]>
git.proxmox.com Git - mirror_lxc.git/blob - templates/lxc-alpine.in
4 # Exit on error and treat unset variables as an error.
8 # LXC template for Alpine Linux 3+
11 # Note: Do not replace tabs with spaces, it would break heredocs!
14 # Jakub Jirutka <jakub@jirutka.cz>
16 # This library is free software; you can redistribute it and/or
17 # modify it under the terms of the GNU Lesser General Public
18 # License as published by the Free Software Foundation; either
19 # version 2.1 of the License, or (at your option) any later version.
21 # This library is distributed in the hope that it will be useful,
22 # but WITHOUT ANY WARRANTY; without even the implied warranty of
23 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
24 # Lesser General Public License for more details.
26 # You should have received a copy of the GNU Lesser General Public
27 # License along with this library; if not, write to the Free Software
28 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
31 #=========================== Constants ============================#
33 # Make sure the usual locations are in PATH
34 export PATH
=$PATH:/usr
/sbin
:/usr
/bin
:/sbin
:/bin
36 readonly LOCAL_STATE_DIR
='@LOCALSTATEDIR@'
37 readonly LXC_TEMPLATE_CONFIG
='@LXCTEMPLATECONFIG@'
38 readonly LXC_CACHE_DIR
="${LXC_CACHE_PATH:-"$LOCAL_STATE_DIR/cache/lxc"}/alpine"
40 # SHA256 checksums of GPG keys for APK.
41 readonly APK_KEYS_SHA256
="\
42 9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4 alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
43 2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub
44 ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9 alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
45 1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub
46 12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub"
48 readonly APK_KEYS_URI
='http://alpinelinux.org/keys'
49 readonly MIRRORS_LIST_URL
='http://rsync.alpinelinux.org/alpine/MIRRORS.txt'
51 : ${APK_KEYS_DIR:=/etc/apk/keys}
52 if ! ls "$APK_KEYS_DIR"/alpine
* >/dev
/null
2>&1; then
53 APK_KEYS_DIR
="$LXC_CACHE_DIR/bootstrap/keys"
57 : ${APK:=$(command -v apk || true)}
58 if [ ! -x "$APK" ]; then
59 APK
="$LXC_CACHE_DIR/bootstrap/sbin/apk.static"
64 #======================== Helper Functions ========================#
68 Template specific options can be passed to lxc-create after a '--' like this:
70 lxc-create --name=NAME [lxc-create-options] -- [template-options] [PKG...]
72 PKG Additional APK package(s) to install into the container.
75 -a ARCH, --arch=ARCH The container architecture (e.g. x86, x86_64); defaults
77 -d, --debug Run this script in a debug mode (set -x and wget w/o -q).
78 -F, --flush-cache Remove cached files before build.
79 -m URL --mirror=URL The Alpine mirror to use; defaults to random mirror.
80 -r VER, --release=VER The Alpine release branch to install; default is the
83 Environment variables:
84 APK The apk-tools binary to use when building rootfs. If not set
85 or not executable and apk is not on PATH, then the script
86 will download the latest apk-tools-static.
87 APK_KEYS_DIR Path to directory with GPG keys for APK. If not set and
88 /etc/apk/keys does not contain alpine keys, then the script
89 will download the keys from ${APK_KEYS_URI}.
90 LXC_CACHE_PATH Path to the cache directory where to store bootstrap files
96 local retval
=$1; shift
98 printf 'ERROR: %s\n' "$@" 1>&2
107 if [ "$DEBUG" = 'yes' ]; then
110 wget
-T 10 -O - -q $@
114 latest_release_branch
() {
116 local branch
=$
(fetch
"$MIRROR_URL/latest-stable/releases/$arch/latest-releases.yaml" \
117 |
sed -En 's/^[ \t]*branch: (.*)$/\1/p' \
119 [ -n "$branch" ] && echo "$branch"
124 x86 | i
[3-6]86) echo 'x86';;
125 x86_64 | amd64
) echo 'x86_64';;
126 aarch64 | arm64
) echo 'aarch64';;
127 armv7
) echo 'armv7';;
133 random_mirror_url
() {
134 local url
=$
(fetch
"$MIRRORS_LIST_URL" | shuf
-n 1)
135 [ -n "$url" ] && echo "$url"
143 mkdir
-p "$LOCAL_STATE_DIR/lock/subsys"
147 echo -n "Obtaining an exclusive lock..."
