templates/lxc-ubuntu-cloud.in

   1 #!/bin/bash
   2
   3 # template script for generating ubuntu container for LXC based on released
   4 # cloud images.
   5 #
   6 # Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com>
   7 #
   8 #  This library is free software; you can redistribute it and/or
   9 #  modify it under the terms of the GNU Lesser General Public
  10 #  License as published by the Free Software Foundation; either
  11 #  version 2.1 of the License, or (at your option) any later version.
  12
  13 #  This library is distributed in the hope that it will be useful,
  14 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 #  Lesser General Public License for more details.
  17
  18 #  You should have received a copy of the GNU Lesser General Public
  19 #  License along with this library; if not, write to the Free Software
  20 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  21
  22 set -e
  23
  24 STATE_DIR="@LOCALSTATEDIR@"
  25 HOOK_DIR="@LXCHOOKDIR@"
  26 CLONE_HOOK_FN="$HOOK_DIR/ubuntu-cloud-prep"
  27
  28 if [ -r /etc/default/lxc ]; then
  29     . /etc/default/lxc
  30 fi
  31
  32 am_in_userns() {
  33     [ -e /proc/self/uid_map ] || { echo no; return; }
  34     [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }
  35     line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
  36     [ "$line" = "0 0 4294967295" ] && { echo no; return; }
  37     echo yes
  38 }
  39
  40 in_userns=0
  41 [ $(am_in_userns) = "yes" ] && in_userns=1
  42
  43 copy_configuration()
  44 {
  45     path=$1
  46     rootfs=$2
  47     name=$3
  48     arch=$4
  49     release=$5
  50
  51     if [ $arch = "i386" ]; then
  52         arch="i686"
  53     fi
  54
  55     # if there is exactly one veth network entry, make sure it has an
  56     # associated hwaddr.
  57     nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
  58     if [ $nics -eq 1 ]; then
  59         grep -q "^lxc.network.hwaddr" $path/config || sed -i -e "/^lxc\.network\.type[ \t]*=[ \t]*veth/a lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
  60     fi
  61
  62     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
  63     cat <<EOF >> $path/config
  64 lxc.mount = $path/fstab
  65 lxc.pivotdir = lxc_putold
  66
  67 lxc.devttydir =$ttydir
  68 lxc.tty = 4
  69 lxc.pts = 1024
  70
  71 lxc.utsname = $name
  72 lxc.arch = $arch
  73 lxc.cap.drop = sys_module mac_admin mac_override sys_time
  74
  75 # When using LXC with apparmor, uncomment the next line to run unconfined:
  76 #lxc.aa_profile = unconfined
  77
  78 # To support container nesting on an Ubuntu host, uncomment next two lines:
  79 #lxc.aa_profile = lxc-container-default-with-nesting
  80 #lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
  81
  82 lxc.hook.clone = ${CLONE_HOOK_FN}
  83 EOF
  84
  85     # can't write to devices.deny without CAP_SYS_ADMIN in init-user-ns
  86     if [ $in_userns -ne 1 ]; then
  87             cat <<EOF >> $path/config
  88 lxc.cgroup.devices.deny = a
  89 # Allow any mknod (but not using the node)
  90 lxc.cgroup.devices.allow = c *:* m
  91 lxc.cgroup.devices.allow = b *:* m
  92 # /dev/null and zero
  93 lxc.cgroup.devices.allow = c 1:3 rwm
  94 lxc.cgroup.devices.allow = c 1:5 rwm
  95 # consoles
  96 lxc.cgroup.devices.allow = c 5:1 rwm
  97 lxc.cgroup.devices.allow = c 5:0 rwm
  98 # /dev/{,u}random
  99 lxc.cgroup.devices.allow = c 1:9 rwm
 100 lxc.cgroup.devices.allow = c 1:8 rwm
 101 lxc.cgroup.devices.allow = c 136:* rwm
 102 lxc.cgroup.devices.allow = c 5:2 rwm
 103 # rtc
 104 lxc.cgroup.devices.allow = c 254:0 rm
 105 # fuse
 106 lxc.cgroup.devices.allow = c 10:229 rwm
 107 # tun
 108 lxc.cgroup.devices.allow = c 10:200 rwm
 109 # full
 110 lxc.cgroup.devices.allow = c 1:7 rwm
 111 # hpet
 112 lxc.cgroup.devices.allow = c 10:228 rwm
 113 # kvm
 114 lxc.cgroup.devices.allow = c 10:232 rwm
 115 EOF
 116     fi
 117
 118     cat <<EOF > $path/fstab
 119 proc            proc         proc    nodev,noexec,nosuid 0 0
 120 sysfs           sys          sysfs defaults  0 0
 121 /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
 122 /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
 123 /sys/kernel/security sys/kernel/security none bind,optional 0 0
 124 /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
 125 EOF
 126
 127     # unprivileged user can't mknod these.  One day we may allow
 128     # that in the kernel, but not right now.  So let's just bind
 129     # mount the files from the host.
