4 # template script for generating fedora container for LXC
8 # lxc: linux Container library
11 # Daniel Lezcano <daniel.lezcano@free.fr>
12 # Ramez Hanna <rhanna@informatiq.org>
13 # Michael H. Warfield <mhw@WittsEnd.com>
15 # This library is free software; you can redistribute it and/or
16 # modify it under the terms of the GNU Lesser General Public
17 # License as published by the Free Software Foundation; either
18 # version 2.1 of the License, or (at your option) any later version.
20 # This library is distributed in the hope that it will be useful,
21 # but WITHOUT ANY WARRANTY; without even the implied warranty of
22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 # Lesser General Public License for more details.
25 # You should have received a copy of the GNU Lesser General Public
26 # License along with this library; if not, write to the Free Software
27 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
30 default_path
=@LXCPATH@
32 # Some combinations of the tuning knobs below do not exactly make sense.
35 # If the "root_password" is non-blank, use it, else set a default.
36 # This can be passed to the script as an environment variable and is
37 # set by a shell conditional assignment. Looks weird but it is what it is.
39 # If the root password contains a ding ($) then try to expand it.
40 # That will pick up things like ${name} and ${RANDOM}.
41 # If the root password contains more than 3 consecutive X's, pass it as
42 # a template to mktemp and take the result.
44 # If root_display_password = yes, display the temporary root password at exit.
45 # If root_store_password = yes, store it in the configuration directory
46 # If root_prompt_password = yes, invoke "passwd" to force the user to change
47 # the root password after the container is created.
48 # If root_expire_password = yes, you will be prompted to change the root
49 # password at the first login.
51 # These are conditional assignments... The can be overridden from the
52 # preexisting environment variables...
54 # Make sure this is in single quotes to defer expansion to later!
55 # :{root_password='Root-${name}-${RANDOM}'}
56 : ${root_password='Root-${name}-XXXXXX'}
58 # Now, it doesn't make much sense to display, store, and force change
59 # together. But, we gotta test, right???
60 : ${root_display_password='no'}
61 : ${root_store_password='yes'}
62 # Prompting for something interactive has potential for mayhem
63 # with users running under the API... Don't default to "yes"
64 : ${root_prompt_password='no'}
66 # Expire root password? Default to yes, but can be overridden from
67 # the environment variable
68 : ${root_expire_password='yes'}
70 # These are only going into comments in the resulting config...
72 lxc_network_link
=lxcbr0
75 # Alow for weird remixes like the Raspberry Pi
77 # Use the Mitre standard CPE identifier for the release ID if possible...
78 # This may be in /etc/os-release or /etc/system-release-cpe. We
79 # should be able to use EITHER. Give preference to /etc/os-release for now.
81 # Detect use under userns (unsupported)
83 [ "$arg" = "--" ] && break
84 if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
85 echo "This template can't be used for unprivileged containers." 1>&2
86 echo "You may want to try the \"download\" template instead." 1>&2
91 # Make sure the usual locations are in PATH
92 export PATH
=$PATH:/usr
/sbin
:/usr
/bin
:/sbin
:/bin
94 if [ -e /etc
/os-release
]
96 # This is a shell friendly configuration file. We can just source it.
97 # What we're looking for in here is the ID, VERSION_ID and the CPE_NAME
99 echo "Host CPE ID from /etc/os-release: ${CPE_NAME}"
102 if [ "${CPE_NAME}" = "" -a -e /etc
/system-release-cpe
]
104 CPE_NAME
=$
(head -n1 /etc
/system-release-cpe
)
105 CPE_URI
=$
(expr ${CPE_NAME} : '\([^:]*:[^:]*\)')
106 if [ "${CPE_URI}" != "cpe:/o" ]
110 echo "Host CPE ID from /etc/system-release-cpe: ${CPE_NAME}"
111 # Probably a better way to do this but sill remain posix
112 # compatible but this works, shrug...
113 # Must be nice and not introduce convenient bashisms here.
114 ID
=$
(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:\([^:]*\)')
115 VERSION_ID
=$
(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:[^:]*:\([^:]*\)')
119 if [ "${CPE_NAME}" != "" -a "${ID}" = "fedora" -a "${VERSION_ID}" != "" ]
121 fedora_host_ver
=${VERSION_ID}
123 elif [ -e /etc
/redhat-release
]
125 # Only if all other methods fail, try to parse the redhat-release file.
126 fedora_host_ver
=$
( sed -e '/^Fedora /!d' -e 's/Fedora.*\srelease\s*\([0-9][0-9]*\)\s.*/\1/' < /etc
/redhat-release
)
127 if [ "$fedora_host_ver" != "" ]
136 # disable selinux in fedora
137 mkdir
-p $rootfs_path/selinux
138 echo 0 > $rootfs_path/selinux
/enforce
140 # Also kill it in the /etc/selinux/config file if it's there...
141 if [[ -f $rootfs_path/etc
/selinux
/config
]]
143 sed -i '/^SELINUX=/s/.*/SELINUX=disabled/' $rootfs_path/etc
/selinux
/config
146 # Nice catch from Dwight Engen in the Oracle template.
147 # Wantonly plagerized here with much appreciation.
148 if [ -f $rootfs_path/usr
/sbin
/selinuxenabled
]; then
149 mv $rootfs_path/usr
/sbin
/selinuxenabled
$rootfs_path/usr
/sbin
/selinuxenabled.lxcorig
150 ln -s /bin
/false
$rootfs_path/usr
/sbin
/selinuxenabled
153 # This is a known problem and documented in RedHat bugzilla as relating
154 # to a problem with auditing enabled. This prevents an error in
155 # the container "Cannot make/remove an entry for the specified session"
156 sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc
/pam.d
/login
157 sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc
/pam.d
/sshd
159 if [ -f ${rootfs_path}/etc
/pam.d
/crond
]
161 sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc
/pam.d
/crond
164 # In addition to disabling pam_loginuid in the above config files
165 # we'll also disable it by linking it to pam_permit to catch any
166 # we missed or any that get installed after the container is built.
168 # Catch either or both 32 and 64 bit archs.
