]> git.proxmox.com Git - pve-container.git/blob - src/PVE/LXC/Config.pm
add vmconfig_hotplug_pending and vmconfig_apply_pending
[pve-container.git] / src / PVE / LXC / Config.pm
1 package PVE::LXC::Config;
2
3 use strict;
4 use warnings;
5
6 use PVE::AbstractConfig;
7 use PVE::Cluster qw(cfs_register_file);
8 use PVE::GuestHelpers;
9 use PVE::INotify;
10 use PVE::JSONSchema qw(get_standard_option);
11 use PVE::Tools;
12
13 use base qw(PVE::AbstractConfig);
14
15 my $nodename = PVE::INotify::nodename();
16 my $lock_handles = {};
17 my $lockdir = "/run/lock/lxc";
18 mkdir $lockdir;
19 mkdir "/etc/pve/nodes/$nodename/lxc";
20 my $MAX_MOUNT_POINTS = 256;
21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
22
23 # BEGIN implemented abstract methods from PVE::AbstractConfig
24
25 sub guest_type {
26 return "CT";
27 }
28
29 sub __config_max_unused_disks {
30 my ($class) = @_;
31
32 return $MAX_UNUSED_DISKS;
33 }
34
35 sub config_file_lock {
36 my ($class, $vmid) = @_;
37
38 return "$lockdir/pve-config-${vmid}.lock";
39 }
40
41 sub cfs_config_path {
42 my ($class, $vmid, $node) = @_;
43
44 $node = $nodename if !$node;
45 return "nodes/$node/lxc/$vmid.conf";
46 }
47
48 sub mountpoint_backup_enabled {
49 my ($class, $mp_key, $mountpoint) = @_;
50
51 return 1 if $mp_key eq 'rootfs';
52
53 return 0 if $mountpoint->{type} ne 'volume';
54
55 return 1 if $mountpoint->{backup};
56
57 return 0;
58 }
59
60 sub has_feature {
61 my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
62 my $err;
63
64 $class->foreach_mountpoint($conf, sub {
65 my ($ms, $mountpoint) = @_;
66
67 return if $err; # skip further test
68 return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
69
70 $err = 1
71 if !PVE::Storage::volume_has_feature($storecfg, $feature,
72 $mountpoint->{volume},
73 $snapname, $running);
74 });
75
76 return $err ? 0 : 1;
77 }
78
79 sub __snapshot_save_vmstate {
80 my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
81 die "implement me - snapshot_save_vmstate\n";
82 }
83
84 sub __snapshot_check_running {
85 my ($class, $vmid) = @_;
86 return PVE::LXC::check_running($vmid);
87 }
88
89 sub __snapshot_check_freeze_needed {
90 my ($class, $vmid, $config, $save_vmstate) = @_;
91
92 my $ret = $class->__snapshot_check_running($vmid);
93 return ($ret, $ret);
94 }
95
96 sub __snapshot_freeze {
97 my ($class, $vmid, $unfreeze) = @_;
98
99 if ($unfreeze) {
100 eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
101 warn $@ if $@;
102 } else {
103 PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
104 PVE::LXC::sync_container_namespace($vmid);
105 }
106 }
107
108 sub __snapshot_create_vol_snapshot {
109 my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
110
111 my $storecfg = PVE::Storage::config();
112
113 return if $snapname eq 'vzdump' &&
114 !$class->mountpoint_backup_enabled($ms, $mountpoint);
115
116 PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
117 }
118
119 sub __snapshot_delete_remove_drive {
120 my ($class, $snap, $remove_drive) = @_;
121
122 if ($remove_drive eq 'vmstate') {
123 die "implement me - saving vmstate\n";
124 } else {
125 my $value = $snap->{$remove_drive};
126 my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
127 delete $snap->{$remove_drive};
128
129 $class->add_unused_volume($snap, $mountpoint->{volume})
130 if ($mountpoint->{type} eq 'volume');
131 }
132 }
133
134 sub __snapshot_delete_vmstate_file {
135 my ($class, $snap, $force) = @_;
136
137 die "implement me - saving vmstate\n";
138 }
139
140 sub __snapshot_delete_vol_snapshot {
141 my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
142
143 return if $snapname eq 'vzdump' &&
144 !$class->mountpoint_backup_enabled($ms, $mountpoint);
145
146 my $storecfg = PVE::Storage::config();
147 PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
148 push @$unused, $mountpoint->{volume};
149 }
150
151 sub __snapshot_rollback_vol_possible {
152 my ($class, $mountpoint, $snapname) = @_;
153
154 my $storecfg = PVE::Storage::config();
155 PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
156 }
157
158 sub __snapshot_rollback_vol_rollback {
159 my ($class, $mountpoint, $snapname) = @_;
160
161 my $storecfg = PVE::Storage::config();
162 PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
163 }
164
165 sub __snapshot_rollback_vm_stop {
166 my ($class, $vmid) = @_;
167
168 PVE::LXC::vm_stop($vmid, 1)
169 if $class->__snapshot_check_running($vmid);
170 }
171
172 sub __snapshot_rollback_vm_start {
173 my ($class, $vmid, $vmstate, $data);
174
175 die "implement me - save vmstate\n";
176 }
177
178 sub __snapshot_rollback_get_unused {
179 my ($class, $conf, $snap) = @_;
180
181 my $unused = [];
182
183 $class->__snapshot_foreach_volume($conf, sub {
184 my ($vs, $volume) = @_;
185
186 return if $volume->{type} ne 'volume';
187
188 my $found = 0;
189 my $volid = $volume->{volume};
190
191 $class->__snapshot_foreach_volume($snap, sub {
192 my ($ms, $mountpoint) = @_;
193
194 return if $found;
195 return if ($mountpoint->{type} ne 'volume');
196
197 $found = 1
198 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
199 });
200
201 push @$unused, $volid if !$found;
202 });
203
204 return $unused;
205 }
206
207 sub __snapshot_foreach_volume {
208 my ($class, $conf, $func) = @_;
209
210 $class->foreach_mountpoint($conf, $func);
211 }
212
213 # END implemented abstract methods from PVE::AbstractConfig
214
215 # BEGIN JSON config code
216
217 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
218
219
220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
221
222 sub is_valid_mount_option {
223 my ($option) = @_;
224 return $option =~ $valid_mount_option_re;
225 }
226
227 my $rootfs_desc = {
228 volume => {
229 type => 'string',
230 default_key => 1,
231 format => 'pve-lxc-mp-string',
232 format_description => 'volume',
233 description => 'Volume, device or directory to mount into the container.',
234 },
235 size => {
236 type => 'string',
237 format => 'disk-size',
238 format_description => 'DiskSize',
239 description => 'Volume size (read only value).',
240 optional => 1,
241 },
242 acl => {
243 type => 'boolean',
244 description => 'Explicitly enable or disable ACL support.',
245 optional => 1,
246 },
247 mountoptions => {
248 optional => 1,
249 type => 'string',
250 description => 'Extra mount options for rootfs/mps.',
251 format_description => 'opt[;opt...]',
252 pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
253 },
254 ro => {
255 type => 'boolean',
256 description => 'Read-only mount point',
257 optional => 1,
258 },
259 quota => {
260 type => 'boolean',
261 description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
262 optional => 1,
263 },
264 replicate => {
265 type => 'boolean',
266 description => 'Will include this volume to a storage replica job.',
267 optional => 1,
268 default => 1,
269 },
270 shared => {
271 type => 'boolean',
272 description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
273 verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
274 optional => 1,
275 default => 0,
276 },
277 };
278
279 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
280 type => 'string', format => $rootfs_desc,
281 description => "Use volume as container root.",
282 optional => 1,
283 });
284
285 my $features_desc = {
286 mount => {
287 optional => 1,
288 type => 'string',
289 description => "Allow mounting file systems of specific types."
