templates/lxc-oracle.in

   1 #!/bin/sh
   2 #
   3 # Template script for generating Oracle Enterprise Linux container for LXC
   4 # based on lxc-fedora, lxc-ubuntu
   5 #
   6 # Copyright © 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
   7 # Copyright © 2012 Dwight Engen <dwight.engen@oracle.com>
   8 #
   9 # Modified for Oracle Linux 5
  10 # Wim Coekaerts <wim.coekaerts@oracle.com>
  11 #
  12 # Modified for Oracle Linux 6, combined OL4,5,6 into one template script
  13 # Dwight Engen <dwight.engen@oracle.com>
  14 #
  15 # This library is free software; you can redistribute it and/or
  16 # modify it under the terms of the GNU Lesser General Public
  17 # License as published by the Free Software Foundation; either
  18 # version 2.1 of the License, or (at your option) any later version.
  19 #
  20 # This library is distributed in the hope that it will be useful,
  21 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  23 # Lesser General Public License for more details.
  24 #
  25 # You should have received a copy of the GNU Lesser General Public
  26 # License along with this library; if not, write to the Free Software
  27 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  28 #
  29
  30 # Detect use under userns (unsupported)
  31 for arg in "$@"; do
  32     [ "$arg" == "--" ] && break
  33     if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
  34         echo "This template can't be used for unprivileged containers." 1>&2
  35         echo "You may want to try the \"download\" template instead." 1>&2
  36         exit 1
  37     fi
  38 done
  39
  40 # Make sure the usual locations are in PATH
  41 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  42
  43 # use virbr0 that is setup by default by libvirtd
  44 lxc_network_type=veth
  45 lxc_network_link=virbr0
  46
  47 die()
  48 {
  49     echo "failed: $1"
  50     exit 1
  51 }
  52
  53 is_btrfs_subvolume()
  54 {
  55     if which btrfs >/dev/null 2>&1 && \
  56        btrfs subvolume list "$1" >/dev/null 2>&1; then
  57         return 0
  58     fi
  59     return 1
  60 }
  61
  62 can_chcon()
  63 {
  64     if which chcon >/dev/null 2>&1; then
  65         selinuxenabled >/dev/null 2>&1
  66         return $?
  67     fi
  68     return 1
  69 }
  70
  71 # fix up the container_rootfs
  72 container_rootfs_configure()
  73 {
  74     echo "Configuring container for Oracle Linux $container_release_major.$container_release_minor"
  75
  76     # "disable" selinux in the guest. The policy in the container isn't
  77     # likely to match the hosts (unless host == guest exactly) and the
  78     # kernel can only be enforcing one policy.
  79     #
  80     # The OL 5 init honors /etc/selinux/config, but note that
  81     # this doesnt actually disable it if it's enabled in the host, since
  82     # libselinux::is_selinux_enabled() in the guest will check
  83     # /proc/filesystems and see selinuxfs, thus reporting that it is on
  84     # (ie. check the output of sestatus in the guest). We also replace
  85     # /usr/sbin/selinuxenabled with a symlink to /bin/false so that init
  86     # scripts (ie. mcstransd) that call that think selinux is disabled.
