templates/lxc-altlinux.in

   1 #!/bin/bash
   2
   3 #
   4 # template script for generating altlinux container for LXC
   5 #
   6
   7 #
   8 # lxc: linux Container library
   9
  10 # Authors:
  11 # Alexey Shabalin <shaba@altlinux.org>
  12
  13 # This library is free software; you can redistribute it and/or
  14 # modify it under the terms of the GNU Lesser General Public
  15 # License as published by the Free Software Foundation; either
  16 # version 2.1 of the License, or (at your option) any later version.
  17
  18 # This library is distributed in the hope that it will be useful,
  19 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21 # Lesser General Public License for more details.
  22
  23 # You should have received a copy of the GNU Lesser General Public
  24 # License along with this library; if not, write to the Free Software
  25 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  26
  27 # Detect use under userns (unsupported)
  28 for arg in "$@"; do
  29     [ "$arg" == "--" ] && break
  30     if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
  31         echo "This template can't be used for unprivileged containers." 1>&2
  32         echo "You may want to try the \"download\" template instead." 1>&2
  33         exit 1
  34     fi
  35 done
  36
  37 # Make sure the usual locations are in PATH
  38 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  39
  40 #Configurations
  41 arch=$(uname -m)
  42 cache_base=@LOCALSTATEDIR@/cache/lxc/altlinux/$arch
  43 default_path=@LXCPATH@
  44 default_profile=default
  45 profile_dir=/etc/lxc/profiles
  46 root_password=rooter
  47 lxc_network_type=veth
  48 lxc_network_link=virbr0
  49
  50 # is this altlinux?
  51 [ -f /etc/altlinux-release ] && is_altlinux=true
  52
  53 configure_altlinux()
  54 {
  55
  56     # disable selinux in altlinux
  57     mkdir -p $rootfs_path/selinux
  58     echo 0 > $rootfs_path/selinux/enforce
  59
  60     mkdir -p ${rootfs_path}/etc/net/ifaces/veth0
  61     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/options
  62 BOOTPROTO=${BOOTPROTO}
  63 ONBOOT=yes
  64 NM_CONTROLLED=no
  65 TYPE=eth
  66 EOF
  67
  68 if [ ${BOOTPROTO} != "dhcp" ]; then
  69     # ip address
  70     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/ipv4address
  71 ${ipv4}
  72 EOF
  73
  74     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/ipv4route
  75 ${gw}
  76 EOF
  77
  78     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/resolv.conf
  79 nameserver ${dns}
  80 EOF
  81
  82     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/ipv6address
  83 ${ipv6}
  84 EOF
  85
  86     cat <<EOF > ${rootfs_path}/etc/net/ifaces/veth0/ipv6route
  87 ${gw6}
  88 EOF
  89
  90 fi
  91
  92     # set the hostname
  93     cat <<EOF > ${rootfs_path}/etc/sysconfig/network
  94 NETWORKING=yes
  95 CONFMETHOD=etcnet
  96 HOSTNAME=${UTSNAME}
  97 RESOLV_MODS=yes
  98 EOF
  99
 100     # set minimal hosts
 101     cat <<EOF > $rootfs_path/etc/hosts
 102 127.0.0.1 localhost.localdomain localhost $name
 103 EOF
 104     # Allow to login at virsh console. loginuid.so doen't work in the absence of auditd.
