templates/lxc-alpine.in

   1 #!/bin/sh
   2 # vim: set ts=4:
   3
   4 # Exit on error and treat unset variables as an error.
   5 set -eu
   6
   7 #
   8 # LXC template for Alpine Linux 3+
   9 #
  10
  11 # Note: Do not replace tabs with spaces, it would break heredocs!
  12
  13 # Authors:
  14 # Jakub Jirutka <jakub@jirutka.cz>
  15
  16 # This library is free software; you can redistribute it and/or
  17 # modify it under the terms of the GNU Lesser General Public
  18 # License as published by the Free Software Foundation; either
  19 # version 2.1 of the License, or (at your option) any later version.
  20 #
  21 # This library is distributed in the hope that it will be useful,
  22 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  23 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  24 # Lesser General Public License for more details.
  25 #
  26 # You should have received a copy of the GNU Lesser General Public
  27 # License along with this library; if not, write to the Free Software
  28 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  29
  30
  31 #===========================  Constants  ============================#
  32
  33 # Make sure the usual locations are in PATH
  34 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  35
  36 readonly LOCAL_STATE_DIR='@LOCALSTATEDIR@'
  37 readonly LXC_TEMPLATE_CONFIG='@LXCTEMPLATECONFIG@'
  38 readonly LXC_CACHE_DIR="${LXC_CACHE_PATH:-"$LOCAL_STATE_DIR/cache/lxc"}/alpine"
  39
  40 # SHA256 checksums of GPG keys for APK.
  41 readonly APK_KEYS_SHA256="\
  42 9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4  alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
  43 2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab  alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub
  44 ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9  alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
  45 1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b  alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub
  46 12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c  alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub"
  47
  48 readonly APK_KEYS_URI='http://alpinelinux.org/keys'
  49 readonly MIRRORS_LIST_URL='http://rsync.alpinelinux.org/alpine/MIRRORS.txt'
  50
  51 : ${APK_KEYS_DIR:=/etc/apk/keys}
  52 if ! ls "$APK_KEYS_DIR"/alpine* >/dev/null 2>&1; then
  53         APK_KEYS_DIR="$LXC_CACHE_DIR/bootstrap/keys"
  54 fi
  55 readonly APK_KEYS_DIR
  56
  57 : ${APK:=$(command -v apk || true)}
  58 if [ ! -x "$APK" ]; then
  59         APK="$LXC_CACHE_DIR/bootstrap/sbin/apk.static"
  60 fi
  61 readonly APK
  62
  63
  64 #========================  Helper Functions  ========================#
  65
  66 usage() {
  67         cat <<-EOF
  68                 Template specific options can be passed to lxc-create after a '--' like this:
  69
  70                    lxc-create --name=NAME [lxc-create-options] -- [template-options] [PKG...]
  71
  72                 PKG  Additional APK package(s) to install into the container.
  73
  74                 Template options:
  75                    -a ARCH, --arch=ARCH   The container architecture (e.g. x86, x86_64); defaults
  76                                           to the host arch.
  77                    -d, --debug            Run this script in a debug mode (set -x and wget w/o -q).
  78                    -F, --flush-cache      Remove cached files before build.
  79                    -m URL --mirror=URL    The Alpine mirror to use; defaults to random mirror.
  80                    -r VER, --release=VER  The Alpine release branch to install; default is the
  81                                           latest stable.
  82
  83                 Environment variables:
  84                    APK             The apk-tools binary to use when building rootfs. If not set
  85                                    or not executable and apk is not on PATH, then the script
  86                                    will download the latest apk-tools-static.
  87                    APK_KEYS_DIR    Path to directory with GPG keys for APK. If not set and
  88                                    /etc/apk/keys does not contain alpine keys, then the script
  89                                    will download the keys from ${APK_KEYS_URI}.
  90                    LXC_CACHE_PATH  Path to the cache directory where to store bootstrap files
  91                                    and APK packages.
