3 # Client script for LXC container images.
5 # Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
7 # This library is free software; you can redistribute it and/or
8 # modify it under the terms of the GNU Lesser General Public
9 # License as published by the Free Software Foundation; either
10 # version 2.1 of the License, or (at your option) any later version.
12 # This library is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 # Lesser General Public License for more details.
17 # You should have received a copy of the GNU Lesser General Public
18 # License along with this library; if not, write to the Free Software
19 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
24 LOCALSTATEDIR
="@LOCALSTATEDIR@"
25 LXC_HOOK_DIR
="@LXCHOOKDIR@"
26 LXC_TEMPLATE_CONFIG
="@LXCTEMPLATECONFIG@"
31 DOWNLOAD_COMPAT_LEVEL
=4
33 DOWNLOAD_FLUSH_CACHE
="false"
34 DOWNLOAD_FORCE_CACHE
="false"
35 DOWNLOAD_INTERACTIVE
="false"
36 DOWNLOAD_KEYID
="0xE7FB0CAEC8173D669066514CBAEFF88C22F6E216"
37 DOWNLOAD_LIST_IMAGES
="false"
38 DOWNLOAD_MODE
="system"
39 DOWNLOAD_READY_GPG
="false"
41 DOWNLOAD_SERVER
="images.linuxcontainers.org"
42 DOWNLOAD_SHOW_GPG_WARNING
="true"
43 DOWNLOAD_SHOW_HTTP_WARNING
="true"
44 DOWNLOAD_TARGET
="system"
46 DOWNLOAD_USE_CACHE
="false"
47 DOWNLOAD_VALIDATE
="true"
48 DOWNLOAD_VARIANT
="default"
56 if [ -z "${DOWNLOAD_KEYSERVER:-}" ]; then
57 DOWNLOAD_KEYSERVER
="hkp://pool.sks-keyservers.net"
59 # Deal with GPG over http proxy
60 if [ -n "${http_proxy:-}" ]; then
61 DOWNLOAD_KEYSERVER
="hkp://p80.pool.sks-keyservers.net:80"
65 # Make sure the usual locations are in PATH
66 export PATH
=$PATH:/usr
/sbin
:/usr
/bin
:/sbin
:/bin
68 # Some useful functions
70 if [ -d "${DOWNLOAD_TEMP}" ]; then
71 rm -Rf "${DOWNLOAD_TEMP}"
86 if ! wget_wrapper
-T 30 -q "https://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev
/null
2>&1; then
87 if ! wget_wrapper
-T 30 -q "http://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev
/null
2>&1; then
88 if [ "$3" = "noexit" ]; then
91 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
94 elif [ "${DOWNLOAD_SHOW_HTTP_WARNING}" = "true" ]; then
95 DOWNLOAD_SHOW_HTTP_WARNING
="false"
96 echo "WARNING: Failed to download the file over HTTPs." 1>&2
97 echo " The file was instead download over HTTP. " 1>&2
98 echo "A server replay attack may be possible!" 1>&2
104 if ! download_file
"$1" "$2" noexit
; then
105 if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
106 if [ "$3" = "normal" ]; then
107 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
119 if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
123 if [ "${DOWNLOAD_READY_GPG}" = "true" ]; then
127 echo "Setting up the GPG keyring"
129 mkdir
-p "${DOWNLOAD_TEMP}/gpg"
130 chmod 700 "${DOWNLOAD_TEMP}/gpg"
131 export GNUPGHOME
="${DOWNLOAD_TEMP}/gpg"
134 for i
in $
(seq 3); do
135 if gpg
--keyserver "${DOWNLOAD_KEYSERVER}" \
136 --recv-keys "${DOWNLOAD_KEYID}" >/dev
/null
2>&1; then
143 if [ -z "${success}" ]; then
144 echo "ERROR: Unable to fetch GPG key from keyserver."
