This should allow vanilla lxc templates to work without the
double-console issue by removing their getty@.service
replacement. (Since we instead fixup
container-getty@.service)
Dietmar Maurer [Fri, 9 Dec 2016 07:08:11 +0000 (08:08 +0100)]
setup: more general approach to tty paths
Unprivileged containers always use an empty lxc.devttydir
option (iow. don't use the /dev/lxc/ subdirectory).
Alpine and Gentoo don't support it in general.
Define a devttydir() sub in Setup::Base which by default
returns "lxc/" or an empty string depending on whether it is
an unprivileged container. Gentoo and Alpine override it
with one which always returns an empty string.
Dominik Csapak [Fri, 2 Dec 2016 10:42:50 +0000 (11:42 +0100)]
implement lxc restart migration
this checks for the 'restart' parameter and if given, shuts down the
container with a optionally defined timeout (default 180s), and
continues the migration like an offline one.
after finishing, we start the container on the target node
this introduces a new option for non-volume mount points,
modeled after the way we define 'shared' storages: the
boolean flag 'shared' marks a mount point as available on
other nodes (default: false)
when migrating containers with non-volume mount points,
this new property is checked, and a migration is only
allowed if all such mount points are 'shared'.
setting this flag allows containers with non-volume mount
points to be migrated by the ha-manager as well, which was
previously not possible.
for backwards compatibility, the old "workaround" option
'-force' for 'pct migrate' still works, but displays a
warning pointing to the new options.
Thomas Lamprecht [Tue, 18 Oct 2016 13:35:14 +0000 (15:35 +0200)]
vmstatus: fix memory usage value including cache sizes
The cgroup value memory.usage_in_bytes includes the memory used by
file buffers and other caches, resolve this by getting the cache
value from the memory.stat file and substract it from
memory.usage_in_bytes when calculating the current memory usage of
the CT.
This results in the same value as a `free` call from the container
does (when not including the buffered data), at least with a free
version which uses data from /proc and not the sysinfo() syscall.
Addresses partly the bug #1139
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> CC: Wolfgang Bumiller <w.bumiller@proxmox.com>
While a completely unconfigured network interface is
considered manually managed, one that contains an ipv4 _or_
an ipv6 address needs to remove sections with no configured
address rather than printing the 'iface' section header with
no content.
Dominik Csapak [Thu, 11 Aug 2016 09:12:52 +0000 (11:12 +0200)]
fix #1078: accept arch parameter
we now accept the arch parameter,
when value is valid according to the JSONSchema
and skip detection on creation/restoration when we
explicitly set one
Fix #1070: vzdump: handle sparse files in suspend mode
In suspend mode we perform two rsyncs with --inplace which
is incompatible to --sparse. However, only the second one
really needs to do in-place updates, so the first stage
should use --sparse instead.
LXC doesn't reload the configuration on reboot causing
hotplugged changes to not be persistent across
container-side reboots.
Instead, let the post-stop hook return false so that lxc
stops while starting up a new instance in the background
with the updated config.
since we allow to create a container without hostname
(we are using localhost by default then) and hostname
is marked optional in the JSONSchema of the config
we should be able to delete the hostname
the following checks were copied from QemuMigrate and adapted for LXC:
- check volumes from current configuration AND snapshots
- look for and check lost/found volumes via PVE::Storage
- check for local linked clones
also adapt PVE::LXC::destroy_lxc_container to optionally
write an arbitray new config instead of deleting it
altogether. the old configuration is replaced by an empty
temporary configuration at the moment, but this could easily
be reused if/when a "create"-locked config is used instead
of an empty one.
these were only used once and their method signatures were
already quite long, so split up into
- delete old existing container and write new config
- mount
- restore archive / extract template
- restore configuration / setup new container
- unmount
rw/ro race occurs when a container contains the same bind
mount twice and another container contains a bind mount
containing the first container's destination. If the double
bind mounts are both meant to be read-only then the second
container could theoretically swap them out between the
mount and the read-only remount call, then swap them back
for the test. So to verify this we use the same file
descriptor we use for the dev/inode check and perform an
faccessat() call and expect it to return EROFS and nothing
else.
Also include O_NOFOLLOW in the checks' openat() calls.