templates/lxc-ubuntu.in

   1 #!/bin/bash
   2
   3 #
   4 # template script for generating ubuntu container for LXC
   5 #
   6 # This script consolidates and extends the existing lxc ubuntu scripts
   7 #
   8
   9 # Copyright © 2011 Serge Hallyn <serge.hallyn@canonical.com>
  10 # Copyright © 2010 Wilhelm Meier
  11 # Author: Wilhelm Meier <wilhelm.meier@fh-kl.de>
  12 #
  13 #  This library is free software; you can redistribute it and/or
  14 #  modify it under the terms of the GNU Lesser General Public
  15 #  License as published by the Free Software Foundation; either
  16 #  version 2.1 of the License, or (at your option) any later version.
  17
  18 #  This library is distributed in the hope that it will be useful,
  19 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21 #  Lesser General Public License for more details.
  22
  23 #  You should have received a copy of the GNU Lesser General Public
  24 #  License along with this library; if not, write to the Free Software
  25 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  26
  27 # Detect use under userns (unsupported)
  28 for arg in "$@"; do
  29     [ "$arg" = "--" ] && break
  30     if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
  31         echo "This template can't be used for unprivileged containers." 1>&2
  32         echo "You may want to try the \"download\" template instead." 1>&2
  33         exit 1
  34     fi
  35 done
  36
  37 # Make sure the usual locations are in PATH
  38 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  39
  40 set -e
  41
  42 LOCALSTATEDIR="@LOCALSTATEDIR@"
  43 LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
  44 # Allows the lxc-cache directory to be set by environment variable
  45 LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc"}
  46
  47 if [ -r /etc/default/lxc ]; then
  48     . /etc/default/lxc
  49 fi
  50
  51 # Check if given path is in a btrfs partition
  52 is_btrfs()
  53 {
  54     [ -e $1 -a $(stat -f -c '%T' $1) = "btrfs" ]
  55 }
  56
  57 # Check if given path is the root of a btrfs subvolume
  58 is_btrfs_subvolume()
  59 {
  60     [ -d $1 -a $(stat -f -c '%T' $1) = "btrfs" -a $(stat -c '%i' $1) -eq 256 ]
  61 }
  62
  63 try_mksubvolume()
  64 {
  65     path=$1
  66     [ -d $path ] && return 0
  67     mkdir -p $(dirname $path)
  68     if which btrfs >/dev/null 2>&1 && is_btrfs $(dirname $path); then
  69         btrfs subvolume create $path
  70     else
  71         mkdir -p $path
  72     fi
  73 }
  74
  75 try_rmsubvolume()
  76 {
  77     path=$1
  78     [ -d $path ] || return 0
  79     if which btrfs >/dev/null 2>&1 && is_btrfs_subvolume $path; then
  80         btrfs subvolume delete $path
  81     else
  82         rm -rf $path
  83     fi
  84 }
  85
  86 configure_ubuntu()
  87 {
  88     rootfs=$1
  89     hostname=$2
  90     release=$3
  91     user=$4
  92     password=$5
  93
  94     # configure the network using the dhcp
  95     if chroot $rootfs which netplan >/dev/null 2>&1; then
  96         cat <<EOF > $rootfs/etc/netplan/10-lxc.yaml
  97 network:
  98   ethernets:
  99     eth0: {dhcp4: true}
 100   version: 2
 101 EOF
 102     else
 103         cat <<EOF > $rootfs/etc/network/interfaces
 104 # This file describes the network interfaces available on your system
 105 # and how to activate them. For more information, see interfaces(5).