148 DOWNLOAD_READY_GPG
="true"
152 if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
153 if [ "${DOWNLOAD_SHOW_GPG_WARNING}" = "true" ]; then
154 echo "WARNING: Running without gpg validation!" 1>&2
156 DOWNLOAD_SHOW_GPG_WARNING
="false"
160 if ! gpg
--verify "$1" >/dev
/null
2>&1; then
161 echo "ERROR: Invalid signature for $1" 1>&2
167 [ -e /proc
/self
/uid_map
] ||
{ echo no
; return; }
168 while read -r line
; do
169 fields
="$(echo "$line" | awk '{ print $1 " " $2 " " $3 }')"
170 if [ "${fields}" = "0 0 4294967295" ]; then
174 if echo "${fields}" |
grep -q " 0 1$"; then
178 done < /proc
/self
/uid_map
180 [ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && \
181 { echo userns-root
; return; }
186 FILE_PATH
="${LXC_CACHE_PATH}/$1"
187 if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
188 FILE_PATH
="${FILE_PATH}-${DOWNLOAD_MODE}"
190 if [ -e "${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}" ]; then
191 FILE_PATH
="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
199 LXC container image downloader
202 [ -h | --help ]: Print this help message and exit.
203 [ -l | --list ]: List all available images and exit.
206 [ -d | --dist <distribution> ]: The name of the distribution
207 [ -r | --release <release> ]: Release name/version
208 [ -a | --arch <architecture> ]: Architecture of the container
211 [ --variant <variant> ]: Variant of the image (default: "default")
212 [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
213 [ --keyid <keyid> ]: GPG keyid (default: 0x...)
214 [ --keyserver <keyserver> ]: GPG keyserver to use. Environment variable: DOWNLOAD_KEYSERVER
215 [ --no-validate ]: Disable GPG validation (not recommended)
216 [ --flush-cache ]: Flush the local copy (if present)
217 [ --force-cache ]: Force the use of the local copy even if expired
219 LXC internal arguments (do not pass manually!):
220 [ --name <name> ]: The container name
221 [ --path <path> ]: The path to the container
222 [ --rootfs <rootfs> ]: The path to the container's rootfs
223 [ --mapped-uid <map> ]: A uid map (user namespaces)
224 [ --mapped-gid <map> ]: A gid map (user namespaces)
226 Environment Variables:
227 DOWNLOAD_KEYSERVER : The URL of the key server to use, instead of the default.
228 Can be further overridden by using optional argument --keyserver
234 if ! options
=$
(getopt
-o d
:r
:a
:hl
-l dist
:,release
:,arch
:,help,list
,variant
:,\
235 server
:,keyid
:,keyserver
:,no-validate
,flush-cache
,force-cache
,name
:,path
:,\
236 rootfs
:,mapped-uid
:,mapped-gid
: -- "$@"); then
240 eval set -- "$options"
244 -h|
--help) usage
&& exit 1;;
245 -l|
--list) DOWNLOAD_LIST_IMAGES
="true"; shift 1;;
246 -d|
--dist) DOWNLOAD_DIST
="$2"; shift 2;;
247 -r|
--release) DOWNLOAD_RELEASE
="$2"; shift 2;;
248 -a|
--arch) DOWNLOAD_ARCH
="$2"; shift 2;;
249 --variant) DOWNLOAD_VARIANT
="$2"; shift 2;;
250 --server) DOWNLOAD_SERVER
="$2"; shift 2;;
251 --keyid) DOWNLOAD_KEYID
="$2"; shift 2;;
252 --keyserver) DOWNLOAD_KEYSERVER
="$2"; shift 2;;
253 --no-validate) DOWNLOAD_VALIDATE
="false"; shift 1;;
254 --flush-cache) DOWNLOAD_FLUSH_CACHE
="true"; shift 1;;
255 --force-cache) DOWNLOAD_FORCE_CACHE
="true"; shift 1;;
256 --name) LXC_NAME
="$2"; shift 2;;
257 --path) LXC_PATH
="$2"; shift 2;;
258 --rootfs) LXC_ROOTFS
="$2"; shift 2;;
259 --mapped-uid) LXC_MAPPED_UID
="$2"; shift 2;;
260 --mapped-gid) LXC_MAPPED_GID
="$2"; shift 2;;
265 # Check for required binaries
266 for bin
in tar xz wget
; do
