src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::AccessControl;
  12 use PVE::Firewall;
  13 use PVE::Storage;
  14 use PVE::RESTHandler;
  15 use PVE::RPCEnvironment;
  16 use PVE::ReplicationConfig;
  17 use PVE::LXC;
  18 use PVE::LXC::Create;
  19 use PVE::LXC::Migrate;
  20 use PVE::GuestHelpers;
  21 use PVE::API2::LXC::Config;
  22 use PVE::API2::LXC::Status;
  23 use PVE::API2::LXC::Snapshot;
  24 use PVE::JSONSchema qw(get_standard_option);
  25 use base qw(PVE::RESTHandler);
  26
  27 BEGIN {
  28     if (!$ENV{PVE_GENERATING_DOCS}) {
  29         require PVE::HA::Env::PVE2;
  30         import  PVE::HA::Env::PVE2;
  31         require PVE::HA::Config;
  32         import  PVE::HA::Config;
  33     }
  34 }
  35
  36 __PACKAGE__->register_method ({
  37     subclass => "PVE::API2::LXC::Config",
  38     path => '{vmid}/config',
  39 });
  40
  41 __PACKAGE__->register_method ({
  42     subclass => "PVE::API2::LXC::Status",
  43     path => '{vmid}/status',
  44 });
  45
  46 __PACKAGE__->register_method ({
  47     subclass => "PVE::API2::LXC::Snapshot",
  48     path => '{vmid}/snapshot',
  49 });
  50
  51 __PACKAGE__->register_method ({
  52     subclass => "PVE::API2::Firewall::CT",
  53     path => '{vmid}/firewall',
  54 });
  55
  56 __PACKAGE__->register_method({
  57     name => 'vmlist',
  58     path => '',
  59     method => 'GET',
  60     description => "LXC container index (per node).",
  61     permissions => {
  62         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  63         user => 'all',
  64     },
  65     proxyto => 'node',
  66     protected => 1, # /proc files are only readable by root
  67     parameters => {
  68         additionalProperties => 0,
  69         properties => {
  70             node => get_standard_option('pve-node'),
  71         },
  72     },
  73     returns => {
  74         type => 'array',
  75         items => {
  76             type => "object",
  77             properties => $PVE::LXC::vmstatus_return_properties,
  78         },
  79         links => [ { rel => 'child', href => "{vmid}" } ],
  80     },
  81     code => sub {
  82         my ($param) = @_;
  83
  84         my $rpcenv = PVE::RPCEnvironment::get();
  85         my $authuser = $rpcenv->get_user();
  86
  87         my $vmstatus = PVE::LXC::vmstatus();
  88
  89         my $res = [];
  90         foreach my $vmid (keys %$vmstatus) {
  91             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  92
  93             my $data = $vmstatus->{$vmid};
  94             push @$res, $data;
  95         }
  96
  97         return $res;
  98
  99     }});
 100
 101 __PACKAGE__->register_method({
 102     name => 'create_vm',
 103     path => '',
 104     method => 'POST',
 105     description => "Create or restore a container.",
 106     permissions => {
 107         user => 'all', # check inside
 108         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 109             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 110             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 111     },
 112     protected => 1,
 113     proxyto => 'node',
 114     parameters => {
 115         additionalProperties => 0,
 116         properties => PVE::LXC::Config->json_config_properties({
 117             node => get_standard_option('pve-node'),
 118             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 119             ostemplate => {
 120                 description => "The OS template or backup file.",
 121                 type => 'string',
 122                 maxLength => 255,
 123                 completion => \&PVE::LXC::complete_os_templates,
 124             },
 125             password => {
 126                 optional => 1,
 127                 type => 'string',
 128                 description => "Sets root password inside container.",
 129                 minLength => 5,
 130             },
 131             storage => get_standard_option('pve-storage-id', {
 132                 description => "Default Storage.",
 133                 default => 'local',
 134                 optional => 1,
 135                 completion => \&PVE::Storage::complete_storage_enabled,
 136             }),
 137             force => {
 138                 optional => 1,
 139                 type => 'boolean',
 140                 description => "Allow to overwrite existing container.",
 141             },
 142             restore => {
 143                 optional => 1,
 144                 type => 'boolean',
 145                 description => "Mark this as restore task.",
 146             },
 147             pool => {
 148                 optional => 1,
 149                 type => 'string', format => 'pve-poolid',
 150                 description => "Add the VM to the specified pool.",
 151             },
 152             'ignore-unpack-errors' => {
 153                 optional => 1,
 154                 type => 'boolean',
 155                 description => "Ignore errors when extracting the template.",
 156             },
 157             'ssh-public-keys' => {
 158                 optional => 1,
 159                 type => 'string',
 160                 description => "Setup public SSH keys (one key per line, " .
