#!/bin/bash
-# template script for generating ubuntu container for LXC based on released cloud
-# images
+# template script for generating ubuntu container for LXC based on released
+# cloud images.
#
# Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com>
#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2, as
-# published by the Free Software Foundation.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
set -e
+STATE_DIR="@LOCALSTATEDIR@"
+HOOK_DIR="@LXCHOOKDIR@"
+CLONE_HOOK_FN="$HOOK_DIR/ubuntu-cloud-prep"
+LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"
+KNOWN_RELEASES="precise trusty xenial yakkety zesty"
+skip_arch_check=${UCTEMPLATE_SKIP_ARCH_CHECK:-0}
+
+# Make sure the usual locations are in PATH
+export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
+
if [ -r /etc/default/lxc ]; then
. /etc/default/lxc
fi
+am_in_userns() {
+ [ -e /proc/self/uid_map ] || { echo no; return; }
+ [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }
+ line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
+ [ "$line" = "0 0 4294967295" ] && { echo no; return; }
+ echo yes
+}
+
+in_userns=0
+[ $(am_in_userns) = "yes" ] && in_userns=1
+
copy_configuration()
{
path=$1
# if there is exactly one veth network entry, make sure it has an
# associated hwaddr.
- nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
+ nics=`grep -e '^lxc\.net\.0\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
if [ $nics -eq 1 ]; then
- grep -q "^lxc.network.hwaddr" $path/config || cat <<EOF >> $path/config
-lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')
-EOF
+ grep -q "^lxc.net.0.hwaddr" $path/config || sed -i -e "/^lxc\.net\.0\.type[ \t]*=[ \t]*veth/a lxc.net.0.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
fi
- grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
- cat <<EOF >> $path/config
-lxc.utsname = $name
+ # Generate the configuration file
+ ## Relocate all the network config entries
+ sed -i -e "/lxc.net.0/{w ${path}/config-network" -e "d}" $path/config
+
+ ## Relocate any other config entries
+ sed -i -e "/lxc./{w ${path}/config-auto" -e "d}" $path/config
-lxc.tty = 4
-lxc.pts = 1024
-lxc.mount = $path/fstab
+ ## Add all the includes
+ echo "" >> $path/config
+ echo "# Common configuration" >> $path/config
+ if [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.common.conf" ]; then
+ echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.common.conf" >> $path/config
+ fi
+ if [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.${release}.conf" ]; then
+ echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.${release}.conf" >> $path/config
+ fi
+ if [ $in_userns -eq 1 ] && [ -e "${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" ]; then
+ echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/ubuntu-cloud.userns.conf" >> $path/config
+ fi
+
+ ## Add the container-specific config
+ echo "" >> $path/config
+ echo "# Container specific configuration" >> $path/config
+ [ -e "$path/config-auto" ] && cat $path/config-auto >> $path/config && rm $path/config-auto
+ grep -q "^lxc.rootfs.path" $path/config 2>/dev/null || echo "lxc.rootfs.path = $rootfs" >> $path/config
+ cat <<EOF >> $path/config
+lxc.uts.name = $name
lxc.arch = $arch
-lxc.cap.drop = sys_module mac_admin
-lxc.pivotdir = lxc_putold
-
-# When using LXC with apparmor, uncomment the next line to run unconfined:
-#lxc.aa_profile = unconfined
-
-lxc.cgroup.devices.deny = a
-# Allow any mknod (but not using the node)
-lxc.cgroup.devices.allow = c *:* m
-lxc.cgroup.devices.allow = b *:* m
-# /dev/null and zero
-lxc.cgroup.devices.allow = c 1:3 rwm
-lxc.cgroup.devices.allow = c 1:5 rwm
-# consoles
-lxc.cgroup.devices.allow = c 5:1 rwm
-lxc.cgroup.devices.allow = c 5:0 rwm
-#lxc.cgroup.devices.allow = c 4:0 rwm
-#lxc.cgroup.devices.allow = c 4:1 rwm
-# /dev/{,u}random
-lxc.cgroup.devices.allow = c 1:9 rwm
-lxc.cgroup.devices.allow = c 1:8 rwm
