src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::AccessControl;
  12 use PVE::Firewall;
  13 use PVE::Storage;
  14 use PVE::RESTHandler;
  15 use PVE::RPCEnvironment;
  16 use PVE::ReplicationConfig;
  17 use PVE::LXC;
  18 use PVE::LXC::Create;
  19 use PVE::LXC::Migrate;
  20 use PVE::GuestHelpers;
  21 use PVE::API2::LXC::Config;
  22 use PVE::API2::LXC::Status;
  23 use PVE::API2::LXC::Snapshot;
  24 use PVE::JSONSchema qw(get_standard_option);
  25 use base qw(PVE::RESTHandler);
  26
  27 BEGIN {
  28     if (!$ENV{PVE_GENERATING_DOCS}) {
  29         require PVE::HA::Env::PVE2;
  30         import  PVE::HA::Env::PVE2;
  31         require PVE::HA::Config;
  32         import  PVE::HA::Config;
  33     }
  34 }
  35
  36 __PACKAGE__->register_method ({
  37     subclass => "PVE::API2::LXC::Config",
  38     path => '{vmid}/config',
  39 });
  40
  41 __PACKAGE__->register_method ({
  42     subclass => "PVE::API2::LXC::Status",
  43     path => '{vmid}/status',
  44 });
  45
  46 __PACKAGE__->register_method ({
  47     subclass => "PVE::API2::LXC::Snapshot",
  48     path => '{vmid}/snapshot',
  49 });
  50
  51 __PACKAGE__->register_method ({
  52     subclass => "PVE::API2::Firewall::CT",
  53     path => '{vmid}/firewall',
  54 });
  55
  56 __PACKAGE__->register_method({
  57     name => 'vmlist',
  58     path => '',
  59     method => 'GET',
  60     description => "LXC container index (per node).",
  61     permissions => {
  62         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  63         user => 'all',
  64     },
  65     proxyto => 'node',
  66     protected => 1, # /proc files are only readable by root
  67     parameters => {
  68         additionalProperties => 0,
  69         properties => {
  70             node => get_standard_option('pve-node'),
  71         },
  72     },
  73     returns => {
  74         type => 'array',
  75         items => {
  76             type => "object",
  77             properties => {},
  78         },
  79         links => [ { rel => 'child', href => "{vmid}" } ],
  80     },
  81     code => sub {
  82         my ($param) = @_;
  83
  84         my $rpcenv = PVE::RPCEnvironment::get();
  85         my $authuser = $rpcenv->get_user();
  86
  87         my $vmstatus = PVE::LXC::vmstatus();
  88
  89         my $res = [];
  90         foreach my $vmid (keys %$vmstatus) {
  91             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  92
  93             my $data = $vmstatus->{$vmid};
  94             $data->{vmid} = $vmid;
  95             push @$res, $data;
  96         }
  97
  98         return $res;
  99
 100     }});
 101
 102 __PACKAGE__->register_method({
 103     name => 'create_vm',
 104     path => '',
 105     method => 'POST',
 106     description => "Create or restore a container.",
 107     permissions => {
 108         user => 'all', # check inside
 109         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 110             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 111             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 112     },
 113     protected => 1,
 114     proxyto => 'node',
 115     parameters => {
 116         additionalProperties => 0,
 117         properties => PVE::LXC::Config->json_config_properties({
 118             node => get_standard_option('pve-node'),
 119             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 120             ostemplate => {
 121                 description => "The OS template or backup file.",
 122                 type => 'string',
 123                 maxLength => 255,
 124                 completion => \&PVE::LXC::complete_os_templates,
 125             },
 126             password => {
 127                 optional => 1,
 128                 type => 'string',
 129                 description => "Sets root password inside container.",
 130                 minLength => 5,
 131             },
 132             storage => get_standard_option('pve-storage-id', {
 133                 description => "Default Storage.",
 134                 default => 'local',
 135                 optional => 1,
 136                 completion => \&PVE::Storage::complete_storage_enabled,
 137             }),
 138             force => {
 139                 optional => 1,
 140                 type => 'boolean',
 141                 description => "Allow to overwrite existing container.",
 142             },
 143             restore => {
 144                 optional => 1,
 145                 type => 'boolean',
 146                 description => "Mark this as restore task.",
 147             },
 148             pool => {
 149                 optional => 1,
 150                 type => 'string', format => 'pve-poolid',
 151                 description => "Add the VM to the specified pool.",
 152             },
 153             'ignore-unpack-errors' => {
 154                 optional => 1,
 155                 type => 'boolean',
 156                 description => "Ignore errors when extracting the template.",
 157             },
 158             'ssh-public-keys' => {
 159                 optional => 1,
 160                 type => 'string',
 161                 description => "Setup public SSH keys (one key per line, " .