 161                                 "OpenSSH format).",
 162             },
 163             bwlimit => {
 164                 description => "Override i/o bandwidth limit (in KiB/s).",
 165                 optional => 1,
 166                 type => 'number',
 167                 minimum => '0',
 168             },
 169             start => {
 170                 optional => 1,
 171                 type => 'boolean',
 172                 default => 0,
 173                 description => "Start the CT after its creation finished successfully.",
 174             },
 175         }),
 176     },
 177     returns => {
 178         type => 'string',
 179     },
 180     code => sub {
 181         my ($param) = @_;
 182
 183         PVE::Cluster::check_cfs_quorum();
 184
 185         my $rpcenv = PVE::RPCEnvironment::get();
 186         my $authuser = $rpcenv->get_user();
 187
 188         my $node = extract_param($param, 'node');
 189         my $vmid = extract_param($param, 'vmid');
 190         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 191         my $bwlimit = extract_param($param, 'bwlimit');
 192         my $start_after_create = extract_param($param, 'start');
 193
 194         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 195         my $same_container_exists = -f $basecfg_fn;
 196
 197         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 198         my $unprivileged = extract_param($param, 'unprivileged');
 199         my $restore = extract_param($param, 'restore');
 200
 201         if ($restore) {
 202             # fixme: limit allowed parameters
 203         }
 204
 205         my $force = extract_param($param, 'force');
 206
 207         if (!($same_container_exists && $restore && $force)) {
 208             PVE::Cluster::check_vmid_unused($vmid);
 209         } else {
 210             die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 211             my $conf = PVE::LXC::Config->load_config($vmid);
 212             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 213         }
 214
 215         my $password = extract_param($param, 'password');
 216         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 217         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 218
 219         my $pool = extract_param($param, 'pool');
 220         if (defined($pool)) {
 221             $rpcenv->check_pool_exist($pool);
 222             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 223         }
 224
 225         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 226             # OK
 227         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 228             # OK
 229         } elsif ($restore && $force && $same_container_exists &&
 230                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 231             # OK: user has VM.Backup permissions, and want to restore an existing VM
 232         } else {
 233             raise_perm_exc();
 234         }
 235
 236         my $ostemplate = extract_param($param, 'ostemplate');
 237         my $storage = extract_param($param, 'storage') // 'local';
 238
 239         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
 240
 241         my $storage_cfg = cfs_read_file("storage.cfg");
 242
 243         my $archive;
 244         if ($ostemplate eq '-') {
 245             die "pipe requires cli environment\n"
 246                 if $rpcenv->{type} ne 'cli';
 247             die "pipe can only be used with restore tasks\n"
 248                 if !$restore;
 249             $archive = '-';
 250             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 251         } else {
 252             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 253             $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate);
 254         }
 255
 256         my %used_storages;
 257         my $check_and_activate_storage = sub {
 258             my ($sid) = @_;
 259
 260             my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
 261
 262             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 263                 if !$scfg->{content}->{rootdir};
 264
 265             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 266
 267             PVE::Storage::activate_storage($storage_cfg, $sid);
 268             $used_storages{$sid} = 1;
 269         };
 270
 271         my $conf = {};
 272
 273         my $is_root = $authuser eq 'root@pam';
 274
 275         my $no_disk_param = {};
 276         my $mp_param = {};
 277         my $storage_only_mode = 1;
 278         foreach my $opt (keys %$param) {
 279             my $value = $param->{$opt};
 280             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 281                 # allow to use simple numbers (add default storage in that case)
 282                 if ($value =~ m/^\d+(\.\d+)?$/) {
 283                     $mp_param->{$opt} = "$storage:$value";
 284                 } else {
 285                     $mp_param->{$opt} = $value;
 286                 }
 287                 $storage_only_mode = 0;
 288             } elsif ($opt =~ m/^unused\d+$/) {
 289                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 290                 delete $param->{$opt};
 291             } else {
 292                 $no_disk_param->{$opt} = $value;
 293             }
 294         }
 295
 296         die "mount points configured, but 'rootfs' not set - aborting\n"
 297             if !$storage_only_mode && !defined($mp_param->{rootfs});
 298
 299         # check storage access, activate storage
 300         my $delayed_mp_param = {};
 301         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 302             my ($ms, $mountpoint) = @_;
 303
 304             my $volid = $mountpoint->{volume};
 305             my $mp = $mountpoint->{mp};
 306
 307             if ($mountpoint->{type} ne 'volume') { # bind or device
 308                 die "Only root can pass arbitrary filesystem paths.\n"
 309                     if !$is_root;
 310             } else {
 311                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 312                 &$check_and_activate_storage($sid);
 313             }
 314         });
 315
 316         # check/activate default storage
 317         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 318
 319         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 320
 321         $conf->{unprivileged} = 1 if $unprivileged;
 322
 323         my $emsg = $restore ? "unable to restore CT $vmid -" : "unable to create CT $vmid -";
 324
 325         eval { PVE::LXC::Config->create_and_lock_config($vmid, $force) };
 326         die "$emsg $@" if $@;
 327
 328         my $code = sub {
 329             my $old_conf = PVE::LXC::Config->load_config($vmid);
 330
 331             my $vollist = [];
 332             eval {
 333                 my $orig_mp_param; # only used if $restore
 334                 if ($restore) {
 335                     die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 336                     if ($is_root && $archive ne '-') {
 337                         my $orig_conf;
 338                         ($orig_conf, $orig_mp_param) = PVE::LXC::Create::recover_config($archive);
 339                         # When we're root call 'restore_configuration' with ristricted=0,
 340                         # causing it to restore the raw lxc entries, among which there may be
 341                         # 'lxc.idmap' entries. We need to make sure that the extracted contents
 342                         # of the container match up with the restored configuration afterwards:
 343                         $conf->{lxc} = [grep { $_->[0] eq 'lxc.idmap' } @{$orig_conf->{lxc}}];
 344                     }
 345                 }
 346                 if ($storage_only_mode) {
 347                     if ($restore) {
 348                         if (!defined($orig_mp_param)) {
 349                             (undef, $orig_mp_param) = PVE::LXC::Create::recover_config($archive);
 350                         }
 351                         $mp_param = $orig_mp_param;
 352                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 353                             if !defined($mp_param->{rootfs});
 354                         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 355                             my ($ms, $mountpoint) = @_;
 356                             my $type = $mountpoint->{type};
 357                             if ($type eq 'volume') {
 358                                 die "unable to detect disk size - please specify $ms (size)\n"