 130     if [ $in_userns -eq 1 ]; then
 131         mkdir -p $rootfs/dev/pts
 132         for dev in null tty urandom console; do
 133             touch $rootfs/dev/$dev
 134             echo "/dev/$dev dev/$dev    none bind 0 0" >> $path/fstab
 135         done
 136     fi
 137
 138     # rmdir /dev/shm for containers that have /run/shm
 139     # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
 140     # get bind mounted to the host's /run/shm.  So try to rmdir
 141     # it, and in case that fails move it out of the way.
 142     if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then
 143         mv $rootfs/dev/shm $rootfs/dev/shm.bak
 144         ln -s /run/shm $rootfs/dev/shm
 145     fi
 146
 147     return 0
 148 }
 149
 150 usage()
 151 {
 152     cat <<EOF
 153 LXC Container configuration for Ubuntu Cloud images.
 154
 155 Generic Options
 156 [ -r | --release <release> ]: Release name of container, defaults to host
 157 [ --rootfs <path> ]: Path in which rootfs will be placed
 158 [ -a | --arch ]: Arhcitecture of container, defaults to host architecture
 159 [ -T | --tarball ]: Location of tarball
 160 [ -d | --debug ]: Run with 'set -x' to debug errors
 161 [ -s | --stream]: Use specified stream rather than 'released'
 162
 163 Additionally, clone hooks can be passed through (ie, --userdata).  For those,
 164 see:
 165   $CLONE_HOOK_FN --help
 166 EOF
 167     return 0
 168 }
 169
 170 options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds:u: -l arch:,help,rootfs:,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata:,mapped-uid: -- "$@")
 171 if [ $? -ne 0 ]; then
 172     usage $(basename $0)
 173     exit 1
 174 fi
 175 eval set -- "$options"
 176
 177 mapped_uid=-1
 178 # default release is precise, or the systems release if recognized
 179 release=precise
 180 if [ -f /etc/lsb-release ]; then
 181     . /etc/lsb-release
 182     rels=$(ubuntu-distro-info --supported 2>/dev/null) ||
 183         rels="lucid natty oneiric precise quantal raring saucy"
 184     for r in $rels; do
 185         [ "$DISTRIB_CODENAME" = "$r" ] && release="$r"
 186     done
 187 fi
 188
 189 # Code taken from debootstrap
 190 if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
 191     arch=`/usr/bin/dpkg --print-architecture`
 192 elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
 193     arch=`/usr/bin/udpkg --print-architecture`
 194 else
 195     arch=$(uname -m)
 196     if [ "$arch" = "i686" ]; then
 197         arch="i386"
 198     elif [ "$arch" = "x86_64" ]; then
 199         arch="amd64"
 200     elif [ "$arch" = "armv7l" ]; then
 201         # note: arm images don't exist before oneiric;  are called armhf in
 202         # precise and later;  and are not supported by the query, so we don't actually
 203         # support them yet (see check later on).  When Query2 is available,
 204         # we'll use that to enable arm images.