 106
 107 # The loopback network interface
 108 auto lo
 109 iface lo inet loopback
 110
 111 auto eth0
 112 iface eth0 inet dhcp
 113 EOF
 114     fi
 115
 116     # set the hostname
 117     cat <<EOF > $rootfs/etc/hostname
 118 $hostname
 119 EOF
 120     # set minimal hosts
 121     cat <<EOF > $rootfs/etc/hosts
 122 127.0.0.1   localhost
 123 127.0.1.1   $hostname
 124
 125 # The following lines are desirable for IPv6 capable hosts
 126 ::1     ip6-localhost ip6-loopback
 127 fe00::0 ip6-localnet
 128 ff00::0 ip6-mcastprefix
 129 ff02::1 ip6-allnodes
 130 ff02::2 ip6-allrouters
 131 EOF
 132
 133     if [ ! -f $rootfs/etc/init/container-detect.conf ]; then
 134         # suppress log level output for udev
 135         sed -i "s/=\"err\"/=0/" $rootfs/etc/udev/udev.conf
 136
 137         # remove jobs for consoles 5 and 6 since we only create 4 consoles in
 138         # this template
 139         rm -f $rootfs/etc/init/tty{5,6}.conf
 140     fi
 141
 142     if [ -z "$bindhome" ]; then
 143         chroot $rootfs useradd --create-home -s /bin/bash $user
 144         echo "$user:$password" | chroot $rootfs chpasswd
 145     fi
 146
 147     # make sure we have the current locale defined in the container
 148     if [ -z "$LANG" ] || echo $LANG | grep -E -q "^C(\..+)*$"; then
 149         chroot $rootfs locale-gen en_US.UTF-8 || true
 150         chroot $rootfs update-locale LANG=en_US.UTF-8 || true
 151     else
 152         chroot $rootfs locale-gen $LANG || true
 153         chroot $rootfs update-locale LANG=$LANG || true
 154     fi
 155
 156     # generate new SSH keys
 157     if [ -x $rootfs/var/lib/dpkg/info/openssh-server.postinst ]; then
 158         cat > $rootfs/usr/sbin/policy-rc.d << EOF
 159 #!/bin/sh
 160 exit 101
 161 EOF
 162         chmod +x $rootfs/usr/sbin/policy-rc.d
 163
 164         if [ -f "$rootfs/etc/init/ssh.conf" ]; then
 165             mv "$rootfs/etc/init/ssh.conf" "$rootfs/etc/init/ssh.conf.disabled"
 166         fi
 167
 168         rm -f $rootfs/etc/ssh/ssh_host_*key*
 169
 170         DPKG_MAINTSCRIPT_PACKAGE=openssh DPKG_MAINTSCRIPT_NAME=postinst chroot $rootfs /var/lib/dpkg/info/openssh-server.postinst configure
 171
 172         sed -i "s/root@$(hostname)/root@$hostname/g" $rootfs/etc/ssh/ssh_host_*.pub
 173
 174         if [ -f "$rootfs/etc/init/ssh.conf.disabled" ]; then
 175             mv "$rootfs/etc/init/ssh.conf.disabled" "$rootfs/etc/init/ssh.conf"
 176         fi
 177
 178         rm -f $rootfs/usr/sbin/policy-rc.d
 179     fi
 180
 181     return 0
 182 }
 183
 184 # finish setting up the user in the container by injecting ssh key and
 185 # adding sudo group membership.
 186 # passed-in user is either 'ubuntu' or the user to bind in from host.
 187 finalize_user()
 188 {
 189     user=$1
 190
 191     sudo_version=$(chroot $rootfs dpkg-query -W -f='${Version}' sudo)
 192
 193     if chroot $rootfs dpkg --compare-versions $sudo_version gt "1.8.3p1-1"; then
 194         groups="sudo"
 195     else
 196         groups="sudo admin"
 197     fi
 198
 199     for group in $groups; do
 200         chroot $rootfs groupadd --system $group >/dev/null 2>&1 || true
 201         chroot $rootfs adduser ${user} $group >/dev/null 2>&1 || true
 202     done
 203
 204     if [ -n "$auth_key" -a -f "$auth_key" ]; then
 205         u_path="/home/${user}/.ssh"
 206         root_u_path="$rootfs/$u_path"
 207         mkdir -p $root_u_path
 208         cp $auth_key "$root_u_path/authorized_keys"
 209         chroot $rootfs chown -R ${user}: "$u_path"
 210
 211         echo "Inserted SSH public key from $auth_key into /home/${user}/.ssh/authorized_keys"
 212     fi
 213     return 0
 214 }
 215
 216 # A function to try and autodetect squid-deb-proxy servers on the local network
 217 # if either the squid-deb-proxy-client package is installed on the host or
 218 # a parent container set the 50squid-deb-proxy-client file.
 219 squid_deb_proxy_autodetect()
 220 {
 221     local apt_discover=/usr/share/squid-deb-proxy-client/apt-avahi-discover
 222     local proxy_file=/etc/apt/apt.conf.d/50squid-deb-proxy-client
 223     squid_proxy_line=  # That's a global :/
 224
 225     # Maybe the host is aware of a squid-deb-proxy?
