templates/lxc-ubuntu.in

   1 #!/bin/bash
   2
   3 #
   4 # template script for generating ubuntu container for LXC
   5 #
   6 # This script consolidates and extends the existing lxc ubuntu scripts
   7 #
   8
   9 # Copyright © 2011 Serge Hallyn <serge.hallyn@canonical.com>
  10 # Copyright © 2010 Wilhelm Meier
  11 # Author: Wilhelm Meier <wilhelm.meier@fh-kl.de>
  12 #
  13 #  This library is free software; you can redistribute it and/or
  14 #  modify it under the terms of the GNU Lesser General Public
  15 #  License as published by the Free Software Foundation; either
  16 #  version 2.1 of the License, or (at your option) any later version.
  17
  18 #  This library is distributed in the hope that it will be useful,
  19 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  21 #  Lesser General Public License for more details.
  22
  23 #  You should have received a copy of the GNU Lesser General Public
  24 #  License along with this library; if not, write to the Free Software
  25 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  26
  27 set -e
  28
  29 if [ -r /etc/default/lxc ]; then
  30     . /etc/default/lxc
  31 fi
  32
  33 configure_ubuntu()
  34 {
  35     rootfs=$1
  36     hostname=$2
  37     release=$3
  38
  39     # configure the network using the dhcp
  40     cat <<EOF > $rootfs/etc/network/interfaces
  41 # This file describes the network interfaces available on your system
  42 # and how to activate them. For more information, see interfaces(5).
  43
  44 # The loopback network interface
  45 auto lo
  46 iface lo inet loopback
  47
  48 auto eth0
  49 iface eth0 inet dhcp
  50 EOF
  51
  52     # set the hostname
  53     cat <<EOF > $rootfs/etc/hostname
  54 $hostname
  55 EOF
  56     # set minimal hosts
  57     cat <<EOF > $rootfs/etc/hosts
  58 127.0.0.1   localhost
  59 127.0.1.1   $hostname
  60
  61 # The following lines are desirable for IPv6 capable hosts
  62 ::1     ip6-localhost ip6-loopback
  63 fe00::0 ip6-localnet
  64 ff00::0 ip6-mcastprefix
  65 ff02::1 ip6-allnodes
  66 ff02::2 ip6-allrouters
  67 EOF
  68
  69     if [ ! -f $rootfs/etc/init/container-detect.conf ]; then
  70         # suppress log level output for udev
  71         sed -i "s/=\"err\"/=0/" $rootfs/etc/udev/udev.conf
  72
  73         # remove jobs for consoles 5 and 6 since we only create 4 consoles in
  74         # this template
  75         rm -f $rootfs/etc/init/tty{5,6}.conf
  76     fi
  77
  78     if [ -z "$bindhome" ]; then
  79         chroot $rootfs useradd --create-home -s /bin/bash ubuntu
  80         echo "ubuntu:ubuntu" | chroot $rootfs chpasswd
  81     fi
  82
  83     # make sure we have the current locale defined in the container
  84     if [ -z "$LANG" ] || echo $LANG | grep -E -q "^C(\..+)*$"; then
  85         chroot $rootfs locale-gen en_US.UTF-8
  86         chroot $rootfs update-locale LANG=en_US.UTF-8
  87     else
  88         chroot $rootfs locale-gen $LANG
  89         chroot $rootfs update-locale LANG=$LANG
  90     fi
  91
  92     # generate new SSH keys
  93     if [ -x $rootfs@LOCALSTATEDIR@/lib/dpkg/info/openssh-server.postinst ]; then
  94         cat > $rootfs/usr/sbin/policy-rc.d << EOF
  95 #!/bin/sh
  96 exit 101
  97 EOF
  98         chmod +x $rootfs/usr/sbin/policy-rc.d
  99
 100         rm -f $rootfs/etc/ssh/ssh_host_*key*
 101         mv $rootfs/etc/init/ssh.conf $rootfs/etc/init/ssh.conf.disabled
 102         DPKG_MAINTSCRIPT_PACKAGE=openssh DPKG_MAINTSCRIPT_NAME=postinst chroot $rootfs @LOCALSTATEDIR@/lib/dpkg/info/openssh-server.postinst configure
 103         mv $rootfs/etc/init/ssh.conf.disabled $rootfs/etc/init/ssh.conf
 104
 105         rm -f $rootfs/usr/sbin/policy-rc.d
 106     fi
 107
 108     return 0
 109 }
 110
 111 # finish setting up the user in the container by injecting ssh key and
 112 # adding sudo group membership.