290 ." This should be a list of file system types as used with the mount command."
291 ." Note that this can have negative effects on the container's security."
292 ." With access to a loop device, mounting a file can circumvent the mknod"
293 ." permission of the devices cgroup, mounting an NFS file system can"
294 ." block the host's I/O completely and prevent it from rebooting, etc.",
295 format_description => 'fstype;fstype;...',
296 pattern => qr/[a-zA-Z0-9_; ]+/,
297 },
298 nesting => {
299 optional => 1,
300 type => 'boolean',
301 default => 0,
302 description => "Allow nesting."
303 ." Best used with unprivileged containers with additional id mapping."
304 ." Note that this will expose procfs and sysfs contents of the host"
305 ." to the guest.",
306 },
307 keyctl => {
308 optional => 1,
309 type => 'boolean',
310 default => 0,
311 description => "For unprivileged containers only: Allow the use of the keyctl() system call."
312 ." This is required to use docker inside a container."
313 ." By default unprivileged containers will see this system call as non-existent."
314 ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
315 ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
316 ." Essentially, you can choose between running systemd-networkd or docker.",
317 },
318 fuse => {
319 optional => 1,
320 type => 'boolean',
321 default => 0,
322 description => "Allow using 'fuse' file systems in a container."
323 ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
324 },
325 };
326
327 my $confdesc = {
328 lock => {
329 optional => 1,
330 type => 'string',
331 description => "Lock/unlock the VM.",
332 enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
333 },
334 onboot => {
335 optional => 1,
336 type => 'boolean',
337 description => "Specifies whether a VM will be started during system bootup.",
338 default => 0,
339 },
340 startup => get_standard_option('pve-startup-order'),
341 template => {
342 optional => 1,
343 type => 'boolean',
344 description => "Enable/disable Template.",
345 default => 0,
346 },
347 arch => {
348 optional => 1,
349 type => 'string',
350 enum => ['amd64', 'i386', 'arm64', 'armhf'],
351 description => "OS architecture type.",
352 default => 'amd64',
353 },
354 ostype => {
355 optional => 1,
356 type => 'string',
357 enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
358 description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
359 },
360 console => {
361 optional => 1,
362 type => 'boolean',
363 description => "Attach a console device (/dev/console) to the container.",
364 default => 1,
365 },
366 tty => {
367 optional => 1,
368 type => 'integer',
369 description => "Specify the number of tty available to the container",
370 minimum => 0,
371 maximum => 6,
372 default => 2,
373 },
374 cores => {
375 optional => 1,
376 type => 'integer',
377 description => "The number of cores assigned to the container. A container can use all available cores by default.",
378 minimum => 1,
379 maximum => 128,
380 },
381 cpulimit => {
382 optional => 1,
383 type => 'number',
384 description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
385 minimum => 0,
386 maximum => 128,
387 default => 0,
388 },
389 cpuunits => {
390 optional => 1,
391 type => 'integer',
392 description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
393 minimum => 0,
394 maximum => 500000,
395 default => 1024,
396 },
397 memory => {
398 optional => 1,
399 type => 'integer',
400 description => "Amount of RAM for the VM in MB.",
401 minimum => 16,
402 default => 512,
403 },
404 swap => {
405 optional => 1,
406 type => 'integer',
407 description => "Amount of SWAP for the VM in MB.",
408 minimum => 0,
409 default => 512,
410 },
411 hostname => {
412 optional => 1,
413 description => "Set a host name for the container.",
414 type => 'string', format => 'dns-name',
415 maxLength => 255,
416 },
417 description => {
418 optional => 1,
419 type => 'string',
420 description => "Container description. Only used on the configuration web interface.",
421 },
422 searchdomain => {
423 optional => 1,
424 type => 'string', format => 'dns-name-list',
425 description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
426 },
427 nameserver => {
428 optional => 1,
429 type => 'string', format => 'address-list',
430 description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
431 },
432 rootfs => get_standard_option('pve-ct-rootfs'),
433 parent => {
434 optional => 1,
435 type => 'string', format => 'pve-configid',
436 maxLength => 40,
437 description => "Parent snapshot name. This is used internally, and should not be modified.",
438 },
439 snaptime => {
440 optional => 1,
441 description => "Timestamp for snapshots.",
442 type => 'integer',
443 minimum => 0,
444 },
445 cmode => {
446 optional => 1,
447 description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
448 type => 'string',
449 enum => ['shell', 'console', 'tty'],
450 default => 'tty',
451 },
452 protection => {
453 optional => 1,
454 type => 'boolean',
455 description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
456 default => 0,
457 },
458 unprivileged => {
459 optional => 1,
460 type => 'boolean',
461 description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
462 default => 0,
463 },
464 features => {
465 optional => 1,
466 type => 'string',
467 format => $features_desc,
468 description => "Allow containers access to advanced features.",
469 },
470 hookscript => {
471 optional => 1,
472 type => 'string',
473 format => 'pve-volume-id',
474 description => 'Script that will be exectued during various steps in the containers lifetime.',
475 },
476 };
477
478 my $valid_lxc_conf_keys = {
479 'lxc.apparmor.profile' => 1,
480 'lxc.apparmor.allow_incomplete' => 1,
481 'lxc.apparmor.allow_nesting' => 1,
482 'lxc.apparmor.raw' => 1,
483 'lxc.selinux.context' => 1,
484 'lxc.include' => 1,
485 'lxc.arch' => 1,
486 'lxc.uts.name' => 1,
487 'lxc.signal.halt' => 1,
488 'lxc.signal.reboot' => 1,
489 'lxc.signal.stop' => 1,
490 'lxc.init.cmd' => 1,
491 'lxc.pty.max' => 1,
492 'lxc.console.logfile' => 1,
493 'lxc.console.path' => 1,
494 'lxc.tty.max' => 1,
495 'lxc.devtty.dir' => 1,
496 'lxc.hook.autodev' => 1,
497 'lxc.autodev' => 1,
498 'lxc.kmsg' => 1,
499 'lxc.mount.fstab' => 1,
500 'lxc.mount.entry' => 1,
501 'lxc.mount.auto' => 1,
502 'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
503 'lxc.rootfs.mount' => 1,