 359                                     if !defined($mountpoint->{size});
 360                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 361                                 delete $mountpoint->{size};
 362                                 $mountpoint->{volume} = "$storage:$disksize";
 363                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 364                             } else {
 365                                 my $type = $mountpoint->{type};
 366                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 367                                     if ($ms eq 'rootfs');
 368                                 die "restoring '$ms' to $type mount is only possible for root\n"
 369                                     if !$is_root;
 370
 371                                 if ($mountpoint->{backup}) {
 372                                     warn "WARNING - unsupported configuration!\n";
 373                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 374                                     warn "mount point configuration will be restored after archive extraction!\n";
 375                                     warn "contained files will be restored to wrong directory!\n";
 376                                 }
 377                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 378                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 379                             }
 380                         });
 381                     } else {
 382                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 383                     }
 384                 }
 385
 386                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 387
 388                 # we always have the 'create' lock so check for more than 1 entry
 389                 if (scalar(keys %$old_conf) > 1) {
 390                     # destroy old container volumes
 391                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, { lock => 'create' });
 392                 }
 393
 394                 eval {
 395                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 396                     $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
 397                     PVE::LXC::Create::restore_archive($archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
 398
 399                     if ($restore) {
 400                         PVE::LXC::Create::restore_configuration($vmid, $rootdir, $conf, !$is_root);
 401                     } else {
 402                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 403                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 404                         $lxc_setup->post_create_hook($password, $ssh_keys);
 405                     }
 406                 };
 407                 my $err = $@;
 408                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 409                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 410                 die $err if $err;
 411                 # set some defaults
 412                 $conf->{hostname} ||= "CT$vmid";
 413                 $conf->{memory} ||= 512;
 414                 $conf->{swap} //= 512;
 415                 foreach my $mp (keys %$delayed_mp_param) {
 416                     $conf->{$mp} = $delayed_mp_param->{$mp};
 417                 }
 418                 PVE::LXC::Config->write_config($vmid, $conf);
 419             };
 420             if (my $err = $@) {
 421                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 422                 eval { PVE::LXC::destroy_config($vmid) };
 423                 warn $@ if $@;
 424                 die "$emsg $err";
 425             }
 426             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 427
 428             PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
 429                 if $start_after_create;
 430         };
 431
 432         my $workername = $restore ? 'vzrestore' : 'vzcreate';
 433         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 434
 435         return $rpcenv->fork_worker($workername, $vmid, $authuser, $realcmd);
 436     }});
 437
 438 __PACKAGE__->register_method({
 439     name => 'vmdiridx',
 440     path => '{vmid}',
 441     method => 'GET',
 442     proxyto => 'node',
 443     description => "Directory index",
 444     permissions => {
 445         user => 'all',
 446     },
 447     parameters => {
 448         additionalProperties => 0,
 449         properties => {
 450             node => get_standard_option('pve-node'),
 451             vmid => get_standard_option('pve-vmid'),
 452         },
 453     },
 454     returns => {
 455         type => 'array',
 456         items => {
 457             type => "object",
 458             properties => {
 459                 subdir => { type => 'string' },
 460             },
 461         },
 462         links => [ { rel => 'child', href => "{subdir}" } ],
 463     },
 464     code => sub {
 465         my ($param) = @_;
 466
 467         # test if VM exists
 468         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 469
 470         my $res = [
 471             { subdir => 'config' },
 472             { subdir => 'status' },
 473             { subdir => 'vncproxy' },
 474             { subdir => 'termproxy' },
 475             { subdir => 'vncwebsocket' },
 476             { subdir => 'spiceproxy' },
 477             { subdir => 'migrate' },
 478             { subdir => 'clone' },
 479 #           { subdir => 'initlog' },
 480             { subdir => 'rrd' },
 481             { subdir => 'rrddata' },
 482             { subdir => 'firewall' },
 483             { subdir => 'snapshot' },
 484             { subdir => 'resize' },
 485             ];
 486
 487         return $res;
 488     }});
 489
 490
 491 __PACKAGE__->register_method({
 492     name => 'rrd',
 493     path => '{vmid}/rrd',
 494     method => 'GET',
 495     protected => 1, # fixme: can we avoid that?
 496     permissions => {
 497         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 498     },
 499     description => "Read VM RRD statistics (returns PNG)",
 500     parameters => {
 501         additionalProperties => 0,
 502         properties => {
 503             node => get_standard_option('pve-node'),
 504             vmid => get_standard_option('pve-vmid'),
 505             timeframe => {
 506                 description => "Specify the time frame you are interested in.",
 507                 type => 'string',
 508                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 509             },
 510             ds => {
 511                 description => "The list of datasources you want to display.",
 512                 type => 'string', format => 'pve-configid-list',
 513             },
 514             cf => {
 515                 description => "The RRD consolidation function",
 516                 type => 'string',
 517                 enum => [ 'AVERAGE', 'MAX' ],
 518                 optional => 1,
 519             },
 520         },
 521     },
 522     returns => {
 523         type => "object",
 524         properties => {
 525             filename => { type => 'string' },
 526         },
 527     },
 528     code => sub {
 529         my ($param) = @_;
 530
 531         return PVE::Cluster::create_rrd_graph(
 532             "pve2-vm/$param->{vmid}", $param->{timeframe},
 533             $param->{ds}, $param->{cf});
 534
 535     }});
 536
 537 __PACKAGE__->register_method({
 538     name => 'rrddata',
 539     path => '{vmid}/rrddata',
 540     method => 'GET',
 541     protected => 1, # fixme: can we avoid that?
 542     permissions => {
 543         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 544     },
 545     description => "Read VM RRD statistics",
 546     parameters => {
 547         additionalProperties => 0,
 548         properties => {
 549             node => get_standard_option('pve-node'),
 550             vmid => get_standard_option('pve-vmid'),
 551             timeframe => {
 552                 description => "Specify the time frame you are interested in.",
 553                 type => 'string',
 554                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 555             },
 556             cf => {
 557                 description => "The RRD consolidation function",
 558                 type => 'string',
 559                 enum => [ 'AVERAGE', 'MAX' ],
 560                 optional => 1,
 561             },
 562         },
 563     },
 564     returns => {
 565         type => "array",
 566         items => {