 162                                 "OpenSSH format).",
 163             },
 164             bwlimit => {
 165                 description => "Override i/o bandwidth limit (in KiB/s).",
 166                 optional => 1,
 167                 type => 'number',
 168                 minimum => '0',
 169             },
 170             start => {
 171                 optional => 1,
 172                 type => 'boolean',
 173                 default => 0,
 174                 description => "Start the CT after its creation finished successfully.",
 175             },
 176         }),
 177     },
 178     returns => {
 179         type => 'string',
 180     },
 181     code => sub {
 182         my ($param) = @_;
 183
 184         my $rpcenv = PVE::RPCEnvironment::get();
 185
 186         my $authuser = $rpcenv->get_user();
 187
 188         my $node = extract_param($param, 'node');
 189
 190         my $vmid = extract_param($param, 'vmid');
 191
 192         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 193
 194         my $bwlimit = extract_param($param, 'bwlimit');
 195
 196         my $start_after_create = extract_param($param, 'start');
 197
 198         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 199
 200         my $same_container_exists = -f $basecfg_fn;
 201
 202         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 203         my $unprivileged = extract_param($param, 'unprivileged');
 204
 205         my $restore = extract_param($param, 'restore');
 206
 207         if ($restore) {
 208             # fixme: limit allowed parameters
 209
 210         }
 211
 212         my $force = extract_param($param, 'force');
 213
 214         if (!($same_container_exists && $restore && $force)) {
 215             PVE::Cluster::check_vmid_unused($vmid);
 216         } else {
 217             my $conf = PVE::LXC::Config->load_config($vmid);
 218             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 219         }
 220
 221         my $password = extract_param($param, 'password');
 222
 223         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 224         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 225
 226         my $pool = extract_param($param, 'pool');
 227
 228         if (defined($pool)) {
 229             $rpcenv->check_pool_exist($pool);
 230             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 231         }
 232
 233         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 234             # OK
 235         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 236             # OK
 237         } elsif ($restore && $force && $same_container_exists &&
 238                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 239             # OK: user has VM.Backup permissions, and want to restore an existing VM
 240         } else {
 241             raise_perm_exc();
 242         }
 243
 244         my $ostemplate = extract_param($param, 'ostemplate');
 245         my $storage = extract_param($param, 'storage') // 'local';
 246
 247         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
 248
 249         my $storage_cfg = cfs_read_file("storage.cfg");
 250
 251
 252         my $archive;
 253
 254         if ($ostemplate eq '-') {
 255             die "pipe requires cli environment\n"
 256                 if $rpcenv->{type} ne 'cli';
 257             die "pipe can only be used with restore tasks\n"
 258                 if !$restore;
 259             $archive = '-';
 260             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 261         } else {
 262             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 263             $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate);
 264         }
 265
 266         my %used_storages;
 267         my $check_and_activate_storage = sub {
 268             my ($sid) = @_;
 269
 270             my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
 271
 272             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 273                 if !$scfg->{content}->{rootdir};
 274
 275             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 276
 277             PVE::Storage::activate_storage($storage_cfg, $sid);
 278
 279             $used_storages{$sid} = 1;
 280         };
 281
 282         my $conf = {};
 283
 284         my $no_disk_param = {};
 285         my $mp_param = {};
 286         my $storage_only_mode = 1;
 287         foreach my $opt (keys %$param) {
 288             my $value = $param->{$opt};
 289             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 290                 # allow to use simple numbers (add default storage in that case)
 291                 if ($value =~ m/^\d+(\.\d+)?$/) {
 292                     $mp_param->{$opt} = "$storage:$value";
 293                 } else {
 294                     $mp_param->{$opt} = $value;
 295                 }
 296                 $storage_only_mode = 0;
 297             } elsif ($opt =~ m/^unused\d+$/) {
 298                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 299                 delete $param->{$opt};
 300             } else {
 301                 $no_disk_param->{$opt} = $value;
 302             }
 303         }
 304
 305         die "mount points configured, but 'rootfs' not set - aborting\n"
 306             if !$storage_only_mode && !defined($mp_param->{rootfs});
 307
 308         # check storage access, activate storage
 309         my $delayed_mp_param = {};
 310         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 311             my ($ms, $mountpoint) = @_;
 312
 313             my $volid = $mountpoint->{volume};
 314             my $mp = $mountpoint->{mp};
 315
 316             if ($mountpoint->{type} ne 'volume') { # bind or device
 317                 die "Only root can pass arbitrary filesystem paths.\n"
 318                     if $authuser ne 'root@pam';
 319             } else {
 320                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 321                 &$check_and_activate_storage($sid);
 322             }
 323         });
 324
 325         # check/activate default storage
 326         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 327
 328         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 329
 330         $conf->{unprivileged} = 1 if $unprivileged;
 331
 332         my $check_vmid_usage = sub {
 333             if ($force) {
 334                 die "can't overwrite running container\n"
 335                     if PVE::LXC::check_running($vmid);
 336             } else {
 337                 PVE::Cluster::check_vmid_unused($vmid);
 338             }
 339         };
 340
 341         my $code = sub {
 342             &$check_vmid_usage(); # final check after locking
 343             my $old_conf;
 344
 345             my $config_fn = PVE::LXC::Config->config_file($vmid);
 346             if (-f $config_fn) {
 347                 die "container exists" if !$restore; # just to be sure
 348                 $old_conf = PVE::LXC::Config->load_config($vmid);
 349             } else {