504 'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
505 ', please use mount point options in the "rootfs" key',
506 # lxc.cgroup.*
507 # lxc.prlimit.*
508 # lxc.net.*
509 'lxc.cap.drop' => 1,
510 'lxc.cap.keep' => 1,
511 'lxc.seccomp.profile' => 1,
512 'lxc.seccomp.notify.proxy' => 1,
513 'lxc.seccomp.notify.cookie' => 1,
514 'lxc.idmap' => 1,
515 'lxc.hook.pre-start' => 1,
516 'lxc.hook.pre-mount' => 1,
517 'lxc.hook.mount' => 1,
518 'lxc.hook.start' => 1,
519 'lxc.hook.stop' => 1,
520 'lxc.hook.post-stop' => 1,
521 'lxc.hook.clone' => 1,
522 'lxc.hook.destroy' => 1,
523 'lxc.log.level' => 1,
524 'lxc.log.file' => 1,
525 'lxc.start.auto' => 1,
526 'lxc.start.delay' => 1,
527 'lxc.start.order' => 1,
528 'lxc.group' => 1,
529 'lxc.environment' => 1,
530
531 # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
532 'lxc.sysctl.fs.mqueue' => 1,
533 'lxc.sysctl.kernel.msgmax' => 1,
534 'lxc.sysctl.kernel.msgmnb' => 1,
535 'lxc.sysctl.kernel.msgmni' => 1,
536 'lxc.sysctl.kernel.sem' => 1,
537 'lxc.sysctl.kernel.shmall' => 1,
538 'lxc.sysctl.kernel.shmmax' => 1,
539 'lxc.sysctl.kernel.shmmni' => 1,
540 'lxc.sysctl.kernel.shm_rmid_forced' => 1,
541 };
542
543 my $deprecated_lxc_conf_keys = {
544 # Deprecated (removed with lxc 3.0):
545 'lxc.aa_profile' => 'lxc.apparmor.profile',
546 'lxc.aa_allow_incomplete' => 'lxc.apparmor.allow_incomplete',
547 'lxc.console' => 'lxc.console.path',
548 'lxc.devttydir' => 'lxc.tty.dir',
549 'lxc.haltsignal' => 'lxc.signal.halt',
550 'lxc.rebootsignal' => 'lxc.signal.reboot',
551 'lxc.stopsignal' => 'lxc.signal.stop',
552 'lxc.id_map' => 'lxc.idmap',
553 'lxc.init_cmd' => 'lxc.init.cmd',
554 'lxc.loglevel' => 'lxc.log.level',
555 'lxc.logfile' => 'lxc.log.file',
556 'lxc.mount' => 'lxc.mount.fstab',
557 'lxc.network.type' => 'lxc.net.INDEX.type',
558 'lxc.network.flags' => 'lxc.net.INDEX.flags',
559 'lxc.network.link' => 'lxc.net.INDEX.link',
560 'lxc.network.mtu' => 'lxc.net.INDEX.mtu',
561 'lxc.network.name' => 'lxc.net.INDEX.name',
562 'lxc.network.hwaddr' => 'lxc.net.INDEX.hwaddr',
563 'lxc.network.ipv4' => 'lxc.net.INDEX.ipv4.address',
564 'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
565 'lxc.network.ipv6' => 'lxc.net.INDEX.ipv6.address',
566 'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
567 'lxc.network.script.up' => 'lxc.net.INDEX.script.up',
568 'lxc.network.script.down' => 'lxc.net.INDEX.script.down',
569 'lxc.pts' => 'lxc.pty.max',
570 'lxc.se_context' => 'lxc.selinux.context',
571 'lxc.seccomp' => 'lxc.seccomp.profile',
572 'lxc.tty' => 'lxc.tty.max',
573 'lxc.utsname' => 'lxc.uts.name',
574 };
575
576 sub is_valid_lxc_conf_key {
577 my ($vmid, $key) = @_;
578 if ($key =~ /^lxc\.limit\./) {
579 warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
580 return 1;
581 }
582 if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
583 warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
584 return 1;
585 }
586 my $validity = $valid_lxc_conf_keys->{$key};
587 return $validity if defined($validity);
588 return 1 if $key =~ /^lxc\.cgroup\./ # allow all cgroup values
589 || $key =~ /^lxc\.prlimit\./ # allow all prlimits
590 || $key =~ /^lxc\.net\./; # allow custom network definitions
591 return 0;
592 }
593
594 our $netconf_desc = {
595 type => {
596 type => 'string',
597 optional => 1,
598 description => "Network interface type.",
599 enum => [qw(veth)],
600 },
601 name => {
602 type => 'string',
603 format_description => 'string',
604 description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
605 pattern => '[-_.\w\d]+',
606 },
607 bridge => {
608 type => 'string',
609 format_description => 'bridge',
610 description => 'Bridge to attach the network device to.',
611 pattern => '[-_.\w\d]+',
612 optional => 1,
613 },
614 hwaddr => get_standard_option('mac-addr', {
615 description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
616 }),
617 mtu => {
618 type => 'integer',
619 description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
620 minimum => 64, # minimum ethernet frame is 64 bytes
621 optional => 1,
622 },
623 ip => {
624 type => 'string',
625 format => 'pve-ipv4-config',
626 format_description => '(IPv4/CIDR|dhcp|manual)',
627 description => 'IPv4 address in CIDR format.',
628 optional => 1,
629 },
630 gw => {
631 type => 'string',
632 format => 'ipv4',
633 format_description => 'GatewayIPv4',
634 description => 'Default gateway for IPv4 traffic.',
635 optional => 1,
636 },
637 ip6 => {
638 type => 'string',
639 format => 'pve-ipv6-config',
640 format_description => '(IPv6/CIDR|auto|dhcp|manual)',
641 description => 'IPv6 address in CIDR format.',
642 optional => 1,
643 },
644 gw6 => {
645 type => 'string',
646 format => 'ipv6',
647 format_description => 'GatewayIPv6',
648 description => 'Default gateway for IPv6 traffic.',
649 optional => 1,
650 },
651 firewall => {
652 type => 'boolean',
653 description => "Controls whether this interface's firewall rules should be used.",
654 optional => 1,
655 },
656 tag => {
657 type => 'integer',
658 minimum => 1,
659 maximum => 4094,
660 description => "VLAN tag for this interface.",
661 optional => 1,
662 },
663 trunks => {
664 type => 'string',
665 pattern => qr/\d+(?:;\d+)*/,
666 format_description => 'vlanid[;vlanid...]',
667 description => "VLAN ids to pass through the interface",
668 optional => 1,
669 },
670 rate => {
671 type => 'number',
672 format_description => 'mbps',
673 description => "Apply rate limiting to the interface",
674 optional => 1,
675 },
676 };
677 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
678
679 my $MAX_LXC_NETWORKS = 10;
680 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
681 $confdesc->{"net$i"} = {
682 optional => 1,
683 type => 'string', format => $netconf_desc,
684 description => "Specifies network interfaces for the container.",
685 };
686 }
687
688 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
689 sub verify_lxc_mp_string {
690 my ($mp, $noerr) = @_;
691
692 # do not allow:
693 # /./ or /../
694 # /. or /.. at the end
695 # ../ at the beginning
696
697 if($mp =~ m@/\.\.?/@ ||
698 $mp =~ m@/\.\.?$@ ||
699 $mp =~ m@^\.\./@) {
700 return undef if $noerr;
701 die "$mp contains illegal character sequences\n";
702 }
703 return $mp;
704 }
705
706 my $mp_desc = {
707 %$rootfs_desc,
708 backup => {
709 type => 'boolean',
710 description => 'Whether to include the mount point in backups.',
711 verbose_description => 'Whether to include the mount point in backups '.