169 if [ -f ${rootfs_path}/lib
/security
/pam_loginuid.so
]
171 ( cd ${rootfs_path}/lib
/security
/
172 mv pam_loginuid.so pam_loginuid.so.disabled
173 ln -s pam_permit.so pam_loginuid.so
177 if [ -f ${rootfs_path}/lib64
/security
/pam_loginuid.so
]
179 ( cd ${rootfs_path}/lib64
/security
/
180 mv pam_loginuid.so pam_loginuid.so.disabled
181 ln -s pam_permit.so pam_loginuid.so
185 # Set default localtime to the host localtime if not set...
186 if [ -e /etc
/localtime
-a ! -e ${rootfs_path}/etc
/localtime
]
188 # if /etc/localtime is a symlink, this should preserve it.
189 cp -a /etc
/localtime
${rootfs_path}/etc
/localtime
192 # Deal with some dain bramage in the /etc/init.d/halt script.
193 # Trim it and make it our own and link it in before the default
194 # halt script so we can intercept it. This also preventions package
195 # updates from interferring with our interferring with it.
197 # There's generally not much in the halt script that useful but what's
198 # in there from resetting the hardware clock down is generally very bad.
199 # So we just eliminate the whole bottom half of that script in making
200 # ourselves a copy. That way a major update to the init scripts won't
201 # trash what we've set up.
203 # This is mostly for legacy distros since any modern systemd Fedora
204 # release will not have this script so we won't try to intercept it.
205 if [ -f ${rootfs_path}/etc
/init.d
/halt
]
207 sed -e '/hwclock/,$d' \
208 < ${rootfs_path}/etc
/init.d
/halt \
209 > ${rootfs_path}/etc
/init.d
/lxc-halt
211 echo '$command -f' >> ${rootfs_path}/etc
/init.d
/lxc-halt
212 chmod 755 ${rootfs_path}/etc
/init.d
/lxc-halt
214 # Link them into the rc directories...
216 cd ${rootfs_path}/etc
/rc.d
/rc0.d
217 ln -s ..
/init.d
/lxc-halt S00lxc-halt
218 cd ${rootfs_path}/etc
/rc.d
/rc6.d
219 ln -s ..
/init.d
/lxc-halt S00lxc-reboot
223 # configure the network using the dhcp
224 cat <<EOF > ${rootfs_path}/etc/sysconfig/network-scripts/ifcfg-eth0
235 cat <<EOF > ${rootfs_path}/etc/sysconfig/network
240 # set hostname on systemd Fedora systems
241 if [ $release -gt 14 ]; then
242 echo "${utsname}" > ${rootfs_path}/etc
/hostname
246 cat <<EOF > $rootfs_path/etc/hosts
247 127.0.0.1 localhost.localdomain localhost $utsname
248 ::1 localhost6.localdomain6 localhost6
251 # These mknod's really don't make any sense with modern releases of
252 # Fedora with systemd, devtmpfs, and autodev enabled. They are left
253 # here for legacy reasons and older releases with upstart and sysv init.
254 dev_path
="${rootfs_path}/dev"
257 mknod
-m 666 ${dev_path}/null c
1 3
258 mknod
-m 666 ${dev_path}/zero c
1 5
259 mknod
-m 666 ${dev_path}/random c
1 8
260 mknod
-m 666 ${dev_path}/urandom c
1 9
261 mkdir
-m 755 ${dev_path}/pts
262 mkdir
-m 1777 ${dev_path}/shm
263 mknod
-m 666 ${dev_path}/tty c
5 0
264 mknod
-m 666 ${dev_path}/tty0 c
4 0
265 mknod
-m 666 ${dev_path}/tty1 c
4 1
266 mknod
-m 666 ${dev_path}/tty2 c
4 2
267 mknod
-m 666 ${dev_path}/tty3 c
4 3
268 mknod
-m 666 ${dev_path}/tty4 c
4 4
269 mknod
-m 600 ${dev_path}/console c
5 1
270 mknod
-m 666 ${dev_path}/full c
1 7
271 mknod
-m 600 ${dev_path}/initctl p
272 mknod
-m 666 ${dev_path}/ptmx c
5 2
274 # setup console and tty[1-4] for login. note that /dev/console and
275 # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
276 # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
277 # lxc will maintain these links and bind mount ptys over /dev/lxc/*
278 # since lxc.devttydir is specified in the config.
280 # allow root login on console, tty[1-4], and pts/0 for libvirt
281 echo "# LXC (Linux Containers)" >>${rootfs_path}/etc
/securetty
282 echo "lxc/console" >>${rootfs_path}/etc
/securetty
283 echo "lxc/tty1" >>${rootfs_path}/etc
/securetty
284 echo "lxc/tty2" >>${rootfs_path}/etc
/securetty
285 echo "lxc/tty3" >>${rootfs_path}/etc
/securetty
286 echo "lxc/tty4" >>${rootfs_path}/etc
/securetty
287 echo "# For libvirt/Virtual Machine Monitor" >>${rootfs_path}/etc
/securetty
288 echo "pts/0" >>${rootfs_path}/etc
/securetty
290 if [ ${root_display_password} = "yes" ]
292 echo "Setting root password to '$root_password'"
294 if [ ${root_store_password} = "yes" ]
296 touch ${config_path}/tmp_root_pass
297 chmod 600 ${config_path}/tmp_root_pass
298 echo ${root_password} > ${config_path}/tmp_root_pass
299 echo "Storing root password in '${config_path}/tmp_root_pass'"
302 echo "root:$root_password" | chroot
$rootfs_path chpasswd
304 if [ ${root_expire_password} = "yes" ]
306 # Also set this password as expired to force the user to change it!
307 chroot
$rootfs_path passwd
-e root
310 # specifying this in the initial packages doesn't always work.
311 # Even though it should have...
312 echo "installing fedora-release package"
313 mount
-o bind /dev
${rootfs_path}/dev
314 mount
-t proc proc
${rootfs_path}/proc
315 # Always make sure /etc/resolv.conf is up to date in the target!
316 cp /etc
/resolv.conf
${rootfs_path}/etc
/
317 # Rebuild the rpm database based on the target rpm version...