  87     mkdir -p $container_rootfs/selinux
  88     echo 0 > $container_rootfs/selinux/enforce
  89     if [ -e $container_rootfs/etc/selinux/config ]; then
  90         sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
  91     else
  92         mkdir -p $container_rootfs/etc/selinux
  93         echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
  94     fi
  95     sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
  96     sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
  97
  98     # setting /proc/$$/loginuid doesn't work under user namespace, which
  99     # prevents logins from working
 100     sed -i 's|session[ \t]*required[ \t]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/sshd
 101     sed -i 's|session[ \t]*required[ \t]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/login
 102
 103     if [ -f $container_rootfs/usr/sbin/selinuxenabled ]; then
 104         mv $container_rootfs/usr/sbin/selinuxenabled $container_rootfs/usr/sbin/selinuxenabled.lxcorig
 105         ln -s /bin/false $container_rootfs/usr/sbin/selinuxenabled
 106     fi
 107
 108     # silence error in checking for selinux
 109     sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.sysinit
 110     sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.d/rc.sysinit
 111
 112     # on ol4 pam_limits prevents logins when using user namespaces
 113     if [ $container_release_major = "4" ]; then
 114         sed -i 's|session[ \t]*required[ \t]*/lib/security/\$ISA/pam_limits.so|#session required /lib/security/$ISA/pam_limits.so|' $container_rootfs/etc/pam.d/system-auth
 115     fi
 116
 117     # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
 118     # will report its name and be resolv'able by the hosts dnsmasq
 119     cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
 120 DEVICE=eth0
 121 BOOTPROTO=dhcp
 122 ONBOOT=yes
 123 HOSTNAME=$name
 124 DHCP_HOSTNAME=$name
 125 NM_CONTROLLED=no
 126 TYPE=Ethernet
 127 EOF
 128
 129     # avoid error in ol5 attempting to copy non-existent resolv.conf
 130     if [ $container_release_major = "5" ]; then
 131         sed -i 's|resolv.conf.predhclient|resolv.conf.predhclient 2>/dev/null|' $container_rootfs/sbin/dhclient-script
 132     fi
 133
 134     # set the hostname
 135     cat <<EOF > $container_rootfs/etc/sysconfig/network
 136 NETWORKING=yes
 137 NETWORKING_IPV6=no
 138 HOSTNAME=$name
 139 EOF
 140
 141     # disable interactive ovmd asking questions
 142     if [ -f $container_rootfs/etc/sysconfig/ovmd ]; then
 143         sed -i 's|INITIAL_CONFIG=yes|INITIAL_CONFIG=no|' $container_rootfs/etc/sysconfig/ovmd
 144     fi
 145
 146     # set minimal hosts
 147     echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
 148
 149     # disable ipv6 on ol6
 150     rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
 151
 152     # this file has to exist for libvirt/Virtual machine monitor to boot the container
 153     touch $container_rootfs/etc/mtab
 154
 155     # don't put devpts,proc, nor sysfs in here, it will already be mounted for us by lxc/libvirt
 156     cat <<EOF > $container_rootfs/etc/fstab
 157 EOF
 158
 159     # remove module stuff for iptables it just shows errors that are not
 160     # relevant in a container
 161     if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
 162         sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
 163         sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
 164     fi
 165
 166     # disable readahead in the container
 167     if [ $container_release_major = "6" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
 168         rm -f $container_rootfs/etc/init/readahead-collector.conf
 169         rm -f $container_rootfs/etc/init/readahead-disable-services.conf
 170         sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
 171     fi
 172
 173     if [ $container_release_major = "4" ]; then
 174         # enable fastboot always
 175         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.sysinit
 176         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.d/rc.sysinit
 177
 178         # dont attempt to set kernel parameters
 179         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.sysinit
 180         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.d/rc.sysinit
 181         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/network 2>/dev/null
 182         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/NetworkManager 2>/dev/null
 183     fi
 184
 185     # sem_open(3) checks that /dev/shm is SHMFS_SUPER_MAGIC, so make sure to mount /dev/shm (normally done by dracut initrd) as tmpfs
 186     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 187         echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
 188         echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
 189     fi
 190
 191     if [ $container_release_major = "6" ]; then
 192         sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
 193         sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
 194     fi
 195
 196     # no need to attempt to mount /
 197     sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.sysinit
 198     sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.d/rc.sysinit
 199     sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.sysinit
 200     sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.d/rc.sysinit
 201
 202     # disable udev in the container
 203     if [ $container_release_major = "4" ]; then
 204         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.sysinit
 205         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.d/rc.sysinit
 206     else
 207         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
 208         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
 209     fi
 210
 211     # disable nash raidautorun in the container since no /dev/md*
 212     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 213         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
 214         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
 215     fi
 216
 217     # prevent rc.sysinit from attempting to loadkeys
 218     if [ \( $container_release_major = "4" -o $container_release_major = "5" \) -a -e $container_rootfs/etc/sysconfig/keyboard ]; then
 219         rm $container_rootfs/etc/sysconfig/keyboard
 220     fi
 221
 222     # dont use the hwclock, it messes up the host's time
 223     if [ $container_release_major = "4" ]; then
 224         sed -i 's|runcmd $"Syncing hardware clock|# LXC no hwclock runcmd $"Syncing hardware clock|' $container_rootfs/etc/rc.d/init.d/halt
 225     else
 226         sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
 227     fi
 228     sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.sysinit
 229     sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/rc.sysinit
 230     sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.sysinit
 231     sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.d/rc.sysinit
 232
 233     # dont start lvm
 234     sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
 235     sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
 236
 237     # fix assumptions that plymouth is available
 238     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
 239     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
 240     rm -f $container_rootfs/etc/init/plymouth-shutdown.conf
 241     rm -f $container_rootfs/etc/init/quit-plymouth.conf
 242     rm -f $container_rootfs/etc/init/splash-manager.conf
 243
 244     # setup console and tty[1-4] for login. note that /dev/console and
 245     # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
 246     # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
 247     # lxc will maintain these links and bind mount ptys over /dev/lxc/*
 248     # since lxc.devttydir is specified in the config.
