3 # Client script for LXC container images.
5 # Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
7 # This library is free software; you can redistribute it and/or
8 # modify it under the terms of the GNU Lesser General Public
9 # License as published by the Free Software Foundation; either
10 # version 2.1 of the License, or (at your option) any later version.
12 # This library is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 # Lesser General Public License for more details.
17 # You should have received a copy of the GNU Lesser General Public
18 # License along with this library; if not, write to the Free Software
19 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
24 LOCALSTATEDIR
="@LOCALSTATEDIR@"
25 LXC_HOOK_DIR
="@LXCHOOKDIR@"
26 LXC_TEMPLATE_CONFIG
="@LXCTEMPLATECONFIG@"
31 DOWNLOAD_COMPAT_LEVEL
=5
33 DOWNLOAD_FLUSH_CACHE
="false"
34 DOWNLOAD_FORCE_CACHE
="false"
35 DOWNLOAD_INTERACTIVE
="false"
36 DOWNLOAD_KEYID
="0xE7FB0CAEC8173D669066514CBAEFF88C22F6E216"
37 DOWNLOAD_LIST_IMAGES
="false"
38 DOWNLOAD_MODE
="system"
39 DOWNLOAD_READY_GPG
="false"
41 DOWNLOAD_SERVER
="images.linuxcontainers.org"
42 DOWNLOAD_SHOW_GPG_WARNING
="true"
43 DOWNLOAD_SHOW_HTTP_WARNING
="true"
44 DOWNLOAD_TARGET
="system"
46 DOWNLOAD_USE_CACHE
="false"
47 DOWNLOAD_VALIDATE
="true"
48 DOWNLOAD_VARIANT
="default"
57 if [ -z "${DOWNLOAD_KEYSERVER:-}" ]; then
58 DOWNLOAD_KEYSERVER
="hkp://pool.sks-keyservers.net"
60 # Deal with GPG over http proxy
61 if [ -n "${http_proxy:-}" ]; then
62 DOWNLOAD_KEYSERVER
="hkp://p80.pool.sks-keyservers.net:80"
63 DOWNLOAD_GPG_PROXY
="--keyserver-options http-proxy=\"${http_proxy}\""
67 # Make sure the usual locations are in PATH
68 export PATH
=$PATH:/usr
/sbin
:/usr
/bin
:/sbin
:/bin
70 # Some useful functions
72 if [ -d "${DOWNLOAD_TEMP}" ]; then
73 rm -Rf "${DOWNLOAD_TEMP}"
88 if ! wget_wrapper
-T 30 -q "https://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev
/null
2>&1; then
89 if ! wget_wrapper
-T 30 -q "http://${DOWNLOAD_SERVER}/$1" -O "$2" >/dev
/null
2>&1; then
90 if [ "$3" = "noexit" ]; then
93 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
96 elif [ "${DOWNLOAD_SHOW_HTTP_WARNING}" = "true" ]; then
97 DOWNLOAD_SHOW_HTTP_WARNING
="false"
98 echo "WARNING: Failed to download the file over HTTPs" 1>&2
99 echo " The file was instead download over HTTP " 1>&2
100 echo "A server replay attack may be possible!" 1>&2
106 if ! download_file
"$1" "$2" noexit
; then
107 if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
108 if [ "$3" = "normal" ]; then
109 echo "ERROR: Failed to download http://${DOWNLOAD_SERVER}/$1" 1>&2