318 rm -f ${rootfs_path}/var
/lib
/rpm
/__db
*
319 chroot
${rootfs_path} rpm
--rebuilddb
320 chroot
${rootfs_path} yum
-y install fedora-release
322 if [[ ! -e ${rootfs_path}/sbin
/NetworkManager
]]
324 # NetworkManager has not been installed. Use the
325 # legacy chkconfig command to enable the network startup
326 # scripts in the container.
327 chroot
${rootfs_path} chkconfig network on
330 umount
${rootfs_path}/proc
331 umount
${rootfs_path}/dev
333 # silence some needless startup errors
334 touch ${rootfs_path}/etc
/fstab
336 # give us a console on /dev/console
337 sed -i 's/ACTIVE_CONSOLES=.*$/ACTIVE_CONSOLES="\/dev\/console \/dev\/tty[1-4]"/' \
338 ${rootfs_path}/etc
/sysconfig
/init
343 configure_fedora_init
()
345 sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc
/rc.sysinit
346 sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc
/rc.d
/rc.sysinit
347 # don't mount devpts, for pete's sake
348 sed -i 's/^.*dev.pts.*$/#\0/' ${rootfs_path}/etc
/rc.sysinit
349 sed -i 's/^.*dev.pts.*$/#\0/' ${rootfs_path}/etc
/rc.d
/rc.sysinit
350 chroot
${rootfs_path} chkconfig udev-post off
351 chroot
${rootfs_path} chkconfig network on
353 if [ -d ${rootfs_path}/etc
/init
]
355 # This is to make upstart honor SIGPWR. Should do no harm
356 # on systemd systems and some systems may have both.
357 cat <<EOF >${rootfs_path}/etc/init/power-status-changed.conf
358 # power-status-changed - shutdown on SIGPWR
360 start on power-status-changed
362 exec /sbin/shutdown -h now "SIGPWR received"
367 configure_fedora_systemd
()
369 rm -f ${rootfs_path}/etc
/systemd
/system
/default.target
370 touch ${rootfs_path}/etc
/fstab
371 chroot
${rootfs_path} ln -s /dev
/null
/etc
/systemd
/system
/udev.service
372 chroot
${rootfs_path} ln -s /lib
/systemd
/system
/multi-user.target
/etc
/systemd
/system
/default.target
373 # Make systemd honor SIGPWR
374 chroot
${rootfs_path} ln -s /usr
/lib
/systemd
/system
/halt.target
/etc
/systemd
/system
/sigpwr.target
375 #dependency on a device unit fails it specially that we disabled udev
376 # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
378 # Actually, the After=dev-%i.device line does not appear in the
379 # Fedora 17 or Fedora 18 systemd getty\@.service file. It may be left
380 # over from an earlier version and it's not doing any harm. We do need
381 # to disable the "ConditionalPathExists=/dev/tty0" line or no gettys are
382 # started on the ttys in the container. Lets do it in an override copy of
383 # the service so it can still pass rpm verifies and not be automatically
384 # updated by a new systemd version. -- mhw /\/\|=mhw=|\/\/
386 sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \
387 -e 's/After=dev-%i.device/After=/' \
388 < ${rootfs_path}/lib
/systemd
/system
/getty\@.service \
389 > ${rootfs_path}/etc
/systemd
/system
/getty\@.service
390 # Setup getty service on the 4 ttys we are going to allow in the
391 # default config. Number should match lxc.tty
392 ( cd ${rootfs_path}/etc
/systemd
/system
/getty.target.wants
393 for i
in 1 2 3 4 ; do ln -sf ..
/getty\@.service getty@tty
${i}.service
; done )
396 ### BEGIN Bootstrap Environment Code... Michael H. Warfield /\/\|=mhw=|\/\/
398 # Ok... Heads up. If you're reading these comments, you're either a
399 # template owner or someone wondering how the hell I did this (or, worse,
400 # someone in the future trying to maintain it). This code is slightly
401 # "evil coding bastard" code with one significant hack / dirty trick
402 # that you would probably miss just reading the code below. I'll mark
403 # it out with comments.
405 # Because of what this code does, it deserves a lot of comments so people
406 # can understand WHY I did it this way...
408 # Ultimate Objective - Build a Fedora container on a host system which does
409 # not have a (complete compatible) version of rpm and/or yum. That basically
410 # means damn near any distro other than Fedora and Ubuntu (which has rpm and
411 # yum available). Only requirements for this function are rsync and
412 # squashfs available to the kernel. If you don't have those, why are you
413 # even attempting to build containers?
415 # Challenge for this function - Bootstrap a Fedora install bootstrap
416 # run time environment which has all the pieces to run rpm and yum and
417 # from which we can build targets containers even where the host system
418 # has no support for rpm, yum, or fedora.
421 # Stage 0 - Download a Fedora LiveOS squashfs core (netinst core).
422 # Stage 1 - Extract filesystem from Stage 0 and update to full rpm & yum
423 # Stage 2 - Use Stage 1 to build a rootfs with python, rpm, and yum.
425 # Stage 2 becomes our bootstrap file system which can be cached
426 # and then used to build other arbitrary vesions of Fedora of a
427 # given architecture. Note that this only has to run once for
428 # Fedora on a given architecture since rpm and yum can build other
429 # versions. We'll arbitrarily pick Fedora 20 to build this. This
430 # will need to change as time goes on.
432 # Programmers Note... A future fall back may be to download the netinst
433 # iso image instead of the LiveOS squasfs image and work from that.
434 # That may be more general but will introduce another substep
435 # (mounting the iso) to the stage0 setup.
437 # This system is designed to be as autonomous as possible so all whitelists
438 # and controls are self-contained.
440 # Initial testing - Whitelist nobody. Build for everybody...
441 # Initial deployment - Whitelist Fedora.
442 # Long term - Whitelist Fedora, Debian, Ubuntu, CentOs, Scientific, and NST.
444 # List of distros which do not (should not) need a bootstrap (but we will test
445 # for rpm and yum none the less... OS SHOULD be taken from CPE values but
446 # Debian / Ubuntu doesn't support CPE yet.
