWAP for the VM in MB.",
 433         minimum => 0,
 434         default => 512,
 435     },
 436     hostname => {
 437         optional => 1,
 438         description => "Set a host name for the container.",
 439         type => 'string', format => 'dns-name',
 440         maxLength => 255,
 441     },
 442     description => {
 443         optional => 1,
 444         type => 'string',
 445         description => "Container description. Only used on the configuration web interface.",
 446     },
 447     searchdomain => {
 448         optional => 1,
 449         type => 'string', format => 'dns-name-list',
 450         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 451     },
 452     nameserver => {
 453         optional => 1,
 454         type => 'string', format => 'address-list',
 455         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 456     },
 457     timezone => {
 458         optional => 1,
 459         type => 'string', format => 'pve-ct-timezone',
 460         description => "Time zone to use in the container. If option isn't set, then nothing will be done. Can be set to 'host' to match the host time zone, or an arbitrary time zone option from /usr/share/zoneinfo/zone.tab",
 461     },
 462     rootfs => get_standard_option('pve-ct-rootfs'),
 463     parent => {
 464         optional => 1,
 465         type => 'string', format => 'pve-configid',
 466         maxLength => 40,
 467         description => "Parent snapshot name. This is used internally, and should not be modified.",
 468     },
 469     snaptime => {
 470         optional => 1,
 471         description => "Timestamp for snapshots.",
 472         type => 'integer',
 473         minimum => 0,
 474     },
 475     cmode => {
 476         optional => 1,
 477         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 478         type => 'string',
 479         enum => ['shell', 'console', 'tty'],
 480         default => 'tty',
 481     },
 482     protection => {
 483         optional => 1,
 484         type => 'boolean',
 485         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 486         default => 0,
 487     },
 488     unprivileged => {
 489         optional => 1,
 490         type => 'boolean',
 491         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 492         default => 0,
 493     },
 494     features => {
 495         optional => 1,
 496         type => 'string',
 497         format => $features_desc,
 498         description => "Allow containers access to advanced features.",
 499     },
 500     hookscript => {
 501         optional => 1,
 502         type => 'string',
 503         format => 'pve-volume-id',
 504         description => 'Script that will be exectued during various steps in the containers lifetime.',
 505     },
 506     tags => {
 507         type => 'string', format => 'pve-tag-list',
 508         description => 'Tags of the Container. This is only meta information.',
 509         optional => 1,
 510     },
 511 };
 512
 513 my $valid_lxc_conf_keys = {
 514     'lxc.apparmor.profile' => 1,
 515     'lxc.apparmor.allow_incomplete' => 1,
 516     'lxc.apparmor.allow_nesting' => 1,
 517     'lxc.apparmor.raw' => 1,
 518     'lxc.selinux.context' => 1,
 519     'lxc.include' => 1,
 520     'lxc.arch' => 1,
 521     'lxc.uts.name' => 1,
 522     'lxc.signal.halt' => 1,
 523     'lxc.signal.reboot' => 1,
 524     'lxc.signal.stop' => 1,
 525     'lxc.init.cmd' => 1,
 526     'lxc.pty.max' => 1,
 527     'lxc.console.logfile' => 1,
 528     'lxc.console.path' => 1,
 529     'lxc.tty.max' => 1,
 530     'lxc.devtty.dir' => 1,
 531     'lxc.hook.autodev' => 1,
 532     'lxc.autodev' => 1,
 533     'lxc.kmsg' => 1,
 534     'lxc.mount.fstab' => 1,
 535     'lxc.mount.entry' => 1,
 536     'lxc.mount.auto' => 1,
 537     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 538     'lxc.rootfs.mount' => 1,
 539     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 540                             ', please use mount point options in the "rootfs" key',
 541     # lxc.cgroup.*
 542     # lxc.prlimit.*
 543     # lxc.net.*
 544     'lxc.cap.drop' => 1,
 545     'lxc.cap.keep' => 1,
 546     'lxc.seccomp.profile' => 1,
 547     'lxc.seccomp.notify.proxy' => 1,
 548     'lxc.seccomp.notify.cookie' => 1,
 549     'lxc.idmap' => 1,
 550     'lxc.hook.pre-start' => 1,
 551     'lxc.hook.pre-mount' => 1,
 552     'lxc.hook.mount' => 1,
 553     'lxc.hook.start' => 1,
 554     'lxc.hook.stop' => 1,
 555     'lxc.hook.post-stop' => 1,
 556     'lxc.hook.clone' => 1,
 557     'lxc.hook.destroy' => 1,
 558     'lxc.hook.version' => 1,
 559     'lxc.log.level' => 1,
 560     'lxc.log.file' => 1,
 561     'lxc.start.auto' => 1,
 562     'lxc.start.delay' => 1,
 563     'lxc.start.order' => 1,
 564     'lxc.group' => 1,
 565     'lxc.environment' => 1,
 566
 567     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 568     'lxc.sysctl.fs.mqueue' => 1,
 569     'lxc.sysctl.kernel.msgmax' => 1,
 570     'lxc.sysctl.kernel.msgmnb' => 1,
 571     'lxc.sysctl.kernel.msgmni' => 1,
 572     'lxc.sysctl.kernel.sem' => 1,
 573     'lxc.sysctl.kernel.shmall' => 1,
 574     'lxc.sysctl.kernel.shmmax' => 1,
 575     'lxc.sysctl.kernel.shmmni' => 1,
 576     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 577 };
 578
 579 my $deprecated_lxc_conf_keys = {
 580     # Deprecated (removed with lxc 3.0):