121 if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
125 if [ "${DOWNLOAD_READY_GPG}" = "true" ]; then
129 echo "Setting up the GPG keyring"
131 mkdir
-p "${DOWNLOAD_TEMP}/gpg"
132 chmod 700 "${DOWNLOAD_TEMP}/gpg"
133 export GNUPGHOME
="${DOWNLOAD_TEMP}/gpg"
136 for _
in $
(seq 3); do
137 if $
(gpg
--keyserver "${DOWNLOAD_KEYSERVER}" ${DOWNLOAD_GPG_PROXY:-} \
138 --recv-keys "${DOWNLOAD_KEYID}" >/dev
/null
2>&1); then
145 if [ -z "${success}" ]; then
146 echo "ERROR: Unable to fetch GPG key from keyserver"
150 DOWNLOAD_READY_GPG
="true"
154 if [ "${DOWNLOAD_VALIDATE}" = "false" ]; then
155 if [ "${DOWNLOAD_SHOW_GPG_WARNING}" = "true" ]; then
156 echo "WARNING: Running without gpg validation!" 1>&2
158 DOWNLOAD_SHOW_GPG_WARNING
="false"
162 if ! gpg
--verify "$1" >/dev
/null
2>&1; then
163 echo "ERROR: Invalid signature for $1" 1>&2
169 [ -e /proc
/self
/uid_map
] ||
{ echo no
; return; }
170 while read -r line
; do
171 fields
="$(echo "$line" | awk '{ print $1 " " $2 " " $3 }')"
172 if [ "${fields}" = "0 0 4294967295" ]; then
176 if echo "${fields}" |
grep -q " 0 1$"; then
180 done < /proc
/self
/uid_map
182 [ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && { echo userns-root
; return; }
187 FILE_PATH
="${LXC_CACHE_PATH}/$1"
189 if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
190 FILE_PATH
="${FILE_PATH}-${DOWNLOAD_MODE}"
193 if [ -e "${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}" ]; then
194 FILE_PATH
="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
202 LXC container image downloader
205 [ -h | --help ]: Print this help message and exit
206 [ -l | --list ]: List all available images and exit
209 [ -d | --dist <distribution> ]: The name of the distribution
210 [ -r | --release <release> ]: Release name/version
211 [ -a | --arch <architecture> ]: Architecture of the container
214 [ --variant <variant> ]: Variant of the image (default: "default")
215 [ --server <server> ]: Image server (default: "images.linuxcontainers.org")
216 [ --keyid <keyid> ]: GPG keyid (default: 0x...)
217 [ --keyserver <keyserver> ]: GPG keyserver to use. Environment variable: DOWNLOAD_KEYSERVER
218 [ --no-validate ]: Disable GPG validation (not recommended)
219 [ --flush-cache ]: Flush the local copy (if present)
220 [ --force-cache ]: Force the use of the local copy even if expired
222 LXC internal arguments (do not pass manually!):
223 [ --name <name> ]: The container name
224 [ --path <path> ]: The path to the container
225 [ --rootfs <rootfs> ]: The path to the container's rootfs
226 [ --mapped-uid <map> ]: A uid map (user namespaces)
227 [ --mapped-gid <map> ]: A gid map (user namespaces)
