use PVE::SafeSyslog;
use PVE::Tools qw(extract_param run_command);
-use PVE::Exception qw(raise raise_param_exc);
+use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
use PVE::INotify;
use PVE::Cluster qw(cfs_read_file);
use PVE::AccessControl;
+use PVE::Firewall;
use PVE::Storage;
use PVE::RESTHandler;
use PVE::RPCEnvironment;
+use PVE::ReplicationConfig;
use PVE::LXC;
+use PVE::LXC::Create;
+use PVE::LXC::Migrate;
+use PVE::GuestHelpers;
+use PVE::API2::LXC::Config;
+use PVE::API2::LXC::Status;
+use PVE::API2::LXC::Snapshot;
use PVE::JSONSchema qw(get_standard_option);
use base qw(PVE::RESTHandler);
-use Data::Dumper; # fixme: remove
-
-my $get_container_storage = sub {
- my ($stcfg, $vmid, $lxc_conf) = @_;
-
- my $path = $lxc_conf->{'lxc.rootfs'};
- my ($vtype, $volid) = PVE::Storage::path_to_volume_id($stcfg, $path);
- my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1) if $volid;
- return wantarray ? ($sid, $volname, $path) : $sid;
-};
-
-my $check_ct_modify_config_perm = sub {
- my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
-
- return 1 if $authuser ne 'root@pam';
-
- foreach my $opt (@$key_list) {
-
- if ($opt eq 'cpus' || $opt eq 'cpuunits' || $opt eq 'cpulimit') {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
- } elsif ($opt eq 'disk') {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
- } elsif ($opt eq 'memory' || $opt eq 'swap') {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
- } elsif ($opt =~ m/^net\d+$/ || $opt eq 'nameserver' ||
- $opt eq 'searchdomain' || $opt eq 'hostname') {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
- } else {
- $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
- }
+BEGIN {
+ if (!$ENV{PVE_GENERATING_DOCS}) {
+ require PVE::HA::Env::PVE2;
+ import PVE::HA::Env::PVE2;
+ require PVE::HA::Config;
+ import PVE::HA::Config;
}
+}
+
+__PACKAGE__->register_method ({
+ subclass => "PVE::API2::LXC::Config",
+ path => '{vmid}/config',
+});
+
+__PACKAGE__->register_method ({
+ subclass => "PVE::API2::LXC::Status",
+ path => '{vmid}/status',
+});
- return 1;
-};
+__PACKAGE__->register_method ({
+ subclass => "PVE::API2::LXC::Snapshot",
+ path => '{vmid}/snapshot',
+});
+__PACKAGE__->register_method ({
+ subclass => "PVE::API2::Firewall::CT",
+ path => '{vmid}/firewall',
+});
__PACKAGE__->register_method({
- name => 'vmlist',
- path => '',
+ name => 'vmlist',
+ path => '',
method => 'GET',
description => "LXC container index (per node).",
permissions => {
type => 'array',
items => {
type => "object",
- properties => {},
+ properties => $PVE::LXC::vmstatus_return_properties,
},
links => [ { rel => 'child', href => "{vmid}" } ],
},
next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
my $data = $vmstatus->{$vmid};
- $data->{vmid} = $vmid;
push @$res, $data;
}
return $res;
-
+
}});
__PACKAGE__->register_method({
- name => 'create_vm',
- path => '',
+ name => 'create_vm',
+ path => '',
method => 'POST',
description => "Create or restore a container.",
permissions => {
proxyto => 'node',
parameters => {
additionalProperties => 0,
- properties => PVE::LXC::json_config_properties({
+ properties => PVE::LXC::Config->json_config_properties({
node => get_standard_option('pve-node'),
- vmid => get_standard_option('pve-vmid'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
ostemplate => {
description => "The OS template or backup file.",
- type => 'string',
+ type => 'string',
maxLength => 255,
+ completion => \&PVE::LXC::complete_os_templates,
},
- password => {
- optional => 1,
+ password => {
+ optional => 1,
type => 'string',
description => "Sets root password inside container.",
+ minLength => 5,
},
storage => get_standard_option('pve-storage-id', {
- description => "Target storage.",
+ description => "Default Storage.",
default => 'local',
optional => 1,
+ completion => \&PVE::Storage::complete_storage_enabled,
}),
force => {
- optional => 1,
+ optional => 1,
type => 'boolean',
description => "Allow to overwrite existing container.",
},
restore => {
- optional => 1,
+ optional => 1,
type => 'boolean',
description => "Mark this as restore task.",
},
- pool => {
+ pool => {
optional => 1,
type => 'string', format => 'pve-poolid',
description => "Add the VM to the specified pool.",
},
+ 'ignore-unpack-errors' => {
+ optional => 1,
+ type => 'boolean',
+ description => "Ignore errors when extracting the template.",
+ },
+ 'ssh-public-keys' => {
+ optional => 1,
+ type => 'string',
+ description => "Setup public SSH keys (one key per line, " .