 581     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 582     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 583     'lxc.console'              => 'lxc.console.path',
 584     'lxc.devttydir'            => 'lxc.tty.dir',
 585     'lxc.haltsignal'           => 'lxc.signal.halt',
 586     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 587     'lxc.stopsignal'           => 'lxc.signal.stop',
 588     'lxc.id_map'               => 'lxc.idmap',
 589     'lxc.init_cmd'             => 'lxc.init.cmd',
 590     'lxc.loglevel'             => 'lxc.log.level',
 591     'lxc.logfile'              => 'lxc.log.file',
 592     'lxc.mount'                => 'lxc.mount.fstab',
 593     'lxc.network.type'         => 'lxc.net.INDEX.type',
 594     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 595     'lxc.network.link'         => 'lxc.net.INDEX.link',
 596     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 597     'lxc.network.name'         => 'lxc.net.INDEX.name',
 598     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 599     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 600     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 601     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 602     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 603     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 604     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 605     'lxc.pts'                  => 'lxc.pty.max',
 606     'lxc.se_context'           => 'lxc.selinux.context',
 607     'lxc.seccomp'              => 'lxc.seccomp.profile',
 608     'lxc.tty'                  => 'lxc.tty.max',
 609     'lxc.utsname'              => 'lxc.uts.name',
 610 };
 611
 612 sub is_valid_lxc_conf_key {
 613     my ($vmid, $key) = @_;
 614     if ($key =~ /^lxc\.limit\./) {
 615         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 616         return 1;
 617     }
 618     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 619         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 620         return 1;
 621     }
 622     my $validity = $valid_lxc_conf_keys->{$key};
 623     return $validity if defined($validity);
 624     return 1 if $key =~ /^lxc\.cgroup2?\./  # allow all cgroup values
 625              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 626              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 627     return 0;
 628 }
 629
 630 our $netconf_desc = {
 631     type => {
 632         type => 'string',
 633         optional => 1,
 634         description => "Network interface type.",
 635         enum => [qw(veth)],
 636     },
 637     name => {
 638         type => 'string',
 639         format_description => 'string',
 640         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 641         pattern => '[-_.\w\d]+',
 642     },
 643     bridge => {
 644         type => 'string',
 645         format_description => 'bridge',
 646         description => 'Bridge to attach the network device to.',
 647         pattern => '[-_.\w\d]+',
 648         optional => 1,
 649     },
 650     hwaddr => get_standard_option('mac-addr', {
 651         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 652         }),
 653     mtu => {
 654         type => 'integer',
 655         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 656         minimum => 64, # minimum ethernet frame is 64 bytes
 657         optional => 1,
 658     },
 659     ip => {
 660         type => 'string',
 661         format => 'pve-ipv4-config',
 662         format_description => '(IPv4/CIDR|dhcp|manual)',
 663         description => 'IPv4 address in CIDR format.',
 664         optional => 1,
 665     },
 666     gw => {
 667         type => 'string',
 668         format => 'ipv4',
 669         format_description => 'GatewayIPv4',
 670         description => 'Default gateway for IPv4 traffic.',
 671         optional => 1,
 672     },
 673     ip6 => {
 674         type => 'string',
 675         format => 'pve-ipv6-config',
 676         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 677         description => 'IPv6 address in CIDR format.',
 678         optional => 1,
 679     },
 680     gw6 => {
 681         type => 'string',
 682         format => 'ipv6',
 683         format_description => 'GatewayIPv6',
 684         description => 'Default gateway for IPv6 traffic.',
 685         optional => 1,
 686     },
 687     firewall => {
 688         type => 'boolean',
 689         description => "Controls whether this interface's firewall rules should be used.",
 690         optional => 1,
 691     },
 692     tag => {
 693         type => 'integer',
 694         minimum => 1,
 695         maximum => 4094,
 696         description => "VLAN tag for this interface.",
 697         optional => 1,
 698     },
 699     trunks => {
 700         type => 'string',
 701         pattern => qr/\d+(?:;\d+)*/,
 702         format_description => 'vlanid[;vlanid...]',
 703         description => "VLAN ids to pass through the interface",
 704         optional => 1,
 705     },
 706     rate => {
 707         type => 'number',
 708         format_description => 'mbps',
 709         description => "Apply rate limiting to the interface",
 710         optional => 1,
 711     },
 712 };
 713 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 714
 715 my $MAX_LXC_NETWORKS = 32;
 716 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 717     $confdesc->{"net$i"} = {