-lxc.cgroup.devices.allow = c 136:* rwm
-lxc.cgroup.devices.allow = c 5:2 rwm
-# rtc
-lxc.cgroup.devices.allow = c 254:0 rwm
-#fuse
-lxc.cgroup.devices.allow = c 10:229 rwm
-#tun
-lxc.cgroup.devices.allow = c 10:200 rwm
-#full
-lxc.cgroup.devices.allow = c 1:7 rwm
-#hpet
-lxc.cgroup.devices.allow = c 10:228 rwm
-#kvm
-lxc.cgroup.devices.allow = c 10:232 rwm
EOF
- cat <<EOF > $path/fstab
-proc proc proc nodev,noexec,nosuid 0 0
-sysfs sys sysfs defaults 0 0
-EOF
+ ## Re-add the previously removed network config
+ echo "" >> $path/config
+ echo "# Network configuration" >> $path/config
+ cat $path/config-network >> $path/config
+ rm $path/config-network
+
+ # Set initial timezone as on host
+ if [ -f /etc/timezone ]; then
+ cat /etc/timezone > $rootfs/etc/timezone
+ chroot $rootfs dpkg-reconfigure -f noninteractive tzdata
+ elif [ -f /etc/sysconfig/clock ]; then
+ . /etc/sysconfig/clock
+ echo $ZONE > $rootfs/etc/timezone
+ chroot $rootfs dpkg-reconfigure -f noninteractive tzdata
+ else
+ echo "Timezone in container is not configured. Adjust it manually."
+ fi
# rmdir /dev/shm for containers that have /run/shm
# I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
# get bind mounted to the host's /run/shm. So try to rmdir
# it, and in case that fails move it out of the way.
- if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then
- mv $rootfs/dev/shm $rootfs/dev/shm.bak
+ # NOTE: This can only be removed once 12.04 goes out of support
+ if [ ! -L $rootfs/dev/shm ] && [ -e $rootfs/dev/shm ]; then
+ rmdir $rootfs/dev/shm 2>/dev/null || mv $rootfs/dev/shm $rootfs/dev/shm.bak
ln -s /run/shm $rootfs/dev/shm
fi
Generic Options
[ -r | --release <release> ]: Release name of container, defaults to host
-[ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture
-[ -C | --cloud ]: Configure container for use with meta-data service, defaults to no
+[ --rootfs <path> ]: Path in which rootfs will be placed
+[ -a | --arch ]: Architecture of container, defaults to host architecture
[ -T | --tarball ]: Location of tarball
[ -d | --debug ]: Run with 'set -x' to debug errors
-[ -s | --stream]: Use specified stream rather than 'released'
-
-Options, mutually exclusive of "-C" and "--cloud":
- [ -i | --hostid ]: HostID for cloud-init, defaults to random string
- [ -u | --userdata ]: Cloud-init user-data file to configure container on start
- [ -S | --auth-key ]: SSH Public key file to inject into container
- [ -L | --nolocales ]: Do not copy host's locales into container
+[ -s | --stream]: Use specified stream rather than 'tryreleased'
+Additionally, clone hooks can be passed through (ie, --userdata). For those,
+see:
+ $CLONE_HOOK_FN --help
EOF
return 0
}
-options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds: -l arch:,help,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata: -- "$@")
+options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds:u: -l arch:,help,rootfs:,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata:,vendordata:,mapped-uid:,mapped-gid: -- "$@")
if [ $? -ne 0 ]; then
usage $(basename $0)
exit 1
fi
eval set -- "$options"
-release=lucid
+mapped_uid=-1
+mapped_gid=-1
+# default release is trusty, or the systems release if recognized
+release=trusty
if [ -f /etc/lsb-release ]; then
. /etc/lsb-release
- case "$DISTRIB_CODENAME" in
- lucid|natty|oneiric|precise|quantal)
- release=$DISTRIB_CODENAME
- ;;
- esac
+ rels=$(ubuntu-distro-info --supported 2>/dev/null) ||
+ rels="$KNOWN_RELEASES"
+ for r in $rels; do
+ [ "$DISTRIB_CODENAME" = "$r" ] && release="$r"
+ done
fi
-arch=$(arch)
-
# Code taken from debootstrap
if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
arch=`/usr/bin/dpkg --print-architecture`
elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
arch=`/usr/bin/udpkg --print-architecture`
else
- arch=$(arch)
+ arch=$(uname -m)
if [ "$arch" = "i686" ]; then
arch="i386"
elif [ "$arch" = "x86_64" ]; then
arch="amd64"