+ "OpenSSH format).",
+ },
+ bwlimit => {
+ description => "Override i/o bandwidth limit (in KiB/s).",
+ optional => 1,
+ type => 'number',
+ minimum => '0',
+ },
+ start => {
+ optional => 1,
+ type => 'boolean',
+ default => 0,
+ description => "Start the CT after its creation finished successfully.",
+ },
}),
},
- returns => {
+ returns => {
type => 'string',
},
code => sub {
my ($param) = @_;
- my $rpcenv = PVE::RPCEnvironment::get();
+ PVE::Cluster::check_cfs_quorum();
+ my $rpcenv = PVE::RPCEnvironment::get();
my $authuser = $rpcenv->get_user();
my $node = extract_param($param, 'node');
-
my $vmid = extract_param($param, 'vmid');
+ my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
+ my $bwlimit = extract_param($param, 'bwlimit');
+ my $start_after_create = extract_param($param, 'start');
- my $basecfg_fn = PVE::LXC::config_file($vmid);
-
+ my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
my $same_container_exists = -f $basecfg_fn;
+ # 'unprivileged' is read-only, so we can't pass it to update_pct_config
+ my $unprivileged = extract_param($param, 'unprivileged');
my $restore = extract_param($param, 'restore');
+ if ($restore) {
+ # fixme: limit allowed parameters
+ }
+
my $force = extract_param($param, 'force');
if (!($same_container_exists && $restore && $force)) {
PVE::Cluster::check_vmid_unused($vmid);
+ } else {
+ die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
}
-
- my $password = extract_param($param, 'password');
- my $storage = extract_param($param, 'storage') || 'local';
+ my $password = extract_param($param, 'password');
+ my $ssh_keys = extract_param($param, 'ssh-public-keys');
+ PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
my $pool = extract_param($param, 'pool');
-
- my $storage_cfg = cfs_read_file("storage.cfg");
-
- my $scfg = PVE::Storage::storage_check_node($storage_cfg, $storage, $node);
-
- raise_param_exc({ storage => "storage '$storage' does not support container root directories"})
- if !$scfg->{content}->{rootdir};
-
- my $private = PVE::Storage::get_private_dir($storage_cfg, $storage, $vmid);
-
if (defined($pool)) {
$rpcenv->check_pool_exist($pool);
$rpcenv->check_perm_modify($authuser, "/pool/$pool");
- }
+ }
if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
# OK
raise_perm_exc();
}
- &$check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
+ my $ostemplate = extract_param($param, 'ostemplate');
+ my $storage = extract_param($param, 'storage') // 'local';
- PVE::Storage::activate_storage($storage_cfg, $storage);
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
- my $ostemplate = extract_param($param, 'ostemplate');
-
- my $archive;
+ my $storage_cfg = cfs_read_file("storage.cfg");
+ my $archive;
if ($ostemplate eq '-') {
- die "archive pipe not implemented\n"
- # $archive = '-';
+ die "pipe requires cli environment\n"
+ if $rpcenv->{type} ne 'cli';
+ die "pipe can only be used with restore tasks\n"
+ if !$restore;
+ $archive = '-';
+ die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
} else {
- $rpcenv->check_volume_access($authuser, $storage_cfg, $vmid, $ostemplate);
+ PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
$archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate);
}
- my $memory = $param->{memory} || 512;
- my $hostname = $param->{hostname} || "T$vmid";
- my $conf = {};
-
- $conf->{'lxc.utsname'} = $param->{hostname} || "CT$vmid";
- $conf->{'lxc.cgroup.memory.limit_in_bytes'} = "${memory}M";
-
- my $code = sub {
- my $temp_conf_fn = PVE::LXC::write_temp_config($vmid, $conf);
+ my %used_storages;
+ my $check_and_activate_storage = sub {
+ my ($sid) = @_;
- my $cmd = ['lxc-create', '-f', $temp_conf_fn, '-t', 'pve', '-n', $vmid,
- '--', '--archive', $archive];
+ my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
- eval { PVE::Tools::run_command($cmd); };
- my $err = $@;
+ raise_param_exc({ storage => "storage '$sid' does not support container directories"})
+ if !$scfg->{content}->{rootdir};
- unlink $temp_conf_fn;
+ $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
- die $err if $err;
+ PVE::Storage::activate_storage($storage_cfg, $sid);
+ $used_storages{$sid} = 1;
};
-
- my $realcmd = sub { PVE::LXC::lock_container($vmid, 1, $code); };
-
- return $rpcenv->fork_worker($param->{restore} ? 'vzrestore' : 'vzcreate',
- $vmid, $authuser, $realcmd);
-
- }});
-my $vm_config_perm_list = [
- 'VM.Config.Disk',
- 'VM.Config.CPU',
- 'VM.Config.Memory',
- 'VM.Config.Network',
- 'VM.Config.Options',
- ];
+ my $conf = {};
-__PACKAGE__->register_method({
- name => 'update_vm',
- path => '{vmid}/config',
- method => 'PUT',
- protected => 1,
- proxyto => 'node',
- description => "Set container options.",
- permissions => {
- check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
- },
- parameters => {
- additionalProperties => 0,
- properties => PVE::LXC::json_config_properties(
- {
- node => get_standard_option('pve-node'),
- vmid => get_standard_option('pve-vmid'),
- delete => {
- type => 'string', format => 'pve-configid-list',
- description => "A list of settings you want to delete.",
- optional => 1,
- },
- digest => {
- type => 'string',
- description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
- maxLength => 40,
- optional => 1,
+ my $is_root = $authuser eq 'root@pam';
+
+ my $no_disk_param = {};
+ my $mp_param = {};
+ my $storage_only_mode = 1;
+ foreach my $opt (keys %$param) {
+ my $value = $param->{$opt};
+ if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
+ # allow to use simple numbers (add default storage in that case)
+ if ($value =~ m/^\d+(\.\d+)?$/) {
+ $mp_param->{$opt} = "$storage:$value";
+ } else {
+ $mp_param->{$opt} = $value;
}
- }),
- },
- returns => { type => 'null'},
- code => sub {
- my ($param) = @_;
-
- my $rpcenv = PVE::RPCEnvironment::get();
+ $storage_only_mode = 0;
+ } elsif ($opt =~ m/^unused\d+$/) {
+ warn "ignoring '$opt', cannot create/restore with unused volume\n";
+ delete $param->{$opt};
+ } else {
+ $no_disk_param->{$opt} = $value;
+ }
+ }
- my $authuser = $rpcenv->get_user();
+ die "mount points configured, but 'rootfs' not set - aborting\n"
+ if !$storage_only_mode && !defined($mp_param->{rootfs});
- my $node = extract_param($param, 'node');
+ # check storage access, activate storage
+ my $delayed_mp_param = {};
+ PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
+ my ($ms, $mountpoint) = @_;
- my $vmid = extract_param($param, 'vmid');
+ my $volid = $mountpoint->{volume};
+ my $mp = $mountpoint->{mp};
- my $digest = extract_param($param, 'digest');
+ if ($mountpoint->{type} ne 'volume') { # bind or device
+ die "Only root can pass arbitrary filesystem paths.\n"
+ if !$is_root;
+ } else {
+ my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
+ &$check_and_activate_storage($sid);
+ }
+ });
- die "no options specified\n" if !scalar(keys %$param);
+ # check/activate default storage
+ &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
- my $delete_str = extract_param($param, 'delete');
- my @delete = PVE::Tools::split_list($delete_str);
-
- &$check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
-
- foreach my $opt (@delete) {
- raise_param_exc({ delete => "you can't use '-$opt' and " .