 567             type => "object",
 568             properties => {},
 569         },
 570     },
 571     code => sub {
 572         my ($param) = @_;
 573
 574         return PVE::Cluster::create_rrd_data(
 575             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 576     }});
 577
 578 __PACKAGE__->register_method({
 579     name => 'destroy_vm',
 580     path => '{vmid}',
 581     method => 'DELETE',
 582     protected => 1,
 583     proxyto => 'node',
 584     description => "Destroy the container (also delete all uses files).",
 585     permissions => {
 586         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 587     },
 588     parameters => {
 589         additionalProperties => 0,
 590         properties => {
 591             node => get_standard_option('pve-node'),
 592             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 593         },
 594     },
 595     returns => {
 596         type => 'string',
 597     },
 598     code => sub {
 599         my ($param) = @_;
 600
 601         my $rpcenv = PVE::RPCEnvironment::get();
 602
 603         my $authuser = $rpcenv->get_user();
 604
 605         my $vmid = $param->{vmid};
 606
 607         # test if container exists
 608         my $conf = PVE::LXC::Config->load_config($vmid);
 609
 610         my $storage_cfg = cfs_read_file("storage.cfg");
 611
 612         PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 613
 614         die "unable to remove CT $vmid - used in HA resources\n"
 615             if PVE::HA::Config::vm_is_ha_managed($vmid);
 616
 617         # do not allow destroy if there are replication jobs
 618         my $repl_conf = PVE::ReplicationConfig->new();
 619         $repl_conf->check_for_existing_jobs($vmid);
 620
 621         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 622
 623         die $running_error_msg if PVE::LXC::check_running($vmid); # check early
 624
 625         my $code = sub {
 626             # reload config after lock
 627             $conf = PVE::LXC::Config->load_config($vmid);
 628             PVE::LXC::Config->check_lock($conf);
 629
 630             die $running_error_msg if PVE::LXC::check_running($vmid);
 631
 632             PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf);
 633             PVE::AccessControl::remove_vm_access($vmid);
 634             PVE::Firewall::remove_vmfw_conf($vmid);
 635         };
 636
 637         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 638
 639         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 640     }});
 641
 642 my $sslcert;
 643
 644 __PACKAGE__->register_method ({
 645     name => 'vncproxy',
 646     path => '{vmid}/vncproxy',
 647     method => 'POST',
 648     protected => 1,
 649     permissions => {
 650         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 651     },
 652     description => "Creates a TCP VNC proxy connections.",
 653     parameters => {
 654         additionalProperties => 0,
 655         properties => {
 656             node => get_standard_option('pve-node'),
 657             vmid => get_standard_option('pve-vmid'),
 658             websocket => {
 659                 optional => 1,
 660                 type => 'boolean',
 661                 description => "use websocket instead of standard VNC.",
 662             },
 663             width => {
 664                 optional => 1,
 665                 description => "sets the width of the console in pixels.",
 666                 type => 'integer',
 667                 minimum => 16,
 668                 maximum => 4096,
 669             },
 670             height => {
 671                 optional => 1,
 672                 description => "sets the height of the console in pixels.",
 673                 type => 'integer',
 674                 minimum => 16,
 675                 maximum => 2160,
 676             },
 677         },
 678     },
 679     returns => {
 680         additionalProperties => 0,
 681         properties => {
 682             user => { type => 'string' },
 683             ticket => { type => 'string' },
 684             cert => { type => 'string' },
 685             port => { type => 'integer' },
 686             upid => { type => 'string' },
 687         },
 688     },
 689     code => sub {
 690         my ($param) = @_;
 691
 692         my $rpcenv = PVE::RPCEnvironment::get();
 693
 694         my $authuser = $rpcenv->get_user();
 695
 696         my $vmid = $param->{vmid};
 697         my $node = $param->{node};
 698
 699         my $authpath = "/vms/$vmid";
 700
 701         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 702
 703         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 704             if !$sslcert;
 705
 706         my ($remip, $family);
 707
 708         if ($node ne PVE::INotify::nodename()) {
 709             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 710         } else {
 711             $family = PVE::Tools::get_host_address_family($node);
 712         }
 713
 714         my $port = PVE::Tools::next_vnc_port($family);
 715
 716         # NOTE: vncterm VNC traffic is already TLS encrypted,
 717         # so we select the fastest chipher here (or 'none'?)
 718         my $remcmd = $remip ?
 719             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 720
 721         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 722         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 723
 724         my $shcmd = [ '/usr/bin/dtach', '-A',
 725                       "/var/run/dtach/vzctlconsole$vmid",
 726                       '-r', 'winch', '-z', @$concmd];
 727
 728         my $realcmd = sub {
 729             my $upid = shift;
 730
 731             syslog ('info', "starting lxc vnc proxy $upid\n");
 732
 733             my $timeout = 10;
 734
 735             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 736                        '-timeout', $timeout, '-authpath', $authpath,
 737                        '-perm', 'VM.Console'];
 738
 739             if ($param->{width}) {
 740                 push @$cmd, '-width', $param->{width};
 741             }
 742
 743             if ($param->{height}) {
 744                 push @$cmd, '-height', $param->{height};
 745             }
 746
 747             if ($param->{websocket}) {
 748                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 749                 push @$cmd, '-notls', '-listen', 'localhost';
 750             }
 751
 752             push @$cmd, '-c', @$remcmd, @$shcmd;
 753
 754             run_command($cmd, keeplocale => 1);
 755
 756             return;
 757         };
 758
 759         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 760
 761         PVE::Tools::wait_for_vnc_port($port);
 762
 763         return {
 764             user => $authuser,
 765             ticket => $ticket,
 766             port => $port,
 767             upid => $upid,
 768             cert => $sslcert,
 769         };
 770     }});
 771
 772 __PACKAGE__->register_method ({
 773     name => 'termproxy',
 774     path => '{vmid}/termproxy',
 775     method => 'POST',
 776     protected => 1,
 777     permissions => {
 778         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 779     },
 780     description => "Creates a TCP proxy connection.",
 781     parameters => {
 782         additionalProperties => 0,
 783         properties => {
 784             node => get_standard_option('pve-node'),
 785             vmid => get_standard_option('pve-vmid'),
 786         },
 787     },
 788     returns => {
 789         additionalProperties => 0,
 790         properties => {
 791             user => { type => 'string' },
 792             ticket => { type => 'string' },
 793             port => { type => 'integer' },
 794             upid => { type => 'string' },
 795         },
 796     },
 797     code => sub {
 798         my ($param) = @_;
 799
 800         my $rpcenv = PVE::RPCEnvironment::get();
 801
 802         my $authuser = $rpcenv->get_user();
 803
 804         my $vmid = $param->{vmid};
 805         my $node = $param->{node};
 806
 807         my $authpath = "/vms/$vmid";
 808
 809         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 810
 811         my ($remip, $family);
 812
 813         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 814             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 815         } else {
 816             $family = PVE::Tools::get_host_address_family($node);
 817         }
 818
 819         my $port = PVE::Tools::next_vnc_port($family);
 820
 821         my $remcmd = $remip ?