 718         optional => 1,
 719         type => 'string', format => $netconf_desc,
 720         description => "Specifies network interfaces for the container.",
 721     };
 722 }
 723
 724 PVE::JSONSchema::register_format('pve-ct-timezone', \&verify_ct_timezone);
 725 sub verify_ct_timezone {
 726     my ($timezone, $noerr) = @_;
 727
 728     return if $timezone eq 'host'; # using host settings
 729
 730     PVE::JSONSchema::pve_verify_timezone($timezone);
 731 }
 732
 733 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 734 sub verify_lxc_mp_string {
 735     my ($mp, $noerr) = @_;
 736
 737     # do not allow:
 738     # /./ or /../
 739     # /. or /.. at the end
 740     # ../ at the beginning
 741
 742     if($mp =~ m@/\.\.?/@ ||
 743        $mp =~ m@/\.\.?$@ ||
 744        $mp =~ m@^\.\./@) {
 745         return undef if $noerr;
 746         die "$mp contains illegal character sequences\n";
 747     }
 748     return $mp;
 749 }
 750
 751 my $mp_desc = {
 752     %$rootfs_desc,
 753     backup => {
 754         type => 'boolean',
 755         description => 'Whether to include the mount point in backups.',
 756         verbose_description => 'Whether to include the mount point in backups '.
 757                                '(only used for volume mount points).',
 758         optional => 1,
 759     },
 760     mp => {
 761         type => 'string',
 762         format => 'pve-lxc-mp-string',
 763         format_description => 'Path',
 764         description => 'Path to the mount point as seen from inside the container '.
 765                        '(must not contain symlinks).',
 766         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 767                                "NOTE: Must not contain any symlinks for security reasons."
 768     },
 769 };
 770 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 771
 772 my $unused_desc = {
 773     volume => {
 774         type => 'string',
 775         default_key => 1,
 776         format => 'pve-volume-id',
 777         format_description => 'volume',
 778         description => 'The volume that is not used currently.',
 779     }
 780 };
 781
 782 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 783     $confdesc->{"mp$i"} = {
 784         optional => 1,
 785         type => 'string', format => $mp_desc,
 786         description => "Use volume as container mount point.",
 787         optional => 1,
 788     };
 789 }
 790
 791 for (my $i = 0; $i < $MAX_UNUSED_DISKS; $i++) {
 792     $confdesc->{"unused$i"} = {
 793         optional => 1,
 794         type => 'string', format => $unused_desc,
 795         description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 796     }
 797 }
 798
 799 sub parse_pct_config {
 800     my ($filename, $raw) = @_;
 801
 802     return undef if !defined($raw);
 803
 804     my $res = {
 805         digest => Digest::SHA::sha1_hex($raw),
 806         snapshots => {},
 807         pending => {},
 808     };
 809
 810     $filename =~ m|/lxc/(\d+).conf$|
 811         || die "got strange filename '$filename'";
 812
 813     my $vmid = $1;
 814
 815     my $conf = $res;
 816     my $descr = '';
 817     my $section = '';
 818
 819     my @lines = split(/\n/, $raw);
 820     foreach my $line (@lines) {
 821         next if $line =~ m/^\s*$/;
 822
 823         if ($line =~ m/^\[pve:pending\]\s*$/i) {
 824             $section = 'pending';
 825             $conf->{description} = $descr if $descr;
 826             $descr = '';
 827             $conf = $res->{$section} = {};
 828             next;
 829         } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 830             $section = $1;
 831             $conf->{description} = $descr if $descr;
 832             $descr = '';
 833             $conf = $res->{snapshots}->{$section} = {};
 834             next;
 835         }
 836
 837         if ($line =~ m/^\#(.*)\s*$/) {
 838             $descr .= PVE::Tools::decode_text($1) . "\n";
 839             next;
 840         }
 841
 842         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 843             my $key = $1;
 844             my $value = $3;
 845             my $validity = is_valid_lxc_conf_key($vmid, $key);
 846             if ($validity eq 1) {
 847                 push @{$conf->{lxc}}, [$key, $value];
 848             } elsif (my $errmsg = $validity) {
 849                 warn "vm $vmid - $key: $errmsg\n";
 850             } else {
 851                 warn "vm $vmid - unable to parse config: $line\n";
 852             }
 853         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 854             $descr .= PVE::Tools::decode_text($2);
 855         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 856             $conf->{snapstate} = $1;
 857         } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
 858             my $value = $1;
 859             if ($section eq 'pending') {
 860                 $conf->{delete} = $value;
 861             } else {
 862                 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
 863             }
 864         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 865             my $key = $1;
 866             my $value = $2;
 867             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 868             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 869             $conf->{$key} = $value;
 870         } else {
