3 # template script for generating ubuntu container for LXC based on released
6 # Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com>
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License version 2, as
10 # published by the Free Software Foundation.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License along
18 # with this program; if not, write to the Free Software Foundation, Inc.,
19 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 STATE_DIR
="@LOCALSTATEDIR@"
25 HOOK_DIR
="@LXCHOOKDIR@"
26 CLONE_HOOK_FN
="$HOOK_DIR/ubuntu-cloud-prep"
28 if [ -r /etc
/default
/lxc
]; then
33 [ -e /proc
/self
/uid_map
] ||
{ echo no
; return; }
34 [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] ||
{ echo yes; return; }
35 line
=$
(awk '{ print $1 " " $2 " " $3 }' /proc
/self
/uid_map
)
36 [ "$line" = "0 0 4294967295" ] && { echo no
; return; }
41 [ $
(am_in_userns
) = "yes" ] && in_userns
=1
51 if [ $arch = "i386" ]; then
55 # if there is exactly one veth network entry, make sure it has an
57 nics
=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
58 if [ $nics -eq 1 ]; then
59 grep -q "^lxc.network.hwaddr" $path/config ||
sed -i -e "/^lxc\.network\.type[ \t]*=[ \t]*veth/a lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
62 grep -q "^lxc.rootfs" $path/config
2>/dev
/null ||
echo "lxc.rootfs = $rootfs" >> $path/config
63 cat <<EOF >> $path/config
64 lxc.mount = $path/fstab
65 lxc.pivotdir = lxc_putold
67 lxc.devttydir =$ttydir
73 lxc.cap.drop = sys_module mac_admin mac_override sys_time
75 # When using LXC with apparmor, uncomment the next line to run unconfined:
76 #lxc.aa_profile = unconfined
78 # To support container nesting on an Ubuntu host, uncomment next two lines:
79 #lxc.aa_profile = lxc-container-default-with-nesting
80 #lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
82 lxc.hook.clone = ${CLONE_HOOK_FN}
84 lxc.cgroup.devices.deny = a
85 # Allow any mknod (but not using the node)
86 lxc.cgroup.devices.allow = c *:* m
87 lxc.cgroup.devices.allow = b *:* m
89 lxc.cgroup.devices.allow = c 1:3 rwm
90 lxc.cgroup.devices.allow = c 1:5 rwm
92 lxc.cgroup.devices.allow = c 5:1 rwm
93 lxc.cgroup.devices.allow = c 5:0 rwm
95 lxc.cgroup.devices.allow = c 1:9 rwm
96 lxc.cgroup.devices.allow = c 1:8 rwm
97 lxc.cgroup.devices.allow = c 136:* rwm
98 lxc.cgroup.devices.allow = c 5:2 rwm
100 lxc.cgroup.devices.allow = c 254:0 rm
102 lxc.cgroup.devices.allow = c 10:229 rwm
104 lxc.cgroup.devices.allow = c 10:200 rwm
106 lxc.cgroup.devices.allow = c 1:7 rwm
108 lxc.cgroup.devices.allow = c 10:228 rwm
110 lxc.cgroup.devices.allow = c 10:232 rwm
113 cat <<EOF > $path/fstab
114 proc proc proc nodev,noexec,nosuid 0 0
115 sysfs sys sysfs defaults 0 0
116 /sys/fs/fuse/connections sys/fs/fuse/connections none bind 0 0
117 /sys/kernel/debug sys/kernel/debug none bind 0 0
118 /sys/kernel/security sys/kernel/security none bind 0 0
121 # unprivileged user can't mknod these. One day we may allow
122 # that in the kernel, but not right now. So let's just bind
123 # mount the files from the host.
124 if [ $in_userns -eq 1 ]; then
125 for dev
in null tty urandom console
; do
126 touch $rootfs/dev
/$dev
127 echo "/dev/$dev dev/$dev none bind 0 0" >> $path/fstab
131 # rmdir /dev/shm for containers that have /run/shm
132 # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
133 # get bind mounted to the host's /run/shm. So try to rmdir
134 # it, and in case that fails move it out of the way.
135 if [ ! -L $rootfs/dev
/shm
] && [ -d $rootfs/run
/shm
] && [ -e $rootfs/dev
/shm
]; then
136 mv $rootfs/dev
/shm
$rootfs/dev
/shm.bak
137 ln -s /run
/shm
$rootfs/dev
/shm
146 LXC Container configuration for Ubuntu Cloud images.
149 [ -r | --release <release> ]: Release name of container, defaults to host
150 [ --rootfs <path> ]: Path in which rootfs will be placed
151 [ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture
152 [ -T | --tarball ]: Location of tarball
153 [ -d | --debug ]: Run with 'set -x' to debug errors
154 [ -s | --stream]: Use specified stream rather than 'released'
156 Additionally, clone hooks can be passed through (ie, --userdata). For those,
158 $CLONE_HOOK_FN --help
163 options
=$
(getopt
-o a
:hp
:r
:n
:Fi
:CLS
:T
:ds
:u
: -l arch
:,help,rootfs
:,path
:,release
:,name
:,flush-cache
,hostid
:,auth-key
:,cloud
,no_locales
,tarball
:,debug
,stream
:,userdata
: -- "$@")
164 if [ $?