elif [ "$arch" = "armv7l" ]; then
# note: arm images don't exist before oneiric; are called armhf in
- # precise and later; and are not supported by the query, so we don't actually
+ # trusty and later; and are not supported by the query, so we don't actually
# support them yet (see check later on). When Query2 is available,
# we'll use that to enable arm images.
- arch="armel"
+ arch="armhf"
+ elif [ "$arch" = "aarch64" ]; then
+ arch="arm64"
+ elif [ "$arch" = "ppc64le" ]; then
+ arch="ppc64el"
fi
fi
cloud=0
locales=1
flushcache=0
-stream="released"
+stream="tryreleased"
+cloneargs=()
while true
do
case "$1" in
- -h|--help) usage $0 && exit 0;;
+ -h|--help) usage $0 && exit 1;;
-p|--path) path=$2; shift 2;;
-n|--name) name=$2; shift 2;;
-F|--flush-cache) flushcache=1; shift 1;;
-r|--release) release=$2; shift 2;;
-a|--arch) arch=$2; shift 2;;
- -i|--hostid) host_id=$2; shift 2;;
- -u|--userdata) userdata=$2; shift 2;;
- -C|--cloud) cloud=1; shift 1;;
- -S|--auth-key) auth_key=$2; shift 2;;
- -L|--no_locales) locales=0; shift 2;;
-T|--tarball) tarball=$2; shift 2;;
-d|--debug) debug=1; shift 1;;
-s|--stream) stream=$2; shift 2;;
+ --rootfs) rootfs=$2; shift 2;;
+ -L|--no?locales) cloneargs[${#cloneargs[@]}]="--no-locales"; shift 1;;
+ -i|--hostid) cloneargs[${#cloneargs[@]}]="--hostid=$2"; shift 2;;
+ -u|--userdata) cloneargs[${#cloneargs[@]}]="--userdata=$2"; shift 2;;
+ -V|--vendordata) cloneargs[${#cloneargs[@]}]="--vendordata=$2"; shift 2;;
+ -C|--cloud) cloneargs[${#cloneargs[@]}]="--cloud"; shift 1;;
+ -S|--auth-key) cloneargs[${#cloneargs[@]}]="--auth-key=$2"; shift 2;;
+ --mapped-uid) mapped_uid=$2; shift 2;;
+ --mapped-gid) mapped_gid=$2; shift 2;;
--) shift 1; break ;;
*) break ;;
esac
done
+cloneargs=( "--name=$name" "${cloneargs[@]}" )
+
if [ $debug -eq 1 ]; then
set -x
fi
-if [ "$arch" == "i686" ]; then
+if [ "$arch" = "i686" ]; then
arch=i386
fi
-if [ $hostarch = "i386" -a $arch = "amd64" ]; then
- echo "can't create amd64 container on i386"
- exit 1
-fi
-
-if [ $arch != "i386" -a $arch != "amd64" ]; then
- echo "Only i386 and amd64 are supported by the ubuntu cloud template."
