templates/lxc-download.in

   1 #!/bin/sh
   2
   3 # Client script for LXC container images.
   4 #
   5 # Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
   6 #
   7 #  This library is free software; you can redistribute it and/or
   8 #  modify it under the terms of the GNU Lesser General Public
   9 #  License as published by the Free Software Foundation; either
  10 #  version 2.1 of the License, or (at your option) any later version.
  11
  12 #  This library is distributed in the hope that it will be useful,
  13 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 #  Lesser General Public License for more details.
  16
  17 #  You should have received a copy of the GNU Lesser General Public
  18 #  License along with this library; if not, write to the Free Software
  19 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  20 #  USA
  21
  22 set -eu
  23
  24 LOCALSTATEDIR="@LOCALSTATEDIR@"
  25 LXC_HOOK_DIR="@LXCHOOKDIR@"
  26 LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
  27
  28 # Defaults
  29 DOWNLOAD_ARCH=
  30 DOWNLOAD_BUILD=
  31 DOWNLOAD_COMPAT_LEVEL=4
  32 DOWNLOAD_DIST=
  33 DOWNLOAD_FLUSH_CACHE="false"
  34 DOWNLOAD_FORCE_CACHE="false"
  35 DOWNLOAD_INTERACTIVE="false"
  36 DOWNLOAD_KEYID="0xE7FB0CAEC8173D669066514CBAEFF88C22F6E216"
  37 DOWNLOAD_LIST_IMAGES="false"
  38 DOWNLOAD_MODE="system"
  39 DOWNLOAD_READY_GPG="false"
  40 DOWNLOAD_RELEASE=
  41 DOWNLOAD_SERVER="images.linuxcontainers.org"
  42 DOWNLOAD_SHOW_GPG_WARNING="true"
  43 DOWNLOAD_SHOW_HTTP_WARNING="true"
  44 DOWNLOAD_TARGET="system"
  45 DOWNLOAD_URL=
  46 DOWNLOAD_USE_CACHE="false"
  47 DOWNLOAD_VALIDATE="true"
  48 DOWNLOAD_VARIANT="default"
  49
  50 LXC_MAPPED_GID=
  51 LXC_MAPPED_UID=
  52 LXC_NAME=
  53 LXC_PATH=
  54 LXC_ROOTFS=
  55
  56 if [ -z "${DOWNLOAD_KEYSERVER:-}" ]; then
  57         DOWNLOAD_KEYSERVER="hkp://pool.sks-keyservers.net"
  58
  59         # Deal with GPG over http proxy
  60         if [ -n "${http_proxy:-}" ]; then
  61             DOWNLOAD_KEYSERVER="hkp://p80.pool.sks-keyservers.net:80"
  62         fi
  63 fi
  64
  65 # Make sure the usual locations are in PATH
  66 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  67
  68 # Some useful functions
  69 cleanup() {
  70     if [ -d "${DOWNLOAD_TEMP}" ]; then
  71         rm -Rf "${DOWNLOAD_TEMP}"
  72     fi
  73 }
  74
  75 wget_wrapper() {
  76     for i in $(seq 3); do
  77         if wget "$@"; then
  78             return 0
  79         fi
  80     done
  81
  82     return 1
  83 }
  84
  85 download_file() {
  86     if ! wget_wrapper -T 30 -q "https://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev/null 2>&1; then
  87         if ! wget_wrapper -T 30 -q "http://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev/null 2>&1; then
  88             if [ "$3" = "noexit" ]; then
  89                 return 1
  90             else
  91                 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
  92                 exit 1
  93             fi
  94         elif [ "${DOWNLOAD_SHOW_HTTP_WARNING}" = "true" ]; then
  95             DOWNLOAD_SHOW_HTTP_WARNING="false"
  96             echo "WARNING: Failed to download the file over HTTPs." 1>&2
  97             echo "         The file was instead download over HTTP. " 1>&2
  98             echo "A server replay attack may be possible!" 1>&2
  99         fi
 100     fi
 101 }
 102
 103 download_sig() {