 113 # passed-in user is either 'ubuntu' or the user to bind in from host.
 114 finalize_user()
 115 {
 116     user=$1
 117
 118     sudo_version=$(chroot $rootfs dpkg-query -W -f='${Version}' sudo)
 119
 120     if chroot $rootfs dpkg --compare-versions $sudo_version gt "1.8.3p1-1"; then
 121         groups="sudo"
 122     else
 123         groups="sudo admin"
 124     fi
 125
 126     for group in $groups; do
 127         chroot $rootfs groupadd --system $group >/dev/null 2>&1 || true
 128         chroot $rootfs adduser ${user} $group >/dev/null 2>&1 || true
 129     done
 130
 131     if [ -n "$auth_key" -a -f "$auth_key" ]; then
 132         u_path="/home/${user}/.ssh"
 133         root_u_path="$rootfs/$u_path"
 134         mkdir -p $root_u_path
 135         cp $auth_key "$root_u_path/authorized_keys"
 136         chroot $rootfs chown -R ${user}: "$u_path"
 137
 138         echo "Inserted SSH public key from $auth_key into /home/${user}/.ssh/authorized_keys"
 139     fi
 140     return 0
 141 }
 142
 143 #
 144 # Choose proxies for container
 145 # http_proxy will be used by debootstrap on the host.
 146 # APT_PROXY will be used to set /etc/apt/apt.conf.d/70proxy in the container.
 147 #
 148 choose_container_proxy()
 149 {
 150     local rootfs=$1
 151     local arch=$2
 152
 153     if [ -z "$HTTP_PROXY" ]; then
 154         HTTP_PROXY="none"
 155     fi
 156     case "$HTTP_PROXY" in
 157     none)
 158         APT_PROXY=
 159         ;;
 160     apt)
 161         RES=`apt-config shell APT_PROXY Acquire::http::Proxy`
 162         eval $RES
 163         [ -z "$APT_PROXY" ] || export http_proxy=$APT_PROXY
 164         ;;
 165     *)
 166         APT_PROXY=$HTTP_PROXY
 167         export http_proxy=$HTTP_PROXY
 168         ;;
 169     esac
 170 }
 171
 172 write_sourceslist()
 173 {
 174     # $1 => path to the rootfs
 175     # $2 => architecture we want to add
 176     # $3 => whether to use the multi-arch syntax or not
 177
 178     if [ -n "$APT_PROXY" ]; then
 179         mkdir -p $rootfs/etc/apt/apt.conf.d
 180         cat > $rootfs/etc/apt/apt.conf.d/70proxy << EOF
 181 Acquire::http::Proxy "$APT_PROXY" ;
 182 EOF
 183     fi
 184
 185     case $2 in
 186       amd64|i386)
 187             MIRROR=${MIRROR:-http://archive.ubuntu.com/ubuntu}
 188             SECURITY_MIRROR=${SECURITY_MIRROR:-http://security.ubuntu.com/ubuntu}
 189             ;;
 190       *)
 191             MIRROR=${MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 192             SECURITY_MIRROR=${SECURITY_MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
 193             ;;
 194     esac
 195     if [ -n "$3" ]; then
 196         cat >> "$1/etc/apt/sources.list" << EOF
 197 deb [arch=$2] $MIRROR ${release} main restricted universe multiverse
 198 deb [arch=$2] $MIRROR ${release}-updates main restricted universe multiverse
 199 deb [arch=$2] $SECURITY_MIRROR ${release}-security main restricted universe multiverse
 200 EOF
 201     else
 202         cat >> "$1/etc/apt/sources.list" << EOF
 203 deb $MIRROR ${release} main restricted universe multiverse
 204 deb $MIRROR ${release}-updates main restricted universe multiverse
 205 deb $SECURITY_MIRROR ${release}-security main restricted universe multiverse
 206 EOF
 207     fi
 208 }
 209
 210 cleanup()
 211 {
 212     rm -rf $cache/partial-$arch
 213     rm -rf $cache/rootfs-$arch
 214 }
 215
 216 suggest_flush()
 217 {
 218     echo "Container upgrade failed.  The container cache may be out of date,"
 219     echo "in which case flushing the case (see -F in the hep output) may help."