 205         arch="armhf"
 206     fi
 207 fi
 208
 209 debug=0
 210 hostarch=$arch
 211 cloud=0
 212 locales=1
 213 flushcache=0
 214 stream="released"
 215 cloneargs=()
 216 while true
 217 do
 218     case "$1" in
 219     -h|--help)         usage $0 && exit 0;;
 220     -p|--path)         path=$2; shift 2;;
 221     -n|--name)         name=$2; shift 2;;
 222     -F|--flush-cache)  flushcache=1; shift 1;;
 223     -r|--release)      release=$2; shift 2;;
 224     -a|--arch)         arch=$2; shift 2;;
 225     -T|--tarball)      tarball=$2; shift 2;;
 226     -d|--debug)        debug=1; shift 1;;
 227     -s|--stream)       stream=$2; shift 2;;
 228     --rootfs)          rootfs=$2; shift 2;;
 229     -L|--no?locales)   cloneargs[${#cloneargs[@]}]="--no-locales"; shift 1;;
 230     -i|--hostid)       cloneargs[${#cloneargs[@]}]="--hostid=$2"; shift 2;;
 231     -u|--userdata)     cloneargs[${#cloneargs[@]}]="--userdata=$2"; shift 2;;
 232     -C|--cloud)        cloneargs[${#cloneargs[@]}]="--cloud"; shift 1;;
 233     -S|--auth-key)     cloneargs[${#cloneargs[@]}]="--auth-key=$2"; shift 2;;
 234     --mapped-uid)      mapped_uid=$2; shift 2;;
 235     --)                shift 1; break ;;
 236         *)              break ;;
 237     esac
 238 done
 239
 240 echo "mapped_uid is .$mapped_uid."
 241 cloneargs=( "--name=$name" "${cloneargs[@]}" )
 242
 243 if [ $debug -eq 1 ]; then
 244     set -x
 245 fi
 246
 247 if [ "$arch" == "i686" ]; then
 248     arch=i386
 249 fi
 250
 251 if [ $arch != "i386" -a $arch != "amd64" -a $arch != "armhf" -a $arch != "armel" ]; then
 252     echo "Only i386, amd64, armel and armhf are supported by the ubuntu cloud template."
 253     exit 1
 254 fi
 255
 256 if [ $hostarch != "i386" -a $hostarch != "amd64" -a $hostarch != "armhf" -a $hostarch != "armel" ]; then
 257     echo "Only i386, amd64, armel and armhf are supported as host."
 258     exit 1
 259 fi
 260
 261 if [ $hostarch = "amd64" -a $arch != "amd64" -a $arch != "i386" ]; then
 262     echo "can't create $arch container on $hostarch"
 263     exit 1
 264 fi
 265
 266 if [ $hostarch = "i386" -a $arch != "i386" ]; then
 267     echo "can't create $arch container on $hostarch"
 268     exit 1
 269 fi
 270
 271 if [ $hostarch = "armhf" -o $hostarch = "armel" ] && \
 272    [ $arch != "armhf" -a $arch != "armel" ]; then
 273     echo "can't create $arch container on $hostarch"
 274     exit 1
 275 fi
 276
 277 if [ "$stream" != "daily" -a "$stream" != "released" ]; then
 278     echo "Only 'daily' and 'released' streams are supported"
 279     exit 1
 280 fi
 281
 282 if [ -z "$path" ]; then
 283     echo "'path' parameter is required"
 284     exit 1
 285 fi
 286
 287 if [ "$(id -u)" != "0" ]; then
 288     echo "This script should be run as 'root'"
 289     exit 1
 290 fi
 291
 292 # detect rootfs
 293 config="$path/config"
 294 if [ -z "$rootfs" ]; then
 295     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 296         rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
 297     else
 298         rootfs=$path/rootfs
 299     fi
 300 fi
 301
 302 type ubuntu-cloudimg-query
 303 type wget
 304
 305 # determine the url, tarball, and directory names
 306 # download if needed
 307 cache="$STATE_DIR/cache/lxc/cloud-$release"
 308 STATE_DIR="$HOME/.cache/lxc/"
 309 cache="$HOME/.cache/lxc/cloud-$release"
 310
 311 mkdir -p $cache
 312
 313 if [ -n "$tarball" ]; then
 314     url2="$tarball"
 315 else
 316     url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
 317     url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/'`
 318 fi
 319
 320 filename=`basename $url2`
 321
 322 wgetcleanup()
 323 {
 324     rm -f $filename
 325 }
 326
 327 buildcleanup()
 328 {
 329     cd $rootfs
 330     umount -l $cache/$xdir || true
 331     rm -rf $cache
 332 }
 333
 334 # if the release doesn't have a *-rootfs.tar.gz, then create one from the
 335 # cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
 336 # a tarball from the mounted image.