 249
 250     # allow root login on console, tty[1-4], and pts/0 for libvirt
 251     echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
 252     echo "lxc/console"  >>$container_rootfs/etc/securetty
 253     echo "lxc/tty1"     >>$container_rootfs/etc/securetty
 254     echo "lxc/tty2"     >>$container_rootfs/etc/securetty
 255     echo "lxc/tty3"     >>$container_rootfs/etc/securetty
 256     echo "lxc/tty4"     >>$container_rootfs/etc/securetty
 257     echo "# For libvirt/Virtual Machine Monitor" >>$container_rootfs/etc/securetty
 258     echo "pts/0"        >>$container_rootfs/etc/securetty
 259
 260     # prevent mingetty from calling vhangup(2) since it fails with userns
 261     if [ -f $container_rootfs/etc/init/tty.conf ]; then
 262         sed -i 's|mingetty|mingetty --nohangup|' $container_rootfs/etc/init/tty.conf
 263     fi
 264
 265     # dont try to unmount /dev/lxc devices
 266     sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
 267
 268     # don't try to unmount swap
 269     sed -i 's|\[ -f /proc/swaps \]|# LXC [ -f /proc/swaps ]|' $container_rootfs/etc/init.d/halt
 270
 271     # start a getty on /dev/console, /dev/tty[1-4]
 272     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 273         sed -i 's|mingetty|mingetty --nohangup|' $container_rootfs/etc/inittab
 274         sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty --nohangup --noclear console' $container_rootfs/etc/inittab
 275         sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
 276         sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
 277     fi
 278
 279     if [ $container_release_major = "6" ]; then
 280         cat <<EOF > $container_rootfs/etc/init/console.conf
 281 # console - getty
 282 #
 283 # This service maintains a getty on the console from the point the system is
 284 # started until it is shut down again.
 285
 286 start on stopped rc RUNLEVEL=[2345]
 287 stop on runlevel [!2345]
 288
 289 respawn
 290 exec /sbin/mingetty --nohangup --noclear /dev/console
 291 EOF
 292     fi
 293
 294     # lxc-shutdown sends SIGPWR to init, OL4 and OL5 have SysVInit, just
 295     # make it do shutdown now instead of delaying 2 minutes.  OL6 uses
 296     # upstart, so we create an upstart job to handle SIGPWR to shut down
 297     # cleanly.  We use "init 0" instead of shutdown -h now to avoid SELinux
 298     # permission denied when upstart's shutdown tries to connect to the
 299     # /com/ubuntu/upstart socket.
 300     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 301         sed -i 's|pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; |pf::powerfail:/sbin/shutdown -f -h now "|' $container_rootfs/etc/inittab
 302     else
 303         cat <<EOF > $container_rootfs/etc/init/power-status-changed.conf
 304 # power-status-changed - used to cleanly shut down the container
 305 #
 306 # This task is run whenever init receives SIGPWR
 307 # Used to shut down the machine.
 308
 309 start on power-status-changed
 310
 311 exec init 0
 312 EOF
 313     fi
 314
 315     # there might be other services that are useless but the below set is a good start
 316     # some of these might not exist in the image, so we silence chkconfig complaining
 317     # about the service file not being found
 318     for service in \
 319         acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd       \
 320         ip6tables irqbalance iscsi iscsid isdn kdump kudzu              \
 321         lm_sensors lvm2-monitor mdmonitor microcode_ctl                 \
 322         ntpd pcmcia postfix sendmail udev-post xfs ;
 323     do
 324         chroot $container_rootfs chkconfig 2>/dev/null $service off
 325     done
 326
 327     for service in rsyslog ;
 328     do
 329         chroot $container_rootfs chkconfig 2>/dev/null $service on
 330     done
 331
 332     # create required devices. note that /dev/console will be created by lxc
 333     # or libvirt itself to be a symlink to the right pty.