 105 #    sed -i 's/^.*loginuid.so.*$/\#&/' ${rootfs_path}/etc/pam.d/common-login
 106
 107     # Allow root to login at virsh console
 108     echo "pts/0" >> ${rootfs_path}/etc/securetty
 109     echo "console" >> ${rootfs_path}/etc/securetty
 110
 111     chroot ${rootfs_path} chkconfig network on
 112     chroot ${rootfs_path} chkconfig syslogd on
 113     chroot ${rootfs_path} chkconfig random on
 114     chroot ${rootfs_path} chkconfig rawdevices off
 115     chroot ${rootfs_path} chkconfig fbsetfont off
 116 #    chroot ${rootfs_path} chkconfig keytable off
 117
 118     subst 's/^\([3-9]\+:[0-9]\+:respawn:\/sbin\/mingetty.*\)/#\1/' ${rootfs_path}/etc/inittab
 119     echo "c1:2345:respawn:/sbin/mingetty --noclear console" >>  ${rootfs_path}/etc/inittab
 120     subst 's,\/dev\/tty12,/var/log/syslog/console,' ${rootfs_path}/etc/syslog.conf
 121
 122 #   touch file for fastboot
 123     touch ${rootfs_path}/fastboot
 124     chattr +i ${rootfs_path}/fastboot
 125
 126     dev_path="${rootfs_path}/dev"
 127     rm -rf ${dev_path}
 128     mkdir -p ${dev_path}
 129     mknod -m 666 ${dev_path}/null c 1 3
 130     mknod -m 666 ${dev_path}/zero c 1 5
 131     mknod -m 644 ${dev_path}/random c 1 8
 132     mknod -m 644 ${dev_path}/urandom c 1 9
 133     mkdir -m 755 ${dev_path}/pts
 134     mkdir -m 1777 ${dev_path}/shm
 135     mknod -m 666 ${dev_path}/tty c 5 0
 136     chown root:tty ${dev_path}/tty
 137     mknod -m 600 ${dev_path}/tty0 c 4 0
 138     mknod -m 600 ${dev_path}/tty1 c 4 1
 139     mknod -m 600 ${dev_path}/tty2 c 4 2
 140     mknod -m 600 ${dev_path}/tty3 c 4 3
 141     mknod -m 600 ${dev_path}/tty4 c 4 4
 142     mknod -m 600 ${dev_path}/console c 5 1
 143     mknod -m 666 ${dev_path}/full c 1 7
 144     mknod -m 600 ${dev_path}/initctl p
 145     mknod -m 666 ${dev_path}/ptmx c 5 2
 146     chown root:tty ${dev_path}/ptmx
 147     ln -s /proc/self/fd ${dev_path}/fd
 148     ln -s /proc/kcore ${dev_path}/core
 149     mkdir -m 755 ${dev_path}/mapper
 150     mknod -m 600 ${dev_path}/mapper/control c 10 236
 151     mkdir -m 755 ${dev_path}/net
 152     mknod -m 666 ${dev_path}/net/tun c 10 200
 153
 154     echo "setting root passwd to $root_password"
 155     echo "root:$root_password" | chroot $rootfs_path chpasswd
 156
 157     return 0
 158 }
 159
 160 download_altlinux()
 161 {
 162
 163     # check the mini altlinux was not already downloaded
 164     INSTALL_ROOT=$cache/partial
 165     mkdir -p $INSTALL_ROOT
 166     if [ $? -ne 0 ]; then
 167         echo "Failed to create '$INSTALL_ROOT' directory"
 168         return 1
 169     fi
 170
 171     # download a mini altlinux into a cache
 172     echo "Downloading altlinux minimal ..."
 173     APT_GET="apt-get -o RPM::RootDir=$INSTALL_ROOT -y"
 174     PKG_LIST="$(grep -hs '^[^#]' "$profile_dir/$profile")"
 175 #    PKG_LIST="basesystem apt apt-conf-sisyphus etcnet openssh-server passwd sysklogd net-tools e2fsprogs"
 176
 177     mkdir -p $INSTALL_ROOT/var/lib/rpm
 178     rpm --root $INSTALL_ROOT  --initdb
 179     $APT_GET install $PKG_LIST
 180
 181     if [ $? -ne 0 ]; then
 182         echo "Failed to download the rootfs, aborting."
 183         return 1
 184     fi
 185
 186     mv "$INSTALL_ROOT" "$cache/rootfs"
 187     echo "Download complete."
 188
 189     return 0
 190 }
 191
 192 copy_altlinux()
 193 {
 194
 195     # make a local copy of the minialtlinux
 196     echo -n "Copying rootfs to $rootfs_path ..."
 197     #cp -a $cache/rootfs-$arch $rootfs_path || return 1
 198     # i prefer rsync (no reason really)
 199     mkdir -p $rootfs_path
 200     rsync -Ha $cache/rootfs/ $rootfs_path/
 201     return 0
 202 }
 203
 204 update_altlinux()
 205 {
 206     chroot $cache/rootfs apt-get update
 207     chroot $cache/rootfs apt-get -y dist-upgrade
 208 }
 209
 210 install_altlinux()
 211 {
 212     mkdir -p @LOCALSTATEDIR@/lock/subsys/
 213     (
 214         flock -x 9
 215         if [ $? -ne 0 ]; then
 216             echo "Cache repository is busy."
 217             return 1
 218         fi
 219
 220         echo "Checking cache download in $cache/rootfs ... "
 221         if [ ! -e "$cache/rootfs" ]; then
 222             download_altlinux
 223             if [ $? -ne 0 ]; then
 224                 echo "Failed to download 'altlinux base'"
 225                 return 1
 226             fi
 227         else
 228             echo "Cache found. Updating..."