229 Environment Variables:
230 DOWNLOAD_KEYSERVER : The URL of the key server to use, instead of the default.
231 Can be further overridden by using optional argument --keyserver
237 if ! options
=$
(getopt
-o d
:r
:a
:hl
-l dist
:,release
:,arch
:,help,list
,variant
:,\
238 server
:,keyid
:,keyserver
:,no-validate
,flush-cache
,force-cache
,name
:,path
:,\
239 rootfs
:,mapped-uid
:,mapped-gid
: -- "$@"); then
243 eval set -- "$options"
247 -h|
--help) usage
&& exit 1;;
248 -l|
--list) DOWNLOAD_LIST_IMAGES
="true"; shift 1;;
249 -d|
--dist) DOWNLOAD_DIST
="$2"; shift 2;;
250 -r|
--release) DOWNLOAD_RELEASE
="$2"; shift 2;;
251 -a|
--arch) DOWNLOAD_ARCH
="$2"; shift 2;;
252 --variant) DOWNLOAD_VARIANT
="$2"; shift 2;;
253 --server) DOWNLOAD_SERVER
="$2"; shift 2;;
254 --keyid) DOWNLOAD_KEYID
="$2"; shift 2;;
255 --keyserver) DOWNLOAD_KEYSERVER
="$2"; shift 2;;
256 --no-validate) DOWNLOAD_VALIDATE
="false"; shift 1;;
257 --flush-cache) DOWNLOAD_FLUSH_CACHE
="true"; shift 1;;
258 --force-cache) DOWNLOAD_FORCE_CACHE
="true"; shift 1;;
259 --name) LXC_NAME
="$2"; shift 2;;
260 --path) LXC_PATH
="$2"; shift 2;;
261 --rootfs) LXC_ROOTFS
="$2"; shift 2;;
262 --mapped-uid) LXC_MAPPED_UID
="$2"; shift 2;;
263 --mapped-gid) LXC_MAPPED_GID
="$2"; shift 2;;
268 # Check for required binaries
269 for bin
in tar xz wget
; do
270 if ! command -V "${bin}" >/dev
/null
2>&1; then
271 echo "ERROR: Missing required tool: ${bin}" 1>&2
277 if [ "${DOWNLOAD_VALIDATE}" = "true" ]; then
278 if ! command -V gpg
>/dev
/null
2>&1; then
279 echo "ERROR: Missing recommended tool: gpg" 1>&2
280 echo "You can workaround this by using --no-validate" 1>&2
285 # Check that we have all variables we need
286 if [ -z "${LXC_NAME}" ] || [ -z "${LXC_PATH}" ] || [ -z "${LXC_ROOTFS}" ]; then
287 if [ "${DOWNLOAD_LIST_IMAGES}" != "true" ]; then
288 echo "ERROR: Please pass the name, path, and rootfs for the container" 1>&2
293 USERNS
="$(in_userns)"
295 if [ "${USERNS}" != "no" ]; then
296 if [ "${USERNS}" = "yes" ]; then
297 if [ -z "${LXC_MAPPED_UID}" ] ||
[ "${LXC_MAPPED_UID}" = "-1" ]; then
298 echo "ERROR: In a user namespace without a map" 1>&2
302 DOWNLOAD_TARGET
="user"
305 DOWNLOAD_TARGET
="system"
309 if [ -z "${DOWNLOAD_DIST}" ] || [ -z "${DOWNLOAD_RELEASE}" ] || [ -z "${DOWNLOAD_ARCH}" ]; then
310 DOWNLOAD_INTERACTIVE
="true"
313 # Trap all exit signals
314 trap cleanup EXIT HUP INT TERM
316 # /tmp may be mounted in tmpfs or noexec
317 if mountpoint
-q /tmp
; then
318 DOWNLOAD_TEMP
="${LXC_PATH}"
321 if ! command -V mktemp
>/dev
/null
2>&1; then
322 DOWNLOAD_TEMP
="${DOWNLOAD_TEMP}/tmp/lxc-download.$$"
323 elif [ -n "${DOWNLOAD_TEMP}" ]; then
324 mkdir