712 '(only used for volume mount points).',
713 optional => 1,
714 },
715 mp => {
716 type => 'string',
717 format => 'pve-lxc-mp-string',
718 format_description => 'Path',
719 description => 'Path to the mount point as seen from inside the container '.
720 '(must not contain symlinks).',
721 verbose_description => "Path to the mount point as seen from inside the container.\n\n".
722 "NOTE: Must not contain any symlinks for security reasons."
723 },
724 };
725 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
726
727 my $unuseddesc = {
728 optional => 1,
729 type => 'string', format => 'pve-volume-id',
730 description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
731 };
732
733 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
734 $confdesc->{"mp$i"} = {
735 optional => 1,
736 type => 'string', format => $mp_desc,
737 description => "Use volume as container mount point.",
738 optional => 1,
739 };
740 }
741
742 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
743 $confdesc->{"unused$i"} = $unuseddesc;
744 }
745
746 sub parse_pct_config {
747 my ($filename, $raw) = @_;
748
749 return undef if !defined($raw);
750
751 my $res = {
752 digest => Digest::SHA::sha1_hex($raw),
753 snapshots => {},
754 pending => {},
755 };
756
757 $filename =~ m|/lxc/(\d+).conf$|
758 || die "got strange filename '$filename'";
759
760 my $vmid = $1;
761
762 my $conf = $res;
763 my $descr = '';
764 my $section = '';
765
766 my @lines = split(/\n/, $raw);
767 foreach my $line (@lines) {
768 next if $line =~ m/^\s*$/;
769
770 if ($line =~ m/^\[pve:pending\]\s*$/i) {
771 $section = 'pending';
772 $conf->{description} = $descr if $descr;
773 $descr = '';
774 $conf = $res->{$section} = {};
775 next;
776 } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
777 $section = $1;
778 $conf->{description} = $descr if $descr;
779 $descr = '';
780 $conf = $res->{snapshots}->{$section} = {};
781 next;
782 }
783
784 if ($line =~ m/^\#(.*)\s*$/) {
785 $descr .= PVE::Tools::decode_text($1) . "\n";
786 next;
787 }
788
789 if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
790 my $key = $1;
791 my $value = $3;
792 my $validity = is_valid_lxc_conf_key($vmid, $key);
793 if ($validity eq 1) {
794 push @{$conf->{lxc}}, [$key, $value];
795 } elsif (my $errmsg = $validity) {
796 warn "vm $vmid - $key: $errmsg\n";
797 } else {
798 warn "vm $vmid - unable to parse config: $line\n";
799 }
800 } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
801 $descr .= PVE::Tools::decode_text($2);
802 } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
803 $conf->{snapstate} = $1;
804 } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
805 my $value = $1;
806 if ($section eq 'pending') {
807 $conf->{delete} = $value;
808 } else {
809 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
810 }
811 } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
812 my $key = $1;
813 my $value = $2;
814 eval { $value = PVE::LXC::Config->check_type($key, $value); };
815 warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
816 $conf->{$key} = $value;
817 } else {
818 warn "vm $vmid - unable to parse config: $line\n";
819 }
820 }
821
822 $conf->{description} = $descr if $descr;
823
824 delete $res->{snapstate}; # just to be sure
825
826 return $res;
827 }
828
829 sub write_pct_config {
830 my ($filename, $conf) = @_;
831
832 delete $conf->{snapstate}; # just to be sure
833
834 my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
835 my $used_volids = {};
836 foreach my $vid (@$volidlist) {
837 $used_volids->{$vid} = 1;
838 }
839
840 # remove 'unusedX' settings if the volume is still used
841 foreach my $key (keys %$conf) {
842 my $value = $conf->{$key};
843 if ($key =~ m/^unused/ && $used_volids->{$value}) {
844 delete $conf->{$key};
845 }
846 }
847
848 my $generate_raw_config = sub {
849 my ($conf) = @_;
850
851 my $raw = '';
852
853 # add description as comment to top of file
854 my $descr = $conf->{description} || '';
855 foreach my $cl (split(/\n/, $descr)) {
856 $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
857 }
858
859 foreach my $key (sort keys %$conf) {
860 next if $key eq 'digest' || $key eq 'description' ||
861 $key eq 'pending' || $key eq 'snapshots' ||
862 $key eq 'snapname' || $key eq 'lxc';
863 my $value = $conf->{$key};
864 die "detected invalid newline inside property '$key'\n"
865 if $value =~ m/\n/;
866 $raw .= "$key: $value\n";
867 }
868
869 if (my $lxcconf = $conf->{lxc}) {
870 foreach my $entry (@$lxcconf) {
871 my ($k, $v) = @$entry;
872 $raw .= "$k: $v\n";
873 }
874 }
875
876 return $raw;
877 };
878
879 my $raw = &$generate_raw_config($conf);
880
881 if (scalar(keys %{$conf->{pending}})){
882 $raw .= "\n[pve:pending]\n";
883 $raw .= &$generate_raw_config($conf->{pending});
884 }
885
886 foreach my $snapname (sort keys %{$conf->{snapshots}}) {
887 $raw .= "\n[$snapname]\n";
888 $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
889 }
890
891 return $raw;
892 }
893
894 sub update_pct_config {
895 my ($class, $vmid, $conf, $running, $param, $delete) = @_;
896
897 my @nohotplug;
898
899 my $new_disks = 0;
900 my @deleted_volumes;
901
902 my $rootdir;
903 if ($running) {
904 my $pid = PVE::LXC::find_lxc_pid($vmid);
905 $rootdir = "/proc/$pid/root";
906 }
907
908 my $hotplug_error = sub {
909 if ($running) {
910 push @nohotplug, @_;
911 return 1;
912 } else {
913 return 0;
914 }
915 };
916
917 if (defined($delete)) {
918 foreach my $opt (@$delete) {
919 if (!exists($conf->{$opt})) {
920 # silently ignore
921 next;
922 }
923
924 if ($opt eq 'memory' || $opt eq 'rootfs') {
925 die "unable to delete required option '$opt'\n";
926 } elsif ($opt eq 'hostname') {
927 delete $conf->{$opt};
928 } elsif ($opt eq 'swap') {
929 delete $conf->{$opt};
930 PVE::LXC::write_cgroup_value("memory", $vmid,
931 "memory.memsw.limit_in_bytes", -1);
932 } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup' || $opt eq 'hookscript') {
933 delete $conf->{$opt};
934 } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
935 $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
936 next if $hotplug_error->($opt);