 229             update_altlinux
 230             if [ $? -ne 0 ]; then
 231                 echo "Failed to update 'altlinux base', continuing with last known good cache"
 232             else
 233                 echo "Update finished"
 234             fi
 235         fi
 236
 237         echo "Copy $cache/rootfs to $rootfs_path ... "
 238         copy_altlinux
 239         if [ $? -ne 0 ]; then
 240             echo "Failed to copy rootfs"
 241             return 1
 242         fi
 243         return 0
 244     ) 9>@LOCALSTATEDIR@/lock/subsys/lxc-altlinux
 245
 246     return $?
 247 }
 248
 249 copy_configuration()
 250 {
 251
 252     mkdir -p $config_path
 253     grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "lxc.rootfs = $rootfs_path" >> $config_path/config
 254     cat <<EOF >> $config_path/config
 255 lxc.utsname = $name
 256 lxc.tty = 4
 257 lxc.pts = 1024
 258 lxc.mount = $config_path/fstab
 259 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 260
 261 # When using LXC with apparmor, uncomment the next line to run unconfined:
 262 #lxc.aa_profile = unconfined
 263
 264 #networking
 265 lxc.network.type = $lxc_network_type
 266 lxc.network.flags = up
 267 lxc.network.link = $lxc_network_link
 268 lxc.network.name = veth0
 269 lxc.network.mtu = 1500
 270 EOF
 271 if [ ! -z ${ipv4} ]; then
 272     cat <<EOF >> $config_path/config
 273 lxc.network.ipv4 = $ipv4
 274 EOF
 275 fi
 276 if [ ! -z ${gw} ]; then
 277     cat <<EOF >> $config_path/config
 278 lxc.network.ipv4.gateway = $gw
 279 EOF
 280 fi
 281 if [ ! -z ${ipv6} ]; then
 282     cat <<EOF >> $config_path/config
 283 lxc.network.ipv6 = $ipv6
 284 EOF
 285 fi
 286 if [ ! -z ${gw6} ]; then
 287     cat <<EOF >> $config_path/config
 288 lxc.network.ipv6.gateway = $gw6
 289 EOF
 290 fi
 291     cat <<EOF >> $config_path/config
 292 #cgroups
 293 lxc.cgroup.devices.deny = a
 294 # /dev/null and zero
 295 lxc.cgroup.devices.allow = c 1:3 rwm
 296 lxc.cgroup.devices.allow = c 1:5 rwm
 297 # consoles
 298 lxc.cgroup.devices.allow = c 5:1 rwm
 299 lxc.cgroup.devices.allow = c 5:0 rwm
 300 lxc.cgroup.devices.allow = c 4:0 rwm
 301 lxc.cgroup.devices.allow = c 4:1 rwm
 302 # /dev/{,u}random
 303 lxc.cgroup.devices.allow = c 1:9 rwm
 304 lxc.cgroup.devices.allow = c 1:8 rwm
 305 lxc.cgroup.devices.allow = c 136:* rwm
 306 lxc.cgroup.devices.allow = c 5:2 rwm
 307 # rtc
 308 lxc.cgroup.devices.allow = c 10:135 rwm
 309 EOF
 310
 311     cat <<EOF > $config_path/fstab
 312 proc            proc         proc    nodev,noexec,nosuid 0 0
 313 sysfs           sys          sysfs   defaults  0 0
 314 EOF
 315
 316     if [ $? -ne 0 ]; then
 317         echo "Failed to add configuration"
 318         return 1
 319     fi
 320
 321     return 0
 322 }
 323
 324 clean()
 325 {
 326
 327     if [ ! -e $cache ]; then
 328         exit 0
 329     fi
 330
 331     # lock, so we won't purge while someone is creating a repository
 332     (
 333         flock -x 9
 334         if [ $? != 0 ]; then
 335             echo "Cache repository is busy."
 336             exit 1
 337         fi
 338
 339         echo -n "Purging the download cache for ALTLinux-$release..."
 340         rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
 341         exit 0
 342     ) 9>@LOCALSTATEDIR@/lock/subsys/lxc-altlinux
 343 }
 344
 345 usage()
 346 {
 347     cat <<EOF
 348 usage:
 349     $1 -n|--name=<container_name>
 350         [-p|--path=<path>] [-c|--clean] [-R|--release=<ALTLinux_release>]
 351         [-4|--ipv4=<ipv4 address>] [-6|--ipv6=<ipv6 address>]
 352         [-g|--gw=<gw address>] [-d|--dns=<dns address>]
 353         [-P|--profile=<name of the profile>] [--rootfs=<path>]
 354         [-A|--arch=<arch of the container>]
 355         [-h|--help]
 356 Mandatory args:
 357   -n,--name         container name, used to as an identifier for that container from now on
 358 Optional args:
 359   -p,--path         path to where the container rootfs will be created, defaults to @LXCPATH@. The container config will go under @LXCPATH@ in that case
 360   -c,--clean        clean the cache
 361   -R,--release      ALTLinux release for the new container. if the host is ALTLinux, then it will defaultto the host's release.