- "-delete $opt' at the same time" })
- if defined($param->{$opt});
-
- if (!PVE::LXC::option_exists($opt)) {
- raise_param_exc({ delete => "unknown option '$opt'" });
- }
- }
+ PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
- &$check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
+ $conf->{unprivileged} = 1 if $unprivileged;
- my $code = sub {
+ my $emsg = $restore ? "unable to restore CT $vmid -" : "unable to create CT $vmid -";
- my $conf = PVE::LXC::load_config($vmid);
+ eval { PVE::LXC::Config->create_and_lock_config($vmid, $force) };
+ die "$emsg $@" if $@;
- PVE::Tools::assert_if_modified($digest, $conf->{digest});
+ my $code = sub {
+ my $old_conf = PVE::LXC::Config->load_config($vmid);
+
+ my $vollist = [];
+ eval {
+ my $orig_mp_param; # only used if $restore
+ if ($restore) {
+ die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
+ if ($is_root && $archive ne '-') {
+ my $orig_conf;
+ ($orig_conf, $orig_mp_param) = PVE::LXC::Create::recover_config($archive);
+ # When we're root call 'restore_configuration' with ristricted=0,
+ # causing it to restore the raw lxc entries, among which there may be
+ # 'lxc.idmap' entries. We need to make sure that the extracted contents
+ # of the container match up with the restored configuration afterwards:
+ $conf->{lxc} = [grep { $_->[0] eq 'lxc.idmap' } @{$orig_conf->{lxc}}];
+ }
+ }
+ if ($storage_only_mode) {
+ if ($restore) {
+ if (!defined($orig_mp_param)) {
+ (undef, $orig_mp_param) = PVE::LXC::Create::recover_config($archive);
+ }
+ $mp_param = $orig_mp_param;
+ die "rootfs configuration could not be recovered, please check and specify manually!\n"
+ if !defined($mp_param->{rootfs});
+ PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
+ my ($ms, $mountpoint) = @_;
+ my $type = $mountpoint->{type};
+ if ($type eq 'volume') {
+ die "unable to detect disk size - please specify $ms (size)\n"
+ if !defined($mountpoint->{size});
+ my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
+ delete $mountpoint->{size};
+ $mountpoint->{volume} = "$storage:$disksize";
+ $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
+ } else {
+ my $type = $mountpoint->{type};
+ die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
+ if ($ms eq 'rootfs');
+ die "restoring '$ms' to $type mount is only possible for root\n"
+ if !$is_root;
+
+ if ($mountpoint->{backup}) {
+ warn "WARNING - unsupported configuration!\n";
+ warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
+ warn "mount point configuration will be restored after archive extraction!\n";
+ warn "contained files will be restored to wrong directory!\n";
+ }
+ delete $mp_param->{$ms}; # actually delay bind/dev mps
+ $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
+ }
+ });
+ } else {
+ $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
+ }
+ }
- # die if running
+ $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
- foreach my $opt (@delete) {
- if ($opt eq 'hostname') {
- die "unable to delete required option '$opt'\n";
- } elsif ($opt =~ m/^net\d$/) {
- delete $conf->{$opt};
- } else {
- die "implement me"
+ # we always have the 'create' lock so check for more than 1 entry
+ if (scalar(keys %$old_conf) > 1) {
+ # destroy old container volumes
+ PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, { lock => 'create' });
}
- }
- foreach my $opt (keys %$param) {
- my $value = $param->{$opt};
- if ($opt eq 'hostname') {
- $conf->{'lxc.utsname'} = $value;
- } elsif ($opt eq 'memory') {
- $conf->{'lxc.cgroup.memory.limit_in_bytes'} = $value*1024*1024;
- } elsif ($opt eq 'swap') {
- $conf->{'lxc.cgroup.memory.memsw.usage_in_bytes'} = $value*1024*1024;
- } elsif ($opt =~ m/^net(\d+)$/) {
- my $netid = $1;
- my $net = PVE::LXC::parse_lxc_network($value);
- $net->{'veth.pair'} = "veth${vmid}.$netid";
- $conf->{$opt} = $net;
- } else {
- die "implement me"
+ eval {
+ my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
+ $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
+ PVE::LXC::Create::restore_archive($archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
+
+ if ($restore) {
+ PVE::LXC::Create::restore_configuration($vmid, $rootdir, $conf, !$is_root);
+ } else {
+ my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
+ PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
+ $lxc_setup->post_create_hook($password, $ssh_keys);
+ }
+ };
+ my $err = $@;
+ PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
+ PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
+ die $err if $err;
+ # set some defaults
+ $conf->{hostname} ||= "CT$vmid";
+ $conf->{memory} ||= 512;
+ $conf->{swap} //= 512;
+ foreach my $mp (keys %$delayed_mp_param) {
+ $conf->{$mp} = $delayed_mp_param->{$mp};
}
+ PVE::LXC::Config->write_config($vmid, $conf);
+ };
+ if (my $err = $@) {
+ PVE::LXC::destroy_disks($storage_cfg, $vollist);
+ eval { PVE::LXC::destroy_config($vmid) };
+ warn $@ if $@;
+ die "$emsg $err";
}
+ PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
- PVE::LXC::write_config($vmid, $conf);
+ PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
+ if $start_after_create;
};
- PVE::LXC::lock_container($vmid, undef, $code);
+ my $workername = $restore ? 'vzrestore' : 'vzcreate';
+ my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
- return undef;
+ return $rpcenv->fork_worker($workername, $vmid, $authuser, $realcmd);
}});
-__PACKAGE__->register_method ({
- subclass => "PVE::API2::Firewall::CT",
- path => '{vmid}/firewall',
-});
-
__PACKAGE__->register_method({
name => 'vmdiridx',
- path => '{vmid}',
+ path => '{vmid}',
method => 'GET',
proxyto => 'node',
description => "Directory index",
my ($param) = @_;
# test if VM exists
- my $conf = PVE::LXC::load_config($param->{vmid});
+ my $conf = PVE::LXC::Config->load_config($param->{vmid});
my $res = [
{ subdir => 'config' },
-# { subdir => 'status' },
-# { subdir => 'vncproxy' },
-# { subdir => 'spiceproxy' },
-# { subdir => 'migrate' },
+ { subdir => 'status' },
+ { subdir => 'vncproxy' },
+ { subdir => 'termproxy' },
+ { subdir => 'vncwebsocket' },
+ { subdir => 'spiceproxy' },
+ { subdir => 'migrate' },
+ { subdir => 'clone' },
# { subdir => 'initlog' },
{ subdir => 'rrd' },
{ subdir => 'rrddata' },
{ subdir => 'firewall' },
+ { subdir => 'snapshot' },
+ { subdir => 'resize' },
];
-
+
return $res;
}});
+
__PACKAGE__->register_method({
- name => 'rrd',
- path => '{vmid}/rrd',
+ name => 'rrd',
+ path => '{vmid}/rrd',
method => 'GET',
protected => 1, # fixme: can we avoid that?