 226     if [ -f $apt_discover ]; then
 227         echo -n "Discovering squid-deb-proxy..."
 228         squid_proxy_line=$($apt_discover)
 229         if [ -n "$squid_proxy_line" ]; then
 230             echo "found squid-deb-proxy: $squid_proxy_line"
 231         else
 232             echo "no squid-deb-proxy found"
 233         fi
 234     fi
 235
 236     # Are we in a nested container, and the parent already knows of a proxy?
 237     if [ -f $proxy_file ]; then
 238         # Extract the squid URL from the file (whatever is between "")
 239         squid_proxy_line=`cat $proxy_file | sed "s/.*\"\(.*\)\".*/\1/"`
 240     fi
 241 }
 242
 243 #
 244 # Choose proxies for container
 245 # http_proxy will be used by debootstrap on the host.
 246 # APT_PROXY will be used to set /etc/apt/apt.conf.d/70proxy in the container.
 247 #
 248 choose_container_proxy()
 249 {
 250     local rootfs=$1
 251     local arch=$2
 252
 253     if [ -z "$HTTP_PROXY" ]; then
 254         HTTP_PROXY="none"
 255     fi
 256     case "$HTTP_PROXY" in
 257     none)
 258         squid_deb_proxy_autodetect
 259         if [ -n "$squid_proxy_line" ]; then
 260             APT_PROXY=$squid_proxy_line
 261             export http_proxy=$squid_proxy_line
 262         else
 263             APT_PROXY=
 264         fi
 265         ;;
 266     apt)
 267         RES=`apt-config shell APT_PROXY Acquire::http::Proxy`
 268         eval $RES
 269         [ -z "$APT_PROXY" ] || export http_proxy=$APT_PROXY
 270         ;;
 271     *)
 272         APT_PROXY=$HTTP_PROXY
 273         export http_proxy=$HTTP_PROXY
 274         ;;
 275     esac
 276 }
 277
 278 write_sourceslist()
 279 {
 280     # $1 => path to the partial cache or the rootfs
 281     # $2 => architecture we want to add
 282     # $3 => whether to use the multi-arch syntax or not
 283
 284     if [ -n "$APT_PROXY" ]; then
 285         mkdir -p $1/etc/apt/apt.conf.d
 286         cat > $1/etc/apt/apt.conf.d/70proxy << EOF
 287 Acquire::http::Proxy "$APT_PROXY" ;
 288 EOF
 289     fi
 290
 291     case $2 in
 292       amd64|i386)
 293             MIRROR=${MIRROR:-http://archive.ubuntu.com/ubuntu}
 294             SECURITY_MIRROR=${SECURITY_MIRROR:-http://security.ubuntu.com/ubuntu}
 295             ;;
 296       *)
 297             MIRROR=${MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 298             SECURITY_MIRROR=${SECURITY_MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 299             ;;
 300     esac
 301     if [ -n "$3" ]; then
 302         cat >> "$1/etc/apt/sources.list" << EOF
 303 deb [arch=$2] $MIRROR ${release} main restricted universe multiverse
 304 deb [arch=$2] $MIRROR ${release}-updates main restricted universe multiverse
 305 deb [arch=$2] $SECURITY_MIRROR ${release}-security main restricted universe multiverse
 306 EOF
 307     else
 308         cat >> "$1/etc/apt/sources.list" << EOF
 309 deb $MIRROR ${release} main restricted universe multiverse
 310 deb $MIRROR ${release}-updates main restricted universe multiverse
 311 deb $SECURITY_MIRROR ${release}-security main restricted universe multiverse
 312 EOF
 313     fi
 314 }
 315
 316 install_packages()
 317 {
 318     local rootfs="$1"
 319     shift
 320     local packages="$*"
 321     if [ -z $update ]
 322     then
 323         chroot $rootfs apt-get update
 324         update=true
 325     fi
 326     if [ -n "${packages}" ]
 327     then
 328         chroot $rootfs apt-get install --force-yes -y --no-install-recommends ${packages}
 329     fi
 330 }
 331
 332 cleanup()
 333 {
 334     try_rmsubvolume $cache/partial-$arch
 335     try_rmsubvolume $cache/rootfs-$arch
 336 }
 337
 338 suggest_flush()
 339 {
 340     echo "Container upgrade failed.  The container cache may be out of date,"
 341     echo "in which case flushing the cache (see -F in the help output) may help."