 220 }
 221
 222 download_ubuntu()
 223 {
 224     cache=$1
 225     arch=$2
 226     release=$3
 227
 228     packages=vim,ssh
 229
 230     # Try to guess a list of langpacks to install
 231     langpacks="language-pack-en"
 232
 233     if which dpkg >/dev/null 2>&1; then
 234         langpacks=`(echo $langpacks &&
 235                     dpkg -l | grep -E "^ii  language-pack-[a-z]* " |
 236                         cut -d ' ' -f3) | sort -u`
 237     fi
 238     packages="$packages,$(echo $langpacks | sed 's/ /,/g')"
 239
 240
 241     echo "installing packages: $packages"
 242
 243     trap cleanup EXIT SIGHUP SIGINT SIGTERM
 244     # check the mini ubuntu was not already downloaded
 245     mkdir -p "$cache/partial-$arch"
 246     if [ $? -ne 0 ]; then
 247         echo "Failed to create '$cache/partial-$arch' directory"
 248         return 1
 249     fi
 250
 251     choose_container_proxy $cache/partial-$arch/ $arch
 252     # download a mini ubuntu into a cache
 253     echo "Downloading ubuntu $release minimal ..."
 254     if [ -n "$(which qemu-debootstrap)" ]; then
 255         qemu-debootstrap --verbose --components=main,universe --arch=$arch --include=$packages $release $cache/partial-$arch $MIRROR
 256     else
 257         debootstrap --verbose --components=main,universe --arch=$arch --include=$packages $release $cache/partial-$arch $MIRROR
 258     fi
 259
 260     if [ $? -ne 0 ]; then
 261         echo "Failed to download the rootfs, aborting."
 262             return 1
 263     fi
 264
 265     # Serge isn't sure whether we should avoid doing this when
 266     # $release == `distro-info -d`
 267     echo "Installing updates"
 268     > $cache/partial-$arch/etc/apt/sources.list
 269     write_sourceslist $cache/partial-$arch/ $arch
 270
 271     chroot "$1/partial-${arch}" apt-get update
 272     if [ $? -ne 0 ]; then
 273         echo "Failed to update the apt cache"
 274         return 1
 275     fi
 276     cat > "$1/partial-${arch}"/usr/sbin/policy-rc.d << EOF
 277 #!/bin/sh
 278 exit 101
 279 EOF
 280     chmod +x "$1/partial-${arch}"/usr/sbin/policy-rc.d
 281
 282     lxc-unshare -s MOUNT -- chroot "$1/partial-${arch}" apt-get dist-upgrade -y || { suggest_flush; false; }
 283     rm -f "$1/partial-${arch}"/usr/sbin/policy-rc.d
 284
 285     chroot "$1/partial-${arch}" apt-get clean
 286
 287     mv "$1/partial-$arch" "$1/rootfs-$arch"
 288     trap EXIT
 289     trap SIGINT
 290     trap SIGTERM
 291     trap SIGHUP
 292     echo "Download complete"
 293     return 0
 294 }
 295
 296 copy_ubuntu()
 297 {
 298     cache=$1
 299     arch=$2
 300     rootfs=$3
 301
 302     # make a local copy of the miniubuntu
 303     echo "Copying rootfs to $rootfs ..."