 822             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 823
 824         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 825         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 826
 827         my $shcmd = [ '/usr/bin/dtach', '-A',
 828                       "/var/run/dtach/vzctlconsole$vmid",
 829                       '-r', 'winch', '-z', @$concmd];
 830
 831         my $realcmd = sub {
 832             my $upid = shift;
 833
 834             syslog ('info', "starting lxc termproxy $upid\n");
 835
 836             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 837                        '--perm', 'VM.Console', '--'];
 838             push @$cmd, @$remcmd, @$shcmd;
 839
 840             PVE::Tools::run_command($cmd);
 841         };
 842
 843         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 844
 845         PVE::Tools::wait_for_vnc_port($port);
 846
 847         return {
 848             user => $authuser,
 849             ticket => $ticket,
 850             port => $port,
 851             upid => $upid,
 852         };
 853     }});
 854
 855 __PACKAGE__->register_method({
 856     name => 'vncwebsocket',
 857     path => '{vmid}/vncwebsocket',
 858     method => 'GET',
 859     permissions => {
 860         description => "You also need to pass a valid ticket (vncticket).",
 861         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 862     },
 863     description => "Opens a weksocket for VNC traffic.",
 864     parameters => {
 865         additionalProperties => 0,
 866         properties => {
 867             node => get_standard_option('pve-node'),
 868             vmid => get_standard_option('pve-vmid'),
 869             vncticket => {
 870                 description => "Ticket from previous call to vncproxy.",
 871                 type => 'string',
 872                 maxLength => 512,
 873             },
 874             port => {
 875                 description => "Port number returned by previous vncproxy call.",
 876                 type => 'integer',
 877                 minimum => 5900,
 878                 maximum => 5999,
 879             },
 880         },
 881     },
 882     returns => {
 883         type => "object",
 884         properties => {
 885             port => { type => 'string' },
 886         },
 887     },
 888     code => sub {
 889         my ($param) = @_;
 890
 891         my $rpcenv = PVE::RPCEnvironment::get();
 892
 893         my $authuser = $rpcenv->get_user();
 894
 895         my $authpath = "/vms/$param->{vmid}";
 896
 897         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
 898
 899         my $port = $param->{port};
 900
 901         return { port => $port };
 902     }});
 903
 904 __PACKAGE__->register_method ({
 905     name => 'spiceproxy',
 906     path => '{vmid}/spiceproxy',
 907     method => 'POST',
 908     protected => 1,
 909     proxyto => 'node',
 910     permissions => {
 911         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 912     },
 913     description => "Returns a SPICE configuration to connect to the CT.",
 914     parameters => {
 915         additionalProperties => 0,
 916         properties => {
 917             node => get_standard_option('pve-node'),
 918             vmid => get_standard_option('pve-vmid'),
 919             proxy => get_standard_option('spice-proxy', { optional => 1 }),
 920         },
 921     },
 922     returns => get_standard_option('remote-viewer-config'),
 923     code => sub {
 924         my ($param) = @_;
 925
 926         my $vmid = $param->{vmid};
 927         my $node = $param->{node};
 928         my $proxy = $param->{proxy};
 929
 930         my $authpath = "/vms/$vmid";
 931         my $permissions = 'VM.Console';
 932
 933         my $conf = PVE::LXC::Config->load_config($vmid);
 934
 935         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
 936
 937         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
 938
 939         my $shcmd = ['/usr/bin/dtach', '-A',
 940                      "/var/run/dtach/vzctlconsole$vmid",
 941                      '-r', 'winch', '-z', @$concmd];
 942
 943         my $title = "CT $vmid";
 944
 945         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
 946     }});
 947
 948
 949 __PACKAGE__->register_method({
 950     name => 'migrate_vm',
 951     path => '{vmid}/migrate',
 952     method => 'POST',
 953     protected => 1,
 954     proxyto => 'node',
 955     description => "Migrate the container to another node. Creates a new migration task.",
 956     permissions => {
 957         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
 958     },
 959     parameters => {
 960         additionalProperties => 0,
 961         properties => {
 962             node => get_standard_option('pve-node'),
 963             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
 964             target => get_standard_option('pve-node', {
 965                 description => "Target node.",
 966                 completion => \&PVE::Cluster::complete_migration_target,
 967             }),
 968             online => {
 969                 type => 'boolean',
 970                 description => "Use online/live migration.",
 971                 optional => 1,
 972             },
 973             restart => {
 974                 type => 'boolean',
 975                 description => "Use restart migration",
 976                 optional => 1,
 977             },
 978             timeout => {
 979                 type => 'integer',
 980                 description => "Timeout in seconds for shutdown for restart migration",
 981                 optional => 1,
 982                 default => 180,
 983             },
 984             force => {
 985                 type => 'boolean',
 986                 description => "Force migration despite local bind / device" .
 987                     " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
 988                 optional => 1,
 989             },
 990         },
 991     },
 992     returns => {
 993         type => 'string',
 994         description => "the task ID.",
 995     },
 996     code => sub {
 997         my ($param) = @_;
 998
 999         my $rpcenv = PVE::RPCEnvironment::get();
1000
1001         my $authuser = $rpcenv->get_user();
1002
1003         my $target = extract_param($param, 'target');
1004
1005         my $localnode = PVE::INotify::nodename();
1006         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1007
1008         PVE::Cluster::check_cfs_quorum();
1009
1010         PVE::Cluster::check_node_exists($target);
1011
1012         my $targetip = PVE::Cluster::remote_node_ip($target);
1013
1014         my $vmid = extract_param($param, 'vmid');
1015
1016         # test if VM exists
1017         PVE::LXC::Config->load_config($vmid);
1018
1019         # try to detect errors early
1020         if (PVE::LXC::check_running($vmid)) {
1021             die "can't migrate running container without --online or --restart\n"
1022                 if !$param->{online} && !$param->{restart};
1023         }
1024
1025         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1026
1027             my $hacmd = sub {
1028                 my $upid = shift;
1029
1030                 my $service = "ct:$vmid";
1031
1032                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1033
1034                 print "Requesting HA migration for CT $vmid to node $target\n";
1035
1036                 PVE::Tools::run_command($cmd);
1037
1038                 return;
1039             };
1040
1041             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1042
1043         } else {
1044
1045             my $realcmd = sub {
1046                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1047             };
1048
1049             my $worker = sub {
1050                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1051             };
1052
1053             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1054         }
1055     }});
1056
1057 __PACKAGE__->register_method({
1058     name => 'vm_feature',
1059     path => '{vmid}/feature',
1060     method => 'GET',
1061     proxyto => 'node',
1062     protected => 1,
1063     description => "Check if feature for virtual machine is available.",
1064     permissions => {
1065         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1066     },
1067     parameters => {
1068         additionalProperties => 0,
1069         properties => {
1070             node => get_standard_option('pve-node'),
1071             vmid => get_standard_option('pve-vmid'),
1072             feature => {
1073                 description => "Feature to check.",
1074                 type => 'string',
1075                 enum => [ 'snapshot', 'clone', 'copy' ],
1076             },
1077             snapname => get_standard_option('pve-lxc-snapshot-name', {
1078                 optional => 1,
1079             }),
1080         },
1081     },
1082     returns => {
1083         type => "object",
1084         properties => {
1085             hasFeature => { type => 'boolean' },
1086             #nodes => {
1087                 #type => 'array',
1088                 #items => { type => 'string' },
1089             #}
1090         },
1091     },
1092     code => sub {
1093         my ($param) = @_;
1094