 342 }
 343
 344 download_ubuntu()
 345 {
 346     cache=$1
 347     arch=$2
 348     release=$3
 349
 350     case $2 in
 351       amd64|i386)
 352             MIRROR=${MIRROR:-http://archive.ubuntu.com/ubuntu}
 353             SECURITY_MIRROR=${SECURITY_MIRROR:-http://security.ubuntu.com/ubuntu}
 354             ;;
 355       *)
 356             MIRROR=${MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 357             SECURITY_MIRROR=${SECURITY_MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 358             ;;
 359     esac
 360
 361     packages_template=${packages_template:-"apt-transport-https,ssh,vim"}
 362     debootstrap_parameters=
 363
 364     # Try to guess a list of langpacks to install
 365     langpacks="language-pack-en"
 366
 367     if which dpkg >/dev/null 2>&1; then
 368         langpacks=`(echo $langpacks &&
 369                     dpkg -l | grep -E "^ii  language-pack-[a-z]* " |
 370                         cut -d ' ' -f3) | sort -u`
 371     fi
 372     packages_template="${packages_template},$(echo $langpacks | sed 's/ /,/g')"
 373
 374     if [ -n "$variant" ]; then
 375         debootstrap_parameters="$debootstrap_parameters --variant=$variant"
 376     fi
 377     if [ "$variant" = 'minbase' ]; then
 378         packages_template="${packages_template},sudo"
 379         # Newer releases use netplan, EOL releases not supported
 380         case $release in
 381           trusty|xenial|zesty)
 382                 packages_template="${packages_template},ifupdown,isc-dhcp-client"
 383                 ;;
 384         esac
 385     fi
 386
 387     echo "Installing packages in template: ${packages_template}"
 388
 389     trap cleanup EXIT SIGHUP SIGINT SIGTERM
 390     # check the mini ubuntu was not already downloaded
 391     try_mksubvolume "$cache/partial-$arch"
 392     if [ $? -ne 0 ]; then
 393         echo "Failed to create '$cache/partial-$arch' directory"
 394         return 1
 395     fi
 396
 397     choose_container_proxy $cache/partial-$arch/ $arch
 398     # download a mini ubuntu into a cache
 399     echo "Downloading ubuntu $release minimal ..."
 400     if [ -n "$(which qemu-debootstrap)" ]; then
 401         qemu-debootstrap --verbose $debootstrap_parameters --components=main,universe --arch=$arch --include=${packages_template} $release $cache/partial-$arch $MIRROR
 402     else
 403         debootstrap --verbose $debootstrap_parameters --components=main,universe --arch=$arch --include=${packages_template} $release $cache/partial-$arch $MIRROR
 404     fi
 405
 406     if [ $? -ne 0 ]; then
 407         echo "Failed to download the rootfs, aborting."
 408             return 1
 409     fi
 410
 411     # Serge isn't sure whether we should avoid doing this when
 412     # $release == `distro-info -d`
 413     echo "Installing updates"
 414     > $cache/partial-$arch/etc/apt/sources.list
 415     write_sourceslist $cache/partial-$arch/ $arch
 416
 417     chroot "$1/partial-${arch}" apt-get update
 418     if [ $? -ne 0 ]; then
 419         echo "Failed to update the apt cache"
 420         return 1
 421     fi
 422     cat > "$1/partial-${arch}"/usr/sbin/policy-rc.d << EOF
 423 #!/bin/sh
 424 exit 101
 425 EOF
 426     chmod +x "$1/partial-${arch}"/usr/sbin/policy-rc.d
 427
 428     (
 429         cat << EOF
 430         mount -t proc proc "${1}/partial-${arch}/proc"
 431         chroot "${1}/partial-${arch}" apt-get dist-upgrade -y
 432 EOF
 433     ) | lxc-unshare -s MOUNT -- sh -eu || (suggest_flush; false)
 434
 435     rm -f "$1/partial-${arch}"/usr/sbin/policy-rc.d
 436
 437     chroot "$1/partial-${arch}" apt-get clean
 438
 439     mv "$1/partial-$arch" "$1/rootfs-$arch"
 440     trap EXIT
 441     trap SIGINT
 442     trap SIGTERM
 443     trap SIGHUP
 444     echo "Download complete"
 445     return 0
 446 }
 447
 448 copy_ubuntu()
 449 {
 450     cache=$1
 451     arch=$2
 452     rootfs=$3
 453
 454     # make a local copy of the miniubuntu
 455     echo "Copying rootfs to $rootfs ..."
