1 package PVE
::LXC
::Config
;
6 use PVE
::AbstractConfig
;
7 use PVE
::Cluster
qw(cfs_register_file);
10 use PVE
::JSONSchema
qw(get_standard_option);
13 use base
qw(PVE::AbstractConfig);
15 my $nodename = PVE
::INotify
::nodename
();
16 my $lock_handles = {};
17 my $lockdir = "/run/lock/lxc";
19 mkdir "/etc/pve/nodes/$nodename/lxc";
20 my $MAX_MOUNT_POINTS = 256;
21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
23 # BEGIN implemented abstract methods from PVE::AbstractConfig
29 sub __config_max_unused_disks
{
32 return $MAX_UNUSED_DISKS;
35 sub config_file_lock
{
36 my ($class, $vmid) = @_;
38 return "$lockdir/pve-config-${vmid}.lock";
42 my ($class, $vmid, $node) = @_;
44 $node = $nodename if !$node;
45 return "nodes/$node/lxc/$vmid.conf";
48 sub mountpoint_backup_enabled
{
49 my ($class, $mp_key, $mountpoint) = @_;
51 return 1 if $mp_key eq 'rootfs';
53 return 0 if $mountpoint->{type
} ne 'volume';
55 return 1 if $mountpoint->{backup
};
61 my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
64 $class->foreach_mountpoint($conf, sub {
65 my ($ms, $mountpoint) = @_;
67 return if $err; # skip further test
68 return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
71 if !PVE
::Storage
::volume_has_feature
($storecfg, $feature,
72 $mountpoint->{volume
},
79 sub __snapshot_save_vmstate
{
80 my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
81 die "implement me - snapshot_save_vmstate\n";
84 sub __snapshot_check_running
{
85 my ($class, $vmid) = @_;
86 return PVE
::LXC
::check_running
($vmid);
89 sub __snapshot_check_freeze_needed
{
90 my ($class, $vmid, $config, $save_vmstate) = @_;
92 my $ret = $class->__snapshot_check_running($vmid);
96 sub __snapshot_freeze
{
97 my ($class, $vmid, $unfreeze) = @_;
100 eval { PVE
::Tools
::run_command
(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
103 PVE
::Tools
::run_command
(['/usr/bin/lxc-freeze', '-n', $vmid]);
104 PVE
::LXC
::sync_container_namespace
($vmid);
108 sub __snapshot_create_vol_snapshot
{
109 my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
111 my $storecfg = PVE
::Storage
::config
();
113 return if $snapname eq 'vzdump' &&
114 !$class->mountpoint_backup_enabled($ms, $mountpoint);
116 PVE
::Storage
::volume_snapshot
($storecfg, $mountpoint->{volume
}, $snapname);
119 sub __snapshot_delete_remove_drive
{
120 my ($class, $snap, $remove_drive) = @_;
122 if ($remove_drive eq 'vmstate') {
123 die "implement me - saving vmstate\n";
125 my $value = $snap->{$remove_drive};
126 my $mountpoint = $remove_drive eq 'rootfs' ?
$class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
127 delete $snap->{$remove_drive};
129 $class->add_unused_volume($snap, $mountpoint->{volume
})
130 if ($mountpoint->{type
} eq 'volume');
134 sub __snapshot_delete_vmstate_file
{
135 my ($class, $snap, $force) = @_;
137 die "implement me - saving vmstate\n";
140 sub __snapshot_delete_vol_snapshot
{
141 my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
143 return if $snapname eq 'vzdump' &&
144 !$class->mountpoint_backup_enabled($ms, $mountpoint);
146 my $storecfg = PVE
::Storage
::config
();
147 PVE
::Storage
::volume_snapshot_delete
($storecfg, $mountpoint->{volume
}, $snapname);
148 push @$unused, $mountpoint->{volume
};
151 sub __snapshot_rollback_vol_possible
{
152 my ($class, $mountpoint, $snapname) = @_;
154 my $storecfg = PVE
::Storage
::config
();
155 PVE
::Storage
::volume_rollback_is_possible
($storecfg, $mountpoint->{volume
}, $snapname);
158 sub __snapshot_rollback_vol_rollback
{
159 my ($class, $mountpoint, $snapname) = @_;
161 my $storecfg = PVE
::Storage
::config
();
162 PVE
::Storage
::volume_snapshot_rollback
($storecfg, $mountpoint->{volume
}, $snapname);
165 sub __snapshot_rollback_vm_stop
{
166 my ($class, $vmid) = @_;
168 PVE
::LXC
::vm_stop
($vmid, 1)
169 if $class->__snapshot_check_running($vmid);
172 sub __snapshot_rollback_vm_start
{
173 my ($class, $vmid, $vmstate, $data);
175 die "implement me - save vmstate\n";
178 sub __snapshot_rollback_get_unused
{
179 my ($class, $conf, $snap) = @_;
183 $class->__snapshot_foreach_volume($conf, sub {
184 my ($vs, $volume) = @_;
186 return if $volume->{type
} ne 'volume';
189 my $volid = $volume->{volume
};
191 $class->__snapshot_foreach_volume($snap, sub {
192 my ($ms, $mountpoint) = @_;
195 return if ($mountpoint->{type
} ne 'volume');
198 if ($mountpoint->{volume
} && $mountpoint->{volume
} eq $volid);
201 push @$unused, $volid if !$found;
207 sub __snapshot_foreach_volume
{
208 my ($class, $conf, $func) = @_;
210 $class->foreach_mountpoint($conf, $func);
213 # END implemented abstract methods from PVE::AbstractConfig
215 # BEGIN JSON config code
217 cfs_register_file
('/lxc/', \
&parse_pct_config
, \
&write_pct_config
);
220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
222 sub is_valid_mount_option
{
224 return $option =~ $valid_mount_option_re;
231 format
=> 'pve-lxc-mp-string',
232 format_description
=> 'volume',
233 description
=> 'Volume, device or directory to mount into the container.',