-p "${DOWNLOAD_TEMP}"
325 DOWNLOAD_TEMP
="$(mktemp -p ${DOWNLOAD_TEMP} -d)"
327 DOWNLOAD_TEMP
="${DOWNLOAD_TEMP}$(mktemp -d)"
331 if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ] ||
[ "${DOWNLOAD_INTERACTIVE}" = "true" ]; then
336 DOWNLOAD_INDEX_PATH
="/meta/1.0/index-${DOWNLOAD_MODE}"
338 echo "Downloading the image index"
339 if ! download_file
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" "${DOWNLOAD_TEMP}/index" noexit ||
340 ! download_sig
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" "${DOWNLOAD_TEMP}/index.asc" noexit
; then
341 download_file
"${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
342 download_sig
"${DOWNLOAD_INDEX_PATH}.asc" "${DOWNLOAD_TEMP}/index.asc" normal
345 gpg_validate
"${DOWNLOAD_TEMP}/index.asc"
350 printf "DIST\tRELEASE\tARCH\tVARIANT\tBUILD\n"
352 while IFS
=';' read -r f1 f2 f3 f4 f5 f6
; do
353 [ -n "${DOWNLOAD_DIST}" ] && [ "$f1" != "${DOWNLOAD_DIST}" ] && continue
354 [ -n "${DOWNLOAD_RELEASE}" ] && [ "$f2" != "${DOWNLOAD_RELEASE}" ] && continue
355 [ -n "${DOWNLOAD_ARCH}" ] && [ "$f3" != "${DOWNLOAD_ARCH}" ] && continue
356 [ -n "${DOWNLOAD_VARIANT}" ] && [ "$f4" != "${DOWNLOAD_VARIANT}" ] && continue
357 [ -z "${f5}" ] ||
[ -z "${f6}" ] && continue
359 printf "%s\t%s\t%s\t%s\t%s\n" "${f1}" "${f2}" "${f3}" "${f4}" "${f5}"
360 unset f1 f2 f3 f4 f5 f6
361 done < "${DOWNLOAD_TEMP}/index"
364 if [ "${DOWNLOAD_LIST_IMAGES}" = "true" ]; then
371 if [ -z "${DOWNLOAD_DIST}" ]; then
372 echo "Distribution: "
373 read -r DOWNLOAD_DIST
376 if [ -z "${DOWNLOAD_RELEASE}" ]; then
378 read -r DOWNLOAD_RELEASE
381 if [ -z "${DOWNLOAD_ARCH}" ]; then
382 echo "Architecture: "
383 read -r DOWNLOAD_ARCH
390 if [ "${DOWNLOAD_TARGET}" = "system" ]; then
391 LXC_CACHE_BASE
="${LOCALSTATEDIR}/cache/lxc/"
393 LXC_CACHE_BASE
="${HOME}/.cache/lxc/"
396 # Allow the setting of the LXC_CACHE_PATH with the usage of environment variables.
397 LXC_CACHE_PATH
="${LXC_CACHE_PATH:-"${LXC_CACHE_BASE}"}"
398 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/download/${DOWNLOAD_DIST}"
399 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/${DOWNLOAD_RELEASE}/${DOWNLOAD_ARCH}/"
400 LXC_CACHE_PATH
="${LXC_CACHE_PATH}/${DOWNLOAD_VARIANT}"
402 if [ -d "${LXC_CACHE_PATH}" ]; then
403 if [ "${DOWNLOAD_FLUSH_CACHE}" = "true" ]; then
404 echo "Flushing the cache..."
405 rm -Rf "${LXC_CACHE_PATH}"
406 elif [ "${DOWNLOAD_FORCE_CACHE}" = "true" ]; then
407 DOWNLOAD_USE_CACHE
="true"
409 DOWNLOAD_USE_CACHE
="true"
410 if [ -e "$(relevant_file expiry)" ]; then
411 if [ "$(cat "$
(relevant_file expiry
)")" -lt "$(date +%s)" ]; then
412 echo "The cached copy has expired, re-downloading..."