937 delete $conf->{$opt};
938 } elsif ($opt eq 'cores') {
939 delete $conf->{$opt}; # rest is handled by pvestatd
940 } elsif ($opt eq 'cpulimit') {
941 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
942 delete $conf->{$opt};
943 } elsif ($opt eq 'cpuunits') {
944 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
945 delete $conf->{$opt};
946 } elsif ($opt =~ m/^net(\d)$/) {
947 delete $conf->{$opt};
948 next if !$running;
949 my $netid = $1;
950 PVE::Network::veth_delete("veth${vmid}i$netid");
951 } elsif ($opt eq 'protection') {
952 delete $conf->{$opt};
953 } elsif ($opt =~ m/^unused(\d+)$/) {
954 next if $hotplug_error->($opt);
955 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
956 push @deleted_volumes, $conf->{$opt};
957 delete $conf->{$opt};
958 } elsif ($opt =~ m/^mp(\d+)$/) {
959 next if $hotplug_error->($opt);
960 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
961 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
962 delete $conf->{$opt};
963 if ($mp->{type} eq 'volume') {
964 PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
965 }
966 } elsif ($opt eq 'unprivileged') {
967 die "unable to delete read-only option: '$opt'\n";
968 } elsif ($opt eq 'features') {
969 next if $hotplug_error->($opt);
970 delete $conf->{$opt};
971 } else {
972 die "implement me (delete: $opt)"
973 }
974 PVE::LXC::Config->write_config($vmid, $conf) if $running;
975 }
976 }
977
978 # There's no separate swap size to configure, there's memory and "total"
979 # memory (iow. memory+swap). This means we have to change them together.
980 my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
981 my $wanted_swap = PVE::Tools::extract_param($param, 'swap');
982 if (defined($wanted_memory) || defined($wanted_swap)) {
983
984 my $old_memory = ($conf->{memory} || 512);
985 my $old_swap = ($conf->{swap} || 0);
986
987 $wanted_memory //= $old_memory;
988 $wanted_swap //= $old_swap;
989
990 my $total = $wanted_memory + $wanted_swap;
991 if ($running) {
992 my $old_total = $old_memory + $old_swap;
993 if ($total > $old_total) {
994 PVE::LXC::write_cgroup_value("memory", $vmid,
995 "memory.memsw.limit_in_bytes",
996 int($total*1024*1024));
997 PVE::LXC::write_cgroup_value("memory", $vmid,
998 "memory.limit_in_bytes",
999 int($wanted_memory*1024*1024));
1000 } else {
1001 PVE::LXC::write_cgroup_value("memory", $vmid,
1002 "memory.limit_in_bytes",
1003 int($wanted_memory*1024*1024));
1004 PVE::LXC::write_cgroup_value("memory", $vmid,
1005 "memory.memsw.limit_in_bytes",
1006 int($total*1024*1024));
1007 }
1008 }
1009 $conf->{memory} = $wanted_memory;
1010 $conf->{swap} = $wanted_swap;
1011
1012 PVE::LXC::Config->write_config($vmid, $conf) if $running;
1013 }
1014
1015 my $storecfg = PVE::Storage::config();
1016
1017 my $used_volids = {};
1018 my $check_content_type = sub {
1019 my ($mp) = @_;
1020 my $sid = PVE::Storage::parse_volume_id($mp->{volume});
1021 my $storage_config = PVE::Storage::storage_config($storecfg, $sid);
1022 die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
1023 if !$storage_config->{content}->{rootdir};
1024 };
1025
1026 my $rescan_volume = sub {
1027 my ($mp) = @_;
1028 eval {
1029 $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1030 if !defined($mp->{size});
1031 };
1032 warn "Could not rescan volume size - $@\n" if $@;
1033 };
1034
1035 foreach my $opt (keys %$param) {
1036 my $value = $param->{$opt};
1037 my $check_protection_msg = "can't update CT $vmid drive '$opt'";
1038 if ($opt eq 'hostname' || $opt eq 'arch') {
1039 $conf->{$opt} = $value;
1040 } elsif ($opt eq 'onboot') {
1041 $conf->{$opt} = $value ? 1 : 0;
1042 } elsif ($opt eq 'startup') {
1043 $conf->{$opt} = $value;
1044 } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
1045 next if $hotplug_error->($opt);
1046 $conf->{$opt} = $value;
1047 } elsif ($opt eq 'nameserver') {
1048 next if $hotplug_error->($opt);
1049 my $list = PVE::LXC::verify_nameserver_list($value);
1050 $conf->{$opt} = $list;
1051 } elsif ($opt eq 'searchdomain') {
1052 next if $hotplug_error->($opt);
1053 my $list = PVE::LXC::verify_searchdomain_list($value);
1054 $conf->{$opt} = $list;
1055 } elsif ($opt eq 'cores') {
1056 $conf->{$opt} = $value;# rest is handled by pvestatd
1057 } elsif ($opt eq 'cpulimit') {
1058 if ($value == 0) {
1059 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1060 } else {
1061 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1062 }
1063 $conf->{$opt} = $value;
1064 } elsif ($opt eq 'cpuunits') {
1065 $conf->{$opt} = $value;
1066 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1067 } elsif ($opt eq 'description') {
1068 $conf->{$opt} = $value;
1069 } elsif ($opt =~ m/^net(\d+)$/) {
1070 my $netid = $1;
1071 my $net = PVE::LXC::Config->parse_lxc_network($value);
1072 if (!$running) {
1073 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1074 } else {
1075 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1076 }
1077 } elsif ($opt eq 'protection') {
1078 $conf->{$opt} = $value ? 1 : 0;
1079 } elsif ($opt =~ m/^mp(\d+)$/) {
1080 next if $hotplug_error->($opt);
1081 PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1082 my $old = $conf->{$opt};
1083 my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
1084 if ($mp->{type} eq 'volume') {
1085 &$check_content_type($mp);
1086 $used_volids->{$mp->{volume}} = 1;
1087 &$rescan_volume($mp);
1088 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp);
1089 } else {
1090 $conf->{$opt} = $value;
1091 }
1092 if (defined($old)) {
1093 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
1094 if ($mp->{type} eq 'volume') {
1095 PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1096 }
1097 }
1098 $new_disks = 1;
1099 } elsif ($opt eq 'rootfs') {
1100 next if $hotplug_error->($opt);
1101 PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1102 my $old = $conf->{$opt};
1103 my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
1104 if ($mp->{type} eq 'volume') {
1105 &$check_content_type($mp);
1106 $used_volids->{$mp->{volume}} = 1;
1107 &$rescan_volume($mp);
