templates/lxc-ubuntu.in

   1 #!/bin/bash
   2
   3 #
   4 # template script for generating ubuntu container for LXC
   5 #
   6 # This script consolidates and extends the existing lxc ubuntu scripts
   7 #
   8
   9 # XXX todo: add -lvm option
  10
  11 # Copyright © 2011 Serge Hallyn <serge.hallyn@canonical.com>
  12 # Copyright © 2010 Wilhelm Meier
  13 # Author: Wilhelm Meier <wilhelm.meier@fh-kl.de>
  14 #
  15 # This program is free software; you can redistribute it and/or modify
  16 # it under the terms of the GNU General Public License version 2, as
  17 # published by the Free Software Foundation.
  18
  19 # This program is distributed in the hope that it will be useful,
  20 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  21 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22 # GNU General Public License for more details.
  23
  24 # You should have received a copy of the GNU General Public License along
  25 # with this program; if not, write to the Free Software Foundation, Inc.,
  26 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  27 #
  28
  29 if [ -r /etc/default/lxc ]; then
  30     . /etc/default/lxc
  31 fi
  32
  33 configure_ubuntu()
  34 {
  35     rootfs=$1
  36     hostname=$2
  37
  38    # configure the network using the dhcp
  39     cat <<EOF > $rootfs/etc/network/interfaces
  40 auto lo
  41 iface lo inet loopback
  42
  43 auto eth0
  44 iface eth0 inet dhcp
  45 EOF
  46
  47     # so you can 'ssh $hostname.' or 'ssh $hostname.local'
  48     if [ -f $rootfs/etc/dhcp/dhclient.conf ]; then
  49         sed -i "s/<hostname>/$hostname/" $rootfs/etc/dhcp/dhclient.conf
  50     elif [ -f $rootfs/etc/dhcp3/dhclient.conf ]; then
  51         sed -i "s/<hostname>/$hostname/" $rootfs/etc/dhcp3/dhclient.conf
  52     fi
  53
  54     # set the hostname
  55     cat <<EOF > $rootfs/etc/hostname
  56 $hostname
  57 EOF
  58     # set minimal hosts
  59     cat <<EOF > $rootfs/etc/hosts
  60 127.0.0.1 localhost $hostname
  61 EOF
  62
  63     # suppress log level output for udev
  64     sed -i "s/=\"err\"/=0/" $rootfs/etc/udev/udev.conf
  65
  66     # remove jobs for consoles 5 and 6 since we only create 4 consoles in
  67     # this template
  68     rm -f $rootfs/etc/init/tty{5,6}.conf
  69
  70     echo "Please change root-password !"
  71     echo "root:root" | chroot $rootfs chpasswd
  72
  73     return 0
  74 }
  75
  76 download_ubuntu()
  77 {
  78     cache=$1
  79     arch=$2
  80     release=$3
  81
  82     if [ $release = "lucid" ]; then
  83         packages=dialog,apt,apt-utils,resolvconf,iproute,inetutils-ping,vim,dhcp3-client,ssh,lsb-release,gnupg
  84     elif [ $release = "maverick" ]; then
  85         packages=dialog,apt,apt-utils,resolvconf,iproute,inetutils-ping,vim,dhcp3-client,ssh,lsb-release,gnupg,netbase
  86     elif [ $release = "natty" ]; then
  87         packages=dialog,apt,apt-utils,resolvconf,iproute,inetutils-ping,vim,isc-dhcp-client,isc-dhcp-common,ssh,lsb-release,gnupg,netbase
  88     else
  89         packages=dialog,apt,apt-utils,iproute,inetutils-ping,vim,isc-dhcp-client,isc-dhcp-common,ssh,lsb-release,gnupg,netbase,ubuntu-keyring
  90     fi
  91     echo "installing packages: $packages"
  92
  93     # check the mini ubuntu was not already downloaded
  94     mkdir -p "$cache/partial-$arch"
  95     if [ $? -ne 0 ]; then
  96         echo "Failed to create '$cache/partial-$arch' directory"
  97         return 1
  98     fi
  99
 100     # download a mini ubuntu into a cache
 101     echo "Downloading ubuntu $release minimal ..."
 102     debootstrap --verbose --components=main,universe --arch=$arch --include=$packages $release $cache/partial-$arch $MIRROR
 103     if [ $? -ne 0 ]; then
 104         echo "Failed to download the rootfs, aborting."