permissions => {
my ($param) = @_;
return PVE::Cluster::create_rrd_graph(
- "pve2-vm/$param->{vmid}", $param->{timeframe},
+ "pve2-vm/$param->{vmid}", $param->{timeframe},
$param->{ds}, $param->{cf});
-
+
}});
__PACKAGE__->register_method({
- name => 'rrddata',
- path => '{vmid}/rrddata',
+ name => 'rrddata',
+ path => '{vmid}/rrddata',
method => 'GET',
protected => 1, # fixme: can we avoid that?
permissions => {
"pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
}});
-
__PACKAGE__->register_method({
- name => 'vm_config',
- path => '{vmid}/config',
- method => 'GET',
+ name => 'destroy_vm',
+ path => '{vmid}',
+ method => 'DELETE',
+ protected => 1,
proxyto => 'node',
- description => "Get container configuration.",
+ description => "Destroy the container (also delete all uses files).",
permissions => {
- check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
+ check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
+ },
+ },
+ returns => {
+ type => 'string',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $vmid = $param->{vmid};
+
+ # test if container exists
+ my $conf = PVE::LXC::Config->load_config($vmid);
+
+ my $storage_cfg = cfs_read_file("storage.cfg");
+
+ PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
+
+ die "unable to remove CT $vmid - used in HA resources\n"
+ if PVE::HA::Config::vm_is_ha_managed($vmid);
+
+ # do not allow destroy if there are replication jobs
+ my $repl_conf = PVE::ReplicationConfig->new();
+ $repl_conf->check_for_existing_jobs($vmid);
+
+ my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
+
+ die $running_error_msg if PVE::LXC::check_running($vmid); # check early
+
+ my $code = sub {
+ # reload config after lock
+ $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_lock($conf);
+
+ die $running_error_msg if PVE::LXC::check_running($vmid);
+
+ PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf);
+ PVE::AccessControl::remove_vm_access($vmid);
+ PVE::Firewall::remove_vmfw_conf($vmid);
+ };
+
+ my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
+
+ return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
+ }});
+
+my $sslcert;
+
+__PACKAGE__->register_method ({
+ name => 'vncproxy',
+ path => '{vmid}/vncproxy',
+ method => 'POST',
+ protected => 1,
+ permissions => {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
},
+ description => "Creates a TCP VNC proxy connections.",
parameters => {
additionalProperties => 0,
properties => {
node => get_standard_option('pve-node'),
vmid => get_standard_option('pve-vmid'),
+ websocket => {
+ optional => 1,
+ type => 'boolean',
+ description => "use websocket instead of standard VNC.",
+ },
+ width => {
+ optional => 1,
+ description => "sets the width of the console in pixels.",
+ type => 'integer',
+ minimum => 16,
+ maximum => 4096,
+ },
+ height => {
+ optional => 1,
+ description => "sets the height of the console in pixels.",
+ type => 'integer',
+ minimum => 16,
+ maximum => 2160,
+ },
},
},
- returns => {
- type => "object",
+ returns => {
+ additionalProperties => 0,
properties => {
- digest => {
- type => 'string',
- description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
- }
+ user => { type => 'string' },
+ ticket => { type => 'string' },
+ cert => { type => 'string' },
+ port => { type => 'integer' },
+ upid => { type => 'string' },
},
},
code => sub {
my ($param) = @_;
- my $lxc_conf = PVE::LXC::load_config($param->{vmid});
+ my $rpcenv = PVE::RPCEnvironment::get();
- # NOTE: we only return selected/converted values
-
- my $conf = { digest => $lxc_conf->{digest} };
+ my $authuser = $rpcenv->get_user();
+
+ my $vmid = $param->{vmid};
+ my $node = $param->{node};
- my $stcfg = PVE::Cluster::cfs_read_file("storage.cfg");
+ my $authpath = "/vms/$vmid";
- my ($sid, undef, $path) = &$get_container_storage($stcfg, $param->{vmid}, $lxc_conf);
- $conf->{storage} = $sid || $path;
+ my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
- my $properties = PVE::LXC::json_config_properties();
+ $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
+ if !$sslcert;
- foreach my $k (keys %$properties) {
+ my ($remip, $family);
- if ($k eq 'description') {
- if (my $raw = $lxc_conf->{'pve.comment'}) {
- $conf->{$k} = PVE::Tools::decode_text($raw);
- }
- } elsif ($k eq 'hostname') {
- $conf->{$k} = $lxc_conf->{'lxc.utsname'} if $lxc_conf->{'lxc.utsname'};
- } elsif ($k eq 'memory') {
- if (my $value = $lxc_conf->{'lxc.cgroup.memory.limit_in_bytes'}) {
- $conf->{$k} = int($value / (1024*1024));
- }
- } elsif ($k eq 'swap') {
- if (my $value = $lxc_conf->{'lxc.cgroup.memory.memsw.usage_in_bytes'}) {
- $conf->{$k} = int($value / (1024*1024));
- }
- } elsif ($k =~ m/^net\d$/) {
- my $net = $lxc_conf->{$k};
- next if !$net;
- $conf->{$k} = PVE::LXC::print_lxc_network($net);
- }
+ if ($node ne PVE::INotify::nodename()) {
+ ($remip, $family) = PVE::Cluster::remote_node_ip($node);
+ } else {
+ $family = PVE::Tools::get_host_address_family($node);
}
- return $conf;
+ my $port = PVE::Tools::next_vnc_port($family);
+
+ # NOTE: vncterm VNC traffic is already TLS encrypted,
+ # so we select the fastest chipher here (or 'none'?)
+ my $remcmd = $remip ?
+ ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
+
+ my $conf = PVE::LXC::Config->load_config($vmid, $node);
+ my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
+
+ my $shcmd = [ '/usr/bin/dtach', '-A',
+ "/var/run/dtach/vzctlconsole$vmid",
+ '-r', 'winch', '-z', @$concmd];
+
+ my $realcmd = sub {
+ my $upid = shift;
+
+ syslog ('info', "starting lxc vnc proxy $upid\n");
+
+ my $timeout = 10;
+
+ my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
+ '-timeout', $timeout, '-authpath', $authpath,
+ '-perm', 'VM.Console'];
+
+ if ($param->{width}) {
+ push @$cmd, '-width', $param->{width};
+ }
+
+ if ($param->{height}) {
+ push @$cmd, '-height', $param->{height};
+ }
+
+ if ($param->{websocket}) {
+ $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
+ push @$cmd, '-notls', '-listen', 'localhost';
+ }
+
+ push @$cmd, '-c', @$remcmd, @$shcmd;
+
+ run_command($cmd, keeplocale => 1);
+
+ return;
+ };
+
+ my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
+
+ PVE::Tools::wait_for_vnc_port($port);
+
+ return {
+ user => $authuser,
+ ticket => $ticket,
+ port => $port,
+ upid => $upid,
+ cert => $sslcert,
+ };
}});
-__PACKAGE__->register_method({
- name => 'destroy_vm',
- path => '{vmid}',
- method => 'DELETE',
+__PACKAGE__->register_method ({
+ name => 'termproxy',
+ path => '{vmid}/termproxy',
+ method => 'POST',
protected => 1,
- proxyto => 'node',
- description => "Destroy the container (also delete all uses files).",
permissions => {
- check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
+ check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
},
+ description => "Creates a TCP proxy connection.",
parameters => {
- additionalProperties => 0,
+ additionalProperties => 0,
properties => {
node => get_standard_option('pve-node'),
vmid => get_standard_option('pve-vmid'),
},
},
- returns => {
- type => 'string',
+ returns => {
+ additionalProperties => 0,
+ properties => {
+ user => { type => 'string' },
+ ticket => { type => 'string' },
+ port => { type => 'integer' },
+ upid => { type => 'string' },
+ },
},
code => sub {
my ($param) = @_;
my $authuser = $rpcenv->get_user();
my $vmid = $param->{vmid};
+ my $node = $param->{node};
- # test if container exists
- my $conf = PVE::LXC::load_config($param->{vmid});
+ my $authpath = "/vms/$vmid";
+
+ my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
+
+ my ($remip, $family);
+
+ if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
+ ($remip, $family) = PVE::Cluster::remote_node_ip($node);
+ } else {
+ $family = PVE::Tools::get_host_address_family($node);
+ }
+
+ my $port = PVE::Tools::next_vnc_port($family);
+
+ my $remcmd = $remip ?
+ ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
+
+ my $conf = PVE::LXC::Config->load_config($vmid, $node);
+ my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
+
+ my $shcmd = [ '/usr/bin/dtach', '-A',
+ "/var/run/dtach/vzctlconsole$vmid",
+ '-r', 'winch', '-z', @$concmd];
my $realcmd = sub {
- my $cmd = ['lxc-destroy', '-n', $vmid ];
+ my $upid = shift;
+
+ syslog ('info', "starting lxc termproxy $upid\n");
- run_command($cmd);
+ my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
+ '--perm', 'VM.Console', '--'];
+ push @$cmd, @$remcmd, @$shcmd;
- PVE::AccessControl::remove_vm_from_pool($vmid);
+ PVE::Tools::run_command($cmd);
};
- return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
+ my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
+
+ PVE::Tools::wait_for_vnc_port($port);
+
+ return {
+ user => $authuser,
+ ticket => $ticket,
+ port => $port,
+ upid => $upid,
+ };
}});
+__PACKAGE__->register_method({
+ name => 'vncwebsocket',
+ path => '{vmid}/vncwebsocket',
+ method => 'GET',
+ permissions => {
+ description => "You also need to pass a valid ticket (vncticket).",
+ check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
+ },
+ description => "Opens a weksocket for VNC traffic.",
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid'),
+ vncticket => {
+ description => "Ticket from previous call to vncproxy.",
+ type => 'string',
+ maxLength => 512,
+ },
+ port => {
+ description => "Port number returned by previous vncproxy call.",
+ type => 'integer',
+ minimum => 5900,
+ maximum => 5999,
+ },
+ },
+ },
+ returns => {
+ type => "object",
+ properties => {
+ port => { type => 'string' },
+ },
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $authpath = "/vms/$param->{vmid}";
+
+ PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
+
+ my $port = $param->{port};
+
+ return { port => $port };
+ }});
+
+__PACKAGE__->register_method ({
+ name => 'spiceproxy',
+ path => '{vmid}/spiceproxy',
+ method => 'POST',
+ protected => 1,
+ proxyto => 'node',
+ permissions => {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
+ },
+ description => "Returns a SPICE configuration to connect to the CT.",
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid'),
+ proxy => get_standard_option('spice-proxy', { optional => 1 }),
+ },
+ },
+ returns => get_standard_option('remote-viewer-config'),
+ code => sub {
+ my ($param) = @_;
+
+ my $vmid = $param->{vmid};
+ my $node = $param->{node};
+ my $proxy = $param->{proxy};
+
+ my $authpath = "/vms/$vmid";
+ my $permissions = 'VM.Console';
+
+ my $conf = PVE::LXC::Config->load_config($vmid);
+
+ die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
+
+ my $concmd = PVE::LXC::get_console_command($vmid, $conf);
+
+ my $shcmd = ['/usr/bin/dtach', '-A',
+ "/var/run/dtach/vzctlconsole$vmid",
+ '-r', 'winch', '-z', @$concmd];
+
+ my $title = "CT $vmid";
+
+ return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
+ }});
+
+
+__PACKAGE__->register_method({
+ name => 'migrate_vm',
+ path => '{vmid}/migrate',
+ method => 'POST',
+ protected => 1,
+ proxyto => 'node',
+ description => "Migrate the container to another node. Creates a new migration task.",
+ permissions => {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
+ target => get_standard_option('pve-node', {
+ description => "Target node.",
+ completion => \&PVE::Cluster::complete_migration_target,
+ }),
+ online => {
+ type => 'boolean',
+ description => "Use online/live migration.",
+ optional => 1,
+ },
+ restart => {
+ type => 'boolean',
+ description => "Use restart migration",
+ optional => 1,
+ },
+ timeout => {
+ type => 'integer',
+ description => "Timeout in seconds for shutdown for restart migration",
+ optional => 1,
+ default => 180,
+ },
+ force => {
+ type => 'boolean',
+ description => "Force migration despite local bind / device" .
+ " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
+ optional => 1,
+ },
+ },
+ },
+ returns => {
+ type => 'string',
+ description => "the task ID.",
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $target = extract_param($param, 'target');
+
+ my $localnode = PVE::INotify::nodename();
+ raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
+
+ PVE::Cluster::check_cfs_quorum();
+
+ PVE::Cluster::check_node_exists($target);
+
+ my $targetip = PVE::Cluster::remote_node_ip($target);
+
+ my $vmid = extract_param($param, 'vmid');
+
+ # test if VM exists
+ PVE::LXC::Config->load_config($vmid);
+
+ # try to detect errors early
+ if (PVE::LXC::check_running($vmid)) {
+ die "can't migrate running container without --online or --restart\n"
+ if !$param->{online} && !$param->{restart};
+ }
+
+ if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
+
+ my $hacmd = sub {
+ my $upid = shift;
+
+ my $service = "ct:$vmid";
+
+ my $cmd = ['ha-manager', 'migrate', $service, $target];
+
+ print "Requesting HA migration for CT $vmid to node $target\n";
+
+ PVE::Tools::run_command($cmd);
+
+ return;
+ };
+
+ return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
+
+ } else {
+
+ my $realcmd = sub {
+ PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
+ };
+
+ my $worker = sub {
+ return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
+ };
+
+ return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
+ }
+ }});
+
+__PACKAGE__->register_method({
+ name => 'vm_feature',
+ path => '{vmid}/feature',
+ method => 'GET',
+ proxyto => 'node',
+ protected => 1,
+ description => "Check if feature for virtual machine is available.",
+ permissions => {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid'),
+ feature => {
+ description => "Feature to check.",
+ type => 'string',
+ enum => [ 'snapshot', 'clone', 'copy' ],
+ },
+ snapname => get_standard_option('pve-lxc-snapshot-name', {
+ optional => 1,
+ }),
+ },
+ },
+ returns => {
+ type => "object",
+ properties => {
+ hasFeature => { type => 'boolean' },
+ #nodes => {
+ #type => 'array',
+ #items => { type => 'string' },
+ #}
+ },
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $node = extract_param($param, 'node');
+
+ my $vmid = extract_param($param, 'vmid');
+
+ my $snapname = extract_param($param, 'snapname');
+
+ my $feature = extract_param($param, 'feature');
+
+ my $conf = PVE::LXC::Config->load_config($vmid);
+
+ if($snapname){
+ my $snap = $conf->{snapshots}->{$snapname};
+ die "snapshot '$snapname' does not exist\n" if !defined($snap);
+ $conf = $snap;
+ }
+ my $storage_cfg = PVE::Storage::config();
+ #Maybe include later
+ #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
+ my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
+
+ return {
+ hasFeature => $hasFeature,
+ #nodes => [ keys %$nodelist ],
+ };
+ }});
+
+__PACKAGE__->register_method({
+ name => 'template',
+ path => '{vmid}/template',
+ method => 'POST',
+ protected => 1,
+ proxyto => 'node',
+ description => "Create a Template.",
+ permissions => {
+ description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
+ check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
+ },
+ },
+ returns => { type => 'null'},
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $node = extract_param($param, 'node');
+
+ my $vmid = extract_param($param, 'vmid');
+
+ my $updatefn = sub {
+
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_lock($conf);
+
+ die "unable to create template, because CT contains snapshots\n"
+ if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
+
+ die "you can't convert a template to a template\n"
+ if PVE::LXC::Config->is_template($conf);
+
+ die "you can't convert a CT to template if the CT is running\n"
+ if PVE::LXC::check_running($vmid);
+
+ my $scfg = PVE::Storage::config();
+ PVE::LXC::Config->foreach_mountpoint($conf, sub {
+ my ($ms, $mp) = @_;
+
+ my ($sid) =PVE::Storage::parse_volume_id($mp->{volume}, 0);
+ die "Directory storage '$sid' does not support container templates!\n"
+ if $scfg->{ids}->{$sid}->{path};
+ });
+
+ my $realcmd = sub {
+ PVE::LXC::template_create($vmid, $conf);
+
+ $conf->{template} = 1;
+
+ PVE::LXC::Config->write_config($vmid, $conf);
+ # and remove lxc config
+ PVE::LXC::update_lxc_config($vmid, $conf);
+ };
+
+ return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
+ };
+
+ PVE::LXC::Config->lock_config($vmid, $updatefn);
+
+ return undef;
+ }});
+
+__PACKAGE__->register_method({
+ name => 'clone_vm',
+ path => '{vmid}/clone',
+ method => 'POST',
+ protected => 1,
+ proxyto => 'node',
+ description => "Create a container clone/copy",
+ permissions => {
+ description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
+ "and 'VM.Allocate' permissions " .
+ "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
+ "'Datastore.AllocateSpace' on any used storage.",
+ check =>
+ [ 'and',
+ ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
+ [ 'or',
+ [ 'perm', '/vms/{newid}', ['VM.Allocate']],
+ [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
+ ],
+ ]
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
+ newid => get_standard_option('pve-vmid', {
+ completion => \&PVE::Cluster::complete_next_vmid,
+ description => 'VMID for the clone.' }),
+ hostname => {
+ optional => 1,
+ type => 'string', format => 'dns-name',
+ description => "Set a hostname for the new CT.",
+ },
+ description => {
+ optional => 1,
+ type => 'string',
+ description => "Description for the new CT.",
+ },
+ pool => {
+ optional => 1,
+ type => 'string', format => 'pve-poolid',
+ description => "Add the new CT to the specified pool.",
+ },
+ snapname => get_standard_option('pve-lxc-snapshot-name', {
+ optional => 1,
+ }),
+ storage => get_standard_option('pve-storage-id', {
+ description => "Target storage for full clone.",
+ optional => 1,
+ }),
+ full => {
+ optional => 1,
+ type => 'boolean',
+ description => "Create a full copy of all disks. This is always done when " .
+ "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
+ },
+ target => get_standard_option('pve-node', {
+ description => "Target node. Only allowed if the original VM is on shared storage.",
+ optional => 1,
+ }),
+ },
+ },
+ returns => {
+ type => 'string',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $node = extract_param($param, 'node');
+
+ my $vmid = extract_param($param, 'vmid');
+
+ my $newid = extract_param($param, 'newid');
+
+ my $pool = extract_param($param, 'pool');
+
+ if (defined($pool)) {
+ $rpcenv->check_pool_exist($pool);
+ }
+
+ my $snapname = extract_param($param, 'snapname');
+
+ my $storage = extract_param($param, 'storage');
+
+ my $target = extract_param($param, 'target');
+
+ my $localnode = PVE::INotify::nodename();
+
+ undef $target if $target && ($target eq $localnode || $target eq 'localhost');
+
+ PVE::Cluster::check_node_exists($target) if $target;
+
+ my $storecfg = PVE::Storage::config();
+
+ if ($storage) {
+ # check if storage is enabled on local node
+ PVE::Storage::storage_check_enabled($storecfg, $storage);
+ if ($target) {
+ # check if storage is available on target node
+ PVE::Storage::storage_check_node($storecfg, $storage, $target);
+ # clone only works if target storage is shared
+ my $scfg = PVE::Storage::storage_config($storecfg, $storage);
+ die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
+ }
+ }
+
+ PVE::Cluster::check_cfs_quorum();
+
+ my $conffile;
+ my $newconf = {};
+ my $mountpoints = {};
+ my $fullclone = {};
+ my $vollist = [];
+ my $running;
+
+ PVE::LXC::Config->lock_config($vmid, sub {
+ my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
+
+ $running = PVE::LXC::check_running($vmid) || 0;
+
+ my $full = extract_param($param, 'full');
+ if (!defined($full)) {
+ $full = !PVE::LXC::Config->is_template($src_conf);
+ }
+ die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
+
+ eval {
+ die "snapshot '$snapname' does not exist\n"
+ if $snapname && !defined($src_conf->{snapshots}->{$snapname});
+
+
+ my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
+
+ $conffile = PVE::LXC::Config->config_file($newid);
+ die "unable to create CT $newid: config file already exists\n"
+ if -f $conffile;
+
+ my $sharedvm = 1;
+ foreach my $opt (keys %$src_conf) {
+ next if $opt =~ m/^unused\d+$/;
+
+ my $value = $src_conf->{$opt};
+
+ if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
+ my $mp = $opt eq 'rootfs' ?