 350                 eval {
 351                     # try to create empty config on local node, we have an flock
 352                     PVE::LXC::Config->write_config($vmid, {});
 353                 };
 354
 355                 # another node was faster, abort
 356                 die "Could not reserve ID $vmid, already taken\n" if $@;
 357             }
 358
 359             PVE::Cluster::check_cfs_quorum();
 360             my $vollist = [];
 361
 362             eval {
 363                 if ($storage_only_mode) {
 364                     if ($restore) {
 365                         (undef, $mp_param) = PVE::LXC::Create::recover_config($archive);
 366                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 367                             if !defined($mp_param->{rootfs});
 368                         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 369                             my ($ms, $mountpoint) = @_;
 370                             my $type = $mountpoint->{type};
 371                             if ($type eq 'volume') {
 372                                 die "unable to detect disk size - please specify $ms (size)\n"
 373                                     if !defined($mountpoint->{size});
 374                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 375                                 delete $mountpoint->{size};
 376                                 $mountpoint->{volume} = "$storage:$disksize";
 377                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 378                             } else {
 379                                 my $type = $mountpoint->{type};
 380                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 381                                     if ($ms eq 'rootfs');
 382                                 die "restoring '$ms' to $type mount is only possible for root\n"
 383                                     if $authuser ne 'root@pam';
 384
 385                                 if ($mountpoint->{backup}) {
 386                                     warn "WARNING - unsupported configuration!\n";
 387                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 388                                     warn "mount point configuration will be restored after archive extraction!\n";
 389                                     warn "contained files will be restored to wrong directory!\n";
 390                                 }
 391                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 392                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 393                             }
 394                         });
 395                     } else {
 396                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 397                     }
 398                 }
 399
 400                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 401
 402                 if (defined($old_conf)) {
 403                     # destroy old container volumes
 404                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, {});
 405                 }
 406
 407                 eval {
 408                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 409                     $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
 410                     PVE::LXC::Create::restore_archive($archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
 411
 412                     if ($restore) {
 413                         PVE::LXC::Create::restore_configuration($vmid, $rootdir, $conf, $authuser ne 'root@pam');
 414                     } else {
 415                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 416                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 417                         $lxc_setup->post_create_hook($password, $ssh_keys);
 418                     }
 419                 };
 420                 my $err = $@;
 421                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 422                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 423                 die $err if $err;
 424                 # set some defaults
 425                 $conf->{hostname} ||= "CT$vmid";
 426                 $conf->{memory} ||= 512;
 427                 $conf->{swap} //= 512;
 428                 foreach my $mp (keys %$delayed_mp_param) {
 429                     $conf->{$mp} = $delayed_mp_param->{$mp};
 430                 }
 431                 PVE::LXC::Config->write_config($vmid, $conf);
 432             };
 433             if (my $err = $@) {
 434                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 435                 PVE::LXC::destroy_config($vmid);
 436                 die $err;
 437             }
 438             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 439
 440             PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
 441                 if $start_after_create;
 442         };
 443
 444         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 445
 446         &$check_vmid_usage(); # first check before locking
 447
 448         return $rpcenv->fork_worker($restore ? 'vzrestore' : 'vzcreate',
 449                                     $vmid, $authuser, $realcmd);
 450
 451     }});
 452
 453 __PACKAGE__->register_method({
 454     name => 'vmdiridx',
 455     path => '{vmid}',
 456     method => 'GET',
 457     proxyto => 'node',
 458     description => "Directory index",
 459     permissions => {
 460         user => 'all',
 461     },
 462     parameters => {
 463         additionalProperties => 0,
 464         properties => {
 465             node => get_standard_option('pve-node'),
 466             vmid => get_standard_option('pve-vmid'),
 467         },
 468     },
 469     returns => {
 470         type => 'array',
 471         items => {
 472             type => "object",
 473             properties => {
 474                 subdir => { type => 'string' },
 475             },
 476         },
 477         links => [ { rel => 'child', href => "{subdir}" } ],
 478     },
 479     code => sub {
 480         my ($param) = @_;
 481
 482         # test if VM exists
 483         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 484
 485         my $res = [
 486             { subdir => 'config' },
 487             { subdir => 'status' },
 488             { subdir => 'vncproxy' },
 489             { subdir => 'termproxy' },
 490             { subdir => 'vncwebsocket' },
 491             { subdir => 'spiceproxy' },
 492             { subdir => 'migrate' },
 493             { subdir => 'clone' },
 494 #           { subdir => 'initlog' },
 495             { subdir => 'rrd' },
 496             { subdir => 'rrddata' },
 497             { subdir => 'firewall' },
 498             { subdir => 'snapshot' },
 499             { subdir => 'resize' },
 500             ];
 501
 502         return $res;
 503     }});
 504
 505
 506 __PACKAGE__->register_method({
 507     name => 'rrd',
 508     path => '{vmid}/rrd',
 509     method => 'GET',
 510     protected => 1, # fixme: can we avoid that?