448 # BOOTSTRAP_WHITE_LIST=""
449 BOOTSTRAP_WHITE_LIST
="fedora"
450 # BOOTSTRAP_WHITE_LIST="fedora debian ubuntu centos scientific sl nst"
456 fedora_get_bootstrap
()
458 echo "Bootstrap Environment testing..."
462 # We need rpm. No rpm - not possible to white list...
463 if ! which rpm
> /dev
/null
2>&1
468 # We need yum No yum - not possible to white list...
469 if ! which yum
> /dev
/null
2>&1
474 if [[ ${WHITE_LISTED} != 0 ]]
476 for OS
in ${BOOTSTRAP_WHITE_LIST}
478 if [[ ${ID} = ${OS} ]]
481 OS ${ID} is whitelisted. Installation Bootstrap Environment not required.
489 Fedora Installation Bootstrap Build..."
491 if ! which rsync
> /dev
/null
2>&1
494 Unable to locate rsync. Cravely bailing out before even attempting to build
495 an Installation Bootstrap Please install rsync and then rerun this process.
501 [[ -d ${cache_base} ]] || mkdir
-p ${cache_base}
505 # We know we don't have a cache directory of this version or we
506 # would have never reached this code to begin with. But we may
507 # have another Fedora cache directory from which we could run...
508 # We'll give a preference for close matches preferring higher over
509 # lower - which makes for really ugly code...
511 # Is this a "bashism" that will need cleaning up????
512 BOOTSTRAP_LIST
="$(( $release + 1 ))/rootfs $(( $release - 1 ))/rootfs \
513 $(( $release + 2 ))/rootfs $(( $release - 2 ))/rootfs \
514 $(( $release + 3 ))/rootfs $(( $release - 3 ))/rootfs \
517 for bootstrap
in ${BOOTSTRAP_LIST}
519 if [[ -d ${bootstrap} ]]
522 Existing Bootstrap found. Testing..."
524 mount
-o bind /dev
${bootstrap}/dev
525 mount
-t proc proc
${bootstrap}/proc
526 # Always make sure /etc/resolv.conf is up to date in the target!
527 cp /etc
/resolv.conf
${bootstrap}/etc
/
528 rm -f ${bootstrap}/var
/lib
/rpm
/__db
*
529 chroot
${bootstrap} rpm
--rebuilddb
530 chroot
${bootstrap} yum
-y update
532 umount
${bootstrap}/proc
533 umount
${bootstrap}/dev
538 BOOTSTRAP_DIR
="${cache_base}/${bootstrap}"
539 BOOTSTRAP_CHROOT
="chroot ${BOOTSTRAP_DIR} "
540 BOOTSTRAP_INSTALL_ROOT
=/run
/install
543 Functional Installation Bootstrap exists and appears to be completed.
544 Will use existing Bootstrap: ${BOOTSTRAP_DIR}
549 Installation Bootstrap in ${BOOTSTRAP_DIR} exists
550 but appears to be non-functional. Skipping... It should be removed.
555 TMP_BOOTSTRAP_DIR
=$
( mktemp
-d --tmpdir=${cache_base} bootstrap_XXXXXX
)
557 cd ${TMP_BOOTSTRAP_DIR}
559 mkdir squashfs stage0 stage1 bootstrap
562 # Download the LiveOS squashfs image
563 # mount image to "squashfs"
564 # mount contained LiveOS to stage0
566 # We're going to use the kernel.org mirror for the initial stages...
567 # 1 - It's generally up to date and comnplete
568 # 2 - It's has high bandwidth access
569 # 3 - It supports rsync and wildcarding (and we need both)
570 # 4 - Not all the mirrors carry the LiveOS images
572 if [[ ! -f ..
/LiveOS
/squashfs.img
]]
575 Downloading stage 0 LiveOS squashfs file system from mirrors.kernel.org...
576 Have a beer or a cup of coffee. This will take a bit (~300MB).
578 sleep 3 # let him read it...
580 # Right now, we are using Fedora 20 for the inial bootstrap.
581 # We could make this the "current" Fedora rev (F > 15).
583 rsync
-av mirrors.kernel.org
::fedora
/releases
/20/Fedora
/$basearch/os
/LiveOS .
587 echo "Download of squashfs image complete."
591 Download of squashfs image failed.
596 echo "Using cached stage 0 LiveOS squashfs file system."
599 mount
-o loop ..
/LiveOS
/squashfs.img squashfs
604 Mount of LiveOS squashfs image failed! You mush have squashfs support
605 available to mount image. Unable to continue. Correct and retry
606 process later! LiveOS image not removed. Process may be rerun
607 without penalty of downloading LiveOS again. If LiveOS is corrupt,
608 remove ${cache_base}/LiveOS before rerunning to redownload.
613 mount
-o loop squashfs
/LiveOS
/rootfs.img stage0
618 Mount of LiveOS stage0 rootfs image failed! LiveOS download may be corrupt.
619 Remove ${cache_base}/LiveOS to force a new download or
620 troubleshoot cached image and then rerun process.
627 # Copy stage0 (which is ro) to stage1 area (rw) for modification.
628 # Unmount stage0 mounts - we're done with stage 0 at this point.
629 # Download our rpm and yum rpm packages.
630 # Force install of rpm and yum into stage1 image (dirty hack!)
632 echo "Stage 0 complete, building Stage 1 image...
633 This will take a couple of minutes. Patience..."
635 echo "Creating Stage 1 r/w copy of r/o Stage 0 squashfs image from LiveOS."
637 rsync
-aAHS stage
0/. stage
1/
644 # Setup stage1 image with pieces to run installs...
647 mount
-o bind /dev dev
648 mount
-t proc proc proc
649 # Always make sure /etc/resolv.conf is up to date in the target!
650 cp /etc
/resolv.conf etc
/
654 echo "Updating Stage 1 image with full rpm and yum packages"
656 # Retrieve our 2 rpm packages we need to force down the throat
657 # of this LiveOS image we're camped out on. This is the beginning
658 # of the butt ugly hack. Look close or you may missing it...
660 rsync
-av mirrors.kernel.org
::fedora
/releases
/20/Fedora
/$basearch/os
/Packages
/r
/rpm-
[0-9]* \
661 mirrors.kernel.org
::fedora
/releases
/20/Fedora
/$basearch/os
/Packages
/y
/yum-
[0-9]* .