267 if ! command -V "${bin}" >/dev
/null
2>&1; then
268 echo "ERROR: Missing required tool: ${bin}" 1>&2
274 if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
275 if ! command -V gpg
>/dev
/null
2>&1; then
276 echo "ERROR: Missing recommended tool: gpg" 1>&2
277 echo "You can workaround this by using --no-validate." 1>&2
282 # Check that we have all variables we need
283 if [ -z "${LXC_NAME}" ] || [ -z "${LXC_PATH}" ] || [ -z "${LXC_ROOTFS}" ]; then
284 if [ "${DOWNLOAD_LIST_IMAGES}" != "true" ]; then
285 echo "ERROR: Not running through LXC." 1>&2
290 USERNS
="$(in_userns)"
292 if [ "${USERNS}" != "no" ]; then
293 if [ "${USERNS}" = "yes" ]; then
294 if [ -z "${LXC_MAPPED_UID}" ] ||
[ "${LXC_MAPPED_UID}" = "-1" ]; then
295 echo "ERROR: In a user namespace without a map." 1>&2
299 DOWNLOAD_TARGET
="user"
302 DOWNLOAD_TARGET
="system"
306 if [ -z "${DOWNLOAD_DIST}" ] ||
[ -z "${DOWNLOAD_RELEASE}" ] || \
307 [ -z "${DOWNLOAD_ARCH}" ]; then
308 DOWNLOAD_INTERACTIVE
="true"
311 # Trap all exit signals
312 trap cleanup EXIT HUP INT TERM
314 if ! command -V mktemp
>/dev
/null
2>&1; then
315 DOWNLOAD_TEMP
=/tmp
/lxc-download.$$
316 mkdir
-p "${DOWNLOAD_TEMP}"
318 DOWNLOAD_TEMP
=$
(mktemp
-d)
322 if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ] || \
323 [ "${DOWNLOAD_INTERACTIVE}" = "true" ]; then
328 DOWNLOAD_INDEX_PATH
="/meta/1.0/index-${DOWNLOAD_MODE}"
330 echo "Downloading the image index"
331 if ! download_file
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" \
332 "${DOWNLOAD_TEMP}/index" noexit ||
333 ! download_sig
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" \
334 "${DOWNLOAD_TEMP}/index.asc" noexit
; then
335 download_file
"${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
336 download_sig
"${DOWNLOAD_INDEX_PATH}.asc" \
337 "${DOWNLOAD_TEMP}/index.asc" normal
340 gpg_validate
"${DOWNLOAD_TEMP}/index.asc"
345 printf "DIST\tRELEASE\tARCH\tVARIANT\tBUILD\n"
347 while IFS
=';' read -r f1 f2 f3 f4 f5 f6
; do
349 [ -n "${DOWNLOAD_DIST}" ] && [ "$f1" != "${DOWNLOAD_DIST}" ] && continue
350 [ -n "${DOWNLOAD_RELEASE}" ] && [ "$f2" != "${DOWNLOAD_RELEASE}" ] && continue
351 [ -n "${DOWNLOAD_ARCH}" ] && [ "$f3" != "${DOWNLOAD_ARCH}" ] && continue
352 [ -n "${DOWNLOAD_VARIANT}" ] && [ "$f4" != "${DOWNLOAD_VARIANT}" ] && continue
353 [ -z "${f5}" ] ||
[ -z "${f6}" ] && continue
355 printf "%s\t%s\t%s\t%s\t%s\n" "${f1}" "${f2}" "${f3}" "${f4}" "${f5}"
356 unset f1 f2 f3 f4 f5 f6
357 done < "${DOWNLOAD_TEMP}/index"
360 if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ]; then
367 if [ -z "${DOWNLOAD_DIST}" ]; then
368 echo "Distribution: "
369 read -r DOWNLOAD_DIST
372 if [ -z "${DOWNLOAD_RELEASE}" ]; then
374 read -r DOWNLOAD_RELEASE
377 if [ -z "${DOWNLOAD_ARCH}" ]; then
378 echo "Architecture: "
379 read -r DOWNLOAD_ARCH
386 if [ "${DOWNLOAD_TARGET}" = "system" ]; then
387 LXC_CACHE_BASE
="${LOCALSTATEDIR}/cache/lxc/"
389 LXC_CACHE_BASE
="${HOME}/.cache/lxc/"
392 # Allow the setting of the LXC_CACHE_PATH with the usage of environment variables.
393 LXC_CACHE_PATH
="${LXC_CACHE_PATH:-"${LXC_CACHE_BASE}"}"
394 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/download/${DOWNLOAD_DIST}"
395 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/${DOWNLOAD_RELEASE}/${DOWNLOAD_ARCH}/"
396 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/${DOWNLOAD_VARIANT}"
398 if [ -d "${LXC_CACHE_PATH}" ]; then
399 if [ "${DOWNLOAD_FLUSH_CACHE}" = "true" ]; then
400 echo "Flushing the cache..."