 511     permissions => {
 512         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 513     },
 514     description => "Read VM RRD statistics (returns PNG)",
 515     parameters => {
 516         additionalProperties => 0,
 517         properties => {
 518             node => get_standard_option('pve-node'),
 519             vmid => get_standard_option('pve-vmid'),
 520             timeframe => {
 521                 description => "Specify the time frame you are interested in.",
 522                 type => 'string',
 523                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 524             },
 525             ds => {
 526                 description => "The list of datasources you want to display.",
 527                 type => 'string', format => 'pve-configid-list',
 528             },
 529             cf => {
 530                 description => "The RRD consolidation function",
 531                 type => 'string',
 532                 enum => [ 'AVERAGE', 'MAX' ],
 533                 optional => 1,
 534             },
 535         },
 536     },
 537     returns => {
 538         type => "object",
 539         properties => {
 540             filename => { type => 'string' },
 541         },
 542     },
 543     code => sub {
 544         my ($param) = @_;
 545
 546         return PVE::Cluster::create_rrd_graph(
 547             "pve2-vm/$param->{vmid}", $param->{timeframe},
 548             $param->{ds}, $param->{cf});
 549
 550     }});
 551
 552 __PACKAGE__->register_method({
 553     name => 'rrddata',
 554     path => '{vmid}/rrddata',
 555     method => 'GET',
 556     protected => 1, # fixme: can we avoid that?
 557     permissions => {
 558         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 559     },
 560     description => "Read VM RRD statistics",
 561     parameters => {
 562         additionalProperties => 0,
 563         properties => {
 564             node => get_standard_option('pve-node'),
 565             vmid => get_standard_option('pve-vmid'),
 566             timeframe => {
 567                 description => "Specify the time frame you are interested in.",
 568                 type => 'string',
 569                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 570             },
 571             cf => {
 572                 description => "The RRD consolidation function",
 573                 type => 'string',
 574                 enum => [ 'AVERAGE', 'MAX' ],
 575                 optional => 1,
 576             },
 577         },
 578     },
 579     returns => {
 580         type => "array",
 581         items => {
 582             type => "object",
 583             properties => {},
 584         },
 585     },
 586     code => sub {
 587         my ($param) = @_;
 588
 589         return PVE::Cluster::create_rrd_data(
 590             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 591     }});
 592
 593 __PACKAGE__->register_method({
 594     name => 'destroy_vm',
 595     path => '{vmid}',
 596     method => 'DELETE',
 597     protected => 1,
 598     proxyto => 'node',
 599     description => "Destroy the container (also delete all uses files).",
 600     permissions => {
 601         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 602     },
 603     parameters => {
 604         additionalProperties => 0,
 605         properties => {
 606             node => get_standard_option('pve-node'),
 607             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 608         },
 609     },
 610     returns => {
 611         type => 'string',
 612     },
 613     code => sub {
 614         my ($param) = @_;
 615
 616         my $rpcenv = PVE::RPCEnvironment::get();
 617
 618         my $authuser = $rpcenv->get_user();
 619
 620         my $vmid = $param->{vmid};
 621
 622         # test if container exists
 623         my $conf = PVE::LXC::Config->load_config($vmid);
 624
 625         my $storage_cfg = cfs_read_file("storage.cfg");
 626
 627         PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 628
 629         die "unable to remove CT $vmid - used in HA resources\n"
 630             if PVE::HA::Config::vm_is_ha_managed($vmid);
 631
 632         # do not allow destroy if there are replication jobs
 633         my $repl_conf = PVE::ReplicationConfig->new();
 634         $repl_conf->check_for_existing_jobs($vmid);
 635
 636         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 637
 638         die $running_error_msg if PVE::LXC::check_running($vmid); # check early
 639
 640         my $code = sub {
 641             # reload config after lock
 642             $conf = PVE::LXC::Config->load_config($vmid);
 643             PVE::LXC::Config->check_lock($conf);
 644
 645             die $running_error_msg if PVE::LXC::check_running($vmid);
 646
 647             PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf);
 648             PVE::AccessControl::remove_vm_access($vmid);
 649             PVE::Firewall::remove_vmfw_conf($vmid);
 650         };
 651
 652         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 653
 654         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 655     }});
 656
 657 my $sslcert;
 658
 659 __PACKAGE__->register_method ({
 660     name => 'vncproxy',
 661     path => '{vmid}/vncproxy',
 662     method => 'POST',
 663     protected => 1,
 664     permissions => {
 665         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 666     },
 667     description => "Creates a TCP VNC proxy connections.",
 668     parameters => {
 669         additionalProperties => 0,
 670         properties => {