 104     if ! download_file "$1" "$2" noexit; then
 105         if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
 106             if [ "$3" = "normal" ]; then
 107                 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
 108                 exit 1
 109             else
 110                 return 1
 111             fi
 112         else
 113             return 0
 114         fi
 115     fi
 116 }
 117
 118 gpg_setup() {
 119     if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
 120         return
 121     fi
 122
 123     if [ "${DOWNLOAD_READY_GPG}" = "true" ]; then
 124         return
 125     fi
 126
 127     echo "Setting up the GPG keyring"
 128
 129     mkdir -p "${DOWNLOAD_TEMP}/gpg"
 130     chmod 700 "${DOWNLOAD_TEMP}/gpg"
 131     export GNUPGHOME="${DOWNLOAD_TEMP}/gpg"
 132
 133     success=
 134     for i in $(seq 3); do
 135         if gpg --keyserver "${DOWNLOAD_KEYSERVER}" \
 136             --recv-keys "${DOWNLOAD_KEYID}" >/dev/null 2>&1; then
 137             success=1
 138             break
 139         fi
 140         break
 141     done
 142
 143     if [ -z "${success}" ]; then
 144         echo "ERROR: Unable to fetch GPG key from keyserver."
 145         exit 1
 146     fi
 147
 148     DOWNLOAD_READY_GPG="true"
 149 }
 150
 151 gpg_validate() {
 152     if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
 153         if [ "${DOWNLOAD_SHOW_GPG_WARNING}" = "true" ]; then
 154             echo "WARNING: Running without gpg validation!" 1>&2
 155         fi
 156         DOWNLOAD_SHOW_GPG_WARNING="false"
 157         return 0
 158     fi
 159
 160     if ! gpg --verify "$1" >/dev/null 2>&1; then
 161         echo "ERROR: Invalid signature for $1" 1>&2
 162         exit 1
 163     fi
 164 }
 165
 166 in_userns() {
 167     [ -e /proc/self/uid_map ] || { echo no; return; }
 168     while read -r line; do
 169         fields="$(echo "$line" | awk '{ print $1 " " $2 " " $3 }')"
 170         if [ "${fields}" = "0 0 4294967295" ]; then
 171             echo no;
 172             return;
 173         fi
 174         if echo "${fields}" | grep -q " 0 1$"; then
 175             echo userns-root;
 176             return;
 177         fi
 178     done < /proc/self/uid_map
 179
 180     [ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && \
 181         { echo userns-root; return; }
 182     echo yes
 183 }
 184
 185 relevant_file() {
 186     FILE_PATH="${LXC_CACHE_PATH}/$1"
 187     if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
 188         FILE_PATH="${FILE_PATH}-${DOWNLOAD_MODE}"
 189     fi
 190     if [ -e "${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}" ]; then
 191         FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
 192     fi
 193
 194     echo "${FILE_PATH}"
 195 }
 196
 197 usage() {
 198     cat <<EOF
 199 LXC container image downloader
 200
 201 Special arguments:
 202 [ -h | --help ]: Print this help message and exit.
 203 [ -l | --list ]: List all available images and exit.
 204
 205 Required arguments:
 206 [ -d | --dist <distribution> ]: The name of the distribution
 207 [ -r | --release <release> ]: Release name/version
 208 [ -a | --arch <architecture> ]: Architecture of the container
 209
 210 Optional arguments:
 211 [ --variant <variant> ]: Variant of the image (default: "default")
 212 [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
 213 [ --keyid <keyid> ]: GPG keyid (default: 0x...)