  92         EOF
  93 }
  94
  95 die() {
  96         local retval=$1; shift
  97
  98         printf 'ERROR: %s\n' "$@" 1>&2
  99         exit $retval
 100 }
 101
 102 einfo() {
 103         printf "\n==> $1\n"
 104 }
 105
 106 fetch() {
 107         if [ "$DEBUG" = 'yes' ]; then
 108                 wget -T 10 -O - $@
 109         else
 110                 wget -T 10 -O - -q $@
 111         fi
 112 }
 113
 114 latest_release_branch() {
 115         local arch="$1"
 116         local branch=$(fetch "$MIRROR_URL/latest-stable/releases/$arch/latest-releases.yaml" \
 117                 | sed -En 's/^[ \t]*branch: (.*)$/\1/p' \
 118                 | head -n 1)
 119         [ -n "$branch" ] && echo "$branch"
 120 }
 121
 122 parse_arch() {
 123         case "$1" in
 124                 x86 | i[3-6]86) echo 'x86';;
 125                 x86_64 | amd64) echo 'x86_64';;
 126                 arm*) echo 'armhf';;
 127                 *) return 1;;
 128         esac
 129 }
 130
 131 random_mirror_url() {
 132         local url=$(fetch "$MIRRORS_LIST_URL" | shuf -n 1)
 133         [ -n "$url" ] && echo "$url"
 134 }
 135
 136 run_exclusively() {
 137         local lock_name="$1"
 138         local timeout=$2
 139         shift 2
 140
 141         mkdir -p "$LOCAL_STATE_DIR/lock/subsys"
 142
 143         local retval
 144         {
 145                 echo -n "Obtaining an exclusive lock..."
 146                 if ! flock -x 9; then
 147                         echo ' failed.'
 148                         return 1
 149                 fi
 150                 echo ' done'
 151
 152                 "$@"; retval=$?
 153         } 9> "$LOCAL_STATE_DIR/lock/subsys/lxc-alpine-$lock_name"
 154
 155         return $retval
 156 }
 157
 158
 159 #============================  Bootstrap  ===========================#
 160
 161 bootstrap() {
 162         if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$LXC_CACHE_DIR/bootstrap" ]; then
 163                 einfo 'Cleaning cached bootstrap files'
 164                 rm -Rf "$LXC_CACHE_DIR/bootstrap"
 165         fi
 166
 167         einfo 'Fetching and/or verifying APK keys'
 168         fetch_apk_keys "$APK_KEYS_DIR"
 169
 170         if [ ! -x "$APK" ]; then
 171                 einfo 'Fetching apk-tools static binary'
 172
 173                 local host_arch=$(parse_arch $(uname -m))
 174                 fetch_apk_static "$LXC_CACHE_DIR/bootstrap" "$host_arch"
 175         fi
 176 }
 177
 178 fetch_apk_keys() {
 179         local dest="$1"
 180         local line keyname
 181
 182         mkdir -p "$dest"
 183         cd "$dest"
 184
 185         echo "$APK_KEYS_SHA256" | while read -r line; do
 186                 keyname="${line##* }"
 187                 if [ ! -f "$keyname" ]; then
 188                         fetch "$APK_KEYS_URI/$keyname" > "$keyname"
 189                 fi
 190                 echo "$line" | sha256sum -c -
 191         done || exit 2
 192
 193         cd - >/dev/null
 194 }
 195
 196 fetch_apk_static() {
 197         local dest="$1"
 198         local arch="$2"
 199         local pkg_name='apk-tools-static'
 200
 201         mkdir -p "$dest"
 202
 203         local pkg_ver=$(fetch "$MIRROR_URL/latest-stable/main/$arch/APKINDEX.tar.gz" \
 204                 | tar -xzO APKINDEX \
 205                 | sed -n "/P:${pkg_name}/,/^$/ s/V:\(.*\)$/\1/p")
 206
 207         [ -n "$pkg_ver" ] || die 2 "Cannot find a version of $pkg_name in APKINDEX"
 208
 209         fetch "$MIRROR_URL/latest-stable/main/$arch/${pkg_name}-${pkg_ver}.apk" \
 210                 | tar -xz -C "$dest" sbin/  # --extract --gzip --directory
 211
 212         [ -f "$dest/sbin/apk.static" ] || die 2 'apk.static not found'
 213
 214         local keyname=$(echo "$dest"/sbin/apk.static.*.pub | sed 's/.*\.SIGN\.RSA\.//')
 215         openssl dgst -sha1 \
 216                 -verify "$APK_KEYS_DIR/$keyname" \
 217                 -signature "$dest/sbin/apk.static.SIGN.RSA.$keyname" \
 218                 "$dest/sbin/apk.static" \
 219                 || die 2 'Signature verification for apk.static failed'
 220
 221         # Note: apk doesn't return 0 for --version
 222         local out="$("$dest"/sbin/apk.static --version)"
 223         echo "$out"
 224
 225         [ "${out%% *}" = 'apk-tools' ] || die 3 'apk.static --version failed'
 226 }
 227
 228
 229 #============================  Install  ============================#
 230
 231 install() {
 232         local dest="$1"
 233         local arch="$2"
 234         local branch="$3"
 235         local extra_packages="$4"
 236         local apk_cache="$LXC_CACHE_DIR/apk/$arch"
 237         local repo_url="$MIRROR_URL/$branch/main"
 238
 239         if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$apk_cache" ]; then
 240                 einfo "Cleaning cached APK packages for $arch"
 241                 rm -Rf "$apk_cache"
 242         fi
 243         mkdir -p "$apk_cache"
 244
 245         einfo "Installing Alpine Linux in $dest"
 246         cd "$dest"
 247
 248         mkdir -p etc/apk
 249         ln -s "$apk_cache" etc/apk/cache
 250         echo "$repo_url" > etc/apk/repositories
 251
 252         install_packages "$arch" alpine-base $extra_packages
 253         make_dev_nodes
 254         setup_inittab
 255         setup_hosts
 256         setup_network
 257         setup_services
 258
 259         chroot . /bin/true \
 260                 || die 3 'Failed to execute /bin/true in chroot, the builded rootfs is broken!'