237 format
=> 'disk-size',
238 format_description
=> 'DiskSize',
239 description
=> 'Volume size (read only value).',
244 description
=> 'Explicitly enable or disable ACL support.',
250 description
=> 'Extra mount options for rootfs/mps.',
251 format_description
=> 'opt[;opt...]',
252 pattern
=> qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
256 description
=> 'Read-only mount point',
261 description
=> 'Enable user quotas inside the container (not supported with zfs subvolumes)',
266 description
=> 'Will include this volume to a storage replica job.',
272 description
=> 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
273 verbose_description
=> "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
279 PVE
::JSONSchema
::register_standard_option
('pve-ct-rootfs', {
280 type
=> 'string', format
=> $rootfs_desc,
281 description
=> "Use volume as container root.",
285 my $features_desc = {
289 description
=> "Allow mounting file systems of specific types."
290 ." This should be a list of file system types as used with the mount command."
291 ." Note that this can have negative effects on the container's security."
292 ." With access to a loop device, mounting a file can circumvent the mknod"
293 ." permission of the devices cgroup, mounting an NFS file system can"
294 ." block the host's I/O completely and prevent it from rebooting, etc.",
295 format_description
=> 'fstype;fstype;...',
296 pattern
=> qr/[a-zA-Z0-9_; ]+/,
302 description
=> "Allow nesting."
303 ." Best used with unprivileged containers with additional id mapping."
304 ." Note that this will expose procfs and sysfs contents of the host"
311 description
=> "For unprivileged containers only: Allow the use of the keyctl() system call."
312 ." This is required to use docker inside a container."
313 ." By default unprivileged containers will see this system call as non-existent."
314 ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
315 ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
316 ." Essentially, you can choose between running systemd-networkd or docker.",
322 description
=> "Allow using 'fuse' file systems in a container."
323 ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
331 description
=> "Lock/unlock the VM.",
332 enum
=> [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
337 description
=> "Specifies whether a VM will be started during system bootup.",
340 startup
=> get_standard_option
('pve-startup-order'),
344 description
=> "Enable/disable Template.",
350 enum
=> ['amd64', 'i386', 'arm64', 'armhf'],
351 description
=> "OS architecture type.",
357 enum
=> [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
358 description
=> "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
363 description
=> "Attach a console device (/dev/console) to the container.",
369 description
=> "Specify the number of tty available to the container",
377 description
=> "The number of cores assigned to the container. A container can use all available cores by default.",
384 description
=> "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
392 description
=> "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
400 description
=> "Amount of RAM for the VM in MB.",
407 description
=> "Amount of SWAP for the VM in MB.",
413 description
=> "Set a host name for the container.",
414 type
=> 'string', format
=> 'dns-name',
420 description
=> "Container description. Only used on the configuration web interface.",
424 type
=> 'string', format
=> 'dns-name-list',
425 description
=> "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
429 type
=> 'string', format
=> 'address-list',
430 description
=> "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
432 rootfs
=> get_standard_option
('pve-ct-rootfs'),
435 type
=> 'string', format
=> 'pve-configid',
437 description
=> "Parent snapshot name. This is used internally, and should not be modified.",
441 description
=> "Timestamp for snapshots.",
447 description
=> "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
449 enum
=> ['shell', 'console', 'tty'],
455 description
=> "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
461 description
=> "Makes the container run as unprivileged user. (Should not be modified manually.)",
467 format
=> $features_desc,
468 description
=> "Allow containers access to advanced features.",
473 format
=> 'pve-volume-id',
474 description
=> 'Script that will be exectued during various steps in the containers lifetime.',
478 my $valid_lxc_conf_keys = {
479 'lxc.apparmor.profile' => 1,
480 'lxc.apparmor.allow_incomplete' => 1,
481 'lxc.apparmor.allow_nesting' => 1,
482 'lxc.apparmor.raw' => 1,
483 'lxc.selinux.context' => 1,
487 'lxc.signal.halt' => 1,
488 'lxc.signal.reboot' => 1,
489 'lxc.signal.stop' => 1,
492 'lxc.console.logfile' => 1,
493 'lxc.console.path' => 1,
495 'lxc.devtty.dir' => 1,
496 'lxc.hook.autodev' => 1,
499 'lxc.mount.fstab' => 1,
500 'lxc.mount.entry' => 1,
501 'lxc.mount.auto' => 1,
502 'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
