Thomas Lamprecht [Wed, 10 May 2017 13:03:46 +0000 (15:03 +0200)]
use Syscall module instead of raw syscall numbers
Raw syscall numbers were not platform independent, so replace them
with the new PVE::Syscall module which gets the syscall numbers from
syscall.ph, which provides the platform local values.
we cannot directly use syscall.ph as it is no normal perl module and
so it's usage requires special handling
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
The commit changes the configuration before the VM is actually
migrated, so it is possible to have a wrong configuration when
migration fails for some reason. Also, I am quite unsure if
this automatic target change is really wanted. The patch also
contains wrong refereces to $self->{opts}->{node}.
Since the STOPPED state is set before cgroup cleanup we need
a better way to restart a container: We now install an
ExecStopPost snippet into the lxc@.service which when
encountering a reboot trigger file
(/var/lib/lxc/$vmid/reboot) performs a systemctl restart.
poststop: reboot: wait for lxc to exit before rebooting
otherwise it'll leak cgroup directories...
Note that we need to escape the lxc@.service context (by
entering a new scope) as well as close our ties to the lxc
monitor (the stdout pipe), otherwise this never finishes
properly.
Thomas Lamprecht [Thu, 16 Feb 2017 16:55:29 +0000 (17:55 +0100)]
Create: fix architecture detection in restore_archive
For detecting a CT templates architecture we used the `file -b -L`
output from the PVE host side.
If the container has a link:
/bin/sh -> /bin/bash
(Alpine Linux does that, for example) the '-L' flag from file
resolves the $rootfs/bin/sh to /bin/bash and thus checks the
architecture of bash on the PVE system, which is always 64 bit.
Add a helper which chroots in the rootfs to avoid problems with
absolute symlinks and use 'open' to avoid relative symlink problems
read the first 5 bytes from /bin/sh, 4 bytes for the ELF magic number
and the fifth for the ELF class, which tells us if we have a 32
(class 1) or 64 (class 2) bit ELF binary.
Return this information as an exit code to the parent.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Until now the lxc-start process was sort of a danglign
process in the pvedaemon.service cgroup when a container was
started from the web UI causing long stalls when trying to
restart pvedaemon and potential container kills. (Mostly
problematic when issuing package upgrades).
We now start containers via the lxc@ service file giving
them their own service cgroup.
The downside is that we'll have to patch the lxc@ service
file in the lxc package to Type=forking without the -F
option otherwise all of the the containers' console outputs
will end up in the logs...
according to "perldoc -f crypt", crypt() should downgrade
unicode strings anyway:
If using crypt() on a Unicode string (which potentially has
characters with codepoints above 255), Perl tries to make
sense of the situation by trying to downgrade (a copy of)
the string back to an eight-bit byte string before calling
crypt() (on that copy). If that works, good. If not,
crypt() dies with "Wide character in crypt".
login via Spice and ssh works now at least, the noVNC /
vncterm combo seems to be broken because of an unrelated
unicode issue..
This should allow vanilla lxc templates to work without the
double-console issue by removing their getty@.service
replacement. (Since we instead fixup
container-getty@.service)
Dietmar Maurer [Fri, 9 Dec 2016 07:08:11 +0000 (08:08 +0100)]
setup: more general approach to tty paths
Unprivileged containers always use an empty lxc.devttydir
option (iow. don't use the /dev/lxc/ subdirectory).
Alpine and Gentoo don't support it in general.
Define a devttydir() sub in Setup::Base which by default
returns "lxc/" or an empty string depending on whether it is
an unprivileged container. Gentoo and Alpine override it
with one which always returns an empty string.
Dominik Csapak [Fri, 2 Dec 2016 10:42:50 +0000 (11:42 +0100)]
implement lxc restart migration
this checks for the 'restart' parameter and if given, shuts down the
container with a optionally defined timeout (default 180s), and
continues the migration like an offline one.
after finishing, we start the container on the target node
this introduces a new option for non-volume mount points,
modeled after the way we define 'shared' storages: the
boolean flag 'shared' marks a mount point as available on
other nodes (default: false)
when migrating containers with non-volume mount points,
this new property is checked, and a migration is only
allowed if all such mount points are 'shared'.
setting this flag allows containers with non-volume mount
points to be migrated by the ha-manager as well, which was
previously not possible.
for backwards compatibility, the old "workaround" option
'-force' for 'pct migrate' still works, but displays a
warning pointing to the new options.