 214 [ --keyserver <keyserver> ]: GPG keyserver to use. Environment variable: DOWNLOAD_KEYSERVER
 215 [ --no-validate ]: Disable GPG validation (not recommended)
 216 [ --flush-cache ]: Flush the local copy (if present)
 217 [ --force-cache ]: Force the use of the local copy even if expired
 218
 219 LXC internal arguments (do not pass manually!):
 220 [ --name <name> ]: The container name
 221 [ --path <path> ]: The path to the container
 222 [ --rootfs <rootfs> ]: The path to the container's rootfs
 223 [ --mapped-uid <map> ]: A uid map (user namespaces)
 224 [ --mapped-gid <map> ]: A gid map (user namespaces)
 225
 226 Environment Variables:
 227 DOWNLOAD_KEYSERVER : The URL of the key server to use, instead of the default.
 228                      Can be further overridden by using optional argument --keyserver
 229
 230 EOF
 231     return 0
 232 }
 233
 234 if ! options=$(getopt -o d:r:a:hl -l dist:,release:,arch:,help,list,variant:,\
 235 server:,keyid:,keyserver:,no-validate,flush-cache,force-cache,name:,path:,\
 236 rootfs:,mapped-uid:,mapped-gid: -- "$@"); then
 237     usage
 238     exit 1
 239 fi
 240 eval set -- "$options"
 241
 242 while :; do
 243     case "$1" in
 244         -h|--help)          usage && exit 1;;
 245         -l|--list)          DOWNLOAD_LIST_IMAGES="true"; shift 1;;
 246         -d|--dist)          DOWNLOAD_DIST="$2"; shift 2;;
 247         -r|--release)       DOWNLOAD_RELEASE="$2"; shift 2;;
 248         -a|--arch)          DOWNLOAD_ARCH="$2"; shift 2;;
 249         --variant)          DOWNLOAD_VARIANT="$2"; shift 2;;
 250         --server)           DOWNLOAD_SERVER="$2"; shift 2;;
 251         --keyid)            DOWNLOAD_KEYID="$2"; shift 2;;
 252         --keyserver)        DOWNLOAD_KEYSERVER="$2"; shift 2;;
 253         --no-validate)      DOWNLOAD_VALIDATE="false"; shift 1;;
 254         --flush-cache)      DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
 255         --force-cache)      DOWNLOAD_FORCE_CACHE="true"; shift 1;;
 256         --name)             LXC_NAME="$2"; shift 2;;
 257         --path)             LXC_PATH="$2"; shift 2;;
 258         --rootfs)           LXC_ROOTFS="$2"; shift 2;;
 259         --mapped-uid)       LXC_MAPPED_UID="$2"; shift 2;;
 260         --mapped-gid)       LXC_MAPPED_GID="$2"; shift 2;;
 261         *)                  break;;
 262     esac
 263 done
 264
 265 # Check for required binaries
 266 for bin in tar xz wget; do
 267     if ! command -V "${bin}" >/dev/null 2>&1; then
 268         echo "ERROR: Missing required tool: ${bin}" 1>&2
 269         exit 1
 270     fi
 271 done
 272
 273 # Check for GPG
 274 if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
 275     if ! command -V gpg >/dev/null 2>&1; then
 276         echo "ERROR: Missing recommended tool: gpg" 1>&2
 277         echo "You can workaround this by using --no-validate." 1>&2
 278         exit 1
 279     fi
 280 fi
 281
 282 # Check that we have all variables we need
 283 if [ -z "${LXC_NAME}" ] || [ -z "${LXC_PATH}" ] || [ -z "${LXC_ROOTFS}" ]; then
 284     if [ "${DOWNLOAD_LIST_IMAGES}" != "true" ]; then
 285         echo "ERROR: Not running through LXC." 1>&2
 286         exit 1
 287     fi
 288 fi
 289
 290 USERNS="$(in_userns)"
 291
 292 if [ "${USERNS}" != "no" ]; then
 293     if [ "${USERNS}" = "yes" ]; then
