]> git.proxmox.com Git - mirror_lxc.git/blob - templates/lxc-oracle.in
81a77226486604ce234331c8617d026a7101ea51
[mirror_lxc.git] / templates / lxc-oracle.in
1 #!/bin/bash
2 #
3 # Template script for generating Oracle Enterprise Linux container for LXC
4 # based on lxc-fedora, lxc-ubuntu
5 #
6 # Copyright © 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
7 # Copyright © 2012 Dwight Engen <dwight.engen@oracle.com>
8 #
9 # Modified for Oracle Linux 5
10 # Wim Coekaerts <wim.coekaerts@oracle.com>
11 #
12 # Modified for Oracle Linux 6, combined OL5,6 into one template script
13 # Dwight Engen <dwight.engen@oracle.com>
14 #
15 # This library is free software; you can redistribute it and/or
16 # modify it under the terms of the GNU Lesser General Public
17 # License as published by the Free Software Foundation; either
18 # version 2.1 of the License, or (at your option) any later version.
19 #
20 # This library is distributed in the hope that it will be useful,
21 # but WITHOUT ANY WARRANTY; without even the implied warranty of
22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 # Lesser General Public License for more details.
24 #
25 # You should have received a copy of the GNU Lesser General Public
26 # License along with this library; if not, write to the Free Software
27 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 #
29
30 # use virbr0 that is setup by default by libvirtd
31 lxc_network_type=veth
32 lxc_network_link=virbr0
33
34 die()
35 {
36 echo "failed: $1"
37 exit 1
38 }
39
40 is_btrfs_subvolume()
41 {
42 if which btrfs >/dev/null 2>&1 && \
43 btrfs subvolume list "$1" >/dev/null 2>&1; then
44 return 0
45 fi
46 return 1
47 }
48
49 # fix up the container_rootfs
50 container_rootfs_configure()
51 {
52 echo "Configuring container for Oracle Linux $container_release_major"
53
54 # "disable" selinux. init in OL 5 honors /etc/selinux/config. note that
55 # this doesnt actually disable it if it's enabled in the host, since
56 # libselinux::is_selinux_enabled() in the guest will check
57 # /proc/filesystems and see selinuxfs, thus reporting that it is on
58 # (ie. check the output of sestatus in the guest)
59 mkdir -p $container_rootfs/selinux
60 echo 0 > $container_rootfs/selinux/enforce
61 if [ -e $container_rootfs/etc/selinux/config ]; then
62 sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
63 else
64 echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
65 fi
66 if [ $container_release_major = "5" ]; then
67 sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
68 sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
69 fi
70
71 # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
72 # will report its name and be resolv'able by the hosts dnsmasq
73 touch $container_rootfs/etc/resolv.conf
74 cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
75 DEVICE=eth0
76 BOOTPROTO=dhcp
77 ONBOOT=yes
78 HOSTNAME=$name
79 DHCP_HOSTNAME=$name
80 NM_CONTROLLED=no
81 TYPE=Ethernet
82 EOF
83
84 # set the hostname
85 cat <<EOF > $container_rootfs/etc/sysconfig/network
86 NETWORKING=yes
87 NETWORKING_IPV6=no
88 HOSTNAME=$name
89 EOF
90
91 # set minimal hosts
92 echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
93
94 # disable ipv6
95 echo "blacklist ipv6" >>$container_rootfs/etc/modprobe.d/blacklist.conf
96 echo "blacklist net-pf-10" >>$container_rootfs/etc/modprobe.d/blacklist.conf
97 rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
98
99 cat <<EOF > $container_rootfs/etc/fstab
100 proc /proc proc nodev,noexec,nosuid 0 0
101 devpts /dev/pts devpts defaults 0 0
102 sysfs /sys sysfs defaults 0 0
103 EOF
104
105 # remove module stuff for iptables it just shows errors that are not
106 # relevant in a container
107 if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
108 sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
109 sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
110 fi
111
112 # disable readahead in the container
113 if [ $container_release_major = "6" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
114 rm -f $container_rootfs/etc/init/readahead-collector.conf
115 rm -f $container_rootfs/etc/init/readahead-disable-services.conf
116 sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
117 fi
118
119 # disable udev in the container
120 sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
121 sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
122
123 # disable nash raidautorun in the container since no /dev/md*
124 if [ $container_release_major = "5" ]; then
125 sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
126 sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
127 fi
128
129 # prevent rc.sysinit from attempting to loadkeys
130 if [ $container_release_major = "5" -a -e $container_rootfs/etc/sysconfig/keyboard ]; then
131 rm $container_rootfs/etc/sysconfig/keyboard
132 fi
133
134 # dont try to sync the hwclock at shutdown
135 sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
136
137 # dont start lvm
138 sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
139 sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
140
141 # fix assumptions that plymouth is available
142 sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
143 sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
144 rm -f $container_rootfs/etc/init/plymouth-shutdown.conf
145 rm -f $container_rootfs/etc/init/quit-plymouth.conf
146 rm -f $container_rootfs/etc/init/splash-manager.conf
147
148 # setup console and tty[1-4] for login. note that /dev/console and
149 # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
150 # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
151 # lxc will maintain these links and bind mount ptys over /dev/lxc/*
152 # since lxc.devttydir is specified in the config.