 456     try_mksubvolume $rootfs
 457     if which btrfs >/dev/null 2>&1 && is_btrfs_subvolume $cache/rootfs-$arch && is_btrfs_subvolume $rootfs; then
 458       realrootfs=$(dirname $config)/rootfs
 459       [ "$rootfs" = "$realrootfs" ] || umount $rootfs || return 1
 460       btrfs subvolume delete $realrootfs || return 1
 461       btrfs subvolume snapshot $cache/rootfs-$arch $realrootfs || return 1
 462       [ "$rootfs" = "$realrootfs" ] || mount --bind $realrootfs $rootfs || return 1
 463     else
 464       rsync -SHaAX $cache/rootfs-$arch/ $rootfs/ || return 1
 465     fi
 466     return 0
 467 }
 468
 469 install_ubuntu()
 470 {
 471     rootfs=$1
 472     release=$2
 473     flushcache=$3
 474     cache="$4/$release"
 475     mkdir -p $LOCALSTATEDIR/lock/subsys/
 476
 477     (
 478         flock -x 9
 479         if [ $? -ne 0 ]; then
 480             echo "Cache repository is busy."
 481             return 1
 482         fi
 483
 484
 485         if [ $flushcache -eq 1 ]; then
 486             echo "Flushing cache..."
 487             try_rmsubvolume $cache/partial-$arch
 488             try_rmsubvolume $cache/rootfs-$arch
 489         fi
 490
 491         echo "Checking cache download in $cache/rootfs-$arch ... "
 492         if [ ! -e "$cache/rootfs-$arch" ]; then
 493             download_ubuntu $cache $arch $release
 494             if [ $? -ne 0 ]; then
 495                 echo "Failed to download 'ubuntu $release base'"
 496                 return 1
 497             fi
 498         fi
 499
 500         echo "Copy $cache/rootfs-$arch to $rootfs ... "
 501         copy_ubuntu $cache $arch $rootfs
 502         if [ $? -ne 0 ]; then
 503             echo "Failed to copy rootfs"
 504             return 1
 505         fi
 506
 507         return 0
 508
 509     ) 9>$LOCALSTATEDIR/lock/subsys/lxc-ubuntu$release
 510
 511     return $?
 512 }
 513
 514 copy_configuration()
 515 {
 516     path=$1
 517     rootfs=$2
 518     name=$3
 519     arch=$4
 520     release=$5
 521
 522     if [ $arch = "i386" ]; then
 523         arch="i686"
 524     fi
 525
 526     # if there is exactly one veth network entry, make sure it has an
 527     # associated hwaddr.
 528     nics=`grep -e '^lxc\.net\.0\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
 529     if [ $nics -eq 1 ]; then
 530         grep -q "^lxc.net.0.hwaddr" $path/config || sed -i -e "/^lxc\.net\.0\.type[ \t]*=[ \t]*veth/a lxc.net.0.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
 531     fi
 532
 533     # Generate the configuration file
 534     ## Relocate all the network config entries
 535     sed -i -e "/lxc.net.0/{w ${path}/config-network" -e "d}" $path/config
 536
 537     ## Relocate any other config entries
 538     sed -i -e "/lxc./{w ${path}/config-auto" -e "d}" $path/config
 539
 540     ## Add all the includes
 541     echo "" >> $path/config
 542     echo "# Common configuration" >> $path/config
 543     if [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu.common.conf" ]; then
 544         echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.common.conf" >> $path/config
 545     fi
 546     if [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu.${release}.conf" ]; then
 547         echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu.${release}.conf" >> $path/config
 548     fi
 549
 550     ## Add the container-specific config
 551     echo "" >> $path/config
 552     echo "# Container specific configuration" >> $path/config
 553     [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
 554     grep -q "^lxc.rootfs.path" $path/config 2>/dev/null || echo "lxc.rootfs.path = $rootfs" >> $path/config
 555     cat <<EOF >> $path/config
 556 lxc.uts.name = $name
 557 lxc.arch = $arch
 558 EOF
 559
 560     ## Re-add the previously removed network config
 561     echo "" >> $path/config
 562     echo "# Network configuration" >> $path/config
 563     cat $path/config-network >> $path/config
 564     rm $path/config-network