 105             return 1
 106     fi
 107
 108     echo "Installing updates"
 109     if [ -z "$MIRROR" ]; then
 110         MIRROR="http://archive.ubuntu.com/ubuntu"
 111     fi
 112     cat >> "$1/partial-${arch}/etc/apt/sources.list" << EOF
 113 deb $MIRROR ${release}-updates main universe
 114 deb http://security.ubuntu.com/ubuntu ${release}-security main universe
 115 EOF
 116     chroot "$1/partial-${arch}" apt-get update
 117     if [ $? -ne 0 ]; then
 118         echo "Failed to update the apt cache"
 119         return 1
 120     fi
 121     cat > "$1/partial-${arch}"/usr/sbin/policy-rc.d << EOF
 122 #!/bin/sh
 123 exit 101
 124 EOF
 125     chmod +x "$1/partial-${arch}"/usr/sbin/policy-rc.d
 126
 127     chroot "$1/partial-${arch}" apt-get dist-upgrade -y
 128     ret=$?
 129
 130     rm -f "$1/partial-${arch}"/usr/sbin/policy-rc.d
 131     if [ $ret -ne 0 ]; then
 132         echo "Failed to upgrade the cache"
 133         return 1
 134     fi
 135
 136     mv "$1/partial-$arch" "$1/rootfs-$arch"
 137     echo "Download complete"
 138     return 0
 139 }
 140
 141 copy_ubuntu()
 142 {
 143     cache=$1
 144     arch=$2
 145     rootfs=$3
 146
 147     # make a local copy of the miniubuntu
 148     echo -n "Copying rootfs to $rootfs ..."
 149     cp -a $cache/rootfs-$arch $rootfs || return 1
 150     return 0
 151 }
 152
 153 install_ubuntu()
 154 {
 155     rootfs=$1
 156     release=$2
 157     cache="/var/cache/lxc/$release"
 158     mkdir -p /var/lock/subsys/
 159     (
 160         flock -n -x 200
 161         if [ $? -ne 0 ]; then
 162             echo "Cache repository is busy."
 163             return 1
 164         fi
 165
 166
 167         echo "Checking cache download in $cache/rootfs-$arch ... "
 168         if [ ! -e "$cache/rootfs-$arch" ]; then
 169             download_ubuntu $cache $arch $release
 170             if [ $? -ne 0 ]; then
 171                 echo "Failed to download 'ubuntu $release base'"
 172                 return 1
 173             fi
 174         fi
 175
 176         echo "Copy $cache/rootfs-$arch to $rootfs ... "
 177         copy_ubuntu $cache $arch $rootfs
 178         if [ $? -ne 0 ]; then
 179             echo "Failed to copy rootfs"
 180             return 1
 181         fi
 182
 183         return 0
 184
 185         ) 200>/var/lock/subsys/lxc
 186
 187     return $?
 188 }
 189
 190 copy_configuration()
 191 {
 192     path=$1
 193     rootfs=$2
 194     name=$3
 195     arch=$4
 196
 197     if [ $arch = "i386" ]; then
 198         arch="i686"
 199     fi
 200
 201     cat <<EOF >> $path/config
 202 lxc.utsname = $name
 203
 204 lxc.tty = 4
 205 lxc.pts = 1024
 206 lxc.rootfs = $rootfs
 207 lxc.mount  = $path/fstab
 208 lxc.arch = $arch
 209 lxc.cap.drop = sys_module
 210
 211 lxc.cgroup.devices.deny = a
 212 # Allow any mknod (but not using the node)
 213 lxc.cgroup.devices.allow = c *:* m
 214 lxc.cgroup.devices.allow = b *:* m
 215 # /dev/null and zero
 216 lxc.cgroup.devices.allow = c 1:3 rwm
 217 lxc.cgroup.devices.allow = c 1:5 rwm
 218 # consoles
 219 lxc.cgroup.devices.allow = c 5:1 rwm
 220 lxc.cgroup.devices.allow = c 5:0 rwm
 221 #lxc.cgroup.devices.allow = c 4:0 rwm
 222 #lxc.cgroup.devices.allow = c 4:1 rwm
 223 # /dev/{,u}random
 224 lxc.cgroup.devices.allow = c 1:9 rwm
 225 lxc.cgroup.devices.allow = c 1:8 rwm
 226 lxc.cgroup.devices.allow = c 136:* rwm
 227 lxc.cgroup.devices.allow = c 5:2 rwm
 228 # rtc
 229 lxc.cgroup.devices.allow = c 254:0 rwm
 230 #fuse
 231 lxc.cgroup.devices.allow = c 10:229 rwm
 232 #tun
 233 lxc.cgroup.devices.allow = c 10:200 rwm
 234 EOF
 235
 236     cat <<EOF > $path/fstab
 237 proc            $rootfs/proc         proc    nodev,noexec,nosuid 0 0
 238 sysfs           $rootfs/sys          sysfs defaults  0 0
 239 EOF
 240
 241     if [ $? -ne 0 ]; then
 242         echo "Failed to add configuration"
 243         return 1
 244     fi
 245
 246     return 0
 247 }
 248
 249 trim()
 250 {
 251     rootfs=$1
 252     release=$2
 253
 254     # provide the lxc service
 255     cat <<EOF > $rootfs/etc/init/lxc.conf
 256 # fake some events needed for correct startup other services
 257
 258 description     "Container Upstart"
 259
 260 start on startup
 261
 262 script
 263         rm -rf /var/run/*.pid
 264         rm -rf /var/run/network/*
 265         /sbin/initctl emit stopped JOB=udevtrigger --no-wait
 266         /sbin/initctl emit started JOB=udev --no-wait
 267 end script
 268 EOF
 269
 270     # fix buggus runlevel with sshd
 271     cat <<EOF > $rootfs/etc/init/ssh.conf
 272 # ssh - OpenBSD Secure Shell server
 273 #
 274 # The OpenSSH server provides secure shell access to the system.