 334     # take care to not nuke /dev in case $container_rootfs isn't set
 335     dev_path="$container_rootfs/dev"
 336     if [ $container_rootfs != "/" -a -d $dev_path ]; then
 337         rm -rf $dev_path
 338         mkdir -p $dev_path
 339         if can_chcon; then
 340             # ensure symlinks created in /dev have the right context
 341             chcon -t device_t $dev_path
 342         fi
 343     fi
 344     mknod -m 666  $dev_path/null c 1 3
 345     mknod -m 666  $dev_path/zero c 1 5
 346     mknod -m 666  $dev_path/random c 1 8
 347     mknod -m 666  $dev_path/urandom c 1 9
 348     mkdir -m 755  $dev_path/pts
 349     mkdir -m 1777 $dev_path/shm
 350     mknod -m 666  $dev_path/tty c 5 0
 351     mknod -m 666  $dev_path/tty0 c 4 0
 352     mknod -m 666  $dev_path/tty1 c 4 1
 353     mknod -m 666  $dev_path/tty2 c 4 2
 354     mknod -m 666  $dev_path/tty3 c 4 3
 355     mknod -m 666  $dev_path/tty4 c 4 4
 356     mknod -m 666  $dev_path/full c 1 7
 357     mknod -m 600  $dev_path/initctl p
 358
 359     # set selinux labels same as host
 360     if can_chcon; then
 361         for node in null zero random urandom pts shm \
 362                     tty tty0 tty1 tty2 tty3 tty4 full ;
 363         do
 364             chcon --reference /dev/$node $dev_path/$node 2>/dev/null
 365         done
 366     fi
 367
 368     # ensure /dev/ptmx refers to the newinstance devpts of the container, or
 369     # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
 370     rm -f $container_rootfs/dev/ptmx
 371     ln -s pts/ptmx $container_rootfs/dev/ptmx
 372
 373     # start with a clean /var/log/messages
 374     rm -f $container_rootfs/var/log/messages
 375
 376     # add oracle user, set root password
 377     chroot $container_rootfs useradd -m -s /bin/bash oracle
 378     echo "oracle:oracle" | chroot $container_rootfs chpasswd
 379     echo "root:root" | chroot $container_rootfs chpasswd
 380     printf "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m\n"
 381     printf "Added container user:\033[1mroot\033[0m password:\033[1mroot\033[0m\n"
 382 }
 383
 384 # create the container's lxc config file
 385 container_config_create()
 386 {
 387     echo "Create configuration file $cfg_dir/config"
 388     mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
 389
 390     echo "# Common configuration" >> $cfg_dir/config
 391     if [ -e "@LXCTEMPLATECONFIG@/oracle.common.conf" ]; then
 392         echo "lxc.include = @LXCTEMPLATECONFIG@/oracle.common.conf" >> $cfg_dir/config
 393     fi
 394
 395     # generate a hwaddr for the container with a high mac address
 396     # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
 397     local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
 398                       head -n 1 |awk '{print $2}' | cut -c1-10 |\
 399                       sed 's/\(..\)/\1:/g; s/.$//'`"
 400     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 401 # Container configuration for Oracle Linux $container_release_major.$container_release_minor
 402 lxc.arch = $arch
 403 lxc.utsname = $name
 404 EOF
 405     grep -q "^lxc.rootfs" $cfg_dir/config 2>/dev/null || echo "lxc.rootfs = $container_rootfs" >> $cfg_dir/config
 406
 407     if [ $container_release_major != "4" ]; then
 408         echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
 409     fi
 410
 411     echo "# Networking" >>$cfg_dir/config
 412     # see if the network settings were already specified
 413     lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
 414     if [ -z "$lxc_network_type" -a                      \
 415         \( $host_distribution = "OracleServer" -o       \
 416            $host_distribution = "Fedora" \) ]; then
 417             echo "lxc.network.type = veth" >>$cfg_dir/config
 418             echo "lxc.network.flags = up" >>$cfg_dir/config
 419             echo "lxc.network.link = virbr0" >>$cfg_dir/config
 420     fi
 421
 422     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 423 lxc.network.name = eth0
 424 lxc.network.mtu = 1500
 425 lxc.network.hwaddr = $hwaddr
 426 EOF
 427 }
 428
 429 container_rootfs_clone()
 430 {
 431     if is_btrfs_subvolume $template_rootfs; then
 432         # lxc-create already made $container_rootfs a btrfs subvolume, but
 433         # in this case we want to snapshot the original subvolume so we we
 434         # have to delete the one that lxc-create made
 435         btrfs subvolume delete $container_rootfs
 436         btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
 437     else
 438         echo "Copying rootfs ..."