1108 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp, 1);
1109 } else {
1110 $conf->{$opt} = $value;
1111 }
1112 if (defined($old)) {
1113 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
1114 if ($mp->{type} eq 'volume') {
1115 PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1116 }
1117 }
1118 $new_disks = 1;
1119 } elsif ($opt eq 'unprivileged') {
1120 die "unable to modify read-only option: '$opt'\n";
1121 } elsif ($opt eq 'ostype') {
1122 next if $hotplug_error->($opt);
1123 $conf->{$opt} = $value;
1124 } elsif ($opt eq 'features') {
1125 next if $hotplug_error->($opt);
1126 $conf->{$opt} = $value;
1127 } elsif ($opt eq 'hookscript') {
1128 PVE::GuestHelpers::check_hookscript($value);
1129 $conf->{$opt} = $value;
1130 } else {
1131 die "implement me: $opt";
1132 }
1133
1134 PVE::LXC::Config->write_config($vmid, $conf) if $running;
1135 }
1136
1137 # Apply deletions and creations of new volumes
1138 if (@deleted_volumes) {
1139 my $storage_cfg = PVE::Storage::config();
1140 foreach my $volume (@deleted_volumes) {
1141 next if $used_volids->{$volume}; # could have been re-added, too
1142 # also check for references in snapshots
1143 next if $class->is_volume_in_use($conf, $volume, 1);
1144 PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
1145 }
1146 }
1147
1148 if ($new_disks) {
1149 my $storage_cfg = PVE::Storage::config();
1150 PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
1151 }
1152
1153 # This should be the last thing we do here
1154 if ($running && scalar(@nohotplug)) {
1155 die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
1156 }
1157 }
1158
1159 sub check_type {
1160 my ($class, $key, $value) = @_;
1161
1162 die "unknown setting '$key'\n" if !$confdesc->{$key};
1163
1164 my $type = $confdesc->{$key}->{type};
1165
1166 if (!defined($value)) {
1167 die "got undefined value\n";
1168 }
1169
1170 if ($value =~ m/[\n\r]/) {
1171 die "property contains a line feed\n";
1172 }
1173
1174 if ($type eq 'boolean') {
1175 return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1176 return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1177 die "type check ('boolean') failed - got '$value'\n";
1178 } elsif ($type eq 'integer') {
1179 return int($1) if $value =~ m/^(\d+)$/;
1180 die "type check ('integer') failed - got '$value'\n";
1181 } elsif ($type eq 'number') {
1182 return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1183 die "type check ('number') failed - got '$value'\n";
1184 } elsif ($type eq 'string') {
1185 if (my $fmt = $confdesc->{$key}->{format}) {
1186 PVE::JSONSchema::check_format($fmt, $value);
1187 return $value;
1188 }
1189 return $value;
1190 } else {
1191 die "internal error"
1192 }
1193 }
1194
1195
1196 # add JSON properties for create and set function
1197 sub json_config_properties {
1198 my ($class, $prop) = @_;
1199
1200 foreach my $opt (keys %$confdesc) {
1201 next if $opt eq 'parent' || $opt eq 'snaptime';
1202 next if $prop->{$opt};
1203 $prop->{$opt} = $confdesc->{$opt};
1204 }
1205
1206 return $prop;
1207 }
1208
1209 sub __parse_ct_mountpoint_full {
1210 my ($class, $desc, $data, $noerr) = @_;
1211
1212 $data //= '';
1213
1214 my $res;
1215 eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1216 if ($@) {
1217 return undef if $noerr;
1218 die $@;
1219 }
1220
1221 if (defined(my $size = $res->{size})) {
1222 $size = PVE::JSONSchema::parse_size($size);
1223 if (!defined($size)) {
1224 return undef if $noerr;
1225 die "invalid size: $size\n";
1226 }
1227 $res->{size} = $size;
1228 }
1229
1230 $res->{type} = $class->classify_mountpoint($res->{volume});
1231
1232 return $res;
1233 };
1234
1235 sub parse_ct_rootfs {
1236 my ($class, $data, $noerr) = @_;
1237
1238 my $res = $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1239
1240 $res->{mp} = '/' if defined($res);
1241
1242 return $res;
1243 }
1244
1245 sub parse_ct_mountpoint {
1246 my ($class, $data, $noerr) = @_;
1247
1248 return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1249 }
1250
1251 sub print_ct_mountpoint {
1252 my ($class, $info, $nomp) = @_;
1253 my $skip = [ 'type' ];
1254 push @$skip, 'mp' if $nomp;
1255 return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1256 }
1257
1258 sub print_lxc_network {
1259 my ($class, $net) = @_;
1260 return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1261 }
1262
1263 sub parse_lxc_network {
1264 my ($class, $data) = @_;
1265
1266 my $res = {};
1267
1268 return $res if !$data;
1269
1270 $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1271
1272 $res->{type} = 'veth';
1273 if (!$res->{hwaddr}) {
1274 my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1275 $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1276 }
1277
1278 return $res;
1279 }
1280
1281 sub parse_features {
1282 my ($class, $data) = @_;
1283 return {} if !$data;
1284 return PVE::JSONSchema::parse_property_string($features_desc, $data);
1285 }
1286
1287 sub option_exists {
1288 my ($class, $name) = @_;
1289
1290 return defined($confdesc->{$name});
1291 }
1292 # END JSON config code
1293
1294 my $LXC_FASTPLUG_OPTIONS= {
1295 'description' => 1,
1296 'onboot' => 1,
1297 'startup' => 1,
1298 'protection' => 1,
1299 'hostname' => 1,
1300 'hookscript' => 1,
1301 'cores' => 1,
1302 'tags' => 1,
1303 };
1304
1305 sub vmconfig_hotplug_pending {
1306 my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1307
1308 my $pid = PVE::LXC::find_lxc_pid($vmid);
1309 my $rootdir = "/proc/$pid/root";
1310
1311 my $add_hotplug_error = sub {
1312 my ($opt, $msg) = @_;
1313 $errors->{$opt} = "unable to hotplug $opt: $msg";
1314 };
1315
1316 my $changes;
1317 foreach my $opt (keys %{$conf->{pending}}) { # add/change
1318 next if $selection && !$selection->{$opt};
1319 if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1320 $conf->{$opt} = delete $conf->{pending}->{$opt};
1321 $changes = 1;
1322 }
1323 }
1324
1325 if ($changes) {
1326 $class->write_config($vmid, $conf);
1327 }
1328
1329 # There's no separate swap size to configure, there's memory and "total"
1330 # memory (iow. memory+swap). This means we have to change them together.