153
154 # allow root login on console and tty[1-4]
155 echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
156 echo "lxc/console" >>$container_rootfs/etc/securetty
157 echo "lxc/tty1" >>$container_rootfs/etc/securetty
158 echo "lxc/tty2" >>$container_rootfs/etc/securetty
159 echo "lxc/tty3" >>$container_rootfs/etc/securetty
160 echo "lxc/tty4" >>$container_rootfs/etc/securetty
161
162 # dont try to unmount /dev/lxc devices
163 sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
164
165 # start a getty on /dev/console, /dev/tty[1-4]
166 if [ $container_release_major = "5" ]; then
167 sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty console' $container_rootfs/etc/inittab
168 sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
169 sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
170 fi
171
172 if [ $container_release_major = "6" ]; then
173 cat <<EOF > $container_rootfs/etc/init/console.conf
174 # console - getty
175 #
176 # This service maintains a getty on the console from the point the system is
177 # started until it is shut down again.
178
179 start on stopped rc RUNLEVEL=[2345]
180 stop on runlevel [!2345]
181
182 respawn
183 exec /sbin/mingetty /dev/console
184 EOF
185 fi
186
187 # there might be other services that are useless but the below set is a good start
188 # some of these might not exist in the image, so we silence chkconfig complaining
189 # about the service file not being found
190 for service in \
191 acpid auditd autofs cpuspeed dund gpm haldaemon hidd \
192 ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
193 lm_sensors lvm2-monitor mdmonitor microcode_ctl \
194 ntpd postfix sendmail udev-post ;
195 do
196 chroot $container_rootfs chkconfig 2>/dev/null $service off
197 done
198
199 for service in rsyslog ;
200 do
201 chroot $container_rootfs chkconfig 2>/dev/null $service on
202 done
203
204 # create required devices
205 # take care to not nuke /dev in case $container_rootfs isn't set
206 dev_path="$container_rootfs/dev"
207 if [ $container_rootfs != "/" -a -d $dev_path ]; then
208 rm -rf $dev_path
209 mkdir -p $dev_path
210 fi
211 mknod -m 666 $dev_path/null c 1 3
212 mknod -m 666 $dev_path/zero c 1 5
213 mknod -m 666 $dev_path/random c 1 8
214 mknod -m 666 $dev_path/urandom c 1 9
215 mkdir -m 755 $dev_path/pts
216 mkdir -m 1777 $dev_path/shm
217 mknod -m 666 $dev_path/tty c 5 0
218 mknod -m 666 $dev_path/tty0 c 4 0
219 mknod -m 666 $dev_path/tty1 c 4 1
220 mknod -m 666 $dev_path/tty2 c 4 2
221 mknod -m 666 $dev_path/tty3 c 4 3
222 mknod -m 666 $dev_path/tty4 c 4 4
223 mknod -m 600 $dev_path/console c 5 1
224 mknod -m 666 $dev_path/full c 1 7
225 mknod -m 600 $dev_path/initctl p
226
227 # ensure /dev/ptmx refers to the newinstance devpts of the container, or
228 # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
229 rm -f $container_rootfs/dev/ptmx
230 ln -s pts/ptmx $container_rootfs/dev/ptmx
231
232 # start with a clean /var/log/messages
233 rm -f $container_rootfs/var/log/messages
234
235 # add oracle user, set root password
236 chroot $container_rootfs useradd --create-home -s /bin/bash oracle
237 echo "oracle:oracle" | chroot $container_rootfs chpasswd
238 echo "root:root" | chroot $container_rootfs chpasswd
239 echo -e "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m"
240 echo -e "Added container user:\033[1mroot\033[0m password:\033[1mroot\033[0m"
241 }
242
243 # create the container's lxc config file
244 container_config_create()
245 {
246 echo "Create configuration file $cfg_dir/config"
247 # generate a hwaddr for the container with a high mac address
248 # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
249 local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
250 head -1 |awk '{print $2}' | cut -c1-10 |\
251 sed 's/\(..\)/\1:/g; s/.$//'`"
252 mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
253 rm -f $cfg_dir/config
254 cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
255 # Container configuration for Oracle Linux $release_major.$release_minor
256 lxc.arch = $arch
257 lxc.utsname = $name
258 lxc.devttydir = lxc
259 lxc.tty = 4
260 lxc.pts = 1024
261 lxc.rootfs = $container_rootfs
262 lxc.mount = $cfg_dir/fstab
263 # Networking
264 lxc.network.type = $lxc_network_type