 439         cp -axT $template_rootfs $container_rootfs || die "copy template"
 440     fi
 441 }
 442
 443 container_rootfs_create()
 444 {
 445     cmds="rpm wget yum"
 446     if [ $container_release_major -lt "6" ]; then
 447         if [ $host_distribution = "Ubuntu" -o $host_distribution = "Debian" ]; then
 448             db_dump_cmd="db5.1_dump"
 449             db_load_cmd="db4.3_load"
 450         fi
 451         if [ $host_distribution = "OracleServer" -o \
 452              $host_distribution = "Fedora" ]; then
 453             db_dump_cmd="db_dump"
 454             db_load_cmd="db43_load"
 455         fi
 456
 457         cmds="$cmds $db_dump_cmd $db_load_cmd file"
 458     fi
 459     for cmd in $cmds; do
 460         which $cmd >/dev/null 2>&1
 461         if [ $? -ne 0 ]; then
 462             die "The $cmd command is required, please install it"
 463         fi
 464     done
 465
 466     mkdir -p @LOCALSTATEDIR@/lock/subsys/lxc
 467     (
 468         flock -x 9
 469         if [ $? -ne 0 ]; then
 470             die "The template is busy."
 471         fi
 472
 473         echo "Downloading release $container_release_major.$container_release_minor for $basearch"
 474
 475         # get yum repo file
 476         if [ -n "$repourl" ]; then
 477             yum_url=$repourl
 478         else
 479             yum_url=http://public-yum.oracle.com
 480         fi
 481         if   [ $container_release_major = "4" ]; then
 482             repofile=public-yum-el4.repo
 483         elif [ $container_release_major = "5" ]; then
 484             repofile=public-yum-el5.repo
 485         elif [ $container_release_major = "6" ]; then
 486             repofile=public-yum-ol6.repo
 487         else
 488             die "Unsupported release $container_release_major"
 489         fi
 490         mkdir -p $container_rootfs/etc/yum.repos.d
 491         wget -q $yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
 492         if [ $? -ne 0 ]; then
 493             die "Failed to download repo file $yum_url/$repofile"
 494         fi
 495
 496         # yum will take $basearch from host, so force the arch we want
 497         sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
 498
 499         # replace url if they specified one
 500         if [ -n "$repourl" ]; then
 501             sed -i "s|baseurl=http://public-yum.oracle.com/repo|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
 502             sed -i "s|gpgkey=http://public-yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
 503         fi
 504
 505         # disable all repos, then enable the repo for the version we are installing.
 506         if [ $container_release_minor = "latest" ]; then
 507             if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 508                 repo="el"$container_release_major"_"$container_release_minor
 509             else
 510                 repo="ol"$container_release_major"_"$container_release_minor
 511             fi
 512         elif [ $container_release_major = "6" ]; then
 513             if   [ $container_release_minor = "0" ]; then
 514                 repo="ol"$container_release_major"_ga_base"
 515             else
 516                 repo="ol"$container_release_major"_u"$container_release_minor"_base"
 517             fi
 518         elif [ $container_release_major = "5" ]; then
 519             if   [ $container_release_minor = "0" ]; then
 520                 repo="el"$container_release_major"_ga_base"
 521             elif [ $container_release_minor -lt "6" ]; then
 522                 repo="el"$container_release_major"_u"$container_release_minor"_base"
 523             else
 524                 repo="ol"$container_release_major"_u"$container_release_minor"_base"
 525             fi
 526         elif [ $container_release_major = "4" -a $container_release_minor -gt "5" ]; then
 527             repo="el"$container_release_major"_u"$container_release_minor"_base"
 528         else
 529             die "Unsupported release $container_release_major.$container_release_minor"
 530         fi
 531         sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
 532         sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
 533
 534         # create rpm db, download and yum install minimal packages
 535         mkdir -p $container_rootfs/var/lib/rpm
 536         rpm --root $container_rootfs --initdb
 537         yum_args="--installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
 538         min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils oraclelinux-release"
 539
 540         # we unshare the mount namespace because yum installing the ol4
 541         # packages causes $rootfs/proc to be mounted on
 542         lxc-unshare -s MOUNT yum -- $yum_args install $min_pkgs $user_pkgs
 543         if [ $? -ne 0 ]; then
 544             die "Failed to download and install the rootfs, aborting."