503 'lxc.rootfs.mount' => 1,
504 'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
505 ', please use mount point options in the "rootfs" key',
511 'lxc.seccomp.profile' => 1,
512 'lxc.seccomp.notify.proxy' => 1,
513 'lxc.seccomp.notify.cookie' => 1,
515 'lxc.hook.pre-start' => 1,
516 'lxc.hook.pre-mount' => 1,
517 'lxc.hook.mount' => 1,
518 'lxc.hook.start' => 1,
519 'lxc.hook.stop' => 1,
520 'lxc.hook.post-stop' => 1,
521 'lxc.hook.clone' => 1,
522 'lxc.hook.destroy' => 1,
523 'lxc.log.level' => 1,
525 'lxc.start.auto' => 1,
526 'lxc.start.delay' => 1,
527 'lxc.start.order' => 1,
529 'lxc.environment' => 1,
531 # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
532 'lxc.sysctl.fs.mqueue' => 1,
533 'lxc.sysctl.kernel.msgmax' => 1,
534 'lxc.sysctl.kernel.msgmnb' => 1,
535 'lxc.sysctl.kernel.msgmni' => 1,
536 'lxc.sysctl.kernel.sem' => 1,
537 'lxc.sysctl.kernel.shmall' => 1,
538 'lxc.sysctl.kernel.shmmax' => 1,
539 'lxc.sysctl.kernel.shmmni' => 1,
540 'lxc.sysctl.kernel.shm_rmid_forced' => 1,
543 my $deprecated_lxc_conf_keys = {
544 # Deprecated (removed with lxc 3.0):
545 'lxc.aa_profile' => 'lxc.apparmor.profile',
546 'lxc.aa_allow_incomplete' => 'lxc.apparmor.allow_incomplete',
547 'lxc.console' => 'lxc.console.path',
548 'lxc.devttydir' => 'lxc.tty.dir',
549 'lxc.haltsignal' => 'lxc.signal.halt',
550 'lxc.rebootsignal' => 'lxc.signal.reboot',
551 'lxc.stopsignal' => 'lxc.signal.stop',
552 'lxc.id_map' => 'lxc.idmap',
553 'lxc.init_cmd' => 'lxc.init.cmd',
554 'lxc.loglevel' => 'lxc.log.level',
555 'lxc.logfile' => 'lxc.log.file',
556 'lxc.mount' => 'lxc.mount.fstab',
557 'lxc.network.type' => 'lxc.net.INDEX.type',
558 'lxc.network.flags' => 'lxc.net.INDEX.flags',
559 'lxc.network.link' => 'lxc.net.INDEX.link',
560 'lxc.network.mtu' => 'lxc.net.INDEX.mtu',
561 'lxc.network.name' => 'lxc.net.INDEX.name',
562 'lxc.network.hwaddr' => 'lxc.net.INDEX.hwaddr',
563 'lxc.network.ipv4' => 'lxc.net.INDEX.ipv4.address',
564 'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
565 'lxc.network.ipv6' => 'lxc.net.INDEX.ipv6.address',
566 'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
567 'lxc.network.script.up' => 'lxc.net.INDEX.script.up',
568 'lxc.network.script.down' => 'lxc.net.INDEX.script.down',
569 'lxc.pts' => 'lxc.pty.max',
570 'lxc.se_context' => 'lxc.selinux.context',
571 'lxc.seccomp' => 'lxc.seccomp.profile',
572 'lxc.tty' => 'lxc.tty.max',
573 'lxc.utsname' => 'lxc.uts.name',
576 sub is_valid_lxc_conf_key
{
577 my ($vmid, $key) = @_;
578 if ($key =~ /^lxc\.limit\./) {
579 warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
582 if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
583 warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
586 my $validity = $valid_lxc_conf_keys->{$key};
587 return $validity if defined($validity);
588 return 1 if $key =~ /^lxc\.cgroup\./ # allow all cgroup values
589 || $key =~ /^lxc\.prlimit\./ # allow all prlimits
590 || $key =~ /^lxc\.net\./; # allow custom network definitions
594 our $netconf_desc = {
598 description
=> "Network interface type.",
603 format_description
=> 'string',
604 description
=> 'Name of the network device as seen from inside the container. (lxc.network.name)',
605 pattern
=> '[-_.\w\d]+',
609 format_description
=> 'bridge',
610 description
=> 'Bridge to attach the network device to.',
611 pattern
=> '[-_.\w\d]+',
614 hwaddr
=> get_standard_option
('mac-addr', {
615 description
=> 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
619 description
=> 'Maximum transfer unit of the interface. (lxc.network.mtu)',
620 minimum
=> 64, # minimum ethernet frame is 64 bytes
625 format
=> 'pve-ipv4-config',
626 format_description
=> '(IPv4/CIDR|dhcp|manual)',
627 description
=> 'IPv4 address in CIDR format.',
633 format_description
=> 'GatewayIPv4',
634 description
=> 'Default gateway for IPv4 traffic.',
639 format
=> 'pve-ipv6-config',
640 format_description
=> '(IPv6/CIDR|auto|dhcp|manual)',
641 description
=> 'IPv6 address in CIDR format.',
647 format_description
=> 'GatewayIPv6',
648 description
=> 'Default gateway for IPv6 traffic.',
653 description
=> "Controls whether this interface's firewall rules should be used.",
660 description
=> "VLAN tag for this interface.",
665 pattern
=> qr/\d+(?:;\d+)*/,
666 format_description
=> 'vlanid[;vlanid...]',
667 description
=> "VLAN ids to pass through the interface",
672 format_description
=> 'mbps',
673 description
=> "Apply rate limiting to the interface",
677 PVE
::JSONSchema
::register_format
('pve-lxc-network', $netconf_desc);
679 my $MAX_LXC_NETWORKS = 10;
680 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
681 $confdesc->{"net$i"} = {
683 type
=> 'string', format
=> $netconf_desc,
684 description
=> "Specifies network interfaces for the container.",
688 PVE
::JSONSchema
::register_format
('pve-lxc-mp-string', \
&verify_lxc_mp_string
);
689 sub verify_lxc_mp_string
{
690 my ($mp, $noerr) = @_;
694 # /. or /.. at the end
695 # ../ at the beginning
697 if($mp =~ m
@/\.\
.?