 871             warn "vm $vmid - unable to parse config: $line\n";
 872         }
 873     }
 874
 875     $conf->{description} = $descr if $descr;
 876
 877     delete $res->{snapstate}; # just to be sure
 878
 879     return $res;
 880 }
 881
 882 sub write_pct_config {
 883     my ($filename, $conf) = @_;
 884
 885     delete $conf->{snapstate}; # just to be sure
 886
 887     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 888     my $used_volids = {};
 889     foreach my $vid (@$volidlist) {
 890         $used_volids->{$vid} = 1;
 891     }
 892
 893     # remove 'unusedX' settings if the volume is still used
 894     foreach my $key (keys %$conf) {
 895         my $value = $conf->{$key};
 896         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 897             delete $conf->{$key};
 898         }
 899     }
 900
 901     my $generate_raw_config = sub {
 902         my ($conf) = @_;
 903
 904         my $raw = '';
 905
 906         # add description as comment to top of file
 907         my $descr = $conf->{description} || '';
 908         foreach my $cl (split(/\n/, $descr)) {
 909             $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
 910         }
 911
 912         foreach my $key (sort keys %$conf) {
 913             next if $key eq 'digest' || $key eq 'description' ||
 914                     $key eq 'pending' || $key eq 'snapshots' ||
 915                     $key eq 'snapname' || $key eq 'lxc';
 916             my $value = $conf->{$key};
 917             die "detected invalid newline inside property '$key'\n"
 918                 if $value =~ m/\n/;
 919             $raw .= "$key: $value\n";
 920         }
 921
 922         if (my $lxcconf = $conf->{lxc}) {
 923             foreach my $entry (@$lxcconf) {
 924                 my ($k, $v) = @$entry;
 925                 $raw .= "$k: $v\n";
 926             }
 927         }
 928
 929         return $raw;
 930     };
 931
 932     my $raw = &$generate_raw_config($conf);
 933
 934     if (scalar(keys %{$conf->{pending}})){
 935         $raw .= "\n[pve:pending]\n";
 936         $raw .= &$generate_raw_config($conf->{pending});
 937     }
 938
 939     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 940         $raw .= "\n[$snapname]\n";
 941         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 942     }
 943
 944     return $raw;
 945 }
 946
 947 sub update_pct_config {
 948     my ($class, $vmid, $conf, $running, $param, $delete, $revert) = @_;
 949
 950     my $storage_cfg = PVE::Storage::config();
 951
 952     foreach my $opt (@$revert) {
 953         delete $conf->{pending}->{$opt};
 954         $class->remove_from_pending_delete($conf, $opt); # also remove from deletion queue
 955     }
 956
 957     # write updates to pending section
 958     my $modified = {}; # record modified options
 959
 960     foreach my $opt (@$delete) {
 961         if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
 962             warn "cannot delete '$opt' - not set in current configuration!\n";
 963             next;
 964         }
 965         $modified->{$opt} = 1;
 966         if ($opt eq 'memory' || $opt eq 'rootfs' || $opt eq 'ostype') {
 967             die "unable to delete required option '$opt'\n";
 968         } elsif ($opt =~ m/^unused(\d+)$/) {
 969             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 970         } elsif ($opt =~ m/^mp(\d+)$/) {
 971             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 972         } elsif ($opt eq 'unprivileged') {
 973             die "unable to delete read-only option: '$opt'\n";
 974         }
 975         $class->add_to_pending_delete($conf, $opt);
 976     }
 977
 978     my $check_content_type = sub {
 979         my ($mp) = @_;
 980         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 981         my $storage_config = PVE::Storage::storage_config($storage_cfg, $sid);
 982         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 983             if !$storage_config->{content}->{rootdir};
 984     };
 985
 986     foreach my $opt (sort keys %$param) { # add/change
 987         $modified->{$opt} = 1;
 988         my $value = $param->{$opt};
 989         if ($opt =~ m/^mp(\d+)$/ || $opt eq 'rootfs') {
 990             $class->check_protection($conf, "can't update CT $vmid drive '$opt'");
 991             my $mp = $class->parse_volume($opt, $value);
 992             $check_content_type->($mp) if ($mp->{type} eq 'volume');
 993         } elsif ($opt eq 'hookscript') {
 994             PVE::GuestHelpers::check_hookscript($value);
 995         } elsif ($opt eq 'nameserver') {
 996             $value = PVE::LXC::verify_nameserver_list($value);
 997         } elsif ($opt eq 'searchdomain') {
 998             $value = PVE::LXC::verify_searchdomain_list($value);
 999         } elsif ($opt eq 'unprivileged') {
1000             die "unable to modify read-only option: '$opt'\n";
1001         }
1002         $conf->{pending}->{$opt} = $value;
1003         $class->remove_from_pending_delete($conf, $opt);
1004     }
1005
1006     my $changes = $class->cleanup_pending($conf);
1007
1008     my $errors = {};
1009     if ($running) {
1010         $class->vmconfig_hotplug_pending($vmid, $conf, $storage_cfg, $modified, $errors);
1011     } else {
1012         $class->vmconfig_apply_pending($vmid, $conf, $storage_cfg, $modified, $errors);
1013     }
1014
1015     return $errors;
1016 }
1017
1018 sub check_type {