 671             node => get_standard_option('pve-node'),
 672             vmid => get_standard_option('pve-vmid'),
 673             websocket => {
 674                 optional => 1,
 675                 type => 'boolean',
 676                 description => "use websocket instead of standard VNC.",
 677             },
 678             width => {
 679                 optional => 1,
 680                 description => "sets the width of the console in pixels.",
 681                 type => 'integer',
 682                 minimum => 16,
 683                 maximum => 4096,
 684             },
 685             height => {
 686                 optional => 1,
 687                 description => "sets the height of the console in pixels.",
 688                 type => 'integer',
 689                 minimum => 16,
 690                 maximum => 2160,
 691             },
 692         },
 693     },
 694     returns => {
 695         additionalProperties => 0,
 696         properties => {
 697             user => { type => 'string' },
 698             ticket => { type => 'string' },
 699             cert => { type => 'string' },
 700             port => { type => 'integer' },
 701             upid => { type => 'string' },
 702         },
 703     },
 704     code => sub {
 705         my ($param) = @_;
 706
 707         my $rpcenv = PVE::RPCEnvironment::get();
 708
 709         my $authuser = $rpcenv->get_user();
 710
 711         my $vmid = $param->{vmid};
 712         my $node = $param->{node};
 713
 714         my $authpath = "/vms/$vmid";
 715
 716         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 717
 718         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 719             if !$sslcert;
 720
 721         my ($remip, $family);
 722
 723         if ($node ne PVE::INotify::nodename()) {
 724             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 725         } else {
 726             $family = PVE::Tools::get_host_address_family($node);
 727         }
 728
 729         my $port = PVE::Tools::next_vnc_port($family);
 730
 731         # NOTE: vncterm VNC traffic is already TLS encrypted,
 732         # so we select the fastest chipher here (or 'none'?)
 733         my $remcmd = $remip ?
 734             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 735
 736         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 737         my $concmd = PVE::LXC::get_console_command($vmid, $conf, 1);
 738
 739         my $shcmd = [ '/usr/bin/dtach', '-A',
 740                       "/var/run/dtach/vzctlconsole$vmid",
 741                       '-r', 'winch', '-z', @$concmd];
 742
 743         my $realcmd = sub {
 744             my $upid = shift;
 745
 746             syslog ('info', "starting lxc vnc proxy $upid\n");
 747
 748             my $timeout = 10;
 749
 750             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 751                        '-timeout', $timeout, '-authpath', $authpath,
 752                        '-perm', 'VM.Console'];
 753
 754             if ($param->{width}) {
 755                 push @$cmd, '-width', $param->{width};
 756             }
 757
 758             if ($param->{height}) {
 759                 push @$cmd, '-height', $param->{height};
 760             }
 761
 762             if ($param->{websocket}) {
 763                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 764                 push @$cmd, '-notls', '-listen', 'localhost';
 765             }
 766
 767             push @$cmd, '-c', @$remcmd, @$shcmd;
 768
 769             run_command($cmd, keeplocale => 1);
 770
 771             return;
 772         };
 773
 774         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 775
 776         PVE::Tools::wait_for_vnc_port($port);
 777
 778         return {
 779             user => $authuser,
 780             ticket => $ticket,
 781             port => $port,
 782             upid => $upid,
 783             cert => $sslcert,
 784         };
 785     }});
 786
 787 __PACKAGE__->register_method ({
 788     name => 'termproxy',
 789     path => '{vmid}/termproxy',
 790     method => 'POST',
 791     protected => 1,
 792     permissions => {
 793         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 794     },
 795     description => "Creates a TCP proxy connection.",
 796     parameters => {
 797         additionalProperties => 0,
 798         properties => {
 799             node => get_standard_option('pve-node'),
 800             vmid => get_standard_option('pve-vmid'),
 801         },
 802     },
 803     returns => {
 804         additionalProperties => 0,
 805         properties => {
 806             user => { type => 'string' },
 807             ticket => { type => 'string' },
 808             port => { type => 'integer' },
 809             upid => { type => 'string' },
 810         },
 811     },
 812     code => sub {
 813         my ($param) = @_;
 814
 815         my $rpcenv = PVE::RPCEnvironment::get();
 816
 817         my $authuser = $rpcenv->get_user();
 818
 819         my $vmid = $param->{vmid};
 820         my $node = $param->{node};
 821
 822         my $authpath = "/vms/$vmid";
 823
 824         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 825
 826         my ($remip, $family);
 827
 828         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 829             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 830         } else {
 831             $family = PVE::Tools::get_host_address_family($node);
 832         }
 833
 834         my $port = PVE::Tools::next_vnc_port($family);
 835
 836         my $remcmd = $remip ?