+ PVE::LXC::Config->parse_ct_rootfs($value) :
+ PVE::LXC::Config->parse_ct_mountpoint($value);
+
+ if ($mp->{type} eq 'volume') {
+ my $volid = $mp->{volume};
+
+ my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
+ $sid = $storage if defined($storage);
+ my $scfg = PVE::Storage::storage_config($storecfg, $sid);
+ if (!$scfg->{shared}) {
+ $sharedvm = 0;
+ warn "found non-shared volume: $volid\n" if $target;
+ }
+
+ $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
+
+ if ($full) {
+ die "Cannot do full clones on a running container without snapshots\n"
+ if $running && !defined($snapname);
+ $fullclone->{$opt} = 1;
+ } else {
+ # not full means clone instead of copy
+ die "Linked clone feature for '$volid' is not available\n"
+ if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running);
+ }
+
+ $mountpoints->{$opt} = $mp;
+ push @$vollist, $volid;
+
+ } else {
+ # TODO: allow bind mounts?
+ die "unable to clone mountpint '$opt' (type $mp->{type})\n";
+ }
+ } elsif ($opt =~ m/^net(\d+)$/) {
+ # always change MAC! address
+ my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
+ my $net = PVE::LXC::Config->parse_lxc_network($value);
+ $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
+ $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
+ } else {
+ # copy everything else
+ $newconf->{$opt} = $value;
+ }
+ }
+ die "can't clone CT to node '$target' (CT uses local storage)\n"
+ if $target && !$sharedvm;
+
+ # Replace the 'disk' lock with a 'create' lock.
+ $newconf->{lock} = 'create';
+
+ delete $newconf->{template};
+ if ($param->{hostname}) {
+ $newconf->{hostname} = $param->{hostname};
+ }
+
+ if ($param->{description}) {
+ $newconf->{description} = $param->{description};
+ }
+
+ # create empty/temp config - this fails if CT already exists on other node
+ PVE::LXC::Config->write_config($newid, $newconf);
+ };
+ if (my $err = $@) {
+ eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
+ warn $@ if $@;
+ die $err;
+ }
+ });
+
+ my $update_conf = sub {
+ my ($key, $value) = @_;
+ return PVE::LXC::Config->lock_config($newid, sub {
+ my $conf = PVE::LXC::Config->load_config($newid);
+ die "Lost 'create' config lock, aborting.\n"
+ if !PVE::LXC::Config->has_lock($conf, 'create');
+ $conf->{$key} = $value;
+ PVE::LXC::Config->write_config($newid, $conf);
+ });
+ };
+
+ my $realcmd = sub {
+ my ($upid) = @_;
+
+ my $newvollist = [];
+
+ my $verify_running = PVE::LXC::check_running($vmid) || 0;
+ die "unexpected state change\n" if $verify_running != $running;
+
+ eval {
+ local $SIG{INT} =
+ local $SIG{TERM} =
+ local $SIG{QUIT} =
+ local $SIG{HUP} = sub { die "interrupted by signal\n"; };
+
+ PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
+
+ foreach my $opt (keys %$mountpoints) {
+ my $mp = $mountpoints->{$opt};
+ my $volid = $mp->{volume};
+
+ my $newvolid;
+ if ($fullclone->{$opt}) {
+ print "create full clone of mountpoint $opt ($volid)\n";
+ my $target_storage = $storage // PVE::Storage::parse_volume_id($volid);
+ $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname);
+ } else {
+ print "create linked clone of mount point $opt ($volid)\n";
+ $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
+ }
+
+ push @$newvollist, $newvolid;
+ $mp->{volume} = $newvolid;
+
+ $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
+ }
+
+ PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
+ PVE::LXC::Config->remove_lock($newid, 'create');
+
+ if ($target) {
+ # always deactivate volumes - avoid lvm LVs to be active on several nodes
+ PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
+ PVE::Storage::deactivate_volumes($storecfg, $newvollist);
+
+ my $newconffile = PVE::LXC::Config->config_file($newid, $target);
+ die "Failed to move config to node '$target' - rename failed: $!\n"
+ if !rename($conffile, $newconffile);
+ }
+ };
+ my $err = $@;
+
+ # Unlock the source config in any case:
+ eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
+ warn $@ if $@;
+
+ if ($err) {
+ # Now cleanup the config & disks:
+ unlink $conffile;
+
+ sleep 1; # some storages like rbd need to wait before release volume - really?