 304     mkdir -p $rootfs
 305     rsync -Ha $cache/rootfs-$arch/ $rootfs/ || return 1
 306     return 0
 307 }
 308
 309 install_ubuntu()
 310 {
 311     rootfs=$1
 312     release=$2
 313     flushcache=$3
 314     cache="@LOCALSTATEDIR@/cache/lxc/$release"
 315     mkdir -p @LOCALSTATEDIR@/lock/subsys/
 316
 317     (
 318         flock -x 200
 319         if [ $? -ne 0 ]; then
 320             echo "Cache repository is busy."
 321             return 1
 322         fi
 323
 324
 325         if [ $flushcache -eq 1 ]; then
 326             echo "Flushing cache..."
 327             rm -rf "$cache/partial-$arch"
 328             rm -rf "$cache/rootfs-$arch"
 329         fi
 330
 331         echo "Checking cache download in $cache/rootfs-$arch ... "
 332         if [ ! -e "$cache/rootfs-$arch" ]; then
 333             download_ubuntu $cache $arch $release
 334             if [ $? -ne 0 ]; then
 335                 echo "Failed to download 'ubuntu $release base'"
 336                 return 1
 337             fi
 338         fi
 339
 340         echo "Copy $cache/rootfs-$arch to $rootfs ... "
 341         copy_ubuntu $cache $arch $rootfs
 342         if [ $? -ne 0 ]; then
 343             echo "Failed to copy rootfs"
 344             return 1
 345         fi
 346
 347         return 0
 348
 349     ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-ubuntu
 350
 351     return $?
 352 }
 353
 354 copy_configuration()
 355 {
 356     path=$1
 357     rootfs=$2
 358     name=$3
 359     arch=$4
 360     release=$5
 361
 362     if [ $arch = "i386" ]; then
 363         arch="i686"
 364     fi
 365
 366     ttydir=""
 367     if [ -f $rootfs/etc/init/container-detect.conf ]; then
 368         ttydir=" lxc"
 369     fi
 370
 371     # if there is exactly one veth network entry, make sure it has an
 372     # associated hwaddr.
 373     nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
 374     if [ $nics -eq 1 ]; then
 375         grep -q "^lxc.network.hwaddr" $path/config || sed -i -e "/^lxc\.network\.type[ \t]*=[ \t]*veth/a lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
 376     fi
 377
 378     grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 379     cat <<EOF >> $path/config
 380 lxc.mount = $path/fstab
 381 lxc.pivotdir = lxc_putold
 382
 383 lxc.devttydir =$ttydir
 384 lxc.tty = 4
 385 lxc.pts = 1024
 386
 387 lxc.utsname = $name
 388 lxc.arch = $arch
 389 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 390
 391 # When using LXC with apparmor, uncomment the next line to run unconfined:
 392 #lxc.aa_profile = unconfined
 393
 394 # To support container nesting on an Ubuntu host, uncomment next two lines:
 395 #lxc.aa_profile = lxc-container-default-with-nesting
 396 #lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
 397
 398 lxc.cgroup.devices.deny = a
 399 # Allow any mknod (but not using the node)