 837             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 838
 839         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 840         my $concmd = PVE::LXC::get_console_command($vmid, $conf, 1);
 841
 842         my $shcmd = [ '/usr/bin/dtach', '-A',
 843                       "/var/run/dtach/vzctlconsole$vmid",
 844                       '-r', 'winch', '-z', @$concmd];
 845
 846         my $realcmd = sub {
 847             my $upid = shift;
 848
 849             syslog ('info', "starting lxc termproxy $upid\n");
 850
 851             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 852                        '--perm', 'VM.Console', '--'];
 853             push @$cmd, @$remcmd, @$shcmd;
 854
 855             PVE::Tools::run_command($cmd);
 856         };
 857
 858         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 859
 860         PVE::Tools::wait_for_vnc_port($port);
 861
 862         return {
 863             user => $authuser,
 864             ticket => $ticket,
 865             port => $port,
 866             upid => $upid,
 867         };
 868     }});
 869
 870 __PACKAGE__->register_method({
 871     name => 'vncwebsocket',
 872     path => '{vmid}/vncwebsocket',
 873     method => 'GET',
 874     permissions => {
 875         description => "You also need to pass a valid ticket (vncticket).",
 876         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 877     },
 878     description => "Opens a weksocket for VNC traffic.",
 879     parameters => {
 880         additionalProperties => 0,
 881         properties => {
 882             node => get_standard_option('pve-node'),
 883             vmid => get_standard_option('pve-vmid'),
 884             vncticket => {
 885                 description => "Ticket from previous call to vncproxy.",
 886                 type => 'string',
 887                 maxLength => 512,
 888             },
 889             port => {
 890                 description => "Port number returned by previous vncproxy call.",
 891                 type => 'integer',
 892                 minimum => 5900,
 893                 maximum => 5999,
 894             },
 895         },
 896     },
 897     returns => {
 898         type => "object",
 899         properties => {
 900             port => { type => 'string' },
 901         },
 902     },
 903     code => sub {
 904         my ($param) = @_;
 905
 906         my $rpcenv = PVE::RPCEnvironment::get();
 907
 908         my $authuser = $rpcenv->get_user();
 909
 910         my $authpath = "/vms/$param->{vmid}";
 911
 912         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
 913
 914         my $port = $param->{port};
 915
 916         return { port => $port };
 917     }});
 918
 919 __PACKAGE__->register_method ({
 920     name => 'spiceproxy',
 921     path => '{vmid}/spiceproxy',
 922     method => 'POST',
 923     protected => 1,
 924     proxyto => 'node',
 925     permissions => {
 926         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 927     },
 928     description => "Returns a SPICE configuration to connect to the CT.",
 929     parameters => {
 930         additionalProperties => 0,
 931         properties => {
 932             node => get_standard_option('pve-node'),
 933             vmid => get_standard_option('pve-vmid'),
 934             proxy => get_standard_option('spice-proxy', { optional => 1 }),
 935         },
 936     },
 937     returns => get_standard_option('remote-viewer-config'),
 938     code => sub {
 939         my ($param) = @_;
 940
 941         my $vmid = $param->{vmid};
 942         my $node = $param->{node};
 943         my $proxy = $param->{proxy};
 944
 945         my $authpath = "/vms/$vmid";
 946         my $permissions = 'VM.Console';
 947
 948         my $conf = PVE::LXC::Config->load_config($vmid);
 949
 950         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
 951
 952         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
 953
 954         my $shcmd = ['/usr/bin/dtach', '-A',
 955                      "/var/run/dtach/vzctlconsole$vmid",
 956                      '-r', 'winch', '-z', @$concmd];
 957
 958         my $title = "CT $vmid";
 959
 960         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
 961     }});
 962
 963
 964 __PACKAGE__->register_method({
 965     name => 'migrate_vm',
 966     path => '{vmid}/migrate',
 967     method => 'POST',
 968     protected => 1,
 969     proxyto => 'node',
 970     description => "Migrate the container to another node. Creates a new migration task.",
 971     permissions => {
 972         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
 973     },
 974     parameters => {
 975         additionalProperties => 0,
 976         properties => {
 977             node => get_standard_option('pve-node'),
 978             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
 979             target => get_standard_option('pve-node', {
 980                 description => "Target node.",
 981                 completion => \&PVE::Cluster::complete_migration_target,
 982             }),
 983             online => {
 984                 type => 'boolean',
 985                 description => "Use online/live migration.",
 986                 optional => 1,
 987             },
 988             restart => {
 989                 type => 'boolean',
 990                 description => "Use restart migration",
 991                 optional => 1,
 992             },
 993             timeout => {
 994                 type => 'integer',
 995                 description => "Timeout in seconds for shutdown for restart migration",
 996                 optional => 1,
 997                 default => 180,
 998             },
 999             force => {
1000                 type => 'boolean',
1001                 description => "Force migration despite local bind / device" .