-ne 0 ]; then
168 eval set -- "$options"
170 # default release is precise, or the systems release if recognized
172 if [ -f /etc
/lsb-release
]; then
174 rels
=$
(ubuntu-distro-info
--supported 2>/dev
/null
) ||
175 rels
="lucid natty oneiric precise quantal raring saucy"
177 [ "$DISTRIB_CODENAME" = "$r" ] && release
="$r"
181 # Code taken from debootstrap
182 if [ -x /usr
/bin
/dpkg
] && /usr
/bin
/dpkg
--print-architecture >/dev
/null
2>&1; then
183 arch
=`/usr/bin/dpkg --print-architecture`
184 elif type udpkg
>/dev
/null
2>&1 && udpkg
--print-architecture >/dev
/null
2>&1; then
185 arch
=`/usr/bin/udpkg --print-architecture`
188 if [ "$arch" = "i686" ]; then
190 elif [ "$arch" = "x86_64" ]; then
192 elif [ "$arch" = "armv7l" ]; then
193 # note: arm images don't exist before oneiric; are called armhf in
194 # precise and later; and are not supported by the query, so we don't actually
195 # support them yet (see check later on). When Query2 is available,
196 # we'll use that to enable arm images.
211 -h|
--help) usage
$0 && exit 0;;
212 -p|
--path) path
=$2; shift 2;;
213 -n|
--name) name
=$2; shift 2;;
214 -F|
--flush-cache) flushcache
=1; shift 1;;
215 -r|
--release) release
=$2; shift 2;;
216 -a|
--arch) arch
=$2; shift 2;;
217 -T|
--tarball) tarball
=$2; shift 2;;
218 -d|
--debug) debug
=1; shift 1;;
219 -s|
--stream) stream
=$2; shift 2;;
220 --rootfs) rootfs
=$2; shift 2;;
221 -L|
--no?locales
) cloneargs
[${#cloneargs[@]}]="--no-locales"; shift 1;;
222 -i|
--hostid) cloneargs
[${#cloneargs[@]}]="--hostid=$2"; shift 2;;
223 -u|
--userdata) cloneargs
[${#cloneargs[@]}]="--userdata=$2"; shift 2;;
224 -C|
--cloud) cloneargs
[${#cloneargs[@]}]="--cloud"; shift 1;;
225 -S|
--auth-key) cloneargs
[${#cloneargs[@]}]="--auth-key=$2"; shift 2;;
226 --) shift 1; break ;;
231 cloneargs
=( "--name=$name" "${cloneargs[@]}" )
233 if [ $debug -eq 1 ]; then
237 if [ "$arch" == "i686" ]; then
241 if [ $arch != "i386" -a $arch != "amd64" -a $arch != "armhf" -a $arch != "armel" ]; then
242 echo "Only i386, amd64, armel and armhf are supported by the ubuntu cloud template."
246 if [ $hostarch != "i386" -a $hostarch != "amd64" -a $hostarch != "armhf" -a $hostarch != "armel" ]; then
247 echo "Only i386, amd64, armel and armhf are supported as host."
251 if [ $hostarch = "amd64" -a $arch != "amd64" -a $arch != "i386" ]; then
252 echo "can't create $arch container on $hostarch"
256 if [ $hostarch = "i386" -a $arch != "i386" ]; then
257 echo "can't create $arch container on $hostarch"
261 if [ $hostarch = "armhf" -o $hostarch = "armel" ] && \
262 [ $arch != "armhf" -a $arch != "armel" ]; then
263 echo "can't create $arch container on $hostarch"
267 if [ "$stream" != "daily" -a "$stream" != "released" ]; then
268 echo "Only 'daily' and 'released' streams are supported"
272 if [ -z "$path" ]; then
273 echo "'path' parameter is required"
277 if [ "$(id -u)" != "0" ]; then
278 echo "This script should be run as 'root'"
283 config
="$path/config"
284 if [ -z "$rootfs" ]; then
285 if grep -q '^lxc.rootfs' $config 2>/dev
/null
; then
286 rootfs
=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
292 type ubuntu-cloudimg-query
295 # determine the url, tarball, and directory names
297 cache
="$STATE_DIR/cache/lxc/cloud-$release"
301 if [ -n "$tarball" ]; then
304 url1
=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
305 url2
=`echo $url1 | sed -e 's/.tar.gz/-root\0/'`
308 filename
=`basename $url2`
318 umount
-l $cache/$xdir || true
322 # if the release doesn't have a *-rootfs.tar.gz, then create one from the
323 # cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
324 # a tarball from the mounted image.
330 xdir
=`mktemp -d -p .`
331 tarname
=`basename $url`
332 imgname
="$release-*-cloudimg-$arch.img"
333 trap buildcleanup EXIT SIGHUP SIGINT SIGTERM
334 if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
336 echo "Downloading cloud image from $url"
337 wget
$url ||
{ echo "Couldn't find cloud image $url."; exit 1; }
339 echo "Creating new cached cloud image rootfs"
340 tar --wildcards -zxf $tarname $imgname
341 mount
-o loop
$imgname $xdir
342 (cd $xdir; tar zcf ..
/$filename .
)
344 rm -f $tarname $imgname
346 echo "New cloud image cache created"
353 do_extract_rootfs
() {
356 if [ $flushcache -eq 1 ]; then
357 echo "Clearing the cached images"
361 trap wgetcleanup EXIT SIGHUP SIGINT SIGTERM
362 if [ ! -f $filename ]; then
363 wget
$url2 || build_root_tgz
$url1 $filename
370 echo "Extracting container rootfs"
373 tar -zxf $cache/$filename
376 if [ -n "$tarball" ]; then
379 mkdir
-p "$STATE_DIR/lock/subsys/"
383 ) 200>"$STATE_DIR/lock/subsys/lxc-ubuntu-cloud"
386 copy_configuration
$path $rootfs $name $arch $release
388 "$CLONE_HOOK_FN" "${cloneargs[@]}" "$rootfs"
390 echo "Container $name created."