413 DOWNLOAD_USE_CACHE
="false"
419 # Download what's needed
420 if [ "${DOWNLOAD_USE_CACHE}" = "false" ]; then
425 DOWNLOAD_INDEX_PATH
="/meta/1.0/index-${DOWNLOAD_MODE}"
427 echo "Downloading the image index"
428 if ! download_file
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}" "${DOWNLOAD_TEMP}/index" noexit ||
429 ! download_sig
"${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc" "${DOWNLOAD_TEMP}/index.asc" noexit
; then
430 download_file
"${DOWNLOAD_INDEX_PATH}" "${DOWNLOAD_TEMP}/index" normal
431 download_sig
"${DOWNLOAD_INDEX_PATH}.asc" "${DOWNLOAD_TEMP}/index.asc" normal
434 gpg_validate
"${DOWNLOAD_TEMP}/index.asc"
437 while IFS
=';' read -r f1 f2 f3 f4 f5 f6
; do
438 if [ "${f1}" != "${DOWNLOAD_DIST}" ] || \
439 [ "${f2}" != "${DOWNLOAD_RELEASE}" ] || \
440 [ "${f3}" != "${DOWNLOAD_ARCH}" ] || \
441 [ "${f4}" != "${DOWNLOAD_VARIANT}" ] || \
446 DOWNLOAD_BUILD
="${f5}"
449 unset f1 f2 f3 f4 f5 f6
451 done < "${DOWNLOAD_TEMP}/index"
453 if [ -z "${DOWNLOAD_URL}" ]; then
454 echo "ERROR: Couldn't find a matching image" 1>&1
458 if [ -d "${LXC_CACHE_PATH}" ] && [ -f "${LXC_CACHE_PATH}/build_id" ] && \
459 [ "$(cat "${LXC_CACHE_PATH}/build_id
")" = "${DOWNLOAD_BUILD}" ]; then
460 echo "The cache is already up to date"
461 echo "Using image from local cache"
463 # Download the actual files
464 echo "Downloading the rootfs"
465 download_file
"${DOWNLOAD_URL}/rootfs.tar.xz" "${DOWNLOAD_TEMP}/rootfs.tar.xz" normal
466 download_sig
"${DOWNLOAD_URL}/rootfs.tar.xz.asc" "${DOWNLOAD_TEMP}/rootfs.tar.xz.asc" normal
467 gpg_validate
"${DOWNLOAD_TEMP}/rootfs.tar.xz.asc"
469 echo "Downloading the metadata"
470 download_file
"${DOWNLOAD_URL}/meta.tar.xz" "${DOWNLOAD_TEMP}/meta.tar.xz" normal
471 download_sig
"$DOWNLOAD_URL/meta.tar.xz.asc" "${DOWNLOAD_TEMP}/meta.tar.xz.asc" normal
472 gpg_validate
"${DOWNLOAD_TEMP}/meta.tar.xz.asc"
474 if [ -d "${LXC_CACHE_PATH}" ]; then
475 rm -Rf "${LXC_CACHE_PATH}"
477 mkdir
-p "${LXC_CACHE_PATH}"
478 mv "${DOWNLOAD_TEMP}/rootfs.tar.xz" "${LXC_CACHE_PATH}"
479 if ! tar Jxf
"${DOWNLOAD_TEMP}/meta.tar.xz" -C "${LXC_CACHE_PATH}"; then
480 echo "ERROR: Invalid rootfs tarball." 2>&1
484 echo "${DOWNLOAD_BUILD}" > "${LXC_CACHE_PATH}/build_id"
486 if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
487 # As the script is run in strict mode (set -eu), all commands
488 # exiting with non 0 would make the script stop.
489 # || true or || : (more portable) prevents that.
490 chown
-R "${LXC_MAPPED_UID}" "${LXC_CACHE_BASE}" >/dev
/null
2>&1 ||
:
492 if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
493 chgrp
-R "${LXC_MAPPED_GID}" "${LXC_CACHE_BASE}" >/dev
/null
2>&1 ||
:
495 echo "The image cache is now ready"
498 echo "Using image from local cache"
502 echo "Unpacking the rootfs"
505 excludelist
=$
(relevant_file excludes
)
506 if [ -f "${excludelist}" ]; then
507 while read -r line
; do
508 EXCLUDES
="${EXCLUDES} --exclude=${line}"
509 done < "${excludelist}"
512 # Do not surround ${EXCLUDES} by quotes. This does not work. The solution could
513 # use array but this is not POSIX compliant. The only POSIX compliant solution
514 # is to use a function wrapper, but the latter can't be used here as the args
515 # are dynamic. We thus need to ignore the warning brought by shellcheck.