/@ ||
700 return undef if $noerr;
701 die "$mp contains illegal character sequences\n";
710 description
=> 'Whether to include the mount point in backups.',
711 verbose_description
=> 'Whether to include the mount point in backups '.
712 '(only used for volume mount points).',
717 format
=> 'pve-lxc-mp-string',
718 format_description
=> 'Path',
719 description
=> 'Path to the mount point as seen from inside the container '.
720 '(must not contain symlinks).',
721 verbose_description
=> "Path to the mount point as seen from inside the container.\n\n".
722 "NOTE: Must not contain any symlinks for security reasons."
725 PVE
::JSONSchema
::register_format
('pve-ct-mountpoint', $mp_desc);
729 type
=> 'string', format
=> 'pve-volume-id',
730 description
=> "Reference to unused volumes. This is used internally, and should not be modified manually.",
733 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
734 $confdesc->{"mp$i"} = {
736 type
=> 'string', format
=> $mp_desc,
737 description
=> "Use volume as container mount point.",
742 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
743 $confdesc->{"unused$i"} = $unuseddesc;
746 sub parse_pct_config
{
747 my ($filename, $raw) = @_;
749 return undef if !defined($raw);
752 digest
=> Digest
::SHA
::sha1_hex
($raw),
757 $filename =~ m
|/lxc/(\d
+).conf
$|
758 || die "got strange filename '$filename'";
766 my @lines = split(/\n/, $raw);
767 foreach my $line (@lines) {
768 next if $line =~ m/^\s*$/;
770 if ($line =~ m/^\[pve:pending\]\s*$/i) {
771 $section = 'pending';
772 $conf->{description
} = $descr if $descr;
774 $conf = $res->{$section} = {};
776 } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
778 $conf->{description
} = $descr if $descr;
780 $conf = $res->{snapshots
}->{$section} = {};
784 if ($line =~ m/^\#(.*)\s*$/) {
785 $descr .= PVE
::Tools
::decode_text
($1) . "\n";
789 if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
792 my $validity = is_valid_lxc_conf_key
($vmid, $key);
793 if ($validity eq 1) {
794 push @{$conf->{lxc
}}, [$key, $value];
795 } elsif (my $errmsg = $validity) {
796 warn "vm $vmid - $key: $errmsg\n";
798 warn "vm $vmid - unable to parse config: $line\n";
800 } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
801 $descr .= PVE
::Tools
::decode_text
($2);
802 } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
803 $conf->{snapstate
} = $1;
804 } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
806 if ($section eq 'pending') {
807 $conf->{delete} = $value;
809 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
811 } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
814 eval { $value = PVE
::LXC
::Config-
>check_type($key, $value); };
815 warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
816 $conf->{$key} = $value;
818 warn "vm $vmid - unable to parse config: $line\n";
822 $conf->{description
} = $descr if $descr;
824 delete $res->{snapstate
}; # just to be sure
829 sub write_pct_config
{
830 my ($filename, $conf) = @_;
832 delete $conf->{snapstate
}; # just to be sure
834 my $volidlist = PVE
::LXC
::Config-
>get_vm_volumes($conf);
835 my $used_volids = {};
836 foreach my $vid (@$volidlist) {
837 $used_volids->{$vid} = 1;
840 # remove 'unusedX' settings if the volume is still used
841 foreach my $key (keys %$conf) {
842 my $value = $conf->{$key};
843 if ($key =~ m/^unused/ && $used_volids->{$value}) {
844 delete $conf->{$key};
848 my $generate_raw_config = sub {