1331 my $hotplug_memory_done;
1332 my $hotplug_memory = sub {
1333 my ($wanted_memory, $wanted_swap) = @_;
1334 my $old_memory = ($conf->{memory} || $confdesc->{memory}->{default});
1335 my $old_swap = ($conf->{swap} || $confdesc->{swap}->{default});
1336
1337 $wanted_memory //= $old_memory;
1338 $wanted_swap //= $old_swap;
1339
1340 my $total = $wanted_memory + $wanted_swap;
1341 my $old_total = $old_memory + $old_swap;
1342
1343 if ($total > $old_total) {
1344 PVE::LXC::write_cgroup_value("memory", $vmid,
1345 "memory.memsw.limit_in_bytes",
1346 int($total*1024*1024));
1347 PVE::LXC::write_cgroup_value("memory", $vmid,
1348 "memory.limit_in_bytes",
1349 int($wanted_memory*1024*1024));
1350 } else {
1351 PVE::LXC::write_cgroup_value("memory", $vmid,
1352 "memory.limit_in_bytes",
1353 int($wanted_memory*1024*1024));
1354 PVE::LXC::write_cgroup_value("memory", $vmid,
1355 "memory.memsw.limit_in_bytes",
1356 int($total*1024*1024));
1357 }
1358 $hotplug_memory_done = 1;
1359 };
1360
1361 my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1362 # FIXME: $force deletion is not implemented for CTs
1363 while (my ($opt, undef) = each %$pending_delete_hash) {
1364 next if $selection && !$selection->{$opt};
1365 eval {
1366 if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1367 # pass
1368 } elsif ($opt =~ m/^unused(\d+)$/) {
1369 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1370 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1371 } elsif ($opt eq 'swap') {
1372 $hotplug_memory->(undef, 0);
1373 } elsif ($opt eq 'cpulimit') {
1374 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", -1);
1375 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1376 } elsif ($opt eq 'cpuunits') {
1377 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shared", $confdesc->{cpuunits}->{default});
1378 } elsif ($opt =~ m/^net(\d)$/) {
1379 my $netid = $1;
1380 PVE::Network::veth_delete("veth${vmid}i$netid");
1381 } else {
1382 die "skip\n"; # skip non-hotpluggable opts
1383 }
1384 };
1385 if (my $err = $@) {
1386 $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1387 } else {
1388 delete $conf->{$opt};
1389 $class->remove_from_pending_delete($conf, $opt);
1390 }
1391 }
1392
1393 foreach my $opt (keys %{$conf->{pending}}) {
1394 next if $opt eq 'delete'; # just to be sure
1395 next if $selection && !$selection->{$opt};
1396 my $value = $conf->{pending}->{$opt};
1397 eval {
1398 if ($opt eq 'cpulimit') {
1399 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", 100000);
1400 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1401 } elsif ($opt eq 'cpuunits') {
1402 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1403 } elsif ($opt =~ m/^net(\d+)$/) {
1404 my $netid = $1;
1405 my $net = $class->parse_lxc_network($value);
1406 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1407 } elsif ($opt eq 'memory' || $opt eq 'swap') {
1408 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1409 $hotplug_memory->($conf->{pending}->{memory}, $conf->{pending}->{swap});
1410 }
1411 } else {
1412 die "skip\n"; # skip non-hotpluggable
1413 }
1414 };
1415 if (my $err = $@) {
1416 $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1417 } else {
1418 $conf->{$opt} = $value;
1419 delete $conf->{pending}->{$opt};
1420 }
1421 }
1422
1423 $class->write_config($vmid, $conf);
1424 }
1425
1426 sub vmconfig_apply_pending {
1427 my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1428
1429 my $add_apply_error = sub {
1430 my ($opt, $msg) = @_;
1431 my $err_msg = "unable to apply pending change $opt : $msg";
1432 $errors->{$opt} = $err_msg;
1433 warn $err_msg;
1434 };
1435
1436 my $rescan_volume = sub {
1437 my ($mp) = @_;
1438 eval {
1439 $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1440 if !defined($mp->{size});
1441 };
1442 warn "Could not rescan volume size - $@\n" if $@;
1443 };
1444
1445 my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1446 # FIXME: $force deletion is not implemented for CTs
1447 while (my ($opt, undef) = each %$pending_delete_hash) {
1448 next if $selection && !$selection->{$opt};
1449 $class->cleanup_pending($conf);
1450 eval {
1451 if ($opt =~ m/^mp(\d+)$/) {
1452 my $mp = $class->parse_ct_mountpoint($conf->{$opt});
1453 if ($mp->{type} eq 'volume') {
1454 $class->add_unused_volume($conf, $mp->{volume})
1455 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1456 }
1457 } elsif ($opt =~ m/^unused(\d+)$/) {
1458 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1459 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1460 }
1461 };
1462 if (my $err = $@) {
1463 $add_apply_error->($opt, $err);
1464 } else {
1465 delete $conf->{$opt};
1466 $class->remove_from_pending_delete($conf, $opt);
1467 }
1468 }
1469
1470 foreach my $opt (keys %{$conf->{pending}}) { # add/change
1471 next if $opt eq 'delete'; # just to be sure
1472 next if $selection && !$selection->{$opt};
1473 eval {
1474 if ($opt =~ m/^mp(\d+)$/) {
1475 my $mp = $class->parse_ct_mountpoint($conf->{pending}->{$opt});
1476 my $old = $conf->{$opt};
1477 if ($mp->{type} eq 'volume') {
1478 if ($mp->{volume} =~ $PVE::LXC::NEW_DISK_RE) {
1479 PVE::LXC::create_disks($storecfg, $vmid, { $opt => $conf->{pending}->{$opt} }, $conf, 1);
1480 } else {
1481 $rescan_volume->($mp);
1482 $conf->{pending}->{$opt} = $class->print_ct_mountpoint($mp);
1483 }
1484 }
1485 if (defined($old)) {
1486 my $mp = $class->parse_ct_mountpoint($old);
1487 if ($mp->{type} eq 'volume') {