1019     my ($class, $key, $value) = @_;
1020
1021     die "unknown setting '$key'\n" if !$confdesc->{$key};
1022
1023     my $type = $confdesc->{$key}->{type};
1024
1025     if (!defined($value)) {
1026         die "got undefined value\n";
1027     }
1028
1029     if ($value =~ m/[\n\r]/) {
1030         die "property contains a line feed\n";
1031     }
1032
1033     if ($type eq 'boolean') {
1034         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1035         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1036         die "type check ('boolean') failed - got '$value'\n";
1037     } elsif ($type eq 'integer') {
1038         return int($1) if $value =~ m/^(\d+)$/;
1039         die "type check ('integer') failed - got '$value'\n";
1040     } elsif ($type eq 'number') {
1041         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1042         die "type check ('number') failed - got '$value'\n";
1043     } elsif ($type eq 'string') {
1044         if (my $fmt = $confdesc->{$key}->{format}) {
1045             PVE::JSONSchema::check_format($fmt, $value);
1046             return $value;
1047         }
1048         return $value;
1049     } else {
1050         die "internal error"
1051     }
1052 }
1053
1054
1055 # add JSON properties for create and set function
1056 sub json_config_properties {
1057     my ($class, $prop) = @_;
1058
1059     foreach my $opt (keys %$confdesc) {
1060         next if $opt eq 'parent' || $opt eq 'snaptime';
1061         next if $prop->{$opt};
1062         $prop->{$opt} = $confdesc->{$opt};
1063     }
1064
1065     return $prop;
1066 }
1067
1068 my $parse_ct_mountpoint_full = sub {
1069     my ($class, $desc, $data, $noerr) = @_;
1070
1071     $data //= '';
1072
1073     my $res;
1074     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1075     if ($@) {
1076         return undef if $noerr;
1077         die $@;
1078     }
1079
1080     if (defined(my $size = $res->{size})) {
1081         $size = PVE::JSONSchema::parse_size($size);
1082         if (!defined($size)) {
1083             return undef if $noerr;
1084             die "invalid size: $size\n";
1085         }
1086         $res->{size} = $size;
1087     }
1088
1089     $res->{type} = $class->classify_mountpoint($res->{volume});
1090
1091     return $res;
1092 };
1093
1094 sub print_ct_mountpoint {
1095     my ($class, $info, $nomp) = @_;
1096     my $skip = [ 'type' ];
1097     push @$skip, 'mp' if $nomp;
1098     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1099 }
1100
1101 sub parse_volume {
1102     my ($class, $key, $volume_string, $noerr) = @_;
1103
1104     if ($key eq 'rootfs') {
1105         my $res =  $parse_ct_mountpoint_full->($class, $rootfs_desc, $volume_string, $noerr);
1106         $res->{mp} = '/' if defined($res);
1107         return $res;
1108     } elsif ($key =~ m/^mp\d+$/) {
1109         return $parse_ct_mountpoint_full->($class, $mp_desc, $volume_string, $noerr);
1110     } elsif ($key =~ m/^unused\d+$/) {
1111         return $parse_ct_mountpoint_full->($class, $unused_desc, $volume_string, $noerr);
1112     }
1113
1114     die "parse_volume - unknown type: $key\n";
1115 }
1116
1117 sub print_volume {
1118     my ($class, $key, $volume) = @_;
1119
1120     return $class->print_ct_mountpoint($volume, $key eq 'rootfs');
1121 }
1122
1123 sub volid_key {
1124     my ($class) = @_;
1125
1126     return 'volume';
1127 }
1128
1129 sub print_lxc_network {
1130     my ($class, $net) = @_;
1131     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1132 }
1133
1134 sub parse_lxc_network {
1135     my ($class, $data) = @_;
1136
1137     my $res = {};
1138
1139     return $res if !$data;
1140
1141     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1142
1143     $res->{type} = 'veth';
1144     if (!$res->{hwaddr}) {
1145         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1146         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1147     }
1148
1149     return $res;
1150 }
1151
1152 sub parse_features {
1153     my ($class, $data) = @_;
1154     return {} if !$data;
1155     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1156 }
1157
1158 sub option_exists {
1159     my ($class, $name) = @_;
1160
1161     return defined($confdesc->{$name});
1162 }
1163 # END JSON config code
1164
1165 my $LXC_FASTPLUG_OPTIONS= {
1166     'description' => 1,
1167     'onboot' => 1,
1168     'startup' => 1,
1169     'protection' => 1,
1170     'hostname' => 1,
1171     'hookscript' => 1,
1172     'cores' => 1,
1173     'tags' => 1,
1174     'lock' => 1,
1175 };
1176
1177 sub vmconfig_hotplug_pending {
1178     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1179
1180     my $pid = PVE::LXC::find_lxc_pid($vmid);
1181     my $rootdir = "/proc/$pid/root";
1182
1183     my $add_hotplug_error = sub {
1184         my ($opt, $msg) = @_;
1185         $errors->{$opt} = "unable to hotplug $opt: $msg";
1186     };
1187
1188     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1189         next if $selection && !$selection->{$opt};
1190         if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1191             $conf->{$opt} = delete $conf->{pending}->{$opt};
1192         }
1193     }
1194
1195     my $cgroup = PVE::LXC::CGroup->new($vmid);
1196
1197     # There's no separate swap size to configure, there's memory and "total"
1198     # memory (iow. memory+swap). This means we have to change them together.