853 # add description as comment to top of file
854 my $descr = $conf->{description
} || '';
855 foreach my $cl (split(/\n/, $descr)) {
856 $raw .= '#' . PVE
::Tools
::encode_text
($cl) . "\n";
859 foreach my $key (sort keys %$conf) {
860 next if $key eq 'digest' || $key eq 'description' ||
861 $key eq 'pending' || $key eq 'snapshots' ||
862 $key eq 'snapname' || $key eq 'lxc';
863 my $value = $conf->{$key};
864 die "detected invalid newline inside property '$key'\n"
866 $raw .= "$key: $value\n";
869 if (my $lxcconf = $conf->{lxc
}) {
870 foreach my $entry (@$lxcconf) {
871 my ($k, $v) = @$entry;
879 my $raw = &$generate_raw_config($conf);
881 if (scalar(keys %{$conf->{pending
}})){
882 $raw .= "\n[pve:pending]\n";
883 $raw .= &$generate_raw_config($conf->{pending
});
886 foreach my $snapname (sort keys %{$conf->{snapshots
}}) {
887 $raw .= "\n[$snapname]\n";
888 $raw .= &$generate_raw_config($conf->{snapshots
}->{$snapname});
894 sub update_pct_config
{
895 my ($class, $vmid, $conf, $running, $param, $delete) = @_;
904 my $pid = PVE
::LXC
::find_lxc_pid
($vmid);
905 $rootdir = "/proc/$pid/root";
908 my $hotplug_error = sub {
917 if (defined($delete)) {
918 foreach my $opt (@$delete) {
919 if (!exists($conf->{$opt})) {
924 if ($opt eq 'memory' || $opt eq 'rootfs') {
925 die "unable to delete required option '$opt'\n";
926 } elsif ($opt eq 'hostname') {
927 delete $conf->{$opt};
928 } elsif ($opt eq 'swap') {
929 delete $conf->{$opt};
930 PVE
::LXC
::write_cgroup_value
("memory", $vmid,
931 "memory.memsw.limit_in_bytes", -1);
932 } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup' || $opt eq 'hookscript') {
933 delete $conf->{$opt};
934 } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
935 $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
936 next if $hotplug_error->($opt);
937 delete $conf->{$opt};
938 } elsif ($opt eq 'cores') {
939 delete $conf->{$opt}; # rest is handled by pvestatd
940 } elsif ($opt eq 'cpulimit') {
941 PVE
::LXC
::write_cgroup_value
("cpu", $vmid, "cpu.cfs_quota_us", -1);
942 delete $conf->{$opt};
943 } elsif ($opt eq 'cpuunits') {
944 PVE
::LXC
::write_cgroup_value
("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits
}->{default});
945 delete $conf->{$opt};
946 } elsif ($opt =~ m/^net(\d)$/) {
947 delete $conf->{$opt};
950 PVE
::Network
::veth_delete
("veth${vmid}i$netid");
951 } elsif ($opt eq 'protection') {
952 delete $conf->{$opt};
953 } elsif ($opt =~ m/^unused(\d+)$/) {
954 next if $hotplug_error->($opt);
955 PVE
::LXC
::Config-
>check_protection($conf, "can't remove CT $vmid drive '$opt'");
956 push @deleted_volumes, $conf->{$opt};
957 delete $conf->{$opt};
958 } elsif ($opt =~ m/^mp(\d+)$/) {
959 next if $hotplug_error->($opt);
960 PVE
::LXC
::Config-
>check_protection($conf, "can't remove CT $vmid drive '$opt'");
961 my $mp = PVE
::LXC
::Config-
>parse_ct_mountpoint($conf->{$opt});
962 delete $conf->{$opt};
963 if ($mp->{type
} eq 'volume') {
964 PVE
::LXC
::Config-
>add_unused_volume($conf, $mp->{volume
});
966 } elsif ($opt eq 'unprivileged') {
967 die "unable to delete read-only option: '$opt'\n";
968 } elsif ($opt eq 'features') {
969 next if $hotplug_error->($opt);
970 delete $conf->{$opt};
972 die "implement me (delete: $opt)"
974 PVE
::LXC
::Config-
>write_config($vmid, $conf) if $running;
978 # There's no separate swap size to configure, there's memory and "total"
979 # memory (iow. memory+swap). This means we have to change them together.