 362   -4,--ipv4         specify the ipv4 address to assign to the virtualized interface, eg. 192.168.1.123/24
 363   -6,--ipv6         specify the ipv6 address to assign to the virtualized interface, eg. 2003:db8:1:0:214:1234:fe0b:3596/64
 364   -g,--gw           specify the default gw, eg. 192.168.1.1
 365   -G,--gw6          specify the default gw, eg. 2003:db8:1:0:214:1234:fe0b:3596
 366   -d,--dns          specify the DNS server, eg. 192.168.1.2
 367   -P,--profile      Profile name is the file name in /etc/lxc/profiles contained packages name for install to cache.
 368   -A,--arch         NOT USED YET. Define what arch the container will be [i686,x86_64]
 369   ---rootfs         rootfs path
 370   -h,--help         print this help
 371 EOF
 372     return 0
 373 }
 374
 375 options=$(getopt -o hp:n:P:cR:4:6:g:d: -l help,rootfs:,path:,name:,profile:,clean,release:ipv4:ipv6:gw:dns: -- "$@")
 376 if [ $? -ne 0 ]; then
 377     usage $(basename $0)
 378     exit 1
 379 fi
 380 eval set -- "$options"
 381
 382 while true
 383 do
 384     case "$1" in
 385         -h|--help)      usage $0 && exit 0;;
 386         -p|--path)      path=$2; shift 2;;
 387         --rootfs)       rootfs_path=$2; shift 2;;
 388         -n|--name)      name=$2; shift 2;;
 389         -P|--profile)   profile=$2; shift 2;;
 390         -c|--clean)     clean=$2; shift 2;;
 391         -R|--release)   release=$2; shift 2;;
 392         -4|--ipv4)      ipv4=$2; shift 2;;
 393         -6|--ipv6)      ipv6=$2; shift 2;;
 394         -g|--gw)        gw=$2; shift 2;;
 395         -d|--dns)       dns=$2; shift 2;;
 396         --)             shift 1; break ;;
 397         *)              break ;;
 398     esac
 399 done
 400
 401 if [ ! -z "$clean" -a -z "$path" ]; then
 402     clean || exit 1
 403     exit 0
 404 fi
 405
 406 type apt-get >/dev/null 2>&1
 407 if [ $? -ne 0 ]; then
 408     echo "'apt-get' command is missing"
 409     exit 1
 410 fi
 411
 412 if [ -z "$path" ]; then
 413     path=$default_path
 414 fi
 415
 416 if [ -z "$profile" ]; then
 417     profile=$default_profile
 418 fi
 419
 420 if [ -z "$release" ]; then
 421     if [ "$is_altlinux" ]; then
 422         release=$(cat /etc/altlinux-release |awk '/^ALT/ {print $3}')
 423     else
 424         echo "This is not a ALTLinux host and release missing, use -R|--release to specify release"
 425         exit 1
 426     fi
 427 fi
 428
 429 if [ -z "$ipv4" -a -z "$ipv6" ]; then
 430     BOOTPROTO="dhcp"
 431 else
 432     BOOTPROTO="static"
 433 fi
 434
 435 if [ "$(id -u)" != "0" ]; then
 436     echo "This script should be run as 'root'"
 437     exit 1
 438 fi
 439
 440 # check for 'lxc.rootfs' passed in through default config by lxc-create
 441 if [ -z "$rootfs_path" ]; then
 442     if grep -q '^lxc.rootfs' $path/config 2>/dev/null ; then
 443         rootfs_path=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $path/config)
 444     else
 445         rootfs_path=$path/rootfs
 446     fi
 447 fi
 448
 449 config_path=$default_path/$name
 450 cache=$cache_base/$release/$profile
 451
 452 if [ -f $config_path/config ]; then
 453     echo "A container with that name exists, chose a different name"
 454     exit 1
 455 fi
 456
 457 install_altlinux
 458 if [ $? -ne 0 ]; then
 459     echo "failed to install altlinux"
 460     exit 1
 461 fi
 462
 463 configure_altlinux
 464 if [ $? -ne 0 ]; then
 465     echo "failed to configure altlinux for a container"
 466     exit 1
 467 fi
 468
 469 copy_configuration
 470 if [ $? -ne 0 ]; then
 471     echo "failed write configuration file"
 472     exit 1
 473 fi
 474
 475 if [ ! -z $clean ]; then
 476     clean || exit 1
 477     exit 0
 478 fi
 479 echo "container rootfs and config created"
 480 echo "network configured as $lxc_network_type in the $lxc_network_link"