1095         my $node = extract_param($param, 'node');
1096
1097         my $vmid = extract_param($param, 'vmid');
1098
1099         my $snapname = extract_param($param, 'snapname');
1100
1101         my $feature = extract_param($param, 'feature');
1102
1103         my $conf = PVE::LXC::Config->load_config($vmid);
1104
1105         if($snapname){
1106             my $snap = $conf->{snapshots}->{$snapname};
1107             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1108             $conf = $snap;
1109         }
1110         my $storage_cfg = PVE::Storage::config();
1111         #Maybe include later
1112         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1113         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1114
1115         return {
1116             hasFeature => $hasFeature,
1117             #nodes => [ keys %$nodelist ],
1118         };
1119     }});
1120
1121 __PACKAGE__->register_method({
1122     name => 'template',
1123     path => '{vmid}/template',
1124     method => 'POST',
1125     protected => 1,
1126     proxyto => 'node',
1127     description => "Create a Template.",
1128     permissions => {
1129         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1130         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1131     },
1132     parameters => {
1133         additionalProperties => 0,
1134         properties => {
1135             node => get_standard_option('pve-node'),
1136             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1137         },
1138     },
1139     returns => { type => 'null'},
1140     code => sub {
1141         my ($param) = @_;
1142
1143         my $rpcenv = PVE::RPCEnvironment::get();
1144
1145         my $authuser = $rpcenv->get_user();
1146
1147         my $node = extract_param($param, 'node');
1148
1149         my $vmid = extract_param($param, 'vmid');
1150
1151         my $updatefn =  sub {
1152
1153             my $conf = PVE::LXC::Config->load_config($vmid);
1154             PVE::LXC::Config->check_lock($conf);
1155
1156             die "unable to create template, because CT contains snapshots\n"
1157                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1158
1159             die "you can't convert a template to a template\n"
1160                 if PVE::LXC::Config->is_template($conf);
1161
1162             die "you can't convert a CT to template if the CT is running\n"
1163                 if PVE::LXC::check_running($vmid);
1164
1165             my $scfg = PVE::Storage::config();
1166             PVE::LXC::Config->foreach_mountpoint($conf, sub {
1167                 my ($ms, $mp) = @_;
1168
1169                 my ($sid) =PVE::Storage::parse_volume_id($mp->{volume}, 0);
1170                 die "Directory storage '$sid' does not support container templates!\n"
1171                     if $scfg->{ids}->{$sid}->{path};
1172             });
1173
1174             my $realcmd = sub {
1175                 PVE::LXC::template_create($vmid, $conf);
1176
1177                 $conf->{template} = 1;
1178
1179                 PVE::LXC::Config->write_config($vmid, $conf);
1180                 # and remove lxc config
1181                 PVE::LXC::update_lxc_config($vmid, $conf);
1182             };
1183
1184             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1185         };
1186
1187         PVE::LXC::Config->lock_config($vmid, $updatefn);
1188
1189         return undef;
1190     }});
1191
1192 __PACKAGE__->register_method({
1193     name => 'clone_vm',
1194     path => '{vmid}/clone',
1195     method => 'POST',
1196     protected => 1,
1197     proxyto => 'node',
1198     description => "Create a container clone/copy",
1199     permissions => {
1200         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1201             "and 'VM.Allocate' permissions " .
1202             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1203             "'Datastore.AllocateSpace' on any used storage.",
1204         check =>
1205         [ 'and',
1206           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1207           [ 'or',
1208             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1209             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1210           ],
1211         ]
1212     },
1213     parameters => {
1214         additionalProperties => 0,
1215         properties => {
1216             node => get_standard_option('pve-node'),
1217             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1218             newid => get_standard_option('pve-vmid', {
1219                 completion => \&PVE::Cluster::complete_next_vmid,
1220                 description => 'VMID for the clone.' }),
1221             hostname => {
1222                 optional => 1,
1223                 type => 'string', format => 'dns-name',
1224                 description => "Set a hostname for the new CT.",
1225             },
1226             description => {
1227                 optional => 1,
1228                 type => 'string',
1229                 description => "Description for the new CT.",
1230             },
1231             pool => {
1232                 optional => 1,
1233                 type => 'string', format => 'pve-poolid',
1234                 description => "Add the new CT to the specified pool.",
1235             },
1236             snapname => get_standard_option('pve-lxc-snapshot-name', {
1237                 optional => 1,
1238             }),
1239             storage => get_standard_option('pve-storage-id', {
1240                 description => "Target storage for full clone.",
1241                 optional => 1,
1242             }),
1243             full => {
1244                 optional => 1,
1245                 type => 'boolean',
1246                 description => "Create a full copy of all disks. This is always done when " .
1247                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1248             },
1249             target => get_standard_option('pve-node', {
1250                 description => "Target node. Only allowed if the original VM is on shared storage.",
1251                 optional => 1,
1252             }),
1253         },
1254     },
1255     returns => {
1256         type => 'string',
1257     },
1258     code => sub {
1259         my ($param) = @_;
1260
1261         my $rpcenv = PVE::RPCEnvironment::get();
1262
1263         my $authuser = $rpcenv->get_user();
1264
1265         my $node = extract_param($param, 'node');
1266
1267         my $vmid = extract_param($param, 'vmid');
1268
1269         my $newid = extract_param($param, 'newid');
1270
1271         my $pool = extract_param($param, 'pool');
1272
1273         if (defined($pool)) {
1274             $rpcenv->check_pool_exist($pool);
1275         }
1276
1277         my $snapname = extract_param($param, 'snapname');
1278
1279         my $storage = extract_param($param, 'storage');
1280
1281         my $target = extract_param($param, 'target');
1282
1283         my $localnode = PVE::INotify::nodename();
1284
1285         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1286
1287         PVE::Cluster::check_node_exists($target) if $target;
1288
1289         my $storecfg = PVE::Storage::config();
1290
1291         if ($storage) {
1292             # check if storage is enabled on local node
1293             PVE::Storage::storage_check_enabled($storecfg, $storage);
1294             if ($target) {
1295                 # check if storage is available on target node
1296                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
1297                 # clone only works if target storage is shared
1298                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1299                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1300             }
1301         }
1302
1303         PVE::Cluster::check_cfs_quorum();
1304
1305         my $conffile;
1306         my $newconf = {};
1307         my $mountpoints = {};
1308         my $fullclone = {};
1309         my $vollist = [];
1310         my $running;
1311
1312         PVE::LXC::Config->lock_config($vmid, sub {
1313             my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1314
1315             $running = PVE::LXC::check_running($vmid) || 0;
1316
1317             my $full = extract_param($param, 'full');
1318             if (!defined($full)) {
1319                 $full = !PVE::LXC::Config->is_template($src_conf);
1320             }
1321             die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
1322
1323             eval {
1324                 die "snapshot '$snapname' does not exist\n"
1325                     if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1326
1327
1328                 my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1329
1330                 $conffile = PVE::LXC::Config->config_file($newid);
1331                 die "unable to create CT $newid: config file already exists\n"
1332                     if -f $conffile;
1333
1334                 my $sharedvm = 1;
1335                 foreach my $opt (keys %$src_conf) {
1336                     next if $opt =~ m/^unused\d+$/;
1337
1338                     my $value = $src_conf->{$opt};
1339
1340                     if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1341                         my $mp = $opt eq 'rootfs' ?