664 # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
665 chroot . rpm
-ivh --nodeps rpm-
* yum-
*
668 # The LiveOS image contains rpm (but not rpmdb) and yum (but not
669 # yummain.py - What the hell good does yum do with no
670 # yummain.py?!?! - Sigh...). It contains all the supporting
671 # pieces but the rpm database has not be initialized and it
672 # doesn't know all the dependences (seem to) have been met.
673 # So we do a "--nodeps" rpm install in the chrooted environment
674 # to force the installation of the full rpm and yum packages.
676 # For the purists - Yes, I know the rpm database is wildly out
677 # of whack now. That's why this is a butt ugly hack / dirty trick.
678 # But, this is just the stage1 image that we are going to discard as
679 # soon as the stage2 image is built, so we don't care. All we care
680 # is that the stage2 image ends up with all the pieces it need to
681 # run yum and rpm and that the stage2 rpm database is coherent.
683 # NOW we can really go to work!
686 # Download our Fedora Release rpm packages.
687 # Install fedora-release into bootstrap to initialize fs and databases.
688 # Install rpm, and yum into bootstrap image using yum
690 echo "Stage 1 creation complete. Building stage 2 Installation Bootstrap"
692 mount
-o bind ..
/bootstrap run
/install
693 rsync
-av mirrors.kernel.org
::fedora
/releases
/20/Fedora
/$basearch/os
/Packages
/f
/fedora-release-20
* .
695 # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
696 chroot . rpm
--root /run
/install --nodeps -ivh fedora-release-
*
698 # yum will take $basearch from host, so force the arch we want
699 sed -i "s|\$basearch|$basearch|" .
/run
/install
/etc
/yum.repos.d
/*
701 chroot . yum
-y --nogpgcheck --installroot /run
/install install python rpm yum
707 # That's it! We should now have a viable installation BOOTSTRAP in
708 # bootstrap We'll do a yum update in that to verify and then
709 # move it to the cache location before cleaning up.
712 mount
-o bind /dev dev
713 mount
-t proc proc proc
714 # Always make sure /etc/resolv.conf is up to date in the target!
715 cp /etc
/resolv.conf etc
/
717 # yum will take $basearch from host, so force the arch we want
718 sed -i "s|\$basearch|$basearch|" .
/etc
/yum.repos.d
/*
720 chroot . yum
-y update
732 Build of Installation Bootstrap failed. Temp directory
733 not removed so it can be investigated.
738 # We know have a working run time environment in rootfs...
741 rm -rf ${TMP_BOOTSTRAP_DIR}
744 Build of Installation Bootstrap complete! We now return you to your
745 normally scheduled template creation.
749 BOOTSTRAP_DIR
="${cache_base}/bootstrap"
750 BOOTSTRAP_CHROOT
="chroot ${BOOTSTRAP_DIR} "
751 BOOTSTRAP_INSTALL_ROOT
=/run
/install
757 fedora_bootstrap_mounts
()
759 if [[ ${BOOTSTRAP} -ne 1 ]]
764 BOOTSTRAP_CHROOT
="chroot ${BOOTSTRAP_DIR} "
766 echo "Mounting Bootstrap mount points"
768 [[ -d ${BOOTSTRAP_DIR}/run
/install ]] || mkdir
-p ${BOOTSTRAP_DIR}/run
/install
770 mount
-o bind ${INSTALL_ROOT} ${BOOTSTRAP_DIR}/run
/install
771 mount
-o bind /dev
${BOOTSTRAP_DIR}/dev
772 mount
-t proc proc
${BOOTSTRAP_DIR}/proc
773 # Always make sure /etc/resolv.conf is up to date in the target!
774 cp /etc
/resolv.conf
${BOOTSTRAP_DIR}/etc
/
777 fedora_bootstrap_umounts
()
779 if [[ ${BOOTSTRAP} -ne 1 ]]
784 umount
${BOOTSTRAP_DIR}/proc
785 umount
${BOOTSTRAP_DIR}/dev
786 umount
${BOOTSTRAP_DIR}/run
/install
790 # This is the code to create the initial roofs for Fedora. It may
791 # require a run time environment by calling the routines above...
796 # check the mini fedora was not already downloaded
797 INSTALL_ROOT
=$cache/partial
798 mkdir
-p $INSTALL_ROOT
799 if [ $?
-ne 0 ]; then
800 echo "Failed to create '$INSTALL_ROOT' directory"
804 # download a mini fedora into a cache
805 echo "Downloading fedora minimal ..."
807 # These will get changed if it's decided that we need a
808 # boostrap environment (can not build natively). These
809 # are the defaults for the non-boostrap (native) mode.
811 BOOTSTRAP_INSTALL_ROOT
=${INSTALL_ROOT}
815 PKG_LIST
="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils fedora-release"
816 MIRRORLIST_URL
="http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$release&arch=$basearch"
818 if [[ ${release} -lt 17 ]]
820 # The reflects the move of db_dump and db_load from db4_utils to
821 # libdb_utils in Fedora 17 and above and it's inclusion as a dep...
822 # Prior to Fedora 11, we need to explicitly include it!
823 PKG_LIST
="${PKG_LIST} db4-utils"
826 if [[ ${release} -ge 21 ]]
828 # Since Fedora 21, a separate fedora-repos package is needed.
829 # Before, the information was conained in fedora-release.
830 PKG_LIST
="${PKG_LIST} fedora-repos"
835 # We're splitting the old loop into two loops plus a directory retrival.
836 # First loop... Try and retrive a mirror list with retries and a slight
837 # delay between attempts...
838 for trynumber
in 1 2 3 4; do
839 [ $trynumber != 1 ] && echo "Trying again..."
840 # This code is mildly "brittle" in that it assumes a certain
841 # page format and parsing HTML. I've done worse. :-P
842 MIRROR_URLS
=$
(curl
-s -S -f "$MIRRORLIST_URL" |
sed -e '/^http:/!d' -e '2,6!d')
843 if [ $?