 545         fi
 546
 547         # rsyslog and pam depend on coreutils for some common commands in
 548         # their POSTIN scriptlets, but coreutils wasn't installed yet. now
 549         # that coreutils is installed, reinstall the packages so their POSTIN
 550         # runs right. similarly, libutempter depends on libselinux.so.1 when
 551         # it runs /usr/sbin/groupadd, so reinstall it too
 552         redo_pkgs=""
 553         if [ $container_release_major = "5" ]; then
 554             if   [ $container_release_minor = "latest" ]; then
 555                 redo_pkgs="pam rsyslog libutempter"
 556             elif [ $container_release_minor -lt 2 ]; then
 557                 redo_pkgs="pam"
 558             elif [ $container_release_minor -lt 6 ]; then
 559                 redo_pkgs="pam rsyslog"
 560             elif [ $container_release_minor -gt 5 ]; then
 561                 redo_pkgs="pam rsyslog libutempter"
 562             fi
 563         fi
 564         # shadow utils fails on ol4 and ol6.1
 565         if [ $container_release_major = "4" -o \
 566              $container_release_major = "6" -a $container_release_minor = "1" ]; then
 567             redo_pkgs="shadow-utils"
 568         fi
 569         if [ x"$redo_pkgs" != x ]; then
 570             rpm --root $container_rootfs --nodeps -e $redo_pkgs
 571             yum $yum_args install $redo_pkgs
 572             if [ $? -ne 0 ]; then
 573                 die "Unable to reinstall packages"
 574             fi
 575         fi
 576
 577         # these distributions put the rpm database in a place the guest is
 578         # not expecting it, so move it
 579         if [ $host_distribution = "Ubuntu" -o $host_distribution = "Debian" ]; then
 580             mv $container_rootfs/$HOME/.rpmdb/* $container_rootfs/var/lib/rpm
 581         fi
 582
 583         # if the native rpm created the db with Hash version 9, we need to
 584         # downgrade it to Hash version 8 for use with OL5.x
 585         db_version=`file $container_rootfs/var/lib/rpm/Packages | \
 586                     grep -o 'version [0-9]*' |awk '{print $2}'`
 587         if [ $container_release_major -lt "6" -a $db_version != "8" ]; then
 588             echo "Fixing (downgrading) rpm database from version $db_version"
 589             rm -f $container_rootfs/var/lib/rpm/__db*
 590             for db in $container_rootfs/var/lib/rpm/* ; do
 591                 $db_dump_cmd $db |$db_load_cmd $db.new
 592                 mv $db.new $db
 593             done
 594         fi
 595
 596         # the host rpm may not be the same as the guest, rebuild the db with
 597         # the guest rpm version
 598         echo "Rebuilding rpm database"
 599         rm -f $container_rootfs/var/lib/rpm/__db*
 600         chroot $container_rootfs rpm --rebuilddb >/dev/null 2>&1
 601
 602     ) 9>@LOCALSTATEDIR@/lock/subsys/lxc-oracle-$name
 603 }
 604
 605 container_release_get()
 606 {
 607     if [ -f $1/etc/oracle-release ]; then
 608         container_release_version=`cat $1/etc/oracle-release |awk '/^Oracle/ {print $5}'`
 609         container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 610         container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 611     elif grep -q "Enterprise Linux AS" $1/etc/redhat-release; then
 612         container_release_major=`cat $1/etc/redhat-release |awk '{print $7}'`
 613         container_release_minor=`cat $1/etc/redhat-release |awk '{print $10}' |tr -d ")"`
 614         container_release_version="$container_release_major.$container_release_minor"
 615     elif grep -q "Enterprise Linux Server" $1/etc/redhat-release; then
 616         container_release_version=`cat $1/etc/redhat-release |awk '{print $7}'`
 617         container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 618         container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 619     else
 620         echo "Unable to determine container release version"
 621         exit 1
 622     fi
 623 }
 624
 625 usage()
 626 {
 627     cat <<EOF
 628   -a|--arch=<arch>        architecture (ie. i386, x86_64)
 629   -R|--release=<release>  release to download for the new container