265 lxc.network.flags = up
266 lxc.network.link = $lxc_network_link
267 lxc.network.name = eth0
268 lxc.network.mtu = 1500
269 lxc.network.hwaddr = $hwaddr
270 # Control Group devices: all denied except those whitelisted
271 lxc.cgroup.devices.deny = a
272 lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
273 lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
274 lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
275 lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
276 lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
277 lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
278 lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
279 lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
280 lxc.cgroup.devices.allow = c 254:0 rwm # /dev/rtc0
281 EOF
282
283 cat <<EOF > $cfg_dir/fstab || die "unable to create $cfg_dir/fstab"
284 proc $container_rootfs/proc proc nodev,noexec,nosuid 0 0
285 devpts $container_rootfs/dev/pts devpts defaults 0 0
286 sysfs $container_rootfs/sys sysfs defaults 0 0
287 EOF
288 }
289
290 container_rootfs_clone()
291 {
292 if is_btrfs_subvolume $template_rootfs; then
293 # lxc-create already made $container_rootfs a btrfs subvolume, but
294 # in this case we want to snapshot the original subvolume so we we
295 # have to delete the one that lxc-create made
296 btrfs subvolume delete $container_rootfs
297 btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
298 else
299 cp -ax $template_rootfs $container_rootfs || die "copy template"
300 fi
301 }
302
303 container_rootfs_create()
304 {
305 cmds="rpm wget yum"
306 if [ $release_major = "5" ]; then
307 if [ $host_distribution = "Ubuntu" ]; then
308 db_dump_cmd="db5.1_dump"
309 db_load_cmd="db4.3_load"
310 fi
311 if [ $host_distribution = "OracleServer" -o \
312 $host_distribution = "Fedora" ]; then
313 db_dump_cmd="db_dump"
314 db_load_cmd="db43_load"
315 fi
316
317 cmds="$cmds $db_dump_cmd $db_load_cmd file"
318 fi
319 for cmd in $cmds; do
320 which $cmd >/dev/null 2>&1
321 if [ $? -ne 0 ]; then
322 die "The $cmd command is required, please install it"
323 fi
324 done
325
326 mkdir -p /var/lock/subsys/
327 (
328 flock -x 200
329 if [ $? -ne 0 ]; then
330 die "The template is busy."
331 fi
332
333 echo "Downloading release $release_major.$release_minor for $basearch"
334
335 # get yum repo file
336 public_yum_url=http://public-yum.oracle.com
337 if [ $release_major = "5" ]; then
338 repofile=public-yum-el5.repo
339 elif [ $release_major = "6" ]; then
340 repofile=public-yum-ol6.repo
341 else
342 die "Unsupported release $release_major"
343 fi
344 mkdir -p $container_rootfs/etc/yum.repos.d
345 wget -q $public_yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
346 if [ $? -ne 0 ]; then
347 die "Failed to download repo file $public_yum_url/$repofile"
348 fi
349
350 # yum will take $basearch from host, so force the arch we want
351 sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
352
353 # replace url if they specified one
354 if [ -n "$repourl" ]; then
355 sed -i "s|baseurl=http://public-yum.oracle.com/repo|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
356 sed -i "s|gpgkey=http://public-yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
357 fi
358
359 # disable all repos, then enable the repo for the version we are installing.
360 if [ $release_minor = "latest" ]; then
361 if [ $release_major = "5" ]; then
362 repo="el"$release_major"_"$release_minor
363 else
364 repo="ol"$release_major"_"$release_minor
365 fi
366 elif [ $release_minor = "0" ]; then
367 repo="ol"$release_major"_ga_base"
368 else
369 repo="ol"$release_major"_u"$release_minor"_base"
370 fi
371 sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
372 sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
373
374 # create rpm db, download and yum install minimal packages
375 mkdir -p $container_rootfs/var/lib/rpm
376 rpm --root $container_rootfs --initdb
377 yum_cmd="yum --installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
378 min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server dhclient chkconfig rootfiles policycoreutils oraclelinux-release"
379
380 $yum_cmd install $min_pkgs
381 if [ $? -ne 0 ]; then
382 die "Failed to download and install the rootfs, aborting."