 275
 276 description     "OpenSSH server"
 277
 278 start on filesystem
 279 stop on runlevel [!2345]
 280
 281 expect fork
 282 respawn
 283 respawn limit 10 5
 284 umask 022
 285 # replaces SSHD_OOM_ADJUST in /etc/default/ssh
 286 oom never
 287
 288 pre-start script
 289     test -x /usr/sbin/sshd || { stop; exit 0; }
 290     test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; }
 291     test -c /dev/null || { stop; exit 0; }
 292
 293     mkdir -p -m0755 /var/run/sshd
 294 end script
 295
 296 # if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
 297 # 'exec' line here instead
 298 exec /usr/sbin/sshd
 299 EOF
 300
 301     cat <<EOF > $rootfs/etc/init/console.conf
 302 # console - getty
 303 #
 304 # This service maintains a console on tty1 from the point the system is
 305 # started until it is shut down again.
 306
 307 start on stopped rc RUNLEVEL=[2345]
 308 stop on runlevel [!2345]
 309
 310 respawn
 311 exec /sbin/getty -8 38400 /dev/console
 312 EOF
 313
 314     cat <<EOF > $rootfs/lib/init/fstab
 315 # /lib/init/fstab: cleared out for bare-bones lxc
 316 EOF
 317
 318     # reconfigure some services
 319     if [ -z "$LANG" ]; then
 320         chroot $rootfs locale-gen en_US.UTF-8
 321         chroot $rootfs update-locale LANG=en_US.UTF-8
 322     else
 323         chroot $rootfs locale-gen $LANG
 324         chroot $rootfs update-locale LANG=$LANG
 325     fi
 326
 327     # remove pointless services in a container
 328     chroot $rootfs /usr/sbin/update-rc.d -f ondemand remove
 329
 330     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls u*.conf); do mv $f $f.orig; done'
 331     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls tty[2-9].conf); do mv $f $f.orig; done'
 332     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls plymouth*.conf); do mv $f $f.orig; done'
 333     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls hwclock*.conf); do mv $f $f.orig; done'
 334     chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls module*.conf); do mv $f $f.orig; done'
 335
 336     # if this isn't lucid, then we need to twiddle the network upstart bits :(
 337     if [ $release != "lucid" ]; then
 338         sed -i 's/^.*emission handled.*$/echo Emitting lo/' $rootfs/etc/network/if-up.d/upstart
 339     fi
 340 }
 341
 342 post_process()
 343 {
 344     rootfs=$1
 345     release=$2
 346     trim_container=$3
 347
 348     if [ $trim_container -eq 1 ]; then
 349         trim $rootfs $release
 350     else
 351         # for lucid and maverick, if not trimming, then add the ubuntu-virt
 352         # ppa and install lxcguest
 353         if [ $release = "lucid" -o $release = "maverick" ]; then
 354             chroot $rootfs apt-get install --force-yes -y python-software-properties
 355             chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa
 356             chroot $rootfs apt-get update
 357         fi
 358         chroot $rootfs apt-get install --force-yes -y lxcguest
 359     fi
 360 }
 361
 362 do_bindhome()
 363 {
 364     rootfs=$1
 365     user=$2
 366
 367     # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
 368     pwd=`getent passwd $user`
 369     if [ $? -ne 0 ]; then
 370         echo 'Warning: failed to copy password entry for $user'
 371         return
 372     else
 373         echo $pwd >> $rootfs/etc/passwd
 374     fi
 375     shad=`getent shadow $user`
 376     echo $shad >> $rootfs/etc/shadow
 377
 378     # bind-mount the user's path into the container's /home
 379     h=`getent passwd $user | cut -d: -f 6`
 380     mkdir -p $rootfs/$h
 381     echo "$h $rootfs/$h none bind 0 0" >> $path/fstab
 382 }
 383
 384 clean()
 385 {
 386     release=$1
 387     cache="/var/cache/lxc/$release"
 388
 389     if [ ! -e $cache ]; then
 390         exit 0
 391     fi
 392
 393     # lock, so we won't purge while someone is creating a repository
 394     (
 395         flock -n -x 200
 396         if [ $? != 0 ]; then
 397             echo "Cache repository is busy."