 337 build_root_tgz()
 338 {
 339     url=$1
 340     filename=$2
 341
 342     xdir=`mktemp -d -p .`
 343     tarname=`basename $url`
 344     imgname="$release-*-cloudimg-$arch.img"
 345     trap buildcleanup EXIT SIGHUP SIGINT SIGTERM
 346     if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
 347         rm -f $tarname
 348         echo "Downloading cloud image from $url"
 349         wget $url || { echo "Couldn't find cloud image $url."; exit 1; }
 350     fi
 351     echo "Creating new cached cloud image rootfs"
 352     tar --wildcards -zxf "$tarname" "$imgname"
 353     mount -o loop $imgname $xdir
 354     (cd $xdir; tar --numeric-owner -cpzf "../$filename" .)
 355     umount $xdir
 356     rm -f $tarname $imgname
 357     rmdir $xdir
 358     echo "New cloud image cache created"
 359     trap EXIT
 360     trap SIGHUP
 361     trap SIGINT
 362     trap SIGTERM
 363 }
 364
 365 do_extract_rootfs() {
 366
 367     cd $cache
 368     if [ $flushcache -eq 1 ]; then
 369         echo "Clearing the cached images"
 370         rm -f $filename
 371     fi
 372
 373     trap wgetcleanup EXIT SIGHUP SIGINT SIGTERM
 374     if [ ! -f $filename ]; then
 375         wget $url2 || build_root_tgz $url1 $filename
 376     fi
 377     trap EXIT
 378     trap SIGHUP
 379     trap SIGINT
 380     trap SIGTERM
 381
 382     echo "Extracting container rootfs"
 383     mkdir -p $rootfs
 384     cd $rootfs
 385     if [ $in_userns -eq 1 ]; then
 386         tar --anchored --exclude="dev/*" --numeric-owner -xpzf "$cache/$filename"
 387     else
 388         tar --numeric-owner -xpzf "$cache/$filename"
 389     fi
 390 }
 391
 392 if [ -n "$tarball" ]; then
 393     do_extract_rootfs
 394 else
 395     mkdir -p "$STATE_DIR/lock/subsys/"
 396     (
 397         flock -x 200
 398         do_extract_rootfs
 399     ) 200>"$STATE_DIR/lock/subsys/lxc-ubuntu-cloud"
 400 fi
 401
 402 copy_configuration $path $rootfs $name $arch $release
 403
 404 "$CLONE_HOOK_FN" "${cloneargs[@]}" "$rootfs"
 405
 406 if [ $mapped_uid -ne -1 ]; then
 407         chown $mapped_uid $path/config
 408         chown -R $mapped_uid $STATE_DIR
 409         chown -R $mapped_uid $cache
 410 fi
 411
 412 echo "Container $name created."
 413 exit 0
 414
 415 # vi: ts=4 expandtab