 565
 566     if [ $? -ne 0 ]; then
 567         echo "Failed to add configuration"
 568         return 1
 569     fi
 570
 571     return 0
 572 }
 573
 574 post_process()
 575 {
 576     rootfs=$1
 577     release=$2
 578     packages=$3
 579
 580     # Disable service startup
 581     cat > $rootfs/usr/sbin/policy-rc.d << EOF
 582 #!/bin/sh
 583 exit 101
 584 EOF
 585     chmod +x $rootfs/usr/sbin/policy-rc.d
 586
 587     # If the container isn't running a native architecture, setup multiarch
 588     if [ -x "$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)" ]; then
 589         dpkg_version=$(chroot $rootfs dpkg-query -W -f='${Version}' dpkg)
 590         if chroot $rootfs dpkg --compare-versions $dpkg_version ge "1.16.2"; then
 591             chroot $rootfs dpkg --add-architecture ${hostarch}
 592         else
 593             mkdir -p ${rootfs}/etc/dpkg/dpkg.cfg.d
 594             echo "foreign-architecture ${hostarch}" > ${rootfs}/etc/dpkg/dpkg.cfg.d/lxc-multiarch
 595         fi
 596
 597         # Save existing value of MIRROR and SECURITY_MIRROR
 598         DEFAULT_MIRROR=$MIRROR
 599         DEFAULT_SECURITY_MIRROR=$SECURITY_MIRROR
 600
 601         # Write a new sources.list containing both native and multiarch entries
 602         > ${rootfs}/etc/apt/sources.list
 603         write_sourceslist $rootfs $arch "native"
 604
 605         MIRROR=$DEFAULT_MIRROR
 606         SECURITY_MIRROR=$DEFAULT_SECURITY_MIRROR
 607         write_sourceslist $rootfs $hostarch "multiarch"
 608
 609         # Finally update the lists and install upstart using the host architecture
 610         HOST_PACKAGES="upstart:${hostarch} mountall:${hostarch} isc-dhcp-client:${hostarch}"
 611         chroot $rootfs apt-get update
 612         if chroot $rootfs dpkg -l iproute2 | grep -q ^ii; then
 613             HOST_PACKAGES="$HOST_PACKAGES iproute2:${hostarch}"
 614         else
 615             HOST_PACKAGES="$HOST_PACKAGES iproute:${hostarch}"
 616         fi
 617         install_packages $rootfs $HOST_PACKAGES
 618     fi
 619
 620     # Install Packages in container
 621     if [ -n "$packages" ]
 622     then
 623         local packages="`echo $packages | sed 's/,/ /g'`"
 624         echo "Installing packages: ${packages}"
 625         install_packages $rootfs $packages
 626     fi
 627
 628     # Set initial timezone as on host
 629     if [ -f /etc/timezone ]; then
 630         cat /etc/timezone > $rootfs/etc/timezone
 631         chroot $rootfs dpkg-reconfigure -f noninteractive tzdata
 632     elif [ -f /etc/sysconfig/clock ]; then
 633         . /etc/sysconfig/clock
 634         echo $ZONE > $rootfs/etc/timezone
 635         chroot $rootfs dpkg-reconfigure -f noninteractive tzdata
 636     else
 637         echo "Timezone in container is not configured. Adjust it manually."
 638     fi
 639
 640     # rmdir /dev/shm for containers that have /run/shm
 641     # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
 642     # get bind mounted to the host's /run/shm.  So try to rmdir
 643     # it, and in case that fails move it out of the way.
 644     # NOTE: This can only be removed once 12.04 goes out of support
 645     if [ ! -L $rootfs/dev/shm ] && [ -e $rootfs/dev/shm ]; then
 646         rmdir $rootfs/dev/shm 2>/dev/null || mv $rootfs/dev/shm $rootfs/dev/shm.bak
 647         ln -s /run/shm $rootfs/dev/shm
 648     fi
 649
 650     # Re-enable service startup
 651     rm $rootfs/usr/sbin/policy-rc.d
 652 }
 653
 654 do_bindhome()
 655 {
 656     rootfs=$1
 657     user=$2
 658
 659     # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
 660     pwd=`getent passwd $user` || { echo "Failed to copy password entry for $user"; false; }
 661     echo $pwd >> $rootfs/etc/passwd
 662
 663     # make sure user's shell exists in the container
 664     shell=`echo $pwd | cut -d: -f 7`
 665     if [ ! -x $rootfs/$shell ]; then
 666         echo "shell $shell for user $user was not found in the container."