-eq 0 ] && [ -n "$MIRROR_URLS" ]
848 echo "Failed to get a mirror on try $trynumber"
852 # This will fall through if we didn't get any URLS above
853 for MIRROR_URL
in ${MIRROR_URLS}
855 if [ "$release" -gt "16" ]; then
856 RELEASE_URL
="$MIRROR_URL/Packages/f"
858 RELEASE_URL
="$MIRROR_URL/Packages/"
861 echo "Fetching release rpm name from $RELEASE_URL..."
862 # This code is mildly "brittle" in that it assumes a certain directory
863 # page format and parsing HTML. I've done worse. :-P
864 RELEASE_RPM
=$
(curl
-L -f "$RELEASE_URL" |
sed -e "/fedora-release-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
865 if [ $?
-ne 0 -o "${RELEASE_RPM}" = "" ]; then
866 echo "Failed to identify fedora release rpm."
870 echo "Fetching fedora release rpm from ${RELEASE_URL}/${RELEASE_RPM}......"
871 curl
-L -f "${RELEASE_URL}/${RELEASE_RPM}" > ${INSTALL_ROOT}/${RELEASE_RPM}
872 if [ $? -ne 0 ]; then
873 echo "Failed to download fedora release rpm
${RELEASE_RPM}.
"
877 # F21 and newer need fedora-repos in addition to fedora-release.
878 if [ "$release" -ge "21" ]; then
879 echo "Fetching repos rpm name from
$RELEASE_URL...
"
880 REPOS_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-repos-
${release}-/!d
" -e 's/.*<a href=\"//' -e 's/\">.*//' )
881 if [ $? -ne 0 -o "${REPOS_RPM}" = "" ]; then
882 echo "Failed to identify fedora repos rpm.
"
886 echo "Fetching fedora repos rpm from
${RELEASE_URL}/${REPOS_RPM}...
"
887 curl -L -f "${RELEASE_URL}/${REPOS_RPM}" > ${INSTALL_ROOT}/${REPOS_RPM}
888 if [ $?
-ne 0 ]; then
889 echo "Failed to download fedora repos rpm ${RELEASE_RPM}."
899 if [ $DOWNLOAD_OK != yes ]; then
904 mkdir
-p ${INSTALL_ROOT}/var
/lib
/rpm
906 if ! fedora_get_bootstrap
908 echo "Fedora Bootstrap setup failed"
912 fedora_bootstrap_mounts
914 ${BOOTSTRAP_CHROOT}rpm
--root ${BOOTSTRAP_INSTALL_ROOT} --initdb
916 # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
917 ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --nodeps -ivh ${BOOTSTRAP_INSTALL_ROOT}/${RELEASE_RPM}
919 # F21 and newer need fedora-repos in addition to fedora-release...
920 # Note that fedora-release and fedora-system have a mutual dependency.
921 # So installing the reops package after the release package we can
922 # spare one --nodeps.
923 if [ "$release" -ge "21" ]; then
924 ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} -ivh ${BOOTSTRAP_INSTALL_ROOT}/${REPOS_RPM}
927 # yum will take $basearch from host, so force the arch we want
928 sed -i "s|\$basearch|$basearch|" ${BOOTSTRAP_DIR}/${BOOTSTRAP_INSTALL_ROOT}/etc
/yum.repos.d
/*
930 ${BOOTSTRAP_CHROOT}yum --installroot ${BOOTSTRAP_INSTALL_ROOT} -y --nogpgcheck install ${PKG_LIST}
934 if [[ ${BOOTSTRAP} -eq 1 ]]
936 # Here we have a bit of a sticky problem. We MIGHT have just installed
937 # this template cache using versions of yum and rpm in the bootstrap
938 # chroot that use a different database version than the target version.
939 # That can be a very big problem. Solution is to rebuild the rpmdatabase
940 # with the target database now that we are done building the cache. In the
941 # vast majority of cases, this is a do-not-care with no harm done if we
942 # didn't do it. But it catches several corner cases with older unsupported
943 # releases and it really doesn't cost us a lot of time for a one shot
944 # install that will never be done again for this rev.
946 # Thanks and appreciation to Dwight Engen and the Oracle template for the
947 # database rewrite hint!
949 echo "Fixing up rpm databases"
951 # Change to our target install directory (if we're not already
952 # there) just to simplify some of the logic to follow...
955 rm -f var
/lib
/rpm
/__db
*
956 # Programmers Note (warning):
958 # Pay careful attention to the following commands! It
959 # crosses TWO chroot boundaries linked by a bind mount!
960 # In the bootstrap case, that's the bind mount of ${INSTALL_ROOT}
961 # to the ${BOOTSTRAP_CHROOT}/run/install directory! This is
962 # a deliberate hack across that bind mount to do a database
963 # translation between two environments, neither of which may
964 # be the host environment! It's ugly and hard to follow but,
965 # if you don't understand it, don't mess with it! The pipe
966 # is in host space between the two chrooted environments!
967 # This is also why we cd'ed into the INSTALL_ROOT directory
968 # in advance of this loop, so everything is relative to the
969 # current working directory and congruent with the same working
970 # space in both chrooted environments. The output into the new
971 # db is also done in INSTALL_ROOT space but works in either host
972 # space or INSTALL_ROOT space for the mv, so we don't care. It's
973 # just not obvious what's happening in the db_dump and db_load
976 for db
in var
/lib
/rpm
/* ; do
977 ${BOOTSTRAP_CHROOT} db_dump
${BOOTSTRAP_INSTALL_ROOT}/$db | chroot . db_load
$db.new
980 # finish up by rebuilding the database...
981 # This should be redundant but we do it for completeness and
982 # any corner cases I may have missed...
983 mount
-t proc proc proc
984 mount
-o bind /dev dev
985 chroot . rpm
--rebuilddb
990 fedora_bootstrap_umounts
992 if [ ${RC} -ne 0 ]; then
993 echo "Failed to download the rootfs, aborting."
997 mv "$INSTALL_ROOT" "$cache/rootfs"
998 echo "Download complete."
1006 # make a local copy of the minifedora
1007 echo -n "Copying rootfs to $rootfs_path ..."