1488 $class->add_unused_volume($conf, $mp->{volume})
1489 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1490 }
1491 }
1492 }
1493 };
1494 if (my $err = $@) {
1495 $add_apply_error->($opt, $err);
1496 } else {
1497 $class->cleanup_pending($conf);
1498 $conf->{$opt} = delete $conf->{pending}->{$opt};
1499 }
1500 }
1501
1502 $class->write_config($vmid, $conf);
1503 }
1504
1505 sub classify_mountpoint {
1506 my ($class, $vol) = @_;
1507 if ($vol =~ m!^/!) {
1508 return 'device' if $vol =~ m!^/dev/!;
1509 return 'bind';
1510 }
1511 return 'volume';
1512 }
1513
1514 my $__is_volume_in_use = sub {
1515 my ($class, $config, $volid) = @_;
1516 my $used = 0;
1517
1518 $class->foreach_mountpoint($config, sub {
1519 my ($ms, $mountpoint) = @_;
1520 return if $used;
1521 $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1522 });
1523
1524 return $used;
1525 };
1526
1527 sub is_volume_in_use_by_snapshots {
1528 my ($class, $config, $volid) = @_;
1529
1530 if (my $snapshots = $config->{snapshots}) {
1531 foreach my $snap (keys %$snapshots) {
1532 return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1533 }
1534 }
1535
1536 return 0;
1537 }
1538
1539 sub is_volume_in_use {
1540 my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1541 return 1 if $__is_volume_in_use->($class, $config, $volid);
1542 return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1543 return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending}, $volid);
1544 return 0;
1545 }
1546
1547 sub has_dev_console {
1548 my ($class, $conf) = @_;
1549
1550 return !(defined($conf->{console}) && !$conf->{console});
1551 }
1552
1553 sub has_lxc_entry {
1554 my ($class, $conf, $keyname) = @_;
1555
1556 if (my $lxcconf = $conf->{lxc}) {
1557 foreach my $entry (@$lxcconf) {
1558 my ($key, undef) = @$entry;
1559 return 1 if $key eq $keyname;
1560 }
1561 }
1562
1563 return 0;
1564 }
1565
1566 sub get_tty_count {
1567 my ($class, $conf) = @_;
1568
1569 return $conf->{tty} // $confdesc->{tty}->{default};
1570 }
1571
1572 sub get_cmode {
1573 my ($class, $conf) = @_;
1574
1575 return $conf->{cmode} // $confdesc->{cmode}->{default};
1576 }
1577
1578 sub mountpoint_names {
1579 my ($class, $reverse) = @_;
1580
1581 my @names = ('rootfs');
1582
1583 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1584 push @names, "mp$i";
1585 }
1586
1587 return $reverse ? reverse @names : @names;
1588 }
1589
1590 sub foreach_mountpoint_full {
1591 my ($class, $conf, $reverse, $func, @param) = @_;
1592
1593 my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1594 foreach my $key (@$mps) {
1595 my $value = $conf->{$key};
1596 my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1597 next if !defined($mountpoint);
1598
1599 &$func($key, $mountpoint, @param);
1600 }
1601 }
1602
1603 sub foreach_mountpoint {
1604 my ($class, $conf, $func, @param) = @_;
1605
1606 $class->foreach_mountpoint_full($conf, 0, $func, @param);
1607 }
1608
1609 sub foreach_mountpoint_reverse {
1610 my ($class, $conf, $func, @param) = @_;
1611
1612 $class->foreach_mountpoint_full($conf, 1, $func, @param);
1613 }
1614
1615 sub get_vm_volumes {
1616 my ($class, $conf, $excludes) = @_;
1617
1618 my $vollist = [];
1619
1620 $class->foreach_mountpoint($conf, sub {
1621 my ($ms, $mountpoint) = @_;
1622
1623 return if $excludes && $ms eq $excludes;
1624
1625 my $volid = $mountpoint->{volume};
1626 return if !$volid || $mountpoint->{type} ne 'volume';
1627
1628 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1629 return if !$sid;
1630
1631 push @$vollist, $volid;
1632 });
1633
1634 return $vollist;
1635 }
1636
1637 sub get_replicatable_volumes {
1638 my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1639
1640 my $volhash = {};
1641
1642 my $test_volid = sub {
1643 my ($volid, $mountpoint) = @_;
1644
1645 return if !$volid;
1646
1647 my $mptype = $mountpoint->{type};
1648 my $replicate = $mountpoint->{replicate} // 1;
1649
1650 if ($mptype ne 'volume') {
1651 # skip bindmounts if replicate = 0 even for cleanup,
1652 # since bind mounts could not have been replicated ever
1653 return if !$replicate;
1654 die "unable to replicate mountpoint type '$mptype'\n";
1655 }
1656
1657 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1658 return if !$storeid;
1659
1660 my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1661 return if $scfg->{shared};
1662
1663 my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1664 return if !$owner || ($owner != $vmid);
1665
1666 die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1667
1668 return if !$cleanup && !$replicate;
1669
1670 if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1671 return if $cleanup || $noerr;
1672 die "missing replicate feature on volume '$volid'\n";
1673 }
1674
1675 $volhash->{$volid} = 1;
1676 };
1677
1678 $class->foreach_mountpoint($conf, sub {
1679 my ($ms, $mountpoint) = @_;
1680 $test_volid->($mountpoint->{volume}, $mountpoint);
1681 });
1682
1683 foreach my $snapname (keys %{$conf->{snapshots}}) {
1684 my $snap = $conf->{snapshots}->{$snapname};
1685 $class->foreach_mountpoint($snap, sub {
1686 my ($ms, $mountpoint) = @_;
1687 $test_volid->($mountpoint->{volume}, $mountpoint);
1688 });
1689 }
1690
1691 # add 'unusedX' volumes to volhash
1692 foreach my $key (keys %$conf) {
1693 if ($key =~ m/^unused/) {
1694 $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1695 }
1696 }
1697
1698 return $volhash;
1699 }
1700
1701 1;