X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=src%2FPVE%2FLXC%2FCreate.pm;h=a46a50c268e3222f3c1a9ff4028c611975e09964;hb=391706445abd30f8f33d80baf58977016632bd19;hp=186da280fd917eeeba48fb954679f14e283cf825;hpb=7af97ad5f89ff197db94e9aa68dc800084c7c3ae;p=pve-container.git diff --git a/src/PVE/LXC/Create.pm b/src/PVE/LXC/Create.pm index 186da28..a46a50c 100644 --- a/src/PVE/LXC/Create.pm +++ b/src/PVE/LXC/Create.pm @@ -4,304 +4,241 @@ use strict; use warnings; use File::Basename; use File::Path; -use Data::Dumper; +use Fcntl; use PVE::Storage; use PVE::LXC; use PVE::LXC::Setup; use PVE::VZDump::ConvertOVZ; +use PVE::Tools; +use POSIX; -sub next_free_nbd_dev { - - for(my $i = 0;;$i++) { - my $dev = "/dev/nbd$i"; - last if ! -b $dev; - next if -f "/sys/block/nbd$i/pid"; # busy - return $dev; - } - die "unable to find free nbd device\n"; -} - -sub restore_archive { - my ($archive, $rootdir, $conf) = @_; - - my $userns_cmd = []; - -# we always use the same mapping: 'b:0:100000:65536' -# if ($conf->{'lxc.id_map'}) { -# $userns_cmd = ['lxc-usernsexec', '-m', 'b:0:100000:65536', '--']; -# PVE::Tools::run_command(['chown', '-R', '100000:100000', $rootdir]); -# } - - my $cmd = [@$userns_cmd, 'tar', 'xpf', $archive, '--numeric-owner', '--totals', - '--sparse', '-C', $rootdir]; - - push @$cmd, '--anchored'; - push @$cmd, '--exclude' , './dev/*'; - - if ($archive eq '-') { - print "extracting archive from STDIN\n"; - PVE::Tools::run_command($cmd, input => "<&STDIN"); - } else { - print "extracting archive '$archive'\n"; - PVE::Tools::run_command($cmd); - } - - # determine file type of /usr/bin/file itself to get guests' architecture - $cmd = [@$userns_cmd, '/usr/bin/file', '-b', '-L', "$rootdir/usr/bin/file"]; - PVE::Tools::run_command($cmd, outfunc => sub { - shift =~ /^ELF (\d{2}-bit)/; # safely assumes x86 linux - my $arch_str = $1; - $conf->{'arch'} = 'amd64'; # defaults to 64bit - if(defined($arch_str)) { - $conf->{'arch'} = 'i386' if $arch_str =~ /32/; - print "Detected container architecture: $conf->{'arch'}\n"; - } else { - print "CT architecture detection failed, falling back to amd64.\n" . - "Edit the config in /etc/pve/nodes/{node}/lxc/{vmid}/config " . - "to set another architecture.\n"; - } - }); -} +sub detect_architecture { + my ($rootdir) = @_; -sub tar_archive_search_conf { - my ($archive) = @_; + # see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format - die "ERROR: file '$archive' does not exist\n" if ! -f $archive; + my $supported_elf_machine = { + 0x03 => 'i386', + 0x3e => 'amd64', + 0x28 => 'armhf', + 0xb7 => 'arm64', + }; - my $pid = open(my $fh, '-|', 'tar', 'tf', $archive) || - die "unable to open file '$archive'\n"; + my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory + my $detect_arch = sub { + # chroot avoids a problem where we check the binary of the host system + # if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash) + chroot($rootdir) or die "chroot '$rootdir' failed: $!\n"; + chdir('/') or die "failed to change to root directory\n"; - my $file; - while (defined($file = <$fh>)) { - if ($file =~ m!^(\./etc/vzdump/(pct|vps)\.conf)$!) { - $file = $1; # untaint - last; - } - } + open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n"; + binmode($fh); - kill 15, $pid; - waitpid $pid, 0; - close $fh; + my $length = read($fh, my $data, 20) or die "read failed: $!\n"; - die "ERROR: archive contains no configuration file\n" if !$file; - chomp $file; + # 4 bytes ELF magic number and 1 byte ELF class, padding, machine + my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data); - return $file; -} + die "'$elf_fn' does not resolve to an ELF!\n" + if (!defined($class) || !defined($magic) || $magic ne "\177ELF"); -sub recover_config { - my ($archive) = @_; + my $arch = $supported_elf_machine->{$machine}; + die "'$elf_fn' has unknown ELF machine '$machine'!\n" + if !defined($arch); - my $conf_file = tar_archive_search_conf($archive); - - my $raw = ''; - my $out = sub { - my $output = shift; - $raw .