1008 #cp -a $cache/rootfs-$basearch $rootfs_path || return 1
1009 # i prefer rsync (no reason really)
1010 mkdir
-p $rootfs_path
1011 rsync
-Ha $cache/rootfs
/ $rootfs_path/
1018 mount
-o bind /dev
${cache}/rootfs
/dev
1019 mount
-t proc proc
${cache}/rootfs
/proc
1020 # Always make sure /etc/resolv.conf is up to date in the target!
1021 cp /etc
/resolv.conf
${cache}/rootfs
/etc
/
1022 chroot
${cache}/rootfs yum
-y update
1023 umount
${cache}/rootfs
/proc
1024 umount
${cache}/rootfs
/dev
1029 mkdir
-p @LOCALSTATEDIR@
/lock
/subsys
/
1032 if [ $?
-ne 0 ]; then
1033 echo "Cache repository is busy."
1037 echo "Checking cache download in $cache/rootfs ... "
1038 if [ ! -e "$cache/rootfs" ]; then
1040 if [ $?
-ne 0 ]; then
1041 echo "Failed to download 'fedora base'"
1045 echo "Cache found. Updating..."
1047 if [ $?
-ne 0 ]; then
1048 echo "Failed to update 'fedora base', continuing with last known good cache"
1050 echo "Update finished"
1054 echo "Copy $cache/rootfs to $rootfs_path ... "
1056 if [ $?
-ne 0 ]; then
1057 echo "Failed to copy rootfs"
1062 ) 9>@LOCALSTATEDIR@
/lock
/subsys
/lxc-fedora
1067 # Generate a random hardware (MAC) address composed of FE followed by
1071 openssl rand
-hex 5 |
sed -e 's/\(..\)/:\1/g; s/^/fe/'
1074 copy_configuration
()
1076 mkdir
-p $config_path
1078 grep -q "^lxc.rootfs" $config_path/config
2>/dev
/null ||
echo "
1079 lxc.rootfs = $rootfs_path
1080 " >> $config_path/config
1082 # The following code is to create static MAC addresses for each
1083 # interface in the container. This code will work for multiple
1084 # interfaces in the default config. It will also strip any
1085 # hwaddr stanzas out of the default config since we can not share
1086 # MAC addresses between containers.
1087 mv $config_path/config
$config_path/config.def
1090 # This should catch variable expansions from the default config...
1091 if expr "${LINE}" : '.*\$' > /dev
/null
2>&1
1093 LINE
=$
(eval "echo \"${LINE}\"")
1096 # There is a tab and a space in the regex bracket below!
1097 # Seems that \s doesn't work in brackets.
1098 KEY
=$
(expr "${LINE}" : '\s*\([^ ]*\)\s*=')
1100 if [[ "${KEY}" != "lxc.network.hwaddr" ]]
1102 echo "${LINE}" >> $config_path/config
1104 if [[ "${KEY}" == "lxc.network.link" ]]
1106 echo "lxc.network.hwaddr = $(create_hwaddr)" >> $config_path/config
1109 done < $config_path/config.def
1111 rm -f $config_path/config.def
1113 if [ -e "@LXCTEMPLATECONFIG@/fedora.common.conf" ]; then
1115 # Include common configuration
1116 lxc.include = @LXCTEMPLATECONFIG@/fedora.common.conf
1117 " >> $config_path/config
1120 # Append things which require expansion here...
1121 cat <<EOF >> $config_path/config
1123 lxc.utsname = $utsname
1125 # When using LXC with apparmor, uncomment the next line to run unconfined:
1126 #lxc.aa_profile = unconfined
1128 # example simple networking setup, uncomment to enable
1129 #lxc.network.type = $lxc_network_type
1130 #lxc.network.flags = up
1131 #lxc.network.link = $lxc_network_link
1132 #lxc.network.name = eth0
1133 # Additional example for veth network type
1134 # static MAC address,
1135 #lxc.network.hwaddr = 00:16:3e:77:52:20
1136 # persistent veth device name on host side
1137 # Note: This may potentially collide with other containers of same name!
1138 #lxc.network.veth.pair = v-$name-e0
1142 if [ $?
-ne 0 ]; then
1143 echo "Failed to add configuration"
1153 if [ ! -e $cache ]; then
1157 # lock, so we won't purge while someone is creating a repository
1160 if [ $?
!= 0 ]; then
1161 echo "Cache repository is busy."
1165 echo -n "Purging the download cache for Fedora-$release..."
1166 rm --preserve-root --one-file-system -rf $cache && echo "Done." ||
exit 1
1168 ) 9>@LOCALSTATEDIR@
/lock
/subsys
/lxc-fedora
1175 $1 -n|--name=<container_name>
1176 [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
1177 [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
1180 -n,--name container name, used to as an identifier for that container
1182 -p,--path path to where the container will be created,
1183 defaults to @LXCPATH@.
1184 --rootfs path for actual rootfs.
1185 -c,--clean clean the cache
1186 -R,--release Fedora release for the new container.
1187 Defaults to host's release if the host is Fedora.
1188 --fqdn fully qualified domain name (FQDN) for DNS and system naming
1189 -a,--arch Define what arch the container will be [i686,x86_64]
1190 -h,--help print this help
1195 options
=$
(getopt
-o a
:hp
:n
:cR
: -l help,path
:,rootfs
:,name
:,clean
,release
:,arch
:,fqdn
: -- "$@")
1196 if [ $?
-ne 0 ]; then
1197 usage $
(basename $0)
1202 eval set -- "$options"
1206 -h|
--help) usage
$0 && exit 0;;
1207 -p|
--path) path
=$2; shift 2;;
1208 --rootfs) rootfs
=$2; shift 2;;
1209 -n|
--name) name
=$2; shift 2;;
1210 -c|
--clean) clean
=1; shift 1;;
1211 -R|
--release) release
=$2; shift 2;;
1212 -a|
--arch) newarch
=$2; shift 2;;
1213 --fqdn) utsname
=$2; shift 2;;
1214 --) shift 1; break ;;
1219 if [ ! -z "$clean" -a -z "$path" ]; then
1226 # Map a few architectures to their generic Fedora repository archs.
1227 # The two ARM archs are a bit of a guesstimate for the v5 and v6
1228 # archs. V6 should have hardware floating point (Rasberry Pi).