1199     my $hotplug_memory_done;
1200     my $hotplug_memory = sub {
1201         my ($wanted_memory, $wanted_swap) = @_;
1202
1203         $wanted_memory = int($wanted_memory * 1024 * 1024) if defined($wanted_memory);
1204         $wanted_swap = int($wanted_swap * 1024 * 1024) if defined($wanted_swap);
1205         $cgroup->change_memory_limit($wanted_memory, $wanted_swap);
1206
1207         $hotplug_memory_done = 1;
1208     };
1209
1210     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1211     # FIXME: $force deletion is not implemented for CTs
1212     foreach my $opt (sort keys %$pending_delete_hash) {
1213         next if $selection && !$selection->{$opt};
1214         eval {
1215             if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1216                 # pass
1217             } elsif ($opt =~ m/^unused(\d+)$/) {
1218                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1219                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1220             } elsif ($opt eq 'swap') {
1221                 $hotplug_memory->(undef, 0);
1222             } elsif ($opt eq 'cpulimit') {
1223                 $cgroup->change_cpu_quota(-1, 100000);
1224             } elsif ($opt eq 'cpuunits') {
1225                 $cgroup->change_cpu_shares(undef, $confdesc->{cpuunits}->{default});
1226             } elsif ($opt =~ m/^net(\d)$/) {
1227                 my $netid = $1;
1228                 PVE::Network::veth_delete("veth${vmid}i$netid");
1229             } else {
1230                 die "skip\n"; # skip non-hotpluggable opts
1231             }
1232         };
1233         if (my $err = $@) {
1234             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1235         } else {
1236             delete $conf->{$opt};
1237             $class->remove_from_pending_delete($conf, $opt);
1238         }
1239     }
1240
1241     foreach my $opt (sort keys %{$conf->{pending}}) {
1242         next if $opt eq 'delete'; # just to be sure
1243         next if $selection && !$selection->{$opt};
1244         my $value = $conf->{pending}->{$opt};
1245         eval {
1246             if ($opt eq 'cpulimit') {
1247                 my $quota = 100000 * $value;
1248                 $cgroup->change_cpu_quota(int(100000 * $value), 100000);
1249             } elsif ($opt eq 'cpuunits') {
1250                 $cgroup->change_cpu_shares($value, $confdesc->{cpuunits}->{default});
1251             } elsif ($opt =~ m/^net(\d+)$/) {
1252                 my $netid = $1;
1253                 my $net = $class->parse_lxc_network($value);
1254                 $value = $class->print_lxc_network($net);
1255                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1256             } elsif ($opt eq 'memory' || $opt eq 'swap') {
1257                 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1258                     $hotplug_memory->($conf->{pending}->{memory}, $conf->{pending}->{swap});
1259                 }
1260             } elsif ($opt =~ m/^mp(\d+)$/) {
1261                 if (!PVE::LXC::Tools::can_use_new_mount_api()) {
1262                     die "skip\n";
1263                 }
1264
1265                 if (exists($conf->{$opt})) {
1266                     die "skip\n"; # don't try to hotplug over existing mp
1267                 }
1268
1269                 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 1);
1270                 # apply_pending_mountpoint modifies the value if it creates a new disk
1271                 $value = $conf->{pending}->{$opt};
1272             } else {
1273                 die "skip\n"; # skip non-hotpluggable
1274             }
1275         };
1276         if (my $err = $@) {
1277             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1278         } else {
1279             $conf->{$opt} = $value;
1280             delete $conf->{pending}->{$opt};
1281         }
1282     }
1283 }
1284
1285 sub vmconfig_apply_pending {
1286     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1287