1002                     " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
1003                 optional => 1,
1004             },
1005         },
1006     },
1007     returns => {
1008         type => 'string',
1009         description => "the task ID.",
1010     },
1011     code => sub {
1012         my ($param) = @_;
1013
1014         my $rpcenv = PVE::RPCEnvironment::get();
1015
1016         my $authuser = $rpcenv->get_user();
1017
1018         my $target = extract_param($param, 'target');
1019
1020         my $localnode = PVE::INotify::nodename();
1021         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1022
1023         PVE::Cluster::check_cfs_quorum();
1024
1025         PVE::Cluster::check_node_exists($target);
1026
1027         my $targetip = PVE::Cluster::remote_node_ip($target);
1028
1029         my $vmid = extract_param($param, 'vmid');
1030
1031         # test if VM exists
1032         PVE::LXC::Config->load_config($vmid);
1033
1034         # try to detect errors early
1035         if (PVE::LXC::check_running($vmid)) {
1036             die "can't migrate running container without --online or --restart\n"
1037                 if !$param->{online} && !$param->{restart};
1038         }
1039
1040         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1041
1042             my $hacmd = sub {
1043                 my $upid = shift;
1044
1045                 my $service = "ct:$vmid";
1046
1047                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1048
1049                 print "Requesting HA migration for CT $vmid to node $target\n";
1050
1051                 PVE::Tools::run_command($cmd);
1052
1053                 return;
1054             };
1055
1056             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1057
1058         } else {
1059
1060             my $realcmd = sub {
1061                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1062             };
1063
1064             my $worker = sub {
1065                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1066             };
1067
1068             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1069         }
1070     }});
1071
1072 __PACKAGE__->register_method({
1073     name => 'vm_feature',
1074     path => '{vmid}/feature',
1075     method => 'GET',
1076     proxyto => 'node',
1077     protected => 1,
1078     description => "Check if feature for virtual machine is available.",
1079     permissions => {
1080         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1081     },
1082     parameters => {
1083         additionalProperties => 0,
1084         properties => {
1085             node => get_standard_option('pve-node'),
1086             vmid => get_standard_option('pve-vmid'),
1087             feature => {
1088                 description => "Feature to check.",
1089                 type => 'string',
1090                 enum => [ 'snapshot', 'clone', 'copy' ],
1091             },
1092             snapname => get_standard_option('pve-lxc-snapshot-name', {
1093                 optional => 1,
1094             }),
1095         },
1096     },
1097     returns => {
1098         type => "object",
1099         properties => {
1100             hasFeature => { type => 'boolean' },
1101             #nodes => {
1102                 #type => 'array',
1103                 #items => { type => 'string' },
1104             #}
1105         },
1106     },
1107     code => sub {
1108         my ($param) = @_;
1109
1110         my $node = extract_param($param, 'node');
1111
1112         my $vmid = extract_param($param, 'vmid');
1113
1114         my $snapname = extract_param($param, 'snapname');
1115
1116         my $feature = extract_param($param, 'feature');
1117
1118         my $conf = PVE::LXC::Config->load_config($vmid);
1119
1120         if($snapname){
1121             my $snap = $conf->{snapshots}->{$snapname};
1122             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1123             $conf = $snap;
1124         }
1125         my $storage_cfg = PVE::Storage::config();
1126         #Maybe include later
1127         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1128         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1129
1130         return {
1131             hasFeature => $hasFeature,
1132             #nodes => [ keys %$nodelist ],
1133         };
1134     }});
1135
1136 __PACKAGE__->register_method({
1137     name => 'template',
1138     path => '{vmid}/template',
1139     method => 'POST',
1140     protected => 1,
1141     proxyto => 'node',
1142     description => "Create a Template.",
1143     permissions => {
1144         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1145         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1146     },
1147     parameters => {
1148         additionalProperties => 0,
1149         properties => {
1150             node => get_standard_option('pve-node'),
1151             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1152         },
1153     },
1154     returns => { type => 'null'},
1155     code => sub {
1156         my ($param) = @_;
1157
1158         my $rpcenv = PVE::RPCEnvironment::get();
1159
1160         my $authuser = $rpcenv->get_user();
1161
1162         my $node = extract_param($param, 'node');
1163
1164         my $vmid = extract_param($param, 'vmid');
1165
1166         my $updatefn =  sub {
1167
1168             my $conf = PVE::LXC::Config->load_config($vmid);
1169             PVE::LXC::Config->check_lock($conf);
1170
1171             die "unable to create template, because CT contains snapshots\n"
1172                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1173
1174             die "you can't convert a template to a template\n"
1175                 if PVE::LXC::Config->is_template($conf);
1176
1177             die "you can't convert a CT to template if the CT is running\n"
1178                 if PVE::LXC::check_running($vmid);
1179
1180             my $scfg = PVE::Storage::config();
1181             PVE::LXC::Config->foreach_mountpoint($conf, sub {
1182                 my ($ms, $mp) = @_;
1183
1184                 my ($sid) =PVE::Storage::parse_volume_id($mp->{volume}, 0);
1185                 die "Directory storage '$sid' does not support container templates!\n"
1186                     if $scfg->{ids}->{$sid}->{path};
1187             });
1188
1189             my $realcmd = sub {
1190                 PVE::LXC::template_create($vmid, $conf);
1191
1192                 $conf->{template} = 1;
1193
1194                 PVE::LXC::Config->write_config($vmid, $conf);
1195                 # and remove lxc config
1196                 PVE::LXC::update_lxc_config($vmid, $conf);
1197             };
1198
1199             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1200         };
1201
1202         PVE::LXC::Config->lock_config($vmid, $updatefn);
1203
1204         return undef;
1205     }});
1206
1207 __PACKAGE__->register_method({
1208     name => 'clone_vm',
1209     path => '{vmid}/clone',
1210     method => 'POST',
1211     protected => 1,
1212     proxyto => 'node',
1213     description => "Create a container clone/copy",
1214     permissions => {
1215         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1216             "and 'VM.Allocate' permissions " .