383 fi
384
385 # rsyslog and pam depend on coreutils for some common commands in
386 # their POSTIN scriptlets, but coreutils wasn't installed yet. now
387 # that coreutils is installed, reinstall the packages so their POSTIN
388 # runs right. similarly, libutempter depends on libselinux.so.1 when
389 # it runs /usr/sbin/groupadd, so reinstall it too
390 if [ $release_major = "5" ]; then
391 rpm --root $container_rootfs --nodeps -e rsyslog pam libutempter
392 $yum_cmd install rsyslog pam libutempter
393 if [ $? -ne 0 ]; then
394 die "Unable to reinstall packages"
395 fi
396 fi
397
398 # these distributions put the rpm database in a place the guest is
399 # not expecting it, so move it
400 if [ $host_distribution = "Ubuntu" ]; then
401 mv $container_rootfs/root/.rpmdb/* $container_rootfs/var/lib/rpm
402 fi
403
404 # if the native rpm created the db with Hash version 9, we need to
405 # downgrade it to Hash version 8 for use with OL5.x
406 db_version=`file $container_rootfs/var/lib/rpm/Packages | \
407 grep -o 'version [0-9]*' |awk '{print $2}'`
408 if [ $release_major = "5" -a $db_version != "8" ]; then
409 echo "Fixing (downgrading) rpm database from version $db_version"
410 rm -f $container_rootfs/var/lib/rpm/__db*
411 for db in $container_rootfs/var/lib/rpm/* ; do
412 $db_dump_cmd $db |$db_load_cmd $db.new
413 mv $db.new $db
414 done
415 fi
416
417 # the host rpm may not be the same as the guest, rebuild the db with
418 # the guest rpm version
419 echo "Rebuilding rpm database"
420 rm -f $container_rootfs/var/lib/rpm/__db*
421 chroot $container_rootfs rpm --rebuilddb >/dev/null 2>&1
422 ) 200>/var/lock/subsys/lxc-oracle-$name
423 }
424
425 usage()
426 {
427 cat <<EOF
428 -a|--arch=<arch> architecture (ie. i686, x86_64)
429 -R|--release=<release> release to download for the new container
430 -u|--url=<url> replace yum repo url (ie. local yum mirror)
431 -t|--templatefs=<path> copy/clone rootfs at path instead of downloading
432 -h|--help
433
434 Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
435 EOF
436 return 0
437 }
438
439 options=$(getopt -o hp:n:a:R:u:t: -l help,path:,name:,arch:,release:,url:,templatefs: -- "$@")
440 if [ $? -ne 0 ]; then
441 usage $(basename $0)
442 exit 1
443 fi
444
445 arch=$(arch)
446 eval set -- "$options"
447 while true
448 do
449 case "$1" in
450 -h|--help) usage $0 && exit 0;;
451 -p|--path) cfg_dir=$2; shift 2;;
452 -n|--name) name=$2; shift 2;;
453 -a|--arch) arch=$2; shift 2;;
454 -R|--release) release_version=$2; shift 2;;
455 -u|--url) repourl=$2; shift;;
456 -t|--templatefs) template_rootfs=$2; shift 2;;
457 --) shift 1; break ;;
458 *) break ;;
459 esac
460 done
461
462 # make sure mandatory args are given and valid
463 if [ "$(id -u)" != "0" ]; then
464 echo "This script should be run as 'root'"
465 exit 1
466 fi
467
468 if [ -z $name ]; then
469 echo "Container name must be given"
470 usage
471 exit 1
472 fi
473
474 if [ -z $cfg_dir ]; then
475 echo "Configuration directory must be given, check lxc-create"
476 usage
477 exit 1
478 fi
479
480 basearch=$arch
481 if [ "$arch" = "i686" ]; then
482 basearch="i386"
483 fi
484
485 container_rootfs="$cfg_dir/rootfs"
486
487 if [ -n "$template_rootfs" ]; then
488 release_version=`cat $template_rootfs/etc/oracle-release |awk '/^Oracle/ {print $5}'`
489 fi
490 if [ -z "$release_version" ]; then
491 echo "No release specified with -R, defaulting to 6.3"
492 release_version="6.3"
493 fi
494 release_major=`echo $release_version |awk -F '.' '{print $1}'`
495 release_minor=`echo $release_version |awk -F '.' '{print $2}'`
496
497 if which lsb_release >/dev/null 2>&1; then
498 host_distribution=`lsb_release --id |awk '{print $3}'`
499 host_release_version=`lsb_release --release |awk '{print $2}'`
500 host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
501 host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
502 else
503 echo "Unable to determine host distribution, ensure lsb_release is installed"
504 exit 1
505 fi
506 echo "Host is $host_distribution $host_release_version"
507
508 trap cleanup SIGHUP SIGINT SIGTERM
509
510 container_config_create
511 if [ -n "$template_rootfs" ]; then
512 container_rootfs_clone
513 else
514 container_rootfs_create
515 fi
516
517 container_release_version=`cat $container_rootfs/etc/oracle-release |awk '/^Oracle/ {print $5}'`
518 container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
519 container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
520
521 container_rootfs_configure
522
523 echo "Container : $container_rootfs"
524 echo "Config : $cfg_dir/config"
525 echo "Network : eth0 ($lxc_network_type) on $lxc_network_link"