1342                             PVE::LXC::Config->parse_ct_rootfs($value) :
1343                             PVE::LXC::Config->parse_ct_mountpoint($value);
1344
1345                         if ($mp->{type} eq 'volume') {
1346                             my $volid = $mp->{volume};
1347
1348                             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
1349                             $sid = $storage if defined($storage);
1350                             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
1351                             if (!$scfg->{shared}) {
1352                                 $sharedvm = 0;
1353                                 warn "found non-shared volume: $volid\n" if $target;
1354                             }
1355
1356                             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1357
1358                             if ($full) {
1359                                 die "Cannot do full clones on a running container without snapshots\n"
1360                                     if $running && !defined($snapname);
1361                                 $fullclone->{$opt} = 1;
1362                             } else {
1363                                 # not full means clone instead of copy
1364                                 die "Linked clone feature for '$volid' is not available\n"
1365                                     if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running);
1366                             }
1367
1368                             $mountpoints->{$opt} = $mp;
1369                             push @$vollist, $volid;
1370
1371                         } else {
1372                             # TODO: allow bind mounts?
1373                             die "unable to clone mountpint '$opt' (type $mp->{type})\n";
1374                         }
1375                     } elsif ($opt =~ m/^net(\d+)$/) {
1376                         # always change MAC! address
1377                         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1378                         my $net = PVE::LXC::Config->parse_lxc_network($value);
1379                         $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1380                         $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1381                     } else {
1382                         # copy everything else
1383                         $newconf->{$opt} = $value;
1384                     }
1385                 }
1386                 die "can't clone CT to node '$target' (CT uses local storage)\n"
1387                     if $target && !$sharedvm;
1388
1389                 # Replace the 'disk' lock with a 'create' lock.
1390                 $newconf->{lock} = 'create';
1391
1392                 delete $newconf->{template};
1393                 if ($param->{hostname}) {
1394                     $newconf->{hostname} = $param->{hostname};
1395                 }
1396
1397                 if ($param->{description}) {
1398                     $newconf->{description} = $param->{description};
1399                 }
1400
1401                 # create empty/temp config - this fails if CT already exists on other node
1402                 PVE::LXC::Config->write_config($newid, $newconf);
1403             };
1404             if (my $err = $@) {
1405                 eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1406                 warn $@ if $@;
1407                 die $err;
1408             }
1409         });
1410
1411         my $update_conf = sub {
1412             my ($key, $value) = @_;
1413             return PVE::LXC::Config->lock_config($newid, sub {
1414                 my $conf = PVE::LXC::Config->load_config($newid);
1415                 die "Lost 'create' config lock, aborting.\n"
1416                     if !PVE::LXC::Config->has_lock($conf, 'create');
1417                 $conf->{$key} = $value;
1418                 PVE::LXC::Config->write_config($newid, $conf);
1419             });
1420         };
1421
1422         my $realcmd = sub {
1423             my ($upid) = @_;
1424
1425             my $newvollist = [];
1426
1427             my $verify_running = PVE::LXC::check_running($vmid) || 0;
1428             die "unexpected state change\n" if $verify_running != $running;
1429
1430             eval {
1431                 local $SIG{INT} =
1432                     local $SIG{TERM} =
1433                     local $SIG{QUIT} =
1434                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1435
1436                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1437
1438                 foreach my $opt (keys %$mountpoints) {
1439                     my $mp = $mountpoints->{$opt};
1440                     my $volid = $mp->{volume};
1441
1442                     my $newvolid;
1443                     if ($fullclone->{$opt}) {
1444                         print "create full clone of mountpoint $opt ($volid)\n";
1445                         my $target_storage = $storage // PVE::Storage::parse_volume_id($volid);
1446                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname);
1447                     } else {
1448                         print "create linked clone of mount point $opt ($volid)\n";
1449                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1450                     }
1451
1452                     push @$newvollist, $newvolid;
1453                     $mp->{volume} = $newvolid;
1454
1455                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1456                 }
1457
1458                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1459                 PVE::LXC::Config->remove_lock($newid, 'create');
1460
1461                 if ($target) {
1462                     # always deactivate volumes - avoid lvm LVs to be active on several nodes
1463                     PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
1464                     PVE::Storage::deactivate_volumes($storecfg, $newvollist);
1465
1466                     my $newconffile = PVE::LXC::Config->config_file($newid, $target);
1467                     die "Failed to move config to node '$target' - rename failed: $!\n"
1468                         if !rename($conffile, $newconffile);
1469                 }
1470             };
1471             my $err = $@;
1472
1473             # Unlock the source config in any case:
1474             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1475             warn $@ if $@;
1476
1477             if ($err) {
1478                 # Now cleanup the config & disks:
1479                 unlink $conffile;
1480
1481                 sleep 1; # some storages like rbd need to wait before release volume - really?
1482
1483                 foreach my $volid (@$newvollist) {
1484                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1485                     warn $@ if $@;
1486                 }
1487                 die "clone failed: $err";
1488             }
1489
1490             return;
1491         };
1492
1493         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1494         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1495     }});
1496
1497
1498 __PACKAGE__->register_method({
1499     name => 'resize_vm',
1500     path => '{vmid}/resize',
1501     method => 'PUT',
1502     protected => 1,
1503     proxyto => 'node',
1504     description => "Resize a container mount point.",
1505     permissions => {
1506         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1507     },
1508     parameters => {
1509         additionalProperties => 0,
1510         properties => {
1511             node => get_standard_option('pve-node'),
1512             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1513             disk => {
1514                 type => 'string',
1515                 description => "The disk you want to resize.",
1516                 enum => [PVE::LXC::Config->mountpoint_names()],
1517             },
1518             size => {
1519                 type => 'string',
1520                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1521                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1522             },
1523             digest => {
1524                 type => 'string',
1525                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1526                 maxLength => 40,
1527                 optional => 1,
1528             }
1529         },
1530     },
1531     returns => {
1532         type => 'string',
1533         description => "the task ID.",
1534     },
1535     code => sub {
1536         my ($param) = @_;
1537
1538         my $rpcenv = PVE::RPCEnvironment::get();
1539
1540         my $authuser = $rpcenv->get_user();
1541
1542         my $node = extract_param($param, 'node');
1543
1544         my $vmid = extract_param($param, 'vmid');
1545
1546         my $digest = extract_param($param, 'digest');
1547
1548         my $sizestr = extract_param($param, 'size');
1549         my $ext = ($sizestr =~ s/^\+//);
1550         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1551         die "invalid size string" if !defined($newsize);
1552
1553         die "no options specified\n" if !scalar(keys %$param);
1554
1555         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
1556
1557         my $storage_cfg = cfs_read_file("storage.cfg");
1558
1559         my $code = sub {
1560
1561             my $conf = PVE::LXC::Config->load_config($vmid);
1562             PVE::LXC::Config->check_lock($conf);
1563
1564             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1565
1566             my $running = PVE::LXC::check_running($vmid);
1567
1568             my $disk = $param->{disk};
1569             my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
1570                 PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
1571
1572             my $volid = $mp->{volume};
1573
1574             my (undef, undef, $owner, undef, undef, undef, $format) =
1575                 PVE::Storage::parse_volname($storage_cfg, $volid);
1576
1577             die "can't resize mount point owned by another container ($owner)"
1578                 if $vmid != $owner;
1579
1580             die "can't resize volume: $disk if snapshot exists\n"
1581                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1582
1583             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1584
1585             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1586
1587             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1588
1589             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1590             $newsize += $size if $ext;
1591             $newsize = int($newsize);
1592
1593             die "unable to shrink disk size\n" if $newsize < $size;
1594
1595             return if $size == $newsize;
1596
1597             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1598             my $realcmd = sub {
1599                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1600                 # we pass 0 here (parameter only makes sense for qemu)
1601                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1602
1603                 $mp->{size} = $newsize;
1604                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1605
1606                 PVE::LXC::Config->write_config($vmid, $conf);
1607
1608                 if ($format eq 'raw') {
1609                     my $path = PVE::Storage::map_volume($storage_cfg, $volid) // PVE::Storage::path($storage_cfg, $volid);
1610                     if ($running) {
1611
1612                         $mp->{mp} = '/';
1613                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1614                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1615                         die "internal error: CT running but mount point not attached to a loop device"
1616                             if !$path;
1617                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1618
1619                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1620                         # to be visible to it in its namespace.