- exit 1
+if [ "$skip_arch_check" = "0" ]; then
+ case "$hostarch:$arch" in
+ $arch:$arch) : ;; # the host == container
+ amd64:i386) :;; # supported "cross"
+ arm64:arm*) :;; # supported "cross"
+ armel:armhf) :;; # supported "cross"
+ armhf:armel) :;; # supported "cross"
+ *) echo "cannot create '$arch' container on hostarch '$hostarch'";
+ exit 1;;
+ esac
fi
-if [ "$stream" != "daily" -a "$stream" != "released" ]; then
- echo "Only 'daily' and 'released' streams are supported"
+if [ "$stream" != "daily" -a "$stream" != "released" -a "$stream" != "tryreleased" ]; then
+ echo "Only 'daily' and 'released' and 'tryreleased' streams are supported"
exit 1
fi
-if [ -n "$userdata" ]; then
- if [ ! -f "$userdata" ]; then
- echo "Userdata ($userdata) does not exist"
- exit 1
- else
- userdata=`readlink -f $userdata`
- fi
-fi
-
-if [ -n "$auth_key" ]; then
- if [ ! -f "$auth_key" ]; then
- echo "--auth-key=${auth_key} must reference a file"
- exit 1
- fi
- auth_key=$(readlink -f "${auth_key}") ||
- { echo "failed to get full path for auth_key"; exit 1; }
-fi
-
if [ -z "$path" ]; then
echo "'path' parameter is required"
exit 1
# detect rootfs
config="$path/config"
-if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
- rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
-else
- rootfs=$path/rootfs
+if [ -z "$rootfs" ]; then
+ if grep -q '^lxc.rootfs.path' $config 2>/dev/null ; then
+ rootfs=$(awk -F= '/^lxc.rootfs.path =/{ print $2 }' $config)
+ else
+ rootfs=$path/rootfs
+ fi
fi
type ubuntu-cloudimg-query
# determine the url, tarball, and directory names
# download if needed
-cache="/var/cache/lxc/cloud-$release"
+# Allow the cache base to be set by environment variable
+cache=${LXC_CACHE_PATH:-"$STATE_DIR/cache/lxc"}/cloud-$release
+if [ $in_userns -eq 1 ]; then
+ STATE_DIR="$HOME/.cache/lxc"
+ cache=${LXC_CACHE_PATH:-"$STATE_DIR"}/cloud-$release
+fi
mkdir -p $cache
+if [ "$stream" = "tryreleased" ]; then
+ stream=released
+ ubuntu-cloudimg-query $release $stream $arch 1>/dev/null 2>/dev/null || stream=daily
+fi
+
if [ -n "$tarball" ]; then
url2="$tarball"
else
- url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
- url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/'`
+ if ! url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`; then
+ echo "There is no download available for release=$release, stream=$stream, arch=$arch"
+ [ "$stream" = "daily" ] || echo "You may try with '--stream=daily'"
+ exit 1
+ fi
+ if [ "$release" = "precise" ] || [ "$release" = "trusty" ]; then
+ url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/' -e 's/.tar.gz/.tar.xz/'`
+ else
+ url2=`echo $url1 | sed -e 's/.tar.gz/.squashfs/'`
+ fi
fi
filename=`basename $url2`
rm -f $filename
}
-buildcleanup()
-{
- cd $rootfs
- umount -l $cache/$xdir || true
- rm -rf $cache
-}
-
-# if the release doesn't have a *-rootfs.tar.gz, then create one from the
-# cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
-# a tarball from the mounted image.
-build_root_tgz()
-{
- url=$1
- filename=$2
-
- xdir=`mktemp -d -p .`
- tarname=`basename $url`
- imgname="$release-*-cloudimg-$arch.img"
- trap buildcleanup EXIT SIGHUP SIGINT SIGTERM
- if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
- rm -f $tarname
- echo "Downloading cloud image from $url"
- wget $url || { echo "Couldn't find cloud image $url."; exit 1; }
- fi
- echo "Creating new cached cloud image rootfs"
- tar --wildcards -zxf $tarname $imgname
- mount -o loop $imgname $xdir
- (cd $xdir; tar zcf ../$filename .)