 294         if [ -z "${LXC_MAPPED_UID}" ] || [ "${LXC_MAPPED_UID}" = "-1" ]; then
 295             echo "ERROR: In a user namespace without a map." 1>&2
 296             exit 1
 297         fi
 298         DOWNLOAD_MODE="user"
 299         DOWNLOAD_TARGET="user"
 300     else
 301         DOWNLOAD_MODE="user"
 302         DOWNLOAD_TARGET="system"
 303     fi
 304 fi
 305
 306 if [ -z "${DOWNLOAD_DIST}" ] || [ -z "${DOWNLOAD_RELEASE}" ] || \
 307    [ -z "${DOWNLOAD_ARCH}" ]; then
 308     DOWNLOAD_INTERACTIVE="true"
 309 fi
 310
 311 # Trap all exit signals
 312 trap cleanup EXIT HUP INT TERM
 313
 314 if ! command -V mktemp >/dev/null 2>&1; then
 315     DOWNLOAD_TEMP=/tmp/lxc-download.$$
 316     mkdir -p "${DOWNLOAD_TEMP}"
 317 else
 318     DOWNLOAD_TEMP=$(mktemp -d)
 319 fi
 320
 321 # Simply list images
 322 if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ] || \
 323    [ "${DOWNLOAD_INTERACTIVE}" = "true" ]; then
 324     # Initialize GPG
 325     gpg_setup
 326
 327     # Grab the index
 328     DOWNLOAD_INDEX_PATH="/meta/1.0/index-${DOWNLOAD_MODE}"
 329
 330     echo "Downloading the image index"
 331     if ! download_file "${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" \
 332          "${DOWNLOAD_TEMP}/index" noexit ||
 333        ! download_sig "${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" \
 334             "${DOWNLOAD_TEMP}/index.asc" noexit; then
 335         download_file "${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
 336         download_sig "${DOWNLOAD_INDEX_PATH}.asc" \
 337             "${DOWNLOAD_TEMP}/index.asc" normal
 338     fi
 339
 340     gpg_validate "${DOWNLOAD_TEMP}/index.asc"
 341
 342     # Parse it
 343     echo ""
 344     echo "---"
 345     printf "DIST\tRELEASE\tARCH\tVARIANT\tBUILD\n"
 346     echo "---"
 347     while IFS=';' read -r f1 f2 f3 f4 f5 f6; do
 348
 349         [ -n "${DOWNLOAD_DIST}" ] && [ "$f1" != "${DOWNLOAD_DIST}" ] && continue
 350         [ -n "${DOWNLOAD_RELEASE}" ] && [ "$f2" != "${DOWNLOAD_RELEASE}" ] && continue
 351         [ -n "${DOWNLOAD_ARCH}" ] && [ "$f3" != "${DOWNLOAD_ARCH}" ] && continue
 352         [ -n "${DOWNLOAD_VARIANT}" ] && [ "$f4" != "${DOWNLOAD_VARIANT}" ] && continue
 353         [ -z "${f5}" ] || [ -z "${f6}" ] && continue
 354
 355         printf "%s\t%s\t%s\t%s\t%s\n" "${f1}" "${f2}" "${f3}" "${f4}" "${f5}"
 356         unset f1 f2 f3 f4 f5 f6
 357     done < "${DOWNLOAD_TEMP}/index"
 358     echo "---"
 359
 360     if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ]; then
 361         exit 1
 362     fi
 363
 364     # Interactive mode
 365     echo ""
 366
 367     if [ -z "${DOWNLOAD_DIST}" ]; then
 368         echo "Distribution: "
 369         read -r DOWNLOAD_DIST
 370     fi
 371
 372     if [ -z "${DOWNLOAD_RELEASE}" ]; then
 373         echo "Release: "
 374         read -r DOWNLOAD_RELEASE
 375     fi
 376
 377     if [ -z "${DOWNLOAD_ARCH}" ]; then
 378         echo "Architecture: "
 379         read -r DOWNLOAD_ARCH
 380     fi
 381
 382     echo ""
 383 fi
 384
 385 # Setup the cache
 386 if [ "${DOWNLOAD_TARGET}" = "system" ]; then
 387     LXC_CACHE_BASE="${LOCALSTATEDIR}/cache/lxc/"
 388 else
 389     LXC_CACHE_BASE="${HOME}/.cache/lxc/"
 390 fi
 391
 392 # Allow the setting of the LXC_CACHE_PATH with the usage of environment variables.