= "$output\n"; + return $arch; }; - PVE::Tools::run_command(['tar', '-xpOf', $archive, $conf_file, '--occurrence'], outfunc => $out); - - my $conf; - my $disksize; - - if ($conf_file =~ m/pct\.conf/) { - - $conf = PVE::LXC::parse_pct_config("/lxc/0.conf" , $raw); - - delete $conf->{snapshots}; - delete $conf->{template}; # restored CT is never a template - - if (defined($conf->{rootfs})) { - my $rootinfo = PVE::LXC::parse_ct_mountpoint($conf->{rootfs}); - $disksize = $rootinfo->{size} if defined($rootinfo->{size}); - } - - } elsif ($conf_file =~ m/vps\.conf/) { - - ($conf, $disksize) = PVE::VZDump::ConvertOVZ::convert_ovz($raw); - + my $arch = eval { PVE::Tools::run_fork_with_timeout(5, $detect_arch) }; + if (my $err = $@) { + $arch = 'amd64'; + print "Architecture detection failed: $err\nFalling back to amd64.\n" . + "Use `pct set VMID --arch ARCH` to change.\n"; } else { - - die "internal error"; + print "Detected container architecture: $arch\n"; } - return wantarray ? ($conf, $disksize) : $conf; + return $arch; } -sub restore_and_configure { - my ($vmid, $archive, $rootdir, $conf, $password, $restore) = @_; - - restore_archive($archive, $rootdir, $conf); - - if (!$restore) { - my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS - - PVE::LXC::write_config($vmid, $conf); # safe config (after OS detection) - $lxc_setup->post_create_hook($password); - } else { - # restore: try to extract configuration from archive - - my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf"; - my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf"; - if (-f $pct_cfg_fn) { - my $raw = PVE::Tools::file_get_contents($pct_cfg_fn); - my $oldconf = PVE::LXC::parse_pct_config("/lxc/$vmid.conf", $raw); - - foreach my $key (keys %$oldconf) { - next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots'; - $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key}); - } - - } elsif (-f $ovz_cfg_fn) { - print "###########################################################\n"; - print "Converting OpenVZ configuration to LXC.\n"; - print "Please check the configuration and reconfigure the network.\n"; - print "###########################################################\n"; - - my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn); - my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw); - foreach my $key (keys %$oldconf) { - $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key}); +sub restore_archive { + my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_; + + my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf); + my $userns_cmd = PVE::LXC::userns_command($id_map); + + my $archive_fh; + my $tar_input = '<&STDIN'; + my @compression_opt; + if ($archive ne '-') { + # GNU tar refuses to autodetect this... *sigh* + my %compression_map = ( + '.gz' => '-z', + '.bz2' => '-j', + '.xz' => '-J', + '.lzo' => '--lzop', + ); + if ($archive =~ /\.tar(\.[^.]+)?$/) { + if (defined($1)) { + die "unrecognized compression format: $1\n" if !defined($compression_map{$1}); + @compression_opt = $compression_map{$1}; } - } else { - print "###########################################################\n"; - print "Backup archive does not contain any configuration\n"; - print "###########################################################\n"; + die "file does not look like a template archive: $archive\n"; } + sysopen($archive_fh, $archive, O_RDONLY) + or die "failed to open '$archive': $!\n"; + my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0); + $archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC())); + $tar_input = '<&'.fileno($archive_fh); } -} -# use new subvolume API -sub create_rootfs_subvol { - my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_; + my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals', + @PVE::Storage::Plugin::COMMON_TAR_FLAGS, + '-C', $rootdir]; - my $private = PVE::Storage::path($storage_conf, $volid); - (-d $private) || die "unable to get container private dir '$private' - $!