- umount $xdir
- rm -f $tarname $imgname
- rmdir $xdir
- echo "New cloud image cache created"
- trap EXIT
- trap SIGHUP
- trap SIGINT
- trap SIGTERM
-}
-
-mkdir -p /var/lock/subsys/
-(
- flock -x 200
+do_extract_rootfs() {
cd $cache
if [ $flushcache -eq 1 ]; then
trap wgetcleanup EXIT SIGHUP SIGINT SIGTERM
if [ ! -f $filename ]; then
- wget $url2 || build_root_tgz $url1 $filename
+ wget $url2
fi
trap EXIT
trap SIGHUP
echo "Extracting container rootfs"
mkdir -p $rootfs
cd $rootfs
- tar -zxf $cache/$filename
-
-
- if [ $cloud -eq 0 ]; then
- echo "Configuring for running outside of a cloud environment"
- echo "If you want to configure for a cloud evironment, please use '-- -C' to create the container"
-
- seed_d=$rootfs/var/lib/cloud/seed/nocloud-net
- rhostid=$(uuidgen | cut -c -8)
- host_id=${hostid:-$rhostid}
- mkdir -p $seed_d
-
- cat > "$seed_d/meta-data" <<EOF
-instance-id: lxc-$host_id
-EOF
- if [ -n "$auth_key" ]; then
- {
- echo "public-keys:" &&
- sed -e '/^$/d' -e 's,^,- ,' "$auth_key" "$auth_key"
- } >> "$seed_d/meta-data"
- [ $? -eq 0 ] ||
- { echo "failed to write public keys to metadata"; exit 1; }
- fi
-
- rm $rootfs/etc/hostname
-
- if [ $locales -eq 1 ]; then
- cp /usr/lib/locale/locale-archive $rootfs/usr/lib/locale/locale-archive
- fi
-
- if [ -f "$userdata" ]; then
- echo "Using custom user-data"
- cp $userdata $seed_d/user-data
+ if [ "${filename##*.}" = "squashfs" ]; then
+ unsquashfs -n -f -d "$rootfs" "$cache/$filename"
+ else
+ if [ $in_userns -eq 1 ]; then
+ tar --anchored --exclude="dev/*" --numeric-owner -xpf "$cache/$filename"
+ mkdir -p $rootfs/dev/pts/
else
-
- if [ -z "$MIRROR" ]; then
- MIRROR="http://archive.ubuntu.com/ubuntu"
- fi
-
- cat > "$seed_d/user-data" <<EOF
-#cloud-config
-output: {all: '| tee -a /var/log/cloud-init-output.log'}
-apt_mirror: $MIRROR
-manage_etc_hosts: localhost
-locale: $(/usr/bin/locale | awk -F= '/LANG=/ {print$NF}')
-password: ubuntu
-chpasswd: { expire: False }
-EOF
+ tar --numeric-owner -xpf "$cache/$filename"
fi
- else
-
- echo "Configured for running in a cloud environment."
- echo "If you do not have a meta-data service, this container will likely be useless."
-
fi
-) 200>/var/lock/subsys/lxc-ubucloud
+}
+
+if [ -n "$tarball" ]; then
+ do_extract_rootfs
+else
+ mkdir -p "$STATE_DIR/lock/subsys/"
+ (
+ flock -x 9
+ do_extract_rootfs
+ ) 9>"$STATE_DIR/lock/subsys/lxc-ubuntu-cloud"
+fi
copy_configuration $path $rootfs $name $arch $release
+"$CLONE_HOOK_FN" "${cloneargs[@]}" "$rootfs"
+
+if [ $mapped_uid -ne -1 ]; then
+ chown $mapped_uid $path/config
+ chown -R $mapped_uid $STATE_DIR
+ chown -R $mapped_uid $cache
+fi
+if [ $mapped_gid -ne -1 ]; then
+ chgrp $mapped_gid $path/config
+ chgrp -R $mapped_gid $STATE_DIR
+ chgrp -R $mapped_gid $cache
+fi
+
echo "Container $name created."
exit 0
projects / mirror_lxc.git / blobdiff