148 if ! flock
-x 9; then
155 } 9> "$LOCAL_STATE_DIR/lock/subsys/lxc-alpine-$lock_name"
161 #============================ Bootstrap ===========================#
164 if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$LXC_CACHE_DIR/bootstrap" ]; then
165 einfo
'Cleaning cached bootstrap files'
166 rm -Rf "$LXC_CACHE_DIR/bootstrap"
169 einfo
'Fetching and/or verifying APK keys'
170 fetch_apk_keys
"$APK_KEYS_DIR"
172 if [ ! -x "$APK" ]; then
173 einfo
'Fetching apk-tools static binary'
175 local host_arch
=$
(parse_arch $
(uname
-m))
176 fetch_apk_static
"$LXC_CACHE_DIR/bootstrap" "$host_arch"
187 echo "$APK_KEYS_SHA256" |
while read -r line
; do
188 keyname
="${line##* }"
189 if [ ! -f "$keyname" ]; then
190 fetch
"$APK_KEYS_URI/$keyname" > "$keyname"
192 echo "$line" | sha256sum
-c -
201 local pkg_name
='apk-tools-static'
205 local pkg_ver
=$
(fetch
"$MIRROR_URL/latest-stable/main/$arch/APKINDEX.tar.gz" \
206 |
tar -xzO APKINDEX \
207 |
sed -n "/P:${pkg_name}/,/^$/ s/V:\(.*\)$/\1/p")
209 [ -n "$pkg_ver" ] || die
2 "Cannot find a version of $pkg_name in APKINDEX"
211 fetch
"$MIRROR_URL/latest-stable/main/$arch/${pkg_name}-${pkg_ver}.apk" \
212 |
tar -xz -C "$dest" sbin
/ # --extract --gzip --directory
214 [ -f "$dest/sbin/apk.static" ] || die
2 'apk.static not found'
216 local keyname
=$
(echo "$dest"/sbin
/apk.static.
*.pub |
sed 's/.*\.SIGN\.RSA\.//')
218 -verify "$APK_KEYS_DIR/$keyname" \
219 -signature "$dest/sbin/apk.static.SIGN.RSA.$keyname" \
220 "$dest/sbin/apk.static" \
221 || die
2 'Signature verification for apk.static failed'
223 # Note: apk doesn't return 0 for --version
224 local out
="$("$dest"/sbin/apk.static --version)"
227 [ "${out%% *}" = 'apk-tools' ] || die
3 'apk.static --version failed'
231 #============================ Install ============================#
237 local extra_packages
="$4"
238 local apk_cache
="$LXC_CACHE_DIR/apk/$arch"
239 local repo_url
="$MIRROR_URL/$branch/main"
241 if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$apk_cache" ]; then
242 einfo
"Cleaning cached APK packages for $arch"
245 mkdir
-p "$apk_cache"
247 einfo
"Installing Alpine Linux in $dest"
251 ln -s "$apk_cache" etc
/apk
/cache
252 echo "$repo_url" > etc
/apk
/repositories
254 install_packages
"$arch" "alpine-base $extra_packages"
262 || die
3 'Failed to execute /bin/true in chroot, the builded rootfs is broken!'
269 local arch
="$1"; shift
272 $APK --arch="$arch" --root=.
--keys-dir="$APK_KEYS_DIR" \
273 --update-cache --initdb add
$packages
277 mkdir
-p -m 755 dev
/pts
278 mkdir
-p -m 1777 dev
/shm
280 mknod
-m 666 dev
/zero c
1 5
281 mknod
-m 666 dev
/full c
1 7
282 mknod
-m 666 dev
/random c
1 8
283 mknod
-m 666 dev
/urandom c
1 9
285 local i
; for i
in $
(seq 0 4); do
286 mknod
-m 620 dev
/tty
$i c
4 $i
287 chown
0:5 dev
/tty
$i # root:tty
290 mknod
-m 666 dev
/tty c
5 0
291 chown
0:5 dev
/tty
# root:tty
292 mknod
-m 620 dev
/console c
5 1
293 mknod
-m 666 dev
/ptmx c
5 2
294 chown
0:5 dev
/ptmx
# root:tty
298 # Remove unwanted ttys.