980 my $wanted_memory = PVE
::Tools
::extract_param
($param, 'memory');
981 my $wanted_swap = PVE
::Tools
::extract_param
($param, 'swap');
982 if (defined($wanted_memory) || defined($wanted_swap)) {
984 my $old_memory = ($conf->{memory
} || 512);
985 my $old_swap = ($conf->{swap
} || 0);
987 $wanted_memory //= $old_memory;
988 $wanted_swap //= $old_swap;
990 my $total = $wanted_memory + $wanted_swap;
992 my $old_total = $old_memory + $old_swap;
993 if ($total > $old_total) {
994 PVE
::LXC
::write_cgroup_value
("memory", $vmid,
995 "memory.memsw.limit_in_bytes",
996 int($total*1024*1024));
997 PVE
::LXC
::write_cgroup_value
("memory", $vmid,
998 "memory.limit_in_bytes",
999 int($wanted_memory*1024*1024));
1001 PVE
::LXC
::write_cgroup_value
("memory", $vmid,
1002 "memory.limit_in_bytes",
1003 int($wanted_memory*1024*1024));
1004 PVE
::LXC
::write_cgroup_value
("memory", $vmid,
1005 "memory.memsw.limit_in_bytes",
1006 int($total*1024*1024));
1009 $conf->{memory
} = $wanted_memory;
1010 $conf->{swap
} = $wanted_swap;
1012 PVE
::LXC
::Config-
>write_config($vmid, $conf) if $running;
1015 my $storecfg = PVE
::Storage
::config
();
1017 my $used_volids = {};
1018 my $check_content_type = sub {
1020 my $sid = PVE
::Storage
::parse_volume_id
($mp->{volume
});
1021 my $storage_config = PVE
::Storage
::storage_config
($storecfg, $sid);
1022 die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
1023 if !$storage_config->{content
}->{rootdir
};
1026 my $rescan_volume = sub {
1029 $mp->{size
} = PVE
::Storage
::volume_size_info
($storecfg, $mp->{volume
}, 5)
1030 if !defined($mp->{size
});
1032 warn "Could not rescan volume size - $@\n" if $@;
1035 foreach my $opt (keys %$param) {
1036 my $value = $param->{$opt};
1037 my $check_protection_msg = "can't update CT $vmid drive '$opt'";
1038 if ($opt eq 'hostname' || $opt eq 'arch') {
1039 $conf->{$opt} = $value;
1040 } elsif ($opt eq 'onboot') {
1041 $conf->{$opt} = $value ?
1 : 0;
1042 } elsif ($opt eq 'startup') {
1043 $conf->{$opt} = $value;
1044 } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
1045 next if $hotplug_error->($opt);
1046 $conf->{$opt} = $value;
1047 } elsif ($opt eq 'nameserver') {
1048 next if $hotplug_error->($opt);
1049 my $list = PVE
::LXC
::verify_nameserver_list
($value);
1050 $conf->{$opt} = $list;
1051 } elsif ($opt eq 'searchdomain') {
1052 next if $hotplug_error->($opt);
1053 my $list = PVE
::LXC
::verify_searchdomain_list
($value);
1054 $conf->{$opt} = $list;
1055 } elsif ($opt eq 'cores') {
1056 $conf->{$opt} = $value;# rest is handled by pvestatd
1057 } elsif ($opt eq 'cpulimit') {
1059 PVE
::LXC
::write_cgroup_value
("cpu", $vmid, "cpu.cfs_quota_us", -1);
1061 PVE
::LXC
::write_cgroup_value
("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1063 $conf->{$opt} = $value;
1064 } elsif ($opt eq 'cpuunits') {
1065 $conf->{$opt} = $value;
1066 PVE
::LXC
::write_cgroup_value
("cpu", $vmid, "cpu.shares", $value);
1067 } elsif ($opt eq 'description') {
1068 $conf->{$opt} = $value;
1069 } elsif ($opt =~ m/^net(\d+)$/) {
1071 my $net = PVE
::LXC
::Config-
>parse_lxc_network($value);
1073 $conf->{$opt} = PVE
::LXC
::Config-
>print_lxc_network($net);
1075 PVE
::LXC
::update_net
($vmid, $conf, $opt, $net, $netid, $rootdir);
1077 } elsif ($opt eq 'protection') {
1078 $conf->{$opt} = $value ?
1 : 0;
1079 } elsif ($opt =~ m/^mp(\d+)$/) {
1080 next if $hotplug_error->($opt);
1081 PVE
::LXC
::Config-
>check_protection($conf, $check_protection_msg);
1082 my $old = $conf->{$opt};
1083 my $mp = PVE
::LXC
::Config-
>parse_ct_mountpoint($value);
1084 if ($mp->{type
} eq 'volume') {
1085 &$check_content_type($mp);
1086 $used_volids->{$mp->{volume
}} = 1;
1087 &$rescan_volume($mp);
1088 $conf->{$opt} = PVE
::LXC
::Config-
>print_ct_mountpoint($mp);
1090 $conf->{$opt} = $value;
1092 if (defined($old)) {
1093 my $mp = PVE
::LXC
::Config-
>parse_ct_mountpoint($old);
1094 if ($mp->{type
} eq 'volume') {
1095 PVE
::LXC
::Config-
>add_unused_volume($conf, $mp->{volume
});
1099 } elsif ($opt eq 'rootfs') {
1100 next if $hotplug_error->($opt);
1101 PVE
::LXC
::Config-
>check_protection($conf, $check_protection_msg);
1102 my $old = $conf->{$opt};
1103 my $mp = PVE
::LXC
::Config-
>parse_ct_rootfs($value);
1104 if ($mp->{type
} eq 'volume') {
1105 &$check_content_type($mp);
1106 $used_volids->{$mp->{volume
}} = 1;
1107 &$rescan_volume($mp);
1108 $conf->{$opt} = PVE