401 rm -Rf "${LXC_CACHE_PATH}"
402 elif [ "${DOWNLOAD_FORCE_CACHE}" = "true" ]; then
403 DOWNLOAD_USE_CACHE
="true"
405 DOWNLOAD_USE_CACHE
="true"
406 if [ -e "$(relevant_file expiry)" ]; then
407 if [ "$(cat "$
(relevant_file expiry
)")" -lt "$(date +%s)" ]; then
408 echo "The cached copy has expired, re-downloading..."
409 DOWNLOAD_USE_CACHE
="false"
415 # Download what's needed
416 if [ "${DOWNLOAD_USE_CACHE}" = "false" ]; then
421 DOWNLOAD_INDEX_PATH
="/meta/1.0/index-${DOWNLOAD_MODE}"
423 echo "Downloading the image index"
424 if ! download_file
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" \
425 "${DOWNLOAD_TEMP}/index" noexit ||
426 ! download_sig
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" \
427 "${DOWNLOAD_TEMP}/index.asc" noexit
; then
428 download_file
"${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
429 download_sig
"${DOWNLOAD_INDEX_PATH}.asc" \
430 "${DOWNLOAD_TEMP}/index.asc" normal
433 gpg_validate
"${DOWNLOAD_TEMP}/index.asc"
436 while IFS
=';' read -r f1 f2 f3 f4 f5 f6
; do
438 if [ "${f1}" != "${DOWNLOAD_DIST}" ] || \
439 [ "${f2}" != "${DOWNLOAD_RELEASE}" ] || \
440 [ "${f3}" != "${DOWNLOAD_ARCH}" ] || \
441 [ "${f4}" != "${DOWNLOAD_VARIANT}" ] || \
446 DOWNLOAD_BUILD
="${f5}"
449 unset f1 f2 f3 f4 f5 f6
451 done < "${DOWNLOAD_TEMP}/index"
453 if [ -z "${DOWNLOAD_URL}" ]; then
454 echo "ERROR: Couldn't find a matching image." 1>&1
458 if [ -d "${LXC_CACHE_PATH}" ] && [ -f "${LXC_CACHE_PATH}/build_id" ] && \
459 [ "$(cat "${LXC_CACHE_PATH}/build_id
")" = "${DOWNLOAD_BUILD}" ]; then
460 echo "The cache is already up to date."
461 echo "Using image from local cache"
463 # Download the actual files
464 echo "Downloading the rootfs"
465 download_file
"${DOWNLOAD_URL}/rootfs.tar.xz" \
466 "${DOWNLOAD_TEMP}/rootfs.tar.xz" normal
467 download_sig
"${DOWNLOAD_URL}/rootfs.tar.xz.asc" \
468 "${DOWNLOAD_TEMP}/rootfs.tar.xz.asc" normal
469 gpg_validate
"${DOWNLOAD_TEMP}/rootfs.tar.xz.asc"
471 echo "Downloading the metadata"
472 download_file
"${DOWNLOAD_URL}/meta.tar.xz" \
473 "${DOWNLOAD_TEMP}/meta.tar.xz" normal
474 download_sig
"$DOWNLOAD_URL/meta.tar.xz.asc" \
475 "${DOWNLOAD_TEMP}/meta.tar.xz.asc" normal
476 gpg_validate
"${DOWNLOAD_TEMP}/meta.tar.xz.asc"
478 if [ -d "${LXC_CACHE_PATH}" ]; then
479 rm -Rf "${LXC_CACHE_PATH}"
481 mkdir
-p "${LXC_CACHE_PATH}"
482 mv "${DOWNLOAD_TEMP}/rootfs.tar.xz" "${LXC_CACHE_PATH}"
483 if ! tar Jxf
"${DOWNLOAD_TEMP}/meta.tar.xz" -C "${LXC_CACHE_PATH}"; then
484 echo "ERROR: Invalid rootfs tarball." 2>&1
488 echo "${DOWNLOAD_BUILD}" > "${LXC_CACHE_PATH}/build_id"
490 if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
491 # As the script is run in strict mode (set -eu), all commands
492 # exiting with non 0 would make the script stop.
493 # || true or || : (more portable) prevents that.
494 chown
-R "${LXC_MAPPED_UID}" "${LXC_CACHE_BASE}" >/dev
/null
2>&1 ||
:
496 if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
497 chgrp
-R "${LXC_MAPPED_GID}" "${LXC_CACHE_BASE}" >/dev
/null
2>&1 ||
:
499 echo "The image cache is now ready"
502 echo "Using image from local cache"
506 echo "Unpacking the rootfs"
509 excludelist
=$
(relevant_file excludes
)
510 if [ -f "${excludelist}" ]; then
511 while read -r line
; do
512 EXCLUDES
="${EXCLUDES} --exclude=${line}"
513 done < "${excludelist}"
516 # Do not surround ${EXCLUDES} by quotes. This does not work. The solution could
517 # use array but this is not POSIX compliant. The only POSIX compliant solution
518 # is to use a function wrapper, but the latter can't be used here as the args
519 # are dynamic. We thus need to ignore the warning brought by shellcheck.