 393 LXC_CACHE_PATH="${LXC_CACHE_PATH:-"${LXC_CACHE_BASE}"}"
 394 LXC_CACHE_PATH="${LXC_CACHE_PATH}/download/${DOWNLOAD_DIST}"
 395 LXC_CACHE_PATH="${LXC_CACHE_PATH}/${DOWNLOAD_RELEASE}/${DOWNLOAD_ARCH}/"
 396 LXC_CACHE_PATH="${LXC_CACHE_PATH}/${DOWNLOAD_VARIANT}"
 397
 398 if [ -d "${LXC_CACHE_PATH}" ]; then
 399     if [ "${DOWNLOAD_FLUSH_CACHE}" = "true" ]; then
 400         echo "Flushing the cache..."
 401         rm -Rf "${LXC_CACHE_PATH}"
 402     elif [ "${DOWNLOAD_FORCE_CACHE}" = "true" ]; then
 403         DOWNLOAD_USE_CACHE="true"
 404     else
 405         DOWNLOAD_USE_CACHE="true"
 406         if [ -e "$(relevant_file expiry)" ]; then
 407             if [ "$(cat "$(relevant_file expiry)")" -lt "$(date +%s)" ]; then
 408                 echo "The cached copy has expired, re-downloading..."
 409                 DOWNLOAD_USE_CACHE="false"
 410             fi
 411         fi
 412     fi
 413 fi
 414
 415 # Download what's needed
 416 if [ "${DOWNLOAD_USE_CACHE}" = "false" ]; then
 417     # Initialize GPG
 418     gpg_setup
 419
 420     # Grab the index
 421     DOWNLOAD_INDEX_PATH="/meta/1.0/index-${DOWNLOAD_MODE}"
 422
 423     echo "Downloading the image index"
 424     if ! download_file "${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" \
 425          "${DOWNLOAD_TEMP}/index" noexit ||
 426        ! download_sig "${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" \
 427             "${DOWNLOAD_TEMP}/index.asc" noexit; then
 428         download_file "${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
 429         download_sig "${DOWNLOAD_INDEX_PATH}.asc" \
 430             "${DOWNLOAD_TEMP}/index.asc" normal
 431     fi
 432
 433     gpg_validate "${DOWNLOAD_TEMP}/index.asc"
 434
 435     # Parse it
 436     while IFS=';' read -r f1 f2 f3 f4 f5 f6; do
 437
 438         if [ "${f1}" != "${DOWNLOAD_DIST}" ] || \
 439            [ "${f2}" != "${DOWNLOAD_RELEASE}" ] || \
 440            [ "${f3}" != "${DOWNLOAD_ARCH}" ] || \
 441            [ "${f4}" != "${DOWNLOAD_VARIANT}" ] || \
 442            [ -z "${f6}" ]; then
 443             continue
 444         fi
 445
 446         DOWNLOAD_BUILD="${f5}"
 447         DOWNLOAD_URL="${f6}"
 448
 449         unset f1 f2 f3 f4 f5 f6
 450         break
 451     done < "${DOWNLOAD_TEMP}/index"
 452
 453     if [ -z "${DOWNLOAD_URL}" ]; then
 454         echo "ERROR: Couldn't find a matching image." 1>&1
 455         exit 1
 456     fi
 457
 458     if [ -d "${LXC_CACHE_PATH}" ] && [ -f "${LXC_CACHE_PATH}/build_id" ] && \
 459        [ "$(cat "${LXC_CACHE_PATH}/build_id")" = "${DOWNLOAD_BUILD}" ]; then
 460         echo "The cache is already up to date."