::LXC
::Config-
>print_ct_mountpoint($mp, 1);
1110 $conf->{$opt} = $value;
1112 if (defined($old)) {
1113 my $mp = PVE
::LXC
::Config-
>parse_ct_rootfs($old);
1114 if ($mp->{type
} eq 'volume') {
1115 PVE
::LXC
::Config-
>add_unused_volume($conf, $mp->{volume
});
1119 } elsif ($opt eq 'unprivileged') {
1120 die "unable to modify read-only option: '$opt'\n";
1121 } elsif ($opt eq 'ostype') {
1122 next if $hotplug_error->($opt);
1123 $conf->{$opt} = $value;
1124 } elsif ($opt eq 'features') {
1125 next if $hotplug_error->($opt);
1126 $conf->{$opt} = $value;
1127 } elsif ($opt eq 'hookscript') {
1128 PVE
::GuestHelpers
::check_hookscript
($value);
1129 $conf->{$opt} = $value;
1131 die "implement me: $opt";
1134 PVE
::LXC
::Config-
>write_config($vmid, $conf) if $running;
1137 # Apply deletions and creations of new volumes
1138 if (@deleted_volumes) {
1139 my $storage_cfg = PVE
::Storage
::config
();
1140 foreach my $volume (@deleted_volumes) {
1141 next if $used_volids->{$volume}; # could have been re-added, too
1142 # also check for references in snapshots
1143 next if $class->is_volume_in_use($conf, $volume, 1);
1144 PVE
::LXC
::delete_mountpoint_volume
($storage_cfg, $vmid, $volume);
1149 my $storage_cfg = PVE
::Storage
::config
();
1150 PVE
::LXC
::create_disks
($storage_cfg, $vmid, $conf, $conf);
1153 # This should be the last thing we do here
1154 if ($running && scalar(@nohotplug)) {
1155 die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
1160 my ($class, $key, $value) = @_;
1162 die "unknown setting '$key'\n" if !$confdesc->{$key};
1164 my $type = $confdesc->{$key}->{type
};
1166 if (!defined($value)) {
1167 die "got undefined value\n";
1170 if ($value =~ m/[\n\r]/) {
1171 die "property contains a line feed\n";
1174 if ($type eq 'boolean') {
1175 return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1176 return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1177 die "type check ('boolean') failed - got '$value'\n";
1178 } elsif ($type eq 'integer') {
1179 return int($1) if $value =~ m/^(\d+)$/;
1180 die "type check ('integer') failed - got '$value'\n";
1181 } elsif ($type eq 'number') {
1182 return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1183 die "type check ('number') failed - got '$value'\n";
1184 } elsif ($type eq 'string') {
1185 if (my $fmt = $confdesc->{$key}->{format
}) {
1186 PVE
::JSONSchema
::check_format
($fmt, $value);
1191 die "internal error"
1196 # add JSON properties for create and set function
1197 sub json_config_properties
{
1198 my ($class, $prop) = @_;
1200 foreach my $opt (keys %$confdesc) {
1201 next if $opt eq 'parent' || $opt eq 'snaptime';
1202 next if $prop->{$opt};
1203 $prop->{$opt} = $confdesc->{$opt};
1209 sub __parse_ct_mountpoint_full
{
1210 my ($class, $desc, $data, $noerr) = @_;
1215 eval { $res = PVE
::JSONSchema
::parse_property_string
($desc, $data) };
1217 return undef if $noerr;
1221 if (defined(my $size = $res->{size
})) {
1222 $size = PVE
::JSONSchema
::parse_size
($size);
1223 if (!defined($size)) {
1224 return undef if $noerr;
1225 die "invalid size: $size\n";
1227 $res->{size
} = $size;
1230 $res->{type
} = $class->classify_mountpoint($res->{volume
});
1235 sub parse_ct_rootfs
{
1236 my ($class, $data, $noerr) = @_;
1238 my $res = $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1240 $res->{mp
} = '/' if defined($res);
1245 sub parse_ct_mountpoint
{
1246 my ($class, $data, $noerr) = @_;
1248 return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1251 sub print_ct_mountpoint
{
1252 my ($class, $info, $nomp) = @_;
1253 my $skip = [ 'type' ];
1254 push @$skip, 'mp' if $nomp;
1255 return PVE
::JSONSchema
::print_property_string
($info, $mp_desc, $skip);
1258 sub print_lxc_network
{
1259 my ($class, $net) = @_;
1260 return PVE
::JSONSchema
::print_property_string
($net, $netconf_desc);
1263 sub parse_lxc_network
{
1264 my ($class, $data) = @_;
1268 return $res if !$data;
1270 $res = PVE
::JSONSchema
::parse_property_string
($netconf_desc, $data);
1272 $res->{type
} = 'veth';
1273 if (!$res->{hwaddr
}) {
1274 my $dc = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
1275 $res->{hwaddr
} = PVE
::Tools
::random_ether_addr
($dc->{mac_prefix
});
1281 sub parse_features
{
1282 my ($class, $data) = @_;
1283 return {} if !$data;
1284 return PVE
::JSONSchema
::parse_property_string
($features_desc, $data);