+
+ foreach my $volid (@$newvollist) {
+ eval { PVE::Storage::vdisk_free($storecfg, $volid); };
+ warn $@ if $@;
+ }
+ die "clone failed: $err";
+ }
+
+ return;
+ };
+
+ PVE::Firewall::clone_vmfw_conf($vmid, $newid);
+ return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
+ }});
+
+
+__PACKAGE__->register_method({
+ name => 'resize_vm',
+ path => '{vmid}/resize',
+ method => 'PUT',
+ protected => 1,
+ proxyto => 'node',
+ description => "Resize a container mount point.",
+ permissions => {
+ check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
+ disk => {
+ type => 'string',
+ description => "The disk you want to resize.",
+ enum => [PVE::LXC::Config->mountpoint_names()],
+ },
+ size => {
+ type => 'string',
+ pattern => '\+?\d+(\.\d+)?[KMGT]?',
+ description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
+ },
+ digest => {
+ type => 'string',
+ description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
+ maxLength => 40,
+ optional => 1,
+ }
+ },
+ },
+ returns => {
+ type => 'string',
+ description => "the task ID.",
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $node = extract_param($param, 'node');
+
+ my $vmid = extract_param($param, 'vmid');
+
+ my $digest = extract_param($param, 'digest');
+
+ my $sizestr = extract_param($param, 'size');
+ my $ext = ($sizestr =~ s/^\+//);
+ my $newsize = PVE::JSONSchema::parse_size($sizestr);
+ die "invalid size string" if !defined($newsize);
+
+ die "no options specified\n" if !scalar(keys %$param);
+
+ PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
+
+ my $storage_cfg = cfs_read_file("storage.cfg");
+
+ my $code = sub {
+
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_lock($conf);
+
+ PVE::Tools::assert_if_modified($digest, $conf->{digest});
+
+ my $running = PVE::LXC::check_running($vmid);
+
+ my $disk = $param->{disk};
+ my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
+ PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
+
+ my $volid = $mp->{volume};
+
+ my (undef, undef, $owner, undef, undef, undef, $format) =
+ PVE::Storage::parse_volname($storage_cfg, $volid);
+
+ die "can't resize mount point owned by another container ($owner)"
+ if $vmid != $owner;
+
+ die "can't resize volume: $disk if snapshot exists\n"
+ if %{$conf->{snapshots}} && $format eq 'qcow2';
+
+ my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
+
+ $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
+
+ PVE::Storage::activate_volumes($storage_cfg, [$volid]);
+
+ my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
+ $newsize += $size if $ext;
+ $newsize = int($newsize);
+
+ die "unable to shrink disk size\n" if $newsize < $size;
+
+ return if $size == $newsize;
+
+ PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
+ my $realcmd = sub {
+ # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
+ # we pass 0 here (parameter only makes sense for qemu)
+ PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
+
+ $mp->{size} = $newsize;
+ $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
+
+ PVE::LXC::Config->write_config($vmid, $conf);
+
+ if ($format eq 'raw') {
+ my $path = PVE::Storage::map_volume($storage_cfg, $volid) // PVE::Storage::path($storage_cfg, $volid);
+ if ($running) {
+
+ $mp->{mp} = '/';
+ my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
+ $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
+ die "internal error: CT running but mount point not attached to a loop device"
+ if !$path;
+ PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
+
+ # In order for resize2fs to know that we need online-resizing a mountpoint needs
+ # to be visible to it in its namespace.
+ # To not interfere with the rest of the system we unshare the current mount namespace,
+ # mount over /tmp and then run resize2fs.
+
+ # interestingly we don't need to e2fsck on mounted systems...
+ my $quoted = PVE::Tools::shellquote($path);
+ my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
+ eval {
+ PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
+ };
+ warn "Failed to update the container's filesystem: $@\n" if $@;
+ } else {
+ eval {
+ PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
+ PVE::Tools::run_command(['resize2fs', $path]);
+ };
+ warn "Failed to update the container's filesystem: $@\n" if $@;
+
+ PVE::Storage::unmap_volume($storage_cfg, $volid);
+ }
+ }
+ };
+
+ return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
+ };
+
+ return PVE::LXC::Config->lock_config($vmid, $code);;
+ }});
+
+__PACKAGE__->register_method({
+ name => 'move_volume',
+ path => '{vmid}/move_volume',
+ method => 'POST',
+ protected => 1,
+ proxyto => 'node',
+ description => "Move a rootfs-/mp-volume to a different storage",
+ permissions => {
+ description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
+ "and 'Datastore.AllocateSpace' permissions on the storage.",
+ check =>
+ [ 'and',
+ ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
+ ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
+ ],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ node => get_standard_option('pve-node'),
+ vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
+ volume => {
+ type => 'string',
+ enum => [ PVE::LXC::Config->mountpoint_names() ],
+ description => "Volume which will be moved.",
+ },
+ storage => get_standard_option('pve-storage-id', {
+ description => "Target Storage.",
+ completion => \&PVE::Storage::complete_storage_enabled,
+ }),
+ delete => {
+ type => 'boolean',
+ description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
+ optional => 1,
+ default => 0,
+ },
+ digest => {
+ type => 'string',
+ description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
+ maxLength => 40,
+ optional => 1,
+ }
+ },
+ },
+ returns => {
+ type => 'string',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $rpcenv = PVE::RPCEnvironment::get();
+
+ my $authuser = $rpcenv->get_user();
+
+ my $vmid = extract_param($param, 'vmid');
+
+ my $storage = extract_param($param, 'storage');
+
+ my $mpkey = extract_param($param, 'volume');
+
+ my $lockname = 'disk';
+
+ my ($mpdata, $old_volid);
+
+ PVE::LXC::Config->lock_config($vmid, sub {
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::LXC::Config->check_lock($conf);
+
+ die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
+
+ if ($mpkey eq 'rootfs') {
+ $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
+ } elsif ($mpkey =~ m/mp\d+/) {
+ $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
+ } else {
+ die "Can't parse $mpkey\n";
+ }
+ $old_volid = $mpdata->{volume};
+
+ die "you can't move a volume with snapshots and delete the source\n"
+ if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
+
+ PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
+
+ PVE::LXC::Config->set_lock($vmid, $lockname);
+ });
+
+ my $realcmd = sub {
+ eval {
+ PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
+
+ my $conf = PVE::LXC::Config->load_config($vmid);
+ my $storage_cfg = PVE::Storage::config();
+
+ my $new_volid;
+
+ eval {
+ PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
+ $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf);
+ $mpdata->{volume} = $new_volid;
+
+ PVE::LXC::Config->lock_config($vmid, sub {
+ my $digest = $conf->{digest};
+ $conf = PVE::LXC::Config->load_config($vmid);
+ PVE::Tools::assert_if_modified($digest, $conf->{digest});
+
+ $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
+
+ PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
+
+ PVE::LXC::Config->write_config($vmid, $conf);
+ });
+
+ eval {
+ # try to deactivate volumes - avoid lvm LVs to be active on several nodes
+ PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
+ };
+ warn $@ if $@;
+ };
+ if (my $err = $@) {
+ eval {
+ PVE::Storage::vdisk_free($storage_cfg, $new_volid)
+ if defined($new_volid);
+ };
+ warn $@ if $@;
+ die $err;
+ }
+
+ if ($param->{delete}) {
+ eval {
+ PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
+ PVE::Storage::vdisk_free($storage_cfg, $old_volid);
+ };
+ warn $@ if $@;
+ }
+ };
+ my $err = $@;
+ eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
+ warn $@ if $@;
+ die $err if $err;
+ };
+ my $task = eval {
+ $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
+ };
+ if (my $err = $@) {
+ eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
+ warn $@ if $@;
+ die $err;
+ }
+ return $task;
+ }});
+
1;
projects / pve-container.git / blobdiff