1288     my $add_apply_error = sub {
1289         my ($opt, $msg) = @_;
1290         my $err_msg = "unable to apply pending change $opt : $msg";
1291         $errors->{$opt} = $err_msg;
1292         warn $err_msg;
1293     };
1294
1295     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1296     # FIXME: $force deletion is not implemented for CTs
1297     foreach my $opt (sort keys %$pending_delete_hash) {
1298         next if $selection && !$selection->{$opt};
1299         eval {
1300             if ($opt =~ m/^mp(\d+)$/) {
1301                 my $mp = $class->parse_volume($opt, $conf->{$opt});
1302                 if ($mp->{type} eq 'volume') {
1303                     $class->add_unused_volume($conf, $mp->{volume})
1304                         if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1305                 }
1306             } elsif ($opt =~ m/^unused(\d+)$/) {
1307                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1308                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1309             }
1310         };
1311         if (my $err = $@) {
1312             $add_apply_error->($opt, $err);
1313         } else {
1314             delete $conf->{$opt};
1315             $class->remove_from_pending_delete($conf, $opt);
1316         }
1317     }
1318
1319     $class->cleanup_pending($conf);
1320
1321     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1322         next if $opt eq 'delete'; # just to be sure
1323         next if $selection && !$selection->{$opt};
1324         eval {
1325             if ($opt =~ m/^mp(\d+)$/) {
1326                 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 0);
1327             } elsif ($opt =~ m/^net(\d+)$/) {
1328                 my $netid = $1;
1329                 my $net = $class->parse_lxc_network($conf->{pending}->{$opt});
1330                 $conf->{pending}->{$opt} = $class->print_lxc_network($net);
1331             }
1332         };
1333         if (my $err = $@) {
1334             $add_apply_error->($opt, $err);
1335         } else {
1336             $conf->{$opt} = delete $conf->{pending}->{$opt};
1337         }
1338     }
1339 }
1340
1341 my $rescan_volume = sub {
1342     my ($storecfg, $mp) = @_;
1343     eval {
1344         $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5);
1345     };
1346     warn "Could not rescan volume size - $@\n" if $@;
1347 };
1348
1349 sub apply_pending_mountpoint {
1350     my ($class, $vmid, $conf, $opt, $storecfg, $running) = @_;
1351
1352     my $mp = $class->parse_volume($opt, $conf->{pending}->{$opt});
1353     my $old = $conf->{$opt};
1354     if ($mp->{type} eq 'volume') {
1355         if ($mp->{volume} =~ $PVE::LXC::NEW_DISK_RE) {
1356             my $original_value = $conf->{pending}->{$opt};
1357             my $vollist = PVE::LXC::create_disks(
1358                 $storecfg,
1359                 $vmid,
1360                 { $opt => $original_value },
1361                 $conf,
1362                 1,
1363             );
1364             if ($running) {
1365                 # Re-parse mount point:
1366                 my $mp = $class->parse_volume($opt, $conf->{pending}->{$opt});
1367                 eval {
1368                     PVE::LXC::mountpoint_hotplug($vmid, $conf, $opt, $mp, $storecfg);
1369                 };
1370                 my $err = $@;
1371                 if ($err) {
1372                     PVE::LXC::destroy_disks($storecfg, $vollist);
1373                     # The pending-changes code collects errors but keeps on looping through further
1374                     # pending changes, so unroll the change in $conf as well if destroy_disks()
1375                     # didn't die().
1376                     $conf->{pending}->{$opt} = $original_value;
1377                     die $err;
1378                 }
1379             }
1380         } else {
1381             die "skip\n" if $running && defined($old); # TODO: "changing" mount points?