1288 my ($class, $name) = @_;
1290 return defined($confdesc->{$name});
1292 # END JSON config code
1294 sub classify_mountpoint
{
1295 my ($class, $vol) = @_;
1296 if ($vol =~ m!^/!) {
1297 return 'device' if $vol =~ m!^/dev/!;
1303 my $__is_volume_in_use = sub {
1304 my ($class, $config, $volid) = @_;
1307 $class->foreach_mountpoint($config, sub {
1308 my ($ms, $mountpoint) = @_;
1310 $used = $mountpoint->{type
} eq 'volume' && $mountpoint->{volume
} eq $volid;
1316 sub is_volume_in_use_by_snapshots
{
1317 my ($class, $config, $volid) = @_;
1319 if (my $snapshots = $config->{snapshots
}) {
1320 foreach my $snap (keys %$snapshots) {
1321 return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1328 sub is_volume_in_use
{
1329 my ($class, $config, $volid, $include_snapshots) = @_;
1330 return 1 if $__is_volume_in_use->($class, $config, $volid);
1331 return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1335 sub has_dev_console
{
1336 my ($class, $conf) = @_;
1338 return !(defined($conf->{console
}) && !$conf->{console
});
1342 my ($class, $conf, $keyname) = @_;
1344 if (my $lxcconf = $conf->{lxc
}) {
1345 foreach my $entry (@$lxcconf) {
1346 my ($key, undef) = @$entry;
1347 return 1 if $key eq $keyname;
1355 my ($class, $conf) = @_;
1357 return $conf->{tty
} // $confdesc->{tty
}->{default};
1361 my ($class, $conf) = @_;
1363 return $conf->{cmode
} // $confdesc->{cmode
}->{default};
1366 sub mountpoint_names
{
1367 my ($class, $reverse) = @_;
1369 my @names = ('rootfs');
1371 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1372 push @names, "mp$i";
1375 return $reverse ?
reverse @names : @names;
1378 sub foreach_mountpoint_full
{
1379 my ($class, $conf, $reverse, $func, @param) = @_;
1381 my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1382 foreach my $key (@$mps) {
1383 my $value = $conf->{$key};
1384 my $mountpoint = $key eq 'rootfs' ?
$class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1385 next if !defined($mountpoint);
1387 &$func($key, $mountpoint, @param);
1391 sub foreach_mountpoint
{
1392 my ($class, $conf, $func, @param) = @_;
1394 $class->foreach_mountpoint_full($conf, 0, $func, @param);
1397 sub foreach_mountpoint_reverse
{
1398 my ($class, $conf, $func, @param) = @_;
1400 $class->foreach_mountpoint_full($conf, 1, $func, @param);
1403 sub get_vm_volumes
{
1404 my ($class, $conf, $excludes) = @_;
1408 $class->foreach_mountpoint($conf, sub {
1409 my ($ms, $mountpoint) = @_;
1411 return if $excludes && $ms eq $excludes;
1413 my $volid = $mountpoint->{volume
};
1414 return if !$volid || $mountpoint->{type
} ne 'volume';
1416 my ($sid, $volname) = PVE
::Storage
::parse_volume_id
($volid, 1);
1419 push @$vollist, $volid;
1425 sub get_replicatable_volumes
{
1426 my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1430 my $test_volid = sub {
1431 my ($volid, $mountpoint) = @_;
1435 my $mptype = $mountpoint->{type
};
1436 my $replicate = $mountpoint->{replicate
} // 1;
1438 if ($mptype ne 'volume') {
1439 # skip bindmounts if replicate = 0 even for cleanup,
1440 # since bind mounts could not have been replicated ever
1441 return if !$replicate;
1442 die "unable to replicate mountpoint type '$mptype'\n";
1445 my ($storeid, $volname) = PVE
::Storage
::parse_volume_id
($volid, $noerr);
1446 return if !$storeid;
1448 my $scfg = PVE
::Storage
::storage_config
($storecfg, $storeid);
1449 return if $scfg->{shared
};
1451 my ($path, $owner, $vtype) = PVE
::Storage
::path
($storecfg, $volid);
1452 return if !$owner || ($owner != $vmid);
1454 die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1456 return if !$cleanup && !$replicate;
1458 if (!PVE
::Storage
::volume_has_feature
($storecfg, 'replicate', $volid)) {
1459 return if $cleanup || $noerr;
1460 die "missing replicate feature on volume '$volid'\n";
1463 $volhash->{$volid} = 1;
1466 $class->foreach_mountpoint($conf, sub {
1467 my ($ms, $mountpoint) = @_;
1468 $test_volid->($mountpoint->{volume
}, $mountpoint);
1471 foreach my $snapname (keys %{$conf->{snapshots
}}) {
1472 my $snap = $conf->{snapshots
}->{$snapname};
1473 $class->foreach_mountpoint($snap, sub {
1474 my ($ms, $mountpoint) = @_;
1475 $test_volid->($mountpoint->{volume
}, $mountpoint);
1479 # add 'unusedX' volumes to volhash
1480 foreach my $key (keys %$conf) {
1481 if ($key =~ m/^unused/) {
1482 $test_volid->($conf->{$key}, { type
=> 'volume', replicate
=> 1 });