 398             exit 1
 399         fi
 400
 401         echo -n "Purging the download cache..."
 402         rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
 403         exit 0
 404
 405     ) 200>/var/lock/subsys/lxc
 406 }
 407
 408 usage()
 409 {
 410     cat <<EOF
 411 $1 -h|--help -p|--path=<path> --clean [-a|--arch] [-b|--bindhome <user>] [--trim] [-r|--release]
 412 release: lucid | maverick | natty | oneiric | precise
 413 trim: make a minimal (faster, but not upgrade-safe) container
 414 bindhome: bind <user>'s home into the container
 415 arch: amd64 or i386: defaults to host arch
 416 EOF
 417     return 0
 418 }
 419
 420 options=$(getopt -o a:b:hp:r:xn:c -l arch:,bindhome:,help,path:,release:,trim,name:,clean -- "$@")
 421 if [ $? -ne 0 ]; then
 422     usage $(basename $0)
 423     exit 1
 424 fi
 425 eval set -- "$options"
 426
 427 release=lucid
 428 if [ -f /etc/lsb-release ]; then
 429     . /etc/lsb-release
 430     case "$DISTRIB_CODENAME" in
 431         lucid|maverick|natty|oneiric|precise)
 432             release=$DISTRIB_CODENAME
 433         ;;
 434     esac
 435 fi
 436
 437 bindhome=
 438 arch=$(arch)
 439
 440 # Code taken from debootstrap
 441 if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
 442     arch=`/usr/bin/dpkg --print-architecture`
 443 elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
 444     arch=`/usr/bin/udpkg --print-architecture`
 445 else
 446     arch=$(arch)
 447     if [ "$arch" = "i686" ]; then
 448         arch="i386"
 449     elif [ "$arch" = "x86_64" ]; then
 450         arch="amd64"
 451     elif [ "$arch" = "armv7l" ]; then
 452         arch="armel"
 453     fi
 454 fi
 455
 456 trim_container=0
 457 hostarch=$arch
 458 while true
 459 do
 460     case "$1" in
 461     -h|--help)      usage $0 && exit 0;;
 462     -p|--path)      path=$2; shift 2;;
 463     -n|--name)      name=$2; shift 2;;
 464     -c|--clean)     clean=$2; shift 2;;
 465     -r|--release)   release=$2; shift 2;;
 466     -b|--bindhome)  bindhome=$2; shift 2;;
 467     -a|--arch)      arch=$2; shift 2;;
 468     -x|--trim)      trim_container=1; shift 1;;
 469     --)             shift 1; break ;;
 470         *)              break ;;
 471     esac
 472 done
 473
 474 pwd=`getent passwd $bindhome`
 475 if [ $? -ne 0 ]; then
 476     echo "Error: no password entry found for $bindhome"
 477     exit 1
 478 fi
 479
 480
 481 if [ "$arch" == "i686" ]; then
 482     arch=i386
 483 fi
 484
 485 if [ ! -z "$clean" -a -z "$path" ]; then
 486     clean || exit 1
 487     exit 0
 488 fi
 489
 490 if [ $hostarch = "i386" -a $arch = "amd64" ]; then
 491     echo "can't create amd64 container on i386"
 492     exit 1
 493 fi
 494
 495 type debootstrap
 496 if [ $? -ne 0 ]; then
 497     echo "'debootstrap' command is missing"
 498     exit 1
 499 fi
 500
 501 if [ -z "$path" ]; then
 502     echo "'path' parameter is required"
 503     exit 1
 504 fi
 505
 506 if [ "$(id -u)" != "0" ]; then
 507     echo "This script should be run as 'root'"
 508     exit 1
 509 fi
 510
 511 rootfs=$path/rootfs
 512
 513 install_ubuntu $rootfs $release
 514 if [ $? -ne 0 ]; then
 515     echo "failed to install ubuntu $release"
 516     exit 1
 517 fi
 518
 519 configure_ubuntu $rootfs $name
 520 if [ $? -ne 0 ]; then
 521     echo "failed to configure ubuntu $release for a container"
 522     exit 1
 523 fi
 524
 525 copy_configuration $path $rootfs $name $arch
 526 if [ $? -ne 0 ]; then
 527     echo "failed write configuration file"
 528     exit 1
 529 fi
 530
 531 post_process $rootfs $release $trim_container
 532 if [ ! -z $bindhome ]; then
 533         do_bindhome $rootfs $bindhome
 534 fi
 535
 536 if [ ! -z $clean ]; then
 537     clean $release || exit 1
 538     exit 0
 539 fi