1382             $rescan_volume->($storecfg, $mp);
1383             if ($running) {
1384                 PVE::LXC::mountpoint_hotplug($vmid, $conf, $opt, $mp, $storecfg);
1385             }
1386             $conf->{pending}->{$opt} = $class->print_ct_mountpoint($mp);
1387         }
1388     }
1389
1390     if (defined($old)) {
1391         my $mp = $class->parse_volume($opt, $old);
1392         if ($mp->{type} eq 'volume') {
1393             $class->add_unused_volume($conf, $mp->{volume})
1394                 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1395         }
1396     }
1397 }
1398
1399 sub classify_mountpoint {
1400     my ($class, $vol) = @_;
1401     if ($vol =~ m!^/!) {
1402         return 'device' if $vol =~ m!^/dev/!;
1403         return 'bind';
1404     }
1405     return 'volume';
1406 }
1407
1408 my $__is_volume_in_use = sub {
1409     my ($class, $config, $volid) = @_;
1410     my $used = 0;
1411
1412     $class->foreach_volume($config, sub {
1413         my ($ms, $mountpoint) = @_;
1414         return if $used;
1415         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1416     });
1417
1418     return $used;
1419 };
1420
1421 sub is_volume_in_use_by_snapshots {
1422     my ($class, $config, $volid) = @_;
1423
1424     if (my $snapshots = $config->{snapshots}) {
1425         foreach my $snap (keys %$snapshots) {
1426             return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1427         }
1428     }
1429
1430     return 0;
1431 }
1432
1433 sub is_volume_in_use {
1434     my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1435     return 1 if $__is_volume_in_use->($class, $config, $volid);
1436     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1437     return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending}, $volid);
1438     return 0;
1439 }
1440
1441 sub has_dev_console {
1442     my ($class, $conf) = @_;
1443
1444     return !(defined($conf->{console}) && !$conf->{console});
1445 }
1446
1447 sub has_lxc_entry {
1448     my ($class, $conf, $keyname) = @_;
1449
1450     if (my $lxcconf = $conf->{lxc}) {
1451         foreach my $entry (@$lxcconf) {
1452             my ($key, undef) = @$entry;
1453             return 1 if $key eq $keyname;
1454         }
1455     }
1456
1457     return 0;
1458 }
1459
1460 sub get_tty_count {
1461     my ($class, $conf) = @_;
1462
1463     return $conf->{tty} // $confdesc->{tty}->{default};
1464 }
1465
1466 sub get_cmode {
1467     my ($class, $conf) = @_;
1468
1469     return $conf->{cmode} // $confdesc->{cmode}->{default};
1470 }
1471
1472 sub valid_volume_keys {
1473     my ($class, $reverse) = @_;
1474
1475     my @names = ('rootfs');
1476
1477     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1478         push @names, "mp$i";
1479     }
1480
1481     return $reverse ? reverse @names : @names;
1482 }
1483
1484 sub get_vm_volumes {
1485     my ($class, $conf, $excludes) = @_;
1486
1487     my $vollist = [];
1488
1489     $class->foreach_volume($conf, sub {
1490         my ($ms, $mountpoint) = @_;
1491
1492         return if $excludes && $ms eq $excludes;
1493
1494         my $volid = $mountpoint->{volume};
1495         return if !$volid || $mountpoint->{type} ne 'volume';
1496
1497         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1498         return if !$sid;
1499
1500         push @$vollist, $volid;
1501     });
1502
1503     return $vollist;
1504 }
1505
1506 sub get_replicatable_volumes {
1507     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1508
1509     my $volhash = {};
1510
1511     my $test_volid = sub {
1512         my ($volid, $mountpoint) = @_;
1513
1514         return if !$volid;
1515
1516         my $mptype = $mountpoint->{type};
1517         my $replicate = $mountpoint->{replicate} // 1;
1518
1519         if ($mptype ne 'volume') {
1520             # skip bindmounts if replicate = 0 even for cleanup,
1521             # since bind mounts could not have been replicated ever
1522             return if !$replicate;
1523             die "unable to replicate mountpoint type '$mptype'\n";
1524         }
1525
1526         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1527         return if !$storeid;
1528
1529         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1530         return if $scfg->{shared};
1531
1532         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1533         return if !$owner || ($owner != $vmid);
1534
1535         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1536
1537         return if !$cleanup && !$replicate;
1538
1539         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1540             return if $cleanup || $noerr;
1541             die "missing replicate feature on volume '$volid'\n";
1542         }
1543
1544         $volhash->{$volid} = 1;
1545     };
1546
1547     $class->foreach_volume($conf, sub {
1548         my ($ms, $mountpoint) = @_;
1549         $test_volid->($mountpoint->{volume}, $mountpoint);
1550     });
1551
1552     foreach my $snapname (keys %{$conf->{snapshots}}) {
1553         my $snap = $conf->{snapshots}->{$snapname};
1554         $class->foreach_volume($snap, sub {
1555             my ($ms, $mountpoint) = @_;
1556             $test_volid->($mountpoint->{volume}, $mountpoint);
1557         });
1558     }
1559
1560     # add 'unusedX' volumes to volhash
1561     foreach my $key (keys %$conf) {
1562         if ($key =~ m/^unused/) {
1563             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1564         }
1565     }
1566
1567     return $volhash;
1568 }
1569
1570 sub get_backup_volumes {
1571     my ($class, $conf) = @_;
1572
1573     my $return_volumes = [];
1574
1575     my $test_mountpoint = sub {
1576         my ($key, $volume) = @_;
1577
1578         my ($included, $reason) = $class->mountpoint_backup_enabled($key, $volume);
1579
1580         push @$return_volumes, {
1581             key => $key,
1582             included => $included,
1583             reason => $reason,
1584             volume_config => $volume,
1585         };
1586     };
1587
1588     PVE::LXC::Config->foreach_volume($conf, $test_mountpoint);
1589
1590     return $return_volumes;
1591 }
1592
1593 1;