1229 # The "arm" arch is safer (no hardware floating point). So
1230 # there may be cases where we "get it wrong" for some v6 other
1233 i686
) basearch
=i386
;;
1234 armv3l|armv4l|armv5l
) basearch
=arm
;;
1235 armv6l|armv7l|armv8l
) basearch
=armhfp
;;
1239 # Somebody wants to specify an arch. This is very limited case.
1240 # i386/i586/i686 on i386/x86_64
1243 if [ "${newarch}" != "" -a "${newarch}" != "${arch}" ]
1245 case "${newarch}" in
1247 if [ "${basearch}" = "i386" -o "${basearch}" = "x86_64" ]
1249 # Make the arch a generic x86 32 bit...
1261 if [ "${basearch}" = "bad" ]
1263 echo "You cannot build a ${newarch} Fedora container on a ${arch} host. Sorry!"
1268 cache_base
=@LOCALSTATEDIR@
/cache
/lxc
/fedora
/$basearch
1270 # Let's do something better for the initial root password.
1271 # It's not perfect but it will defeat common scanning brute force
1272 # attacks in the case where ssh is exposed. It will also be set to
1273 # expired, forcing the user to change it at first login.
1274 if [ "${root_password}" = "" ]
1276 root_password
=Root-
${name}-${RANDOM}
1278 # If it's got a ding in it, try and expand it!
1279 if [ $
(expr "${root_password}" : '.*$.') != 0 ]
1281 root_password
=$
(eval echo "${root_password}")
1284 # If it has more than 3 consecutive X's in it, feed it
1285 # through mktemp as a template.
1286 if [ $
(expr "${root_password}" : '.*XXXX') != 0 ]
1288 root_password
=$
(mktemp
-u ${root_password})
1292 if [ -z "${utsname}" ]; then
1296 # This follows a standard "resolver" convention that an FQDN must have
1297 # at least two dots or it is considered a local relative host name.
1298 # If it doesn't, append the dns domain name of the host system.
1300 # This changes one significant behavior when running
1301 # "lxc_create -n Container_Name" without using the
1305 # utsname and hostname = Container_Name
1307 # utsname and hostname = Container_Name.Domain_Name
1309 if [ $
(expr "$utsname" : '.*\..*\.') = 0 ]; then
1310 if [[ "$(dnsdomainname)" != "" && "$(dnsdomainname)" != "localdomain" ]]; then
1311 utsname
=${utsname}.$
(dnsdomainname
)
1317 type curl
>/dev
/null
2>&1
1318 if [ $?
-ne 0 ]; then
1319 needed_pkgs
="curl $needed_pkgs"
1322 if [ -n "$needed_pkgs" ]; then
1323 echo "Missing commands: $needed_pkgs"
1324 echo "Please install these using \"sudo yum install $needed_pkgs\""
1328 if [ -z "$path" ]; then
1329 path
=$default_path/$name
1332 if [ -z "$release" ]; then
1333 if [ "$is_fedora" -a "$fedora_host_ver" ]; then
1334 release
=$fedora_host_ver
1336 echo "This is not a fedora host and release missing, defaulting to 20 use -R|--release to specify release"
1341 if [ "$(id -u)" != "0" ]; then
1342 echo "This script should be run as 'root'"
1347 if [ -z "$rootfs_path" ]; then
1348 rootfs_path
=$path/rootfs
1349 # check for 'lxc.rootfs' passed in through default config by lxc-create
1350 if grep -q '^lxc.rootfs' $path/config
2>/dev
/null
; then
1351 rootfs_path
=$
(sed -e '/^lxc.rootfs\s*=/!d' -e 's/\s*#.*//' \
1352 -e 's/^lxc.rootfs\s*=\s*//' -e q
$path/config
)
1356 cache
=$cache_base/$release
1360 echo "Interrupted, so cleaning up"
1361 lxc-destroy
-n $name
1362 # maybe was interrupted before copy config
1368 trap revert SIGHUP SIGINT SIGTERM
1371 if [ $?
-ne 0 ]; then
1372 echo "failed write configuration file"
1377 if [ $?
-ne 0 ]; then
1378 echo "failed to install fedora"
1383 if [ $?
-ne 0 ]; then
1384 echo "failed to configure fedora for a container"
1388 # If the systemd configuration directory exists - set it up for what we need.
1389 if [ -d ${rootfs_path}/etc
/systemd
/system
]
1391 configure_fedora_systemd
1394 # This configuration (rc.sysinit) is not inconsistent with the systemd stuff
1395 # above and may actually coexist on some upgraded systems. Let's just make
1396 # sure that, if it exists, we update this file, even if it's not used...
1397 if [ -f ${rootfs_path}/etc
/rc.sysinit
]
1399 configure_fedora_init
1402 if [ ! -z "$clean" ]; then
1407 Container rootfs and config have been created.
1408 Edit the config file to check/enable networking setup.
1411 if [[ -d ${cache_base}/bootstrap
]]
1413 echo "You have successfully built a Fedora container and cache. This cache may
1414 be used to create future containers of various revisions. The directory
1415 ${cache_base}/bootstrap contains a bootstrap
1416 which may no longer needed and can be removed.
1420 if [[ -e ${cache_base}/LiveOS
]]
1422 echo "A LiveOS directory exists at ${cache_base}/LiveOS.
1423 This is only used in the creation of the bootstrap run-time-environment
1428 if [ ${root_display_password} = "yes" ]
1430 echo "The temporary password for root is: '$root_password'
1432 You may want to note that password down before starting the container.
1436 if [ ${root_store_password} = "yes" ]
1438 echo "The temporary root password is stored in:
1440 '${config_path}/tmp_root_pass'
1444 if [ ${root_prompt_password} = "yes" ]
1446 echo "Invoking the passwd command in the container to set the root password.
1448 chroot ${rootfs_path} passwd
1450 chroot
${rootfs_path} passwd
1452 if [ ${root_expire_password} = "yes" ]
1455 The root password is set up as "expired
" and will require it to be changed
1456 at first login, which you should do as soon as possible. If you lose the
1457 root password or wish to change it without starting the container, you
1458 can change it from the host by running the following command (which will
1459 also reset the expired flag):
1461 chroot ${rootfs_path} passwd