520 # shellcheck disable=SC2086
521 tar --anchored ${EXCLUDES} --numeric-owner -xpJf \
522 "${LXC_CACHE_PATH}/rootfs.tar.xz" -C "${LXC_ROOTFS}"
524 mkdir
-p "${LXC_ROOTFS}/dev/pts/"
526 # Setup the configuration
527 configfile
="$(relevant_file config)"
528 fstab
="$(relevant_file fstab)"
529 if [ ! -e "${configfile}" ]; then
530 echo "ERROR: meta tarball is missing the configuration file" 1>&2
534 ## Extract all the network config entries
535 sed -i -e "/lxc.net.0/{w ${LXC_PATH}/config-network" -e "d}" \
538 ## Extract any other config entry
539 sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" "${LXC_PATH}/config"
541 ## Append the defaults
542 echo "" >> "${LXC_PATH}/config"
543 echo "# Distribution configuration" >> "${LXC_PATH}/config"
544 cat "$configfile" >> "${LXC_PATH}/config"
546 ## Add the container-specific config
547 echo "" >> "${LXC_PATH}/config"
548 echo "# Container specific configuration" >> "${LXC_PATH}/config"
549 if [ -e "${LXC_PATH}/config-auto" ]; then
550 cat "${LXC_PATH}/config-auto" >> "${LXC_PATH}/config"
551 rm "${LXC_PATH}/config-auto"
553 if [ -e "${fstab}" ]; then
554 echo "lxc.mount.fstab = ${LXC_PATH}/fstab" >> "${LXC_PATH}/config"
556 echo "lxc.uts.name = ${LXC_NAME}" >> "${LXC_PATH}/config"
558 ## Re-add the previously removed network config
559 if [ -e "${LXC_PATH}/config-network" ]; then
560 echo "" >> "${LXC_PATH}/config"
561 echo "# Network configuration" >> "${LXC_PATH}/config"
562 cat "${LXC_PATH}/config-network" >> "${LXC_PATH}/config"
563 rm "${LXC_PATH}/config-network"
566 TEMPLATE_FILES
="${LXC_PATH}/config"
569 if [ -e "${fstab}" ]; then
570 cp "${fstab}" "${LXC_PATH}/fstab"
571 TEMPLATE_FILES
="${TEMPLATE_FILES};${LXC_PATH}/fstab"
574 # Look for extra templates
575 if [ -e "$(relevant_file templates)" ]; then
576 while read -r line
; do
577 fullpath
="${LXC_ROOTFS}/${line}"
578 [ ! -e "${fullpath}" ] && continue
579 TEMPLATE_FILES
="${TEMPLATE_FILES};${fullpath}"
580 done < "$(relevant_file templates)"
583 # Replace variables in all templates
586 for file in ${TEMPLATE_FILES}; do
587 [ ! -f "${file}" ] && continue
589 sed -i "s#LXC_NAME#${LXC_NAME}#g" "${file}"
590 sed -i "s#LXC_PATH#${LXC_PATH}#g" "${file}"
591 sed -i "s#LXC_ROOTFS#${LXC_ROOTFS}#g" "${file}"
592 sed -i "s#LXC_TEMPLATE_CONFIG#${LXC_TEMPLATE_CONFIG}#g" "${file}"
593 sed -i "s#LXC_HOOK_DIR#${LXC_HOOK_DIR}#g" "${file}"
597 # prevent mingetty from calling vhangup(2) since it fails with userns on CentOS / Oracle
598 if [ -f "${LXC_ROOTFS}/etc/init/tty.conf" ]; then
599 sed -i 's|mingetty|mingetty --nohangup|' "${LXC_ROOTFS}/etc/init/tty.conf"
602 if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
603 chown
"${LXC_MAPPED_UID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev
/null
2>&1 ||
:
605 if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
606 chgrp
"${LXC_MAPPED_GID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev
/null
2>&1 ||
:
609 if [ -e "$(relevant_file create-message)" ]; then
612 cat "$(relevant_file create-message)"