 461         echo "Using image from local cache"
 462     else
 463         # Download the actual files
 464         echo "Downloading the rootfs"
 465         download_file "${DOWNLOAD_URL}/rootfs.tar.xz" \
 466             "${DOWNLOAD_TEMP}/rootfs.tar.xz" normal
 467         download_sig "${DOWNLOAD_URL}/rootfs.tar.xz.asc" \
 468              "${DOWNLOAD_TEMP}/rootfs.tar.xz.asc" normal
 469         gpg_validate "${DOWNLOAD_TEMP}/rootfs.tar.xz.asc"
 470
 471         echo "Downloading the metadata"
 472         download_file "${DOWNLOAD_URL}/meta.tar.xz" \
 473             "${DOWNLOAD_TEMP}/meta.tar.xz" normal
 474         download_sig "$DOWNLOAD_URL/meta.tar.xz.asc" \
 475             "${DOWNLOAD_TEMP}/meta.tar.xz.asc" normal
 476         gpg_validate "${DOWNLOAD_TEMP}/meta.tar.xz.asc"
 477
 478         if [ -d "${LXC_CACHE_PATH}" ]; then
 479             rm -Rf "${LXC_CACHE_PATH}"
 480         fi
 481         mkdir -p "${LXC_CACHE_PATH}"
 482         mv "${DOWNLOAD_TEMP}/rootfs.tar.xz" "${LXC_CACHE_PATH}"
 483         if ! tar Jxf "${DOWNLOAD_TEMP}/meta.tar.xz" -C "${LXC_CACHE_PATH}"; then
 484             echo "ERROR: Invalid rootfs tarball." 2>&1
 485             exit 1
 486         fi
 487
 488         echo "${DOWNLOAD_BUILD}" > "${LXC_CACHE_PATH}/build_id"
 489
 490         if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
 491             # As the script is run in strict mode (set -eu), all commands
 492             # exiting with non 0 would make the script stop.
 493             # || true or || : (more portable) prevents that.
 494             chown -R "${LXC_MAPPED_UID}" "${LXC_CACHE_BASE}" >/dev/null 2>&1 || :
 495         fi
 496         if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
 497             chgrp -R "${LXC_MAPPED_GID}" "${LXC_CACHE_BASE}" >/dev/null 2>&1 || :
 498         fi
 499         echo "The image cache is now ready"
 500     fi
 501 else
 502     echo "Using image from local cache"
 503 fi
 504
 505 # Unpack the rootfs
 506 echo "Unpacking the rootfs"
 507
 508 EXCLUDES=""
 509 excludelist=$(relevant_file excludes)
 510 if [ -f "${excludelist}" ]; then
 511     while read -r line; do
 512         EXCLUDES="${EXCLUDES} --exclude=${line}"
 513     done < "${excludelist}"
 514 fi
 515
 516 # Do not surround ${EXCLUDES} by quotes. This does not work. The solution could
 517 # use array but this is not POSIX compliant. The only POSIX compliant solution
 518 # is to use a function wrapper, but the latter can't be used here as the args
 519 # are dynamic. We thus need to ignore the warning brought by shellcheck.