 400 lxc.cgroup.devices.allow = c *:* m
 401 lxc.cgroup.devices.allow = b *:* m
 402 # /dev/null and zero
 403 lxc.cgroup.devices.allow = c 1:3 rwm
 404 lxc.cgroup.devices.allow = c 1:5 rwm
 405 # consoles
 406 lxc.cgroup.devices.allow = c 5:1 rwm
 407 lxc.cgroup.devices.allow = c 5:0 rwm
 408 # /dev/{,u}random
 409 lxc.cgroup.devices.allow = c 1:9 rwm
 410 lxc.cgroup.devices.allow = c 1:8 rwm
 411 lxc.cgroup.devices.allow = c 136:* rwm
 412 lxc.cgroup.devices.allow = c 5:2 rwm
 413 # rtc
 414 lxc.cgroup.devices.allow = c 254:0 rm
 415 # fuse
 416 lxc.cgroup.devices.allow = c 10:229 rwm
 417 # tun
 418 lxc.cgroup.devices.allow = c 10:200 rwm
 419 # full
 420 lxc.cgroup.devices.allow = c 1:7 rwm
 421 # hpet
 422 lxc.cgroup.devices.allow = c 10:228 rwm
 423 # kvm
 424 lxc.cgroup.devices.allow = c 10:232 rwm
 425 EOF
 426
 427     cat <<EOF > $path/fstab
 428 proc            proc         proc    nodev,noexec,nosuid 0 0
 429 sysfs           sys          sysfs defaults  0 0
 430 /sys/fs/fuse/connections sys/fs/fuse/connections none bind 0 0
 431 /sys/kernel/debug sys/kernel/debug none bind 0 0
 432 /sys/kernel/security sys/kernel/security none bind 0 0
 433 EOF
 434
 435     if [ $? -ne 0 ]; then
 436         echo "Failed to add configuration"
 437         return 1
 438     fi
 439
 440     return 0
 441 }
 442
 443 trim()
 444 {
 445     rootfs=$1
 446     release=$2
 447
 448     # provide the lxc service
 449     cat <<EOF > $rootfs/etc/init/lxc.conf
 450 # fake some events needed for correct startup other services
 451
 452 description     "Container Upstart"
 453
 454 start on startup
 455
 456 script
 457         rm -rf /var/run/*.pid
 458         rm -rf /var/run/network/*
 459         /sbin/initctl emit stopped JOB=udevtrigger --no-wait
 460         /sbin/initctl emit started JOB=udev --no-wait
 461 end script
 462 EOF
 463
 464     # fix buggus runlevel with sshd
 465     cat <<EOF > $rootfs/etc/init/ssh.conf
 466 # ssh - OpenBSD Secure Shell server
 467 #
 468 # The OpenSSH server provides secure shell access to the system.
 469
 470 description     "OpenSSH server"
 471
 472 start on filesystem
 473 stop on runlevel [!2345]
 474
 475 expect fork
 476 respawn
 477 respawn limit 10 5
 478 umask 022
 479 # replaces SSHD_OOM_ADJUST in /etc/default/ssh
 480 oom never
 481
 482 pre-start script
 483     test -x /usr/sbin/sshd || { stop; exit 0; }
 484     test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; }
 485     test -c /dev/null || { stop; exit 0; }
 486
 487     mkdir -p -m0755 /var/run/sshd
 488 end script
 489
 490 # if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
 491 # 'exec' line here instead
 492 exec /usr/sbin/sshd
 493 EOF
 494
 495     cat <<EOF > $rootfs/etc/init/console.conf
 496 # console - getty
 497 #
 498 # This service maintains a console on tty1 from the point the system is
 499 # started until it is shut down again.