516 # shellcheck disable=SC2086
517 tar --anchored ${EXCLUDES} --numeric-owner -xpJf "${LXC_CACHE_PATH}/rootfs.tar.xz" -C "${LXC_ROOTFS}"
519 mkdir -p "${LXC_ROOTFS}/dev
/pts
/"
521 # Setup the configuration
522 configfile="$
(relevant_file config
)"
523 fstab="$
(relevant_file fstab
)"
524 if [ ! -e "${configfile}" ]; then
525 echo "ERROR
: meta tarball is missing the configuration
file" 1>&2
529 ## Extract all the network config entries
530 sed -i -e "/lxc.net
.0/{w
${LXC_PATH}/config-network
" -e "d
}" "${LXC_PATH}/config
"
532 ## Extract any other config entry
533 sed -i -e "/lxc.
/{w
${LXC_PATH}/config-auto
" -e "d
}" "${LXC_PATH}/config
"
535 ## Append the defaults
538 echo "# Distribution configuration"
540 } >> "${LXC_PATH}/config"
542 ## Add the container-specific config
545 echo "# Container specific configuration"
546 if [ -e "${LXC_PATH}/config-auto" ]; then
547 cat "${LXC_PATH}/config-auto"
548 rm "${LXC_PATH}/config-auto"
550 if [ -e "${fstab}" ]; then
551 echo "lxc.mount.fstab = ${LXC_PATH}/fstab"
553 echo "lxc.uts.name = ${LXC_NAME}"
554 } >> "${LXC_PATH}/config"
556 ## Re-add the previously removed network config
557 if [ -e "${LXC_PATH}/config-network" ]; then
560 echo "# Network configuration"
561 cat "${LXC_PATH}/config-network"
562 rm "${LXC_PATH}/config-network"
563 } >> "${LXC_PATH}/config"
566 TEMPLATE_FILES
="${LXC_PATH}/config"
569 if [ -e "${fstab}" ]; then
570 cp "${fstab}" "${LXC_PATH}/fstab"
571 TEMPLATE_FILES
="${TEMPLATE_FILES};${LXC_PATH}/fstab"
574 # Look for extra templates
575 if [ -e "$(relevant_file templates)" ]; then
576 while read -r line
; do
577 fullpath
="${LXC_ROOTFS}/${line}"
578 [ ! -e "${fullpath}" ] && continue
579 TEMPLATE_FILES
="${TEMPLATE_FILES};${fullpath}"
580 done < "$(relevant_file templates)"
583 # Replace variables in all templates
586 for file in ${TEMPLATE_FILES}; do
587 [ ! -f "${file}" ] && continue
588 sed -i "s#LXC_NAME#${LXC_NAME}#g" "${file}"
589 sed -i "s#LXC_PATH#${LXC_PATH}#g" "${file}"
590 sed -i "s#LXC_ROOTFS#${LXC_ROOTFS}#g" "${file}"
591 sed -i "s#LXC_TEMPLATE_CONFIG#${LXC_TEMPLATE_CONFIG}#g" "${file}"
592 sed -i "s#LXC_HOOK_DIR#${LXC_HOOK_DIR}#g" "${file}"
596 # prevent mingetty from calling vhangup(2) since it fails with userns on CentOS / Oracle
597 if [ -f "${LXC_ROOTFS}/etc/init/tty.conf" ]; then
598 sed -i 's|mingetty|mingetty --nohangup|' "${LXC_ROOTFS}/etc/init/tty.conf"
601 if [ -n "${LXC_MAPPED_UID}" ] && [ "${LXC_MAPPED_UID}" != "-1" ]; then
602 chown
"${LXC_MAPPED_UID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev
/null
2>&1 ||
:
605 if [ -n "${LXC_MAPPED_GID}" ] && [ "${LXC_MAPPED_GID}" != "-1" ]; then
606 chgrp
"${LXC_MAPPED_GID}" "${LXC_PATH}/config" "${LXC_PATH}/fstab" >/dev
/null
2>&1 ||
:
609 if [ -e "$(relevant_file create-message)" ]; then
612 cat "$(relevant_file create-message)"