 520 # shellcheck disable=SC2086
 521 tar  --anchored ${EXCLUDES} --numeric-owner -xpJf \
 522     "${LXC_CACHE_PATH}/rootfs.tar.xz" -C "${LXC_ROOTFS}"
 523
 524 mkdir -p "${LXC_ROOTFS}/dev/pts/"
 525
 526 # Setup the configuration
 527 configfile="$(relevant_file config)"
 528 fstab="$(relevant_file fstab)"
 529 if [ ! -e "${configfile}" ]; then
 530     echo "ERROR: meta tarball is missing the configuration file" 1>&2
 531     exit 1
 532 fi
 533
 534 ## Extract all the network config entries
 535 sed -i -e "/lxc.net.0/{w ${LXC_PATH}/config-network" -e "d}" \
 536     "${LXC_PATH}/config"
 537
 538 ## Extract any other config entry
 539 sed -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" "${LXC_PATH}/config"
 540
 541 ## Append the defaults
 542 echo "" >> "${LXC_PATH}/config"
 543 echo "# Distribution configuration" >> "${LXC_PATH}/config"
 544 cat "$configfile" >> "${LXC_PATH}/config"
 545
 546 ## Add the container-specific config
 547 echo "" >> "${LXC_PATH}/config"
 548 echo "# Container specific configuration" >> "${LXC_PATH}/config"
 549 if [ -e "${LXC_PATH}/config-auto" ]; then
 550     cat "${LXC_PATH}/config-auto" >> "${LXC_PATH}/config"
 551     rm "${LXC_PATH}/config-auto"
 552 fi
 553 if [ -e "${fstab}" ]; then
 554     echo "lxc.mount.fstab = ${LXC_PATH}/fstab" >> "${LXC_PATH}/config"
 555 fi
 556 echo "lxc.uts.name = ${LXC_NAME}" >> "${LXC_PATH}/config"
 557
 558 ## Re-add the previously removed network config
 559 if [ -e "${LXC_PATH}/config-network" ]; then
 560     echo "" >> "${LXC_PATH}/config"
 561     echo "# Network configuration" >> "${LXC_PATH}/config"
 562     cat "${LXC_PATH}/config-network" >> "${LXC_PATH}/config"
 563     rm "${LXC_PATH}/config-network"
 564 fi
 565
 566 TEMPLATE_FILES="${LXC_PATH}/config"
 567
 568 # Setup the fstab
 569 if [ -e "${fstab}" ]; then
 570     cp "${fstab}" "${LXC_PATH}/fstab"
 571     TEMPLATE_FILES="${TEMPLATE_FILES};${LXC_PATH}/fstab"
 572 fi
 573
 574 # Look for extra templates
 575 if [ -e "$(relevant_file templates)" ]; then
 576     while read -r line; do
 577         fullpath="${LXC_ROOTFS}/${line}"
 578         [ ! -e "${fullpath}" ] && continue
 579         TEMPLATE_FILES="${TEMPLATE_FILES};${fullpath}"
 580     done < "$(relevant_file templates)"
 581 fi
 582
 583 # Replace variables in all templates
 584 for file in $TEMPLATE_FILES; do
 585 OLD_IFS=${IFS}
 586 IFS=";"
 587 for file in ${TEMPLATE_FILES}; do
 588     [ ! -f "${file}" ] && continue
 589
 590     sed -i "s#LXC_NAME#${LXC_NAME}#g" "${file}"
 591     sed -i "s#LXC_PATH#${LXC_PATH}#g" "${file}"
 592     sed -i "s#LXC_ROOTFS#${LXC_ROOTFS}#g" "${file}"
 593     sed -i "s#LXC_TEMPLATE_CONFIG#${LXC_TEMPLATE_CONFIG}#g" "${file}"
 594     sed -i "s#LXC_HOOK_DIR#${LXC_HOOK_DIR}#g" "${file}"
 595 done
 596 IFS=${OLD_IFS}
 597
 598 # prevent mingetty from calling vhangup(2) since it fails with userns on CentOS / Oracle
 599 if [ -f "${LXC_ROOTFS}/etc/init/tty.conf" ]; then
 600     sed -i 's|mingetty|mingetty --nohangup|' "${LXC_ROOTFS}/etc/init/tty.conf"
 601 fi
 602
 603 if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
 604     chown "${LXC_MAPPED_UID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev/null 2>&1 || :
 605 fi
 606 if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
 607     chgrp "${LXC_MAPPED_GID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev/null 2>&1 || :
 608 fi
 609
 610 if [ -e "$(relevant_file create-message)" ]; then
 611     echo ""
 612     echo "---"
 613     cat "$(relevant_file create-message)"
 614 fi
 615
 616 exit 0