1217             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1218             "'Datastore.AllocateSpace' on any used storage.",
1219         check =>
1220         [ 'and',
1221           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1222           [ 'or',
1223             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1224             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1225           ],
1226         ]
1227     },
1228     parameters => {
1229         additionalProperties => 0,
1230         properties => {
1231             node => get_standard_option('pve-node'),
1232             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1233             newid => get_standard_option('pve-vmid', {
1234                 completion => \&PVE::Cluster::complete_next_vmid,
1235                 description => 'VMID for the clone.' }),
1236             hostname => {
1237                 optional => 1,
1238                 type => 'string', format => 'dns-name',
1239                 description => "Set a hostname for the new CT.",
1240             },
1241             description => {
1242                 optional => 1,
1243                 type => 'string',
1244                 description => "Description for the new CT.",
1245             },
1246             pool => {
1247                 optional => 1,
1248                 type => 'string', format => 'pve-poolid',
1249                 description => "Add the new CT to the specified pool.",
1250             },
1251             snapname => get_standard_option('pve-lxc-snapshot-name', {
1252                 optional => 1,
1253             }),
1254             storage => get_standard_option('pve-storage-id', {
1255                 description => "Target storage for full clone.",
1256                 optional => 1,
1257             }),
1258             full => {
1259                 optional => 1,
1260                 type => 'boolean',
1261                 description => "Create a full copy of all disks. This is always done when " .
1262                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1263             },
1264             target => get_standard_option('pve-node', {
1265                 description => "Target node. Only allowed if the original VM is on shared storage.",
1266                 optional => 1,
1267             }),
1268         },
1269     },
1270     returns => {
1271         type => 'string',
1272     },
1273     code => sub {
1274         my ($param) = @_;
1275
1276         my $rpcenv = PVE::RPCEnvironment::get();
1277
1278         my $authuser = $rpcenv->get_user();
1279
1280         my $node = extract_param($param, 'node');
1281
1282         my $vmid = extract_param($param, 'vmid');
1283
1284         my $newid = extract_param($param, 'newid');
1285
1286         my $pool = extract_param($param, 'pool');
1287
1288         if (defined($pool)) {
1289             $rpcenv->check_pool_exist($pool);
1290         }
1291
1292         my $snapname = extract_param($param, 'snapname');
1293
1294         my $storage = extract_param($param, 'storage');
1295
1296         my $target = extract_param($param, 'target');
1297
1298         my $localnode = PVE::INotify::nodename();
1299
1300         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1301
1302         PVE::Cluster::check_node_exists($target) if $target;
1303
1304         my $storecfg = PVE::Storage::config();
1305
1306         if ($storage) {
1307             # check if storage is enabled on local node
1308             PVE::Storage::storage_check_enabled($storecfg, $storage);
1309             if ($target) {
1310                 # check if storage is available on target node
1311                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
1312                 # clone only works if target storage is shared
1313                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1314                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1315             }
1316         }
1317
1318         PVE::Cluster::check_cfs_quorum();
1319
1320         my $conffile;
1321         my $newconf = {};
1322         my $mountpoints = {};
1323         my $fullclone = {};
1324         my $vollist = [];
1325         my $running;
1326
1327         PVE::LXC::Config->lock_config($vmid, sub {
1328             my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1329
1330             $running = PVE::LXC::check_running($vmid) || 0;
1331
1332             my $full = extract_param($param, 'full');
1333             if (!defined($full)) {
1334                 $full = !PVE::LXC::Config->is_template($src_conf);
1335             }
1336             die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
1337
1338             eval {
1339                 die "snapshot '$snapname' does not exist\n"
1340                     if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1341
1342
1343                 my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1344
1345                 $conffile = PVE::LXC::Config->config_file($newid);
1346                 die "unable to create CT $newid: config file already exists\n"
1347                     if -f $conffile;
1348
1349                 my $sharedvm = 1;
1350                 foreach my $opt (keys %$src_conf) {
1351                     next if $opt =~ m/^unused\d+$/;
1352
1353                     my $value = $src_conf->{$opt};
1354
1355                     if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1356                         my $mp = $opt eq 'rootfs' ?
1357                             PVE::LXC::Config->parse_ct_rootfs($value) :
1358                             PVE::LXC::Config->parse_ct_mountpoint($value);
1359