1621                         # To not interfere with the rest of the system we unshare the current mount namespace,
1622                         # mount over /tmp and then run resize2fs.
1623
1624                         # interestingly we don't need to e2fsck on mounted systems...
1625                         my $quoted = PVE::Tools::shellquote($path);
1626                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1627                         eval {
1628                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1629                         };
1630                         warn "Failed to update the container's filesystem: $@\n" if $@;
1631                     } else {
1632                         eval {
1633                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1634                             PVE::Tools::run_command(['resize2fs', $path]);
1635                         };
1636                         warn "Failed to update the container's filesystem: $@\n" if $@;
1637
1638                         PVE::Storage::unmap_volume($storage_cfg, $volid);
1639                     }
1640                 }
1641             };
1642
1643             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1644         };
1645
1646         return PVE::LXC::Config->lock_config($vmid, $code);;
1647     }});
1648
1649 __PACKAGE__->register_method({
1650     name => 'move_volume',
1651     path => '{vmid}/move_volume',
1652     method => 'POST',
1653     protected => 1,
1654     proxyto => 'node',
1655     description => "Move a rootfs-/mp-volume to a different storage",
1656     permissions => {
1657         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1658             "and 'Datastore.AllocateSpace' permissions on the storage.",
1659         check =>
1660         [ 'and',
1661           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1662           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
1663         ],
1664     },
1665     parameters => {
1666         additionalProperties => 0,
1667         properties => {
1668             node => get_standard_option('pve-node'),
1669             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1670             volume => {
1671                 type => 'string',
1672                 enum => [ PVE::LXC::Config->mountpoint_names() ],
1673                 description => "Volume which will be moved.",
1674             },
1675             storage => get_standard_option('pve-storage-id', {
1676                 description => "Target Storage.",
1677                 completion => \&PVE::Storage::complete_storage_enabled,
1678             }),
1679             delete => {
1680                 type => 'boolean',
1681                 description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
1682                 optional => 1,
1683                 default => 0,
1684             },
1685             digest => {
1686                 type => 'string',
1687                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1688                 maxLength => 40,
1689                 optional => 1,
1690             }
1691         },
1692     },
1693     returns => {
1694         type => 'string',
1695     },
1696     code => sub {
1697         my ($param) = @_;
1698
1699         my $rpcenv = PVE::RPCEnvironment::get();
1700
1701         my $authuser = $rpcenv->get_user();
1702
1703         my $vmid = extract_param($param, 'vmid');
1704
1705         my $storage = extract_param($param, 'storage');
1706
1707         my $mpkey = extract_param($param, 'volume');
1708
1709         my $lockname = 'disk';
1710
1711         my ($mpdata, $old_volid);
1712
1713         PVE::LXC::Config->lock_config($vmid, sub {
1714             my $conf = PVE::LXC::Config->load_config($vmid);
1715             PVE::LXC::Config->check_lock($conf);
1716
1717             die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
1718
1719             if ($mpkey eq 'rootfs') {
1720                 $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
1721             } elsif ($mpkey =~ m/mp\d+/) {
1722                 $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
1723             } else {
1724                 die "Can't parse $mpkey\n";
1725             }
1726             $old_volid = $mpdata->{volume};
1727
1728             die "you can't move a volume with snapshots and delete the source\n"
1729                 if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1730
1731             PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
1732
1733             PVE::LXC::Config->set_lock($vmid, $lockname);
1734         });
1735
1736         my $realcmd = sub {
1737             eval {
1738                 PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
1739
1740                 my $conf = PVE::LXC::Config->load_config($vmid);
1741                 my $storage_cfg = PVE::Storage::config();
1742
1743                 my $new_volid;
1744
1745                 eval {
1746                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1747                     $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf);
1748                     $mpdata->{volume} = $new_volid;
1749
1750                     PVE::LXC::Config->lock_config($vmid, sub {
1751                         my $digest = $conf->{digest};
1752                         $conf = PVE::LXC::Config->load_config($vmid);
1753                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1754
1755                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
1756
1757                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1758
1759                         PVE::LXC::Config->write_config($vmid, $conf);
1760                     });
1761
1762                     eval {
1763                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1764                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1765                     };
1766                     warn $@ if $@;
1767                 };
1768                 if (my $err = $@) {
1769                     eval {
1770                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
1771                             if defined($new_volid);
1772                     };
1773                     warn $@ if $@;
1774                     die $err;
1775                 }
1776
1777                 if ($param->{delete}) {
1778                     eval {
1779                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
1780                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
1781                     };
1782                     warn $@ if $@;
1783                 }
1784             };
1785             my $err = $@;
1786             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1787             warn $@ if $@;
1788             die $err if $err;
1789         };
1790         my $task = eval {
1791             $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
1792         };
1793         if (my $err = $@) {
1794             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1795             warn $@ if $@;
1796             die $err;
1797         }
1798         return $task;
1799   }});
1800
1801 1;