\n"; + # skip-old-files doesn't have anything to do with time (old/new), but is + # simply -k (annoyingly also called --keep-old-files) without the 'treat + # existing files as errors' part... iow. it's bsdtar's interpretation of -k + # *sigh*, gnu... + push @$cmd, '--skip-old-files'; + push @$cmd, '--anchored'; + push @$cmd, '--exclude' , './dev/*'; - restore_and_configure($vmid, $archive, $private, $conf, $password, $restore); -} + if (defined($bwlimit)) { + $cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ]; + } -# direct mount -sub create_rootfs_dev { - my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_; + if ($archive eq '-') { + print "extracting archive from STDIN\n"; + } else { + print "extracting archive '$archive'\n"; + } + eval { PVE::Tools::run_command($cmd, input => $tar_input); }; + my $err = $@; + close($archive_fh) if defined $archive_fh; + die $err if $err && !$no_unpack_error; - my $image_path = PVE::Storage::path($storage_conf, $volid); - - my $cmd = ['mkfs.ext4', $image_path]; - PVE::Tools::run_command($cmd); + # if arch is set, we do not try to autodetect it + return if defined($conf->{arch}); - my $mountpoint; + $conf->{arch} = detect_architecture($rootdir); +} - eval { - my $tmp = "/var/lib/lxc/$vmid/rootfs"; - File::Path::mkpath($tmp); - PVE::Tools::run_command(['mount', '-t', 'ext4', $image_path, $tmp]); - $mountpoint = $tmp; +sub recover_config { + my ($archive) = @_; - restore_and_configure($vmid, $archive, $mountpoint, $conf, $password, $restore); - }; - if (my $err = $@) { - if ($mountpoint) { - eval { PVE::Tools::run_command(['umount', $mountpoint]) }; - warn $@ if $@; - } - die $err; - } + my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct|vps)\.conf)$!); + my $conf; + my $mp_param = {}; - PVE::Tools::run_command(['umount', '-l', $mountpoint]); -} + if ($conf_file =~ m/pct\.conf/) { -# create a raw file, then loop mount -sub create_rootfs_dir_loop { - my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_; + $conf = PVE::LXC::Config::parse_pct_config("/lxc/0.conf" , $raw); - my $image_path = PVE::Storage::path($storage_conf, $volid); + delete $conf->{snapshots}; - my $cmd = ['mkfs.ext4', $image_path]; - PVE::Tools::run_command($cmd); + PVE::LXC::Config->foreach_mountpoint($conf, sub { + my ($ms, $mountpoint) = @_; + $mp_param->{$ms} = $conf->{$ms}; + }); - my $mountpoint; + } elsif ($conf_file =~ m/vps\.conf/) { - my $loopdev; - eval { - my $parser = sub { - my $line = shift; - $loopdev = $line if $line =~m|^/dev/loop\d+$|; - }; - PVE::Tools::run_command(['losetup', '--find', '--show', $image_path], outfunc => $parser); + ($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw); - my $tmp = "/var/lib/lxc/$vmid/rootfs"; - File::Path::mkpath($tmp); - PVE::Tools::run_command(['mount', '-t', 'ext4', $loopdev, $tmp]); - $mountpoint = $tmp; + } else { - restore_and_configure($vmid, $archive, $mountpoint, $conf, $password, $restore); - }; - if (my $err = $@) { - if ($mountpoint) { - eval { PVE::Tools::run_command(['umount', '-d', $mountpoint]) }; - warn $@ if $@; - } else { - eval { PVE::Tools::run_command(['losetup', '-d', $loopdev]) if $loopdev; }; - warn $@ if $@; - } - die $err; + die "internal error"; } - PVE::Tools::run_command(['umount', '-l', '-d', $mountpoint]); + return wantarray ? ($conf, $mp_param) : $conf; } -sub create_rootfs { - my ($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_; - - my $config_fn = PVE::LXC::config_file($vmid); - if (-f $config_fn) { - die "container exists" if !$restore; # just to be sure - - my $old_conf = PVE::LXC::load_config($vmid); - - # destroy old container volume - PVE::LXC::destory_lxc_container($storage_cfg, $vmid, $old_conf); +sub restore_configuration { + my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_; + + # restore: try to extract configuration from archive + + my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf"; + my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw"; + my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf"; + if (-f $pct_cfg_fn) { + my $raw = PVE::Tools::file_get_contents($pct_cfg_fn); + my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw); + + foreach my $key (keys %$oldconf) { + next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged' || $key eq 'parent'; + next if $key =~ /^mp\d+$/; # don't recover mountpoints + next if $key =~ /^unused\d+$/; # don't recover unused disks + # we know if it was a template in the restore API call and check if the target + # storage supports creating a template there + next if $key =~ /^template$/; + + if ($key eq 'lxc') { + my $lxc_list = $oldconf->{'lxc'}; + if ($restricted) { + warn "skipping custom lxc options, restore manually as root:\n"; + warn "--------------------------------\n"; + foreach my $lxc_opt (@$lxc_list) { + warn "$lxc_opt->[0]: $lxc_opt->[1]\n" + } + warn "--------------------------------\n"; + } else { + @{$conf->{$key}} = (@$lxc_list, @{$conf->{$key}}); + } + next; + } - # do not copy all settings to restored container - foreach my $opt (qw(rootfs digest snapshots)) { - delete $old_conf->{$opt}; + if ($unique && $key =~ /^net\d+$/) { + my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key}); + my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg'); + $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix}); + $conf->{$key} = PVE::LXC::Config->print_lxc_network($net); + next; + } + $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key}); + } + unlink($pct_cfg_fn); + + # note: this file is possibly from the container itself in backups + # created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x) + # only copy non-empty, non-symlink files, and only if the user is + # allowed to modify the firewall config anyways + if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) { + my $pve_firewall_dir = '/etc/pve/firewall'; + my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw"; + if ($skip_fw) { + warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n"; + warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n" + if -e $pct_fwcfg_target; + } else { + mkdir $pve_firewall_dir; # make sure the directory exists + PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target); + } + unlink $pct_fwcfg_fn; } - PVE::LXC::update_pct_config($vmid, $conf, 0, $old_conf); - - PVE::LXC::create_config($vmid, $conf); - } else { - - PVE::LXC::create_config($vmid, $conf); - } + } elsif (-f $ovz_cfg_fn) { + print "###########################################################\n"; + print "Converting OpenVZ configuration to LXC.\n"; + print "Please check the configuration and reconfigure the network.\n"; + print "###########################################################\n"; - my ($vtype, undef, undef, undef, undef, $isBase, $format) = - PVE::Storage::parse_volname($storage_cfg, $volid); - - die "got strange vtype '$vtype'\n" if $vtype ne 'images'; - - die "unable to install into base volume" if $isBase; - - if ($format eq 'subvol') { - create_rootfs_subvol($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore); - } elsif ($format eq 'raw') { - my $scfg = PVE::Storage::storage_config($storage_cfg, $storage); - PVE::Storage::activate_storage($storage_cfg, $storage); - PVE::Storage::activate_volumes($storage_cfg, [$volid]); - if ($scfg->{path}) { - create_rootfs_dir_loop($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore); - } elsif ($scfg->{type} eq 'drbd' || $scfg->{type} eq 'rbd') { - create_rootfs_dev($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore); - } else { - die "unable to create containers on storage type '$scfg->{type}'\n"; + my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS + $conf->{ostype} = $lxc_setup->{conf}->{ostype}; + my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn); + my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw); + foreach my $key (keys %$oldconf) { + $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key}); } - PVE::Storage::deactivate_volumes($storage_cfg, [$volid]); + unlink($ovz_cfg_fn); + } else { - die "unsupported image format '$format'\n"; + print "###########################################################\n"; + print "Backup archive does not contain any configuration\n"; + print "###########################################################\n"; } }