299 sed -i '/^tty[5-9]\:\:.*$/d' etc
/inittab
301 cat <<-EOF >> etc/inittab
302 # Main LXC console console
303 ::respawn:/sbin/getty 38400 console
308 # This runscript injects localhost entries with the current hostname
310 cat <<'EOF' > etc/init.d/hosts
314 local start_tag='# begin generated'
315 local end_tag='# end generated'
319 $start_tag by /etc/init.d/hosts
320 127.0.0.1 $(hostname).local $(hostname) localhost
321 ::1 $(hostname).local $(hostname) localhost
326 if grep -q "^${start_tag}" /etc
/hosts
; then
327 # escape \n, busybox sed doesn't like them
328 content
=${content//$'\n'/\\$'\n'}
330 sed -ni "/^${start_tag}/ {
332 # read and discard next line and repeat until $end_tag or EOF
333 :a; n; /^${end_tag}/!ba; n
336 printf "$content" >> /etc
/hosts
340 chmod +x etc
/init.d
/hosts
342 # Wipe it, will be generated by the above runscript.
347 # Note: loopback is automatically started by LXC.
348 cat <<-EOF > etc/network/interfaces
351 hostname \$(hostname)
358 # Specify the LXC subsystem.
359 sed -i 's/^#*rc_sys=.*/rc_sys="lxc"/' etc
/rc.conf
362 for svc_name
in bootmisc hosts syslog
; do
363 ln -s /etc
/init.d
/$svc_name etc
/runlevels
/boot
/$svc_name
367 for svc_name
in networking cron crond
; do
368 # issue 1164: alpine renamed cron to crond
369 # Use the one that exists.
370 if [ -e etc
/init.d
/$svc_name ]; then
371 ln -s /etc
/init.d
/$svc_name etc
/runlevels
/default
/$svc_name
377 #=========================== Configure ===========================#
379 configure_container
() {
384 cat <<-EOF >> "$config"
386 # Specify container architecture.
390 lxc.utsname = $hostname
392 # If something doesn't work, try to comment this out.
393 # Dropping sys_admin disables container root from doing a lot of things
394 # that could be bad like re-mounting lxc fstab entries rw for example,
395 # but also disables some useful things like being able to nfs mount, and
396 # things that are already namespaced with ns_capable() kernel checks, like
398 lxc.cap.drop = sys_admin
400 # Include common configuration.
401 lxc.include = $LXC_TEMPLATE_CONFIG/alpine.common.conf
406 #============================= Main ==============================#
408 if [ "$(id -u)" != "0" ]; then
409 die
1 "This script must be run as 'root'"
412 # Parse command options.
413 options
=$
(getopt
-o a
:dFm
:n
:p
:r
:h
-l arch
:,debug
,flush-cache
,mirror
:,name
:,\
414 path
:,release
:,rootfs
:,help,mapped-uid
:,mapped-gid
: -- "$@")
415 eval set -- "$options"
417 # Clean variables and set defaults.
427 # Process command options.
428 while [ $# -gt 0 ]; do
437 flush_cache
='yes'; shift 1
440 mirror_url
=$2; shift 2
461 die
1 "This template can't be used for unprivileged containers." \
462 'You may want to try the "download" template instead.'
465 echo "Unknown option: $1" 1>&2
473 [ "$debug" = 'yes' ] && set -x
475 # Set global variables.
476 readonly DEBUG
="$debug"
477 readonly FLUSH_CACHE
="$flush_cache"
478 readonly MIRROR_URL
="${mirror_url:-$(random_mirror_url)}"
481 [ -n "$name" ] || die
1 'Missing required option --name'
482 [ -n "$path" ] || die
1 'Missing required option --path'
484 if [ -z "$rootfs" ] && [ -f "$path/config" ]; then
485 rootfs
="$(sed -nE 's/^lxc.rootfs\s*=\s*(.*)$/\1/p' "$path/config
")"
487 if [ -z "$rootfs" ]; then
488 rootfs
="$path/rootfs"
491 arch
=$
(parse_arch
"$arch") \
492 || die
1 "Unsupported architecture: $arch"
494 if [ -z "$release" ]; then
495 release
=$
(latest_release_branch
"$arch") \
496 || die
2 'Failed to resolve Alpine last release branch'
500 run_exclusively
'bootstrap' 10 bootstrap
501 run_exclusively
"$arch" 30 install "$rootfs" "$arch" "$release" "$extra_packages"
502 configure_container
"$path/config" "$name" "$arch"
504 einfo
"Container's rootfs and config have been created"
506 Edit the config file $path/config to check/enable networking setup.
507 The installed system is preconfigured for a loopback and single network
508 interface configured via DHCP.
510 To start the container, run "lxc-start -n $name".
511 The root password is not set; to enter the container run "lxc-attach -n $name".