 500
 501 start on stopped rc RUNLEVEL=[2345]
 502 stop on runlevel [!2345]
 503
 504 respawn
 505 exec /sbin/getty -8 38400 /dev/console
 506 EOF
 507
 508     cat <<EOF > $rootfs/lib/init/fstab
 509 # /lib/init/fstab: cleared out for bare-bones lxc
 510 EOF
 511
 512     # remove pointless services in a container
 513     chroot $rootfs /usr/sbin/update-rc.d -f ondemand remove
 514
 515     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls u*.conf); do mv $f $f.orig; done'
 516     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls tty[2-9].conf); do mv $f $f.orig; done'
 517     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls plymouth*.conf); do mv $f $f.orig; done'
 518     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls hwclock*.conf); do mv $f $f.orig; done'
 519     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls module*.conf); do mv $f $f.orig; done'
 520
 521     # if this isn't lucid, then we need to twiddle the network upstart bits :(
 522     if [ $release != "lucid" ]; then
 523         sed -i 's/^.*emission handled.*$/echo Emitting lo/' $rootfs/etc/network/if-up.d/upstart
 524     fi
 525 }
 526
 527 post_process()
 528 {
 529     rootfs=$1
 530     release=$2
 531     trim_container=$3
 532
 533     if [ $trim_container -eq 1 ]; then
 534         trim $rootfs $release
 535     elif [ ! -f $rootfs/etc/init/container-detect.conf ]; then
 536         # Make sure we have a working resolv.conf
 537         cresolvonf="${rootfs}/etc/resolv.conf"
 538         mv $cresolvonf ${cresolvonf}.lxcbak
 539         cat /etc/resolv.conf > ${cresolvonf}
 540
 541         # for lucid, if not trimming, then add the ubuntu-virt
 542         # ppa and install lxcguest
 543         if [ $release = "lucid" ]; then
 544             chroot $rootfs apt-get update
 545             chroot $rootfs apt-get install --force-yes -y python-software-properties
 546             chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa
 547         fi
 548
 549         chroot $rootfs apt-get update
 550         chroot $rootfs apt-get install --force-yes -y lxcguest
 551
 552         # Restore old resolv.conf
 553         rm -f ${cresolvonf}
 554         mv ${cresolvonf}.lxcbak ${cresolvonf}
 555     fi
 556
 557     # If the container isn't running a native architecture, setup multiarch
 558     if [ -x "$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)" ]; then
 559         dpkg_version=$(chroot $rootfs dpkg-query -W -f='${Version}' dpkg)
 560         if chroot $rootfs dpkg --compare-versions $dpkg_version ge "1.16.2"; then
 561             chroot $rootfs dpkg --add-architecture ${hostarch}
 562         else
 563             mkdir -p ${rootfs}/etc/dpkg/dpkg.cfg.d
 564             echo "foreign-architecture ${hostarch}" > ${rootfs}/etc/dpkg/dpkg.cfg.d/lxc-multiarch
 565         fi
 566
 567         # Save existing value of MIRROR and SECURITY_MIRROR
 568         DEFAULT_MIRROR=$MIRROR
 569         DEFAULT_SECURITY_MIRROR=$SECURITY_MIRROR
 570
 571         # Write a new sources.list containing both native and multiarch entries
 572         > ${rootfs}/etc/apt/sources.list
 573         write_sourceslist $rootfs $arch "native"
 574
 575         MIRROR=$DEFAULT_MIRROR
 576         SECURITY_MIRROR=$DEFAULT_SECURITY_MIRROR
 577         write_sourceslist $rootfs $hostarch "multiarch"
 578
 579         # Finally update the lists and install upstart using the host architecture
 580         HOST_PACKAGES="upstart:${hostarch} mountall:${hostarch} isc-dhcp-client:${hostarch}"
 581         chroot $rootfs apt-get update
 582         if chroot $rootfs dpkg -l iproute2 | grep -q ^ii; then
 583             HOST_PACKAGES="$HOST_PACKAGES iproute2:${hostarch}"
 584         else
 585             HOST_PACKAGES="$HOST_PACKAGES iproute:${hostarch}"
 586         fi
 587         chroot $rootfs apt-get install --force-yes -y --no-install-recommends $HOST_PACKAGES
 588     fi
 589
 590     # rmdir /dev/shm for containers that have /run/shm
 591     # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
 592     # get bind mounted to the host's /run/shm.  So try to rmdir
 593     # it, and in case that fails move it out of the way.