 667         pkg=`dpkg -S $(readlink -m $shell) | cut -d ':' -f1`
 668         echo "Installing $pkg"
 669         install_packages $rootfs $pkg
 670     fi
 671
 672     shad=`getent shadow $user`
 673     echo "$shad" >> $rootfs/etc/shadow
 674
 675     # bind-mount the user's path into the container's /home
 676     h=`getent passwd $user | cut -d: -f 6`
 677     mkdir -p $rootfs/$h
 678
 679     # use relative path in container
 680     h2=${h#/}
 681     while [ ${h2:0:1} = "/" ]; do
 682         h2=${h2#/}
 683     done
 684     echo "lxc.mount.entry = $h $h2 none bind 0 0" >> $path/config
 685
 686     # Make sure the group exists in container
 687     grp=`echo $pwd | cut -d: -f 4`  # group number for $user
 688     grpe=`getent group $grp` || return 0  # if host doesn't define grp, ignore in container
 689     chroot $rootfs getent group "$grpe" || echo "$grpe" >> $rootfs/etc/group
 690 }
 691
 692 usage()
 693 {
 694     cat <<EOF
 695 $1 -h|--help [-a|--arch] [-b|--bindhome <user>] [-d|--debug]
 696    [-F | --flush-cache] [-r|--release <release>] [-v|--variant] [ -S | --auth-key <keyfile>]
 697    [--rootfs <rootfs>] [--packages <packages>] [-u|--user <user>] [--password <password>]
 698    [--mirror <url>] [--security-mirror <url>]
 699 release: the ubuntu release (e.g. xenial): defaults to host release on ubuntu, otherwise uses latest LTS
 700 variant: debootstrap variant to use (see debootstrap(8))
 701 bindhome: bind <user>'s home into the container
 702           The ubuntu user will not be created, and <user> will have
 703           sudo access.
 704 arch: the container architecture (e.g. amd64): defaults to host arch
 705 auth-key: SSH Public key file to inject into container
 706 packages: list of packages to add comma separated
 707 mirror,security-mirror: mirror for download and /etc/apt/sources.list
 708 EOF
 709     return 0
 710 }
 711
 712 options=$(getopt -o a:b:hp:r:v:n:FS:du: -l arch:,bindhome:,help,path:,release:,variant:,name:,flush-cache,auth-key:,debug,rootfs:,packages:,user:,password:,mirror:,security-mirror: -- "$@")
 713 if [ $? -ne 0 ]; then
 714     usage $(basename $0)
 715     exit 1
 716 fi
 717 eval set -- "$options"
 718
 719 release=xenial # Default to the last Ubuntu LTS release for non-Ubuntu systems
 720 if [ -f /etc/lsb-release ]; then
 721     . /etc/lsb-release
 722     if [ "$DISTRIB_ID" = "Ubuntu" ]; then
 723         release=$DISTRIB_CODENAME
 724     fi
 725 fi
 726
 727 bindhome=
 728
 729 # Code taken from debootstrap
 730 if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
 731     arch=`/usr/bin/dpkg --print-architecture`
 732 elif which udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
 733     arch=`/usr/bin/udpkg --print-architecture`
 734 else
 735     arch=$(uname -m)
 736     if [ "$arch" = "i686" ]; then
 737         arch="i386"
 738     elif [ "$arch" = "x86_64" ]; then
 739         arch="amd64"
 740     elif [ "$arch" = "armv7l" ]; then
 741         arch="armhf"
 742     elif [ "$arch" = "aarch64" ]; then
 743         arch="arm64"
 744     elif [ "$arch" = "ppc64le" ]; then
 745         arch="ppc64el"
 746     fi
 747 fi
 748
 749 debug=0
 750 hostarch=$arch
 751 flushcache=0
 752 packages=""
 753 user="ubuntu"
 754 password="ubuntu"
 755
 756 while true
 757 do
 758     case "$1" in
 759     -h|--help)      usage $0 && exit 0;;
 760     --rootfs)       rootfs=$2; shift 2;;
 761     -p|--path)      path=$2; shift 2;;