 261
 262         rm etc/apk/cache
 263         cd - >/dev/null
 264 }
 265
 266 install_packages() {
 267         local arch="$1"; shift
 268         local packages="$@"
 269
 270         $APK --arch="$arch" --root=. --keys-dir="$APK_KEYS_DIR" \
 271                 --update-cache --initdb add $packages
 272 }
 273
 274 make_dev_nodes() {
 275         mkdir -p -m 755 dev/pts
 276         mkdir -p -m 1777 dev/shm
 277
 278         mknod -m 666 dev/zero c 1 5
 279         mknod -m 666 dev/full c 1 7
 280         mknod -m 666 dev/random c 1 8
 281         mknod -m 666 dev/urandom c 1 9
 282
 283         local i; for i in $(seq 0 4); do
 284                 mknod -m 620 dev/tty$i c 4 $i
 285                 chown 0:5 dev/tty$i  # root:tty
 286         done
 287
 288         mknod -m 666 dev/tty c 5 0
 289         chown 0:5 dev/tty  # root:tty
 290         mknod -m 620 dev/console c 5 1
 291         mknod -m 666 dev/ptmx c 5 2
 292         chown 0:5 dev/ptmx  # root:tty
 293 }
 294
 295 setup_inittab() {
 296         # Remove unwanted ttys.
 297         sed -i '/^tty[5-9]\:\:.*$/d' etc/inittab
 298
 299         cat <<-EOF >> etc/inittab
 300                 # Main LXC console console
 301                 ::respawn:/sbin/getty 38400 console
 302         EOF
 303 }
 304
 305 setup_hosts() {
 306         # This runscript injects localhost entries with the current hostname
 307         # into /etc/hosts.
 308         cat <<'EOF' > etc/init.d/hosts
 309 #!/sbin/openrc-run
 310
 311 start() {
 312         local start_tag='# begin generated'
 313         local end_tag='# end generated'
 314
 315         local content=$(
 316                 cat <<-EOF
 317                         $start_tag by /etc/init.d/hosts
 318                         127.0.0.1  $(hostname).local $(hostname) localhost
 319                         ::1        $(hostname).local $(hostname) localhost
 320                         $end_tag
 321                 EOF
 322         )
 323
 324         if grep -q "^${start_tag}" /etc/hosts; then
 325                 # escape \n, busybox sed doesn't like them
 326                 content=${content//$'\n'/\\$'\n'}
 327
 328                 sed -ni "/^${start_tag}/ {
 329                                 a\\${content}
 330                                 # read and discard next line and repeat until $end_tag or EOF
 331                                 :a; n; /^${end_tag}/!ba; n
 332                         }; p" /etc/hosts
 333         else
 334                 printf "$content" >> /etc/hosts
 335         fi
 336 }
 337 EOF
 338         chmod +x etc/init.d/hosts
 339
 340         # Wipe it, will be generated by the above runscript.
 341         echo -n > etc/hosts
 342 }
 343
 344 setup_network() {
 345         # Note: loopback is automatically started by LXC.
 346         cat <<-EOF > etc/network/interfaces
 347                 auto eth0
 348                 iface eth0 inet dhcp
 349         EOF
 350 }
 351
 352 setup_services() {
 353         local svc_name
 354
 355         # Specify the LXC subsystem.
 356         sed -i 's/^#*rc_sys=.*/rc_sys="lxc"/' etc/rc.conf
 357
 358         # boot runlevel
 359         for svc_name in bootmisc hosts syslog; do
 360                 ln -s /etc/init.d/$svc_name etc/runlevels/boot/$svc_name
 361         done
 362
 363         # default runlevel
 364         for svc_name in networking cron; do
 365                 ln -s /etc/init.d/$svc_name etc/runlevels/default/$svc_name
 366         done
 367 }
 368
 369
 370 #===========================  Configure  ===========================#
 371
 372 configure_container() {
 373         local config="$1"
 374         local hostname="$2"
 375         local arch="$3"
 376
 377         cat <<-EOF >> "$config"
 378
 379                 # Specify container architecture.