 594     if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then
 595         mv $rootfs/dev/shm $rootfs/dev/shm.bak
 596         ln -s /run/shm $rootfs/dev/shm
 597     fi
 598 }
 599
 600 do_bindhome()
 601 {
 602     rootfs=$1
 603     user=$2
 604
 605     # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
 606     pwd=`getent passwd $user` || { echo "Failed to copy password entry for $user"; false; }
 607     echo $pwd >> $rootfs/etc/passwd
 608
 609     # make sure user's shell exists in the container
 610     shell=`echo $pwd | cut -d: -f 7`
 611     if [ ! -x $rootfs/$shell ]; then
 612         echo "shell $shell for user $user was not found in the container."
 613         pkg=`dpkg -S $(readlink -m $shell) | cut -d ':' -f1`
 614         echo "Installing $pkg"
 615         chroot $rootfs apt-get --force-yes -y install $pkg
 616     fi
 617
 618     shad=`getent shadow $user`
 619     echo "$shad" >> $rootfs/etc/shadow
 620
 621     # bind-mount the user's path into the container's /home
 622     h=`getent passwd $user | cut -d: -f 6`
 623     mkdir -p $rootfs/$h
 624
 625     # use relative path in container
 626     h2=${h#/}
 627     while [ ${h2:0:1} = "/" ]; do
 628         h2=${h2#/}
 629     done
 630     echo "$h $h2 none bind 0 0" >> $path/fstab
 631
 632     # Make sure the group exists in container
 633     grp=`echo $pwd | cut -d: -f 4`  # group number for $user
 634     grpe=`getent group $grp` || return 0  # if host doesn't define grp, ignore in container
 635     chroot $rootfs getent group "$grpe" || echo "$grpe" >> $rootfs/etc/group
 636 }
 637
 638 usage()
 639 {
 640     cat <<EOF
 641 $1 -h|--help [-a|--arch] [-b|--bindhome <user>] [--trim] [-d|--debug]
 642    [-F | --flush-cache] [-r|--release <release>] [ -S | --auth-key <keyfile>]
 643    [--rootfs <rootfs>]
 644 release: the ubuntu release (e.g. precise): defaults to host release on ubuntu, otherwise uses latest LTS
 645 trim: make a minimal (faster, but not upgrade-safe) container
 646 bindhome: bind <user>'s home into the container
 647           The ubuntu user will not be created, and <user> will have
 648           sudo access.
 649 arch: the container architecture (e.g. amd64): defaults to host arch
 650 auth-key: SSH Public key file to inject into container
 651 EOF
 652     return 0
 653 }
 654
 655 options=$(getopt -o a:b:hp:r:xn:FS:d -l arch:,bindhome:,help,path:,release:,trim,name:,flush-cache,auth-key:,debug,rootfs: -- "$@")
 656 if [ $? -ne 0 ]; then
 657     usage $(basename $0)
 658     exit 1
 659 fi
 660 eval set -- "$options"
 661
 662 release=precise # Default to the last Ubuntu LTS release for non-Ubuntu systems
 663 if [ -f /etc/lsb-release ]; then
 664     . /etc/lsb-release
 665     if [ "$DISTRIB_ID" = "Ubuntu" ]; then
 666         release=$DISTRIB_CODENAME
 667     fi
 668 fi
 669
 670 bindhome=
 671
 672 # Code taken from debootstrap
 673 if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
 674     arch=`/usr/bin/dpkg --print-architecture`
 675 elif which udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
 676     arch=`/usr/bin/udpkg --print-architecture`
 677 else
 678     arch=$(uname -m)
 679     if [ "$arch" = "i686" ]; then
 680         arch="i386"
 681     elif [ "$arch" = "x86_64" ]; then
 682         arch="amd64"