 630   --rootfs=<path>         rootfs path
 631   -r|--rpms=<rpm name>    additional rpms to install into container
 632   -u|--url=<url>          replace yum repo url (ie. local yum mirror)
 633   -t|--templatefs=<path>  copy/clone rootfs at path instead of downloading
 634   -h|--help
 635
 636 Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
 637 EOF
 638     return 0
 639 }
 640
 641 options=$(getopt -o hp:n:a:R:r:u:t: -l help,rootfs:,path:,name:,arch:,release:,rpms:,url:,templatefs: -- "$@")
 642 if [ $? -ne 0 ]; then
 643     usage $(basename $0)
 644     exit 1
 645 fi
 646
 647 arch=$(uname -m)
 648 eval set -- "$options"
 649 while true
 650 do
 651     case "$1" in
 652         -h|--help)              usage $0 && exit 0;;
 653         -p|--path)              cfg_dir=$2; shift 2;;
 654         --rootfs)               container_rootfs=$2; shift 2;;
 655         -n|--name)              name=$2; shift 2;;
 656         -a|--arch)              arch=$2; shift 2;;
 657         -R|--release)           container_release_version=$2; shift 2;;
 658         -r|--rpms)              user_pkgs=$2; shift 2;;
 659         -u|--url)               repourl=$2; shift 2;;
 660         -t|--templatefs)        template_rootfs=$2; shift 2;;
 661         --)                     shift 1; break ;;
 662         *)                      break ;;
 663     esac
 664 done
 665
 666 # make sure mandatory args are given and valid
 667 if [ "$(id -u)" != "0" ]; then
 668     echo "This script should be run as 'root'"
 669     exit 1
 670 fi
 671
 672 if [ -z $name ]; then
 673     echo "Container name must be given"
 674     usage
 675     exit 1
 676 fi
 677
 678 if [ -z $cfg_dir ]; then
 679     echo "Configuration directory must be given, check lxc-create"
 680     usage
 681     exit 1
 682 fi
 683
 684 basearch=$arch
 685 if [ "$arch" = "i686" ]; then
 686     basearch="i386"
 687 fi
 688
 689 if [ "$arch" != "i386" -a "$arch" != "x86_64" ]; then
 690     echo "Bad architecture given, check lxc-create"
 691     usage
 692     exit 1
 693 fi
 694
 695 if which lsb_release >/dev/null 2>&1; then
 696     host_distribution=`lsb_release --id |awk '{print $3}'`
 697     host_release_version=`lsb_release --release |awk '{print $2}'`
 698     host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 699     host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 700 else
 701     if   [ -f /etc/fedora-release ]; then
 702        host_distribution="Fedora"
 703        host_release_version=`cat /etc/fedora-release |awk '{print $3}'`
 704        host_release_major=$host_release_version
 705        host_release_minor=0
 706     elif [ -f /etc/oracle-release ]; then
 707        host_distribution="OracleServer"
 708        host_release_version=`cat /etc/oracle-release |awk '{print $5}'`
 709        host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 710        host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 711     else
 712        echo "Unable to determine host distribution, ensure lsb_release is installed"
 713        exit 1
 714     fi
 715 fi
 716 echo "Host is $host_distribution $host_release_version"
 717
 718 if [ -z "$container_rootfs" ]; then
 719     container_rootfs="$cfg_dir/rootfs"
 720 fi
 721
 722 if [ -n "$template_rootfs" ]; then
 723     container_release_get $template_rootfs
 724 else
 725     if [ -z "$container_release_version" ]; then
 726         if [ $host_distribution = "OracleServer" ]; then
 727             container_release_version=$host_release_version
 728         else
 729             echo "No release specified with -R, defaulting to 6.5"
 730             container_release_version="6.5"
 731         fi
 732     fi
 733     container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 734     container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 735 fi
 736
 737 container_config_create
 738 if [ -n "$template_rootfs" ]; then
 739     container_rootfs_clone
 740 else
 741     container_rootfs_create
 742 fi
 743
 744 container_release_get $container_rootfs
 745
 746 container_rootfs_configure
 747
 748 echo "Container : $container_rootfs"
 749 echo "Config    : $cfg_dir/config"
 750 echo "Network   : eth0 ($lxc_network_type) on $lxc_network_link"