 380                 lxc.arch = $arch
 381
 382                 # Set hostname.
 383                 lxc.utsname = $hostname
 384
 385                 # If something doesn't work, try to comment this out.
 386                 # Dropping sys_admin disables container root from doing a lot of things
 387                 # that could be bad like re-mounting lxc fstab entries rw for example,
 388                 # but also disables some useful things like being able to nfs mount, and
 389                 # things that are already namespaced with ns_capable() kernel checks, like
 390                 # hostname(1).
 391                 lxc.cap.drop = sys_admin
 392
 393                 # Include common configuration.
 394                 lxc.include = $LXC_TEMPLATE_CONFIG/alpine.common.conf
 395         EOF
 396 }
 397
 398
 399 #=============================  Main  ==============================#
 400
 401 if [ "$(id -u)" != "0" ]; then
 402         die 1 "This script must be run as 'root'"
 403 fi
 404
 405 # Parse command options.
 406 options=$(getopt -o a:dFm:n:p:r:h -l arch:,debug,flush-cache,mirror:,name:,\
 407 path:,release:,rootfs:,help,mapped-uid:,mapped-gid: -- "$@")
 408 eval set -- "$options"
 409
 410 # Clean variables and set defaults.
 411 arch="$(uname -m)"
 412 debug='no'
 413 flush_cache='no'
 414 mirror_url=
 415 name=
 416 path=
 417 release=
 418 rootfs=
 419
 420 # Process command options.
 421 while [ $# -gt 0 ]; do
 422         case $1 in
 423                 -a | --arch)
 424                         arch=$2; shift 2
 425                 ;;
 426                 -d | --debug)
 427                         debug='yes'; shift 1
 428                 ;;
 429                 -F | --flush-cache)
 430                         flush_cache='yes'; shift 1
 431                 ;;
 432                 -m | --mirror)
 433                         mirror_url=$2; shift 2
 434                 ;;
 435                 -n | --name)
 436                         name=$2; shift 2
 437                 ;;
 438                 -p | --path)
 439                         path=$2; shift 2
 440                 ;;
 441                 -r | --release)
 442                         release=$2; shift 2
 443                 ;;
 444                 --rootfs)
 445                         rootfs=$2; shift 2
 446                 ;;
 447                 -h | --help)
 448                         usage; exit 0
 449                 ;;
 450                 --)
 451                         shift; break
 452                 ;;
 453                 --mapped-[ug]id)
 454                         die 1 "This template can't be used for unprivileged containers." \
 455                                 'You may want to try the "download" template instead.'
 456                 ;;
 457                 *)
 458                         echo "Unknown option: $1" 1>&2
 459                         usage; exit 1
 460                 ;;
 461         esac
 462 done
 463
 464 extra_packages="$@"
 465
 466 [ "$debug" = 'yes' ] && set -x
 467
 468 # Set global variables.
 469 readonly DEBUG="$debug"
 470 readonly FLUSH_CACHE="$flush_cache"
 471 readonly MIRROR_URL="${mirror_url:-$(random_mirror_url)}"
 472
 473 # Validate options.
 474 [ -n "$name" ] || die 1 'Missing required option --name'
 475 [ -n "$path" ] || die 1 'Missing required option --path'
 476
 477 if [ -z "$rootfs" ] && [ -f "$path/config" ]; then
 478         rootfs="$(sed -nE 's/^lxc.rootfs\s*=\s*(.*)$/\1/p' "$path/config")"
 479 fi
 480 if [ -z "$rootfs" ]; then
 481         rootfs="$path/rootfs"
 482 fi
 483
 484 arch=$(parse_arch "$arch") \
 485         || die 1 "Unsupported architecture: $arch"
 486
 487 if [ -z "$release" ]; then
 488         release=$(latest_release_branch "$arch") \
 489                 || die 2 'Failed to resolve Alpine last release branch'
 490 fi
 491
 492 # Here we go!
 493 run_exclusively 'bootstrap' 10 bootstrap
 494 run_exclusively "$arch" 30 install "$rootfs" "$arch" "$release" "$extra_packages"
 495 configure_container "$path/config" "$name" "$arch"
 496
 497 einfo "Container's rootfs and config have been created"
 498 cat <<-EOF
 499         Edit the config file $path/config to check/enable networking setup.
 500         The installed system is preconfigured for a loopback and single network
 501         interface configured via DHCP.
 502
 503         To start the container, run "lxc-start -n $name".
 504         The root password is not set; to enter the container run "lxc-attach -n $name".
 505 EOF