 683     elif [ "$arch" = "armv7l" ]; then
 684         arch="armhf"
 685     fi
 686 fi
 687
 688 debug=0
 689 trim_container=0
 690 hostarch=$arch
 691 flushcache=0
 692 while true
 693 do
 694     case "$1" in
 695     -h|--help)      usage $0 && exit 0;;
 696     --rootfs)       rootfs=$2; shift 2;;
 697     -p|--path)      path=$2; shift 2;;
 698     -n|--name)      name=$2; shift 2;;
 699     -F|--flush-cache) flushcache=1; shift 1;;
 700     -r|--release)   release=$2; shift 2;;
 701     -b|--bindhome)  bindhome=$2; shift 2;;
 702     -a|--arch)      arch=$2; shift 2;;
 703     -x|--trim)      trim_container=1; shift 1;;
 704     -S|--auth-key)  auth_key=$2; shift 2;;
 705     -d|--debug)     debug=1; shift 1;;
 706     --)             shift 1; break ;;
 707         *)              break ;;
 708     esac
 709 done
 710
 711 if [ $debug -eq 1 ]; then
 712     set -x
 713 fi
 714
 715 if [ -n "$bindhome" ]; then
 716     pwd=`getent passwd $bindhome`
 717     if [ $? -ne 0 ]; then
 718         echo "Error: no password entry found for $bindhome"
 719         exit 1
 720     fi
 721 fi
 722
 723
 724 if [ "$arch" == "i686" ]; then
 725     arch=i386
 726 fi
 727
 728 if [ $hostarch = "i386" -a $arch = "amd64" ]; then
 729     echo "can't create $arch container on $hostarch"
 730     exit 1
 731 fi
 732
 733 if [ $hostarch = "armhf" -o $hostarch = "armel" ] && \
 734    [ $arch != "armhf" -a $arch != "armel" ]; then
 735     echo "can't create $arch container on $hostarch"
 736     exit 1
 737 fi
 738
 739 if [ $hostarch = "powerpc" -a $arch != "powerpc" ]; then
 740     echo "can't create $arch container on $hostarch"
 741     exit 1
 742 fi
 743
 744 which debootstrap >/dev/null 2>&1 || { echo "'debootstrap' command is missing" >&2; false; }
 745
 746 if [ -z "$path" ]; then
 747     echo "'path' parameter is required"
 748     exit 1
 749 fi
 750
 751 if [ "$(id -u)" != "0" ]; then
 752     echo "This script should be run as 'root'"
 753     exit 1
 754 fi
 755
 756 # detect rootfs
 757 config="$path/config"
 758 # if $rootfs exists here, it was passed in with --rootfs
 759 if [ -z "$rootfs" ]; then
 760     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 761         rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
 762     else
 763         rootfs=$path/rootfs
 764     fi
 765 fi
 766
 767 install_ubuntu $rootfs $release $flushcache
 768 if [ $? -ne 0 ]; then
 769     echo "failed to install ubuntu $release"
 770     exit 1
 771 fi
 772
 773 configure_ubuntu $rootfs $name $release
 774 if [ $? -ne 0 ]; then
 775     echo "failed to configure ubuntu $release for a container"
 776     exit 1
 777 fi
 778
 779 copy_configuration $path $rootfs $name $arch $release
 780 if [ $? -ne 0 ]; then
 781     echo "failed write configuration file"
 782     exit 1
 783 fi
 784
 785 post_process $rootfs $release $trim_container
 786
 787 if [ -n "$bindhome" ]; then
 788     do_bindhome $rootfs $bindhome
 789     finalize_user $bindhome
 790 else
 791     finalize_user ubuntu
 792 fi
 793
 794 echo ""
 795 echo "##"
 796 if [ -n "$bindhome" ]; then
 797     echo "# Log in as user $bindhome"
 798 else
 799     echo "# The default user is 'ubuntu' with password 'ubuntu'!"
 800     echo "# Use the 'sudo' command to run tasks as root in the container."
 801 fi
 802 echo "##"
 803 echo ""