 762     -n|--name)      name=$2; shift 2;;
 763     -u|--user)      user=$2; shift 2;;
 764     --password)     password=$2; shift 2;;
 765     -F|--flush-cache) flushcache=1; shift 1;;
 766     -r|--release)   release=$2; shift 2;;
 767     -v|--variant)   variant=$2; shift 2;;
 768     --packages)     packages=$2; shift 2;;
 769     -b|--bindhome)  bindhome=$2; shift 2;;
 770     -a|--arch)      arch=$2; shift 2;;
 771     -S|--auth-key)  auth_key=$2; shift 2;;
 772     -d|--debug)     debug=1; shift 1;;
 773     --mirror)       MIRROR=$2; shift 2;;
 774     --security-mirror) SECURITY_MIRROR=$2; shift 2;;
 775     --)             shift 1; break ;;
 776         *)              break ;;
 777     esac
 778 done
 779
 780 if [ $debug -eq 1 ]; then
 781     set -x
 782 fi
 783
 784 if [ -n "$bindhome" ]; then
 785     pwd=`getent passwd $bindhome`
 786     if [ $? -ne 0 ]; then
 787         echo "Error: no password entry found for $bindhome"
 788         exit 1
 789     fi
 790 fi
 791
 792
 793 if [ "$arch" = "i686" ]; then
 794     arch=i386
 795 fi
 796
 797 if [ $hostarch = "i386" -a $arch = "amd64" ]; then
 798     echo "can't create $arch container on $hostarch"
 799     exit 1
 800 fi
 801
 802 if [ $hostarch = "armhf" -o $hostarch = "armel" -o $hostarch = "arm64" ] && \
 803    [ $arch != "armhf" -a $arch != "armel" -a $arch != "arm64" ]; then
 804     echo "can't create $arch container on $hostarch"
 805     exit 1
 806 fi
 807
 808 if [ $arch = "arm64" ] && [ $hostarch != "arm64" ]; then
 809     echo "can't create $arch container on $hostarch"
 810     exit 1
 811 fi
 812
 813 if [ $hostarch = "powerpc" -a $arch != "powerpc" ]; then
 814     echo "can't create $arch container on $hostarch"
 815     exit 1
 816 fi
 817
 818 which debootstrap >/dev/null 2>&1 || { echo "'debootstrap' command is missing" >&2; false; }
 819
 820 if [ -z "$path" ]; then
 821     echo "'path' parameter is required"
 822     exit 1
 823 fi
 824
 825 if [ "$(id -u)" != "0" ]; then
 826     echo "This script should be run as 'root'"
 827     exit 1
 828 fi
 829
 830 # detect rootfs
 831 config="$path/config"
 832 # if $rootfs exists here, it was passed in with --rootfs
 833 if [ -z "$rootfs" ]; then
 834     if grep -q '^lxc.rootfs.path' $config 2>/dev/null ; then
 835         rootfs=$(awk -F= '/^lxc.rootfs.path =/{ print $2 }' $config)
 836     else
 837         rootfs=$path/rootfs
 838     fi
 839 fi
 840
 841 install_ubuntu $rootfs $release $flushcache $LXC_CACHE_PATH
 842 if [ $? -ne 0 ]; then
 843     echo "failed to install ubuntu $release"
 844     exit 1
 845 fi
 846
 847 configure_ubuntu $rootfs $name $release $user $password
 848 if [ $? -ne 0 ]; then
 849     echo "failed to configure ubuntu $release for a container"
 850     exit 1
 851 fi
 852
 853 copy_configuration $path $rootfs $name $arch $release
 854 if [ $? -ne 0 ]; then
 855     echo "failed write configuration file"
 856     exit 1
 857 fi
 858
 859 post_process $rootfs $release $trim_container $packages
 860
 861 if [ -n "$bindhome" ]; then
 862     do_bindhome $rootfs $bindhome
 863     finalize_user $bindhome
 864 else
 865     finalize_user $user
 866 fi
 867
 868 echo ""
 869 echo "##"
 870 if [ -n "$bindhome" ]; then
 871     echo "# Log in as user $bindhome"
 872 else
 873     echo "# The default user is '$user' with password '$password'!"
 874     echo "# Use the 'sudo' command to run tasks as root in the container."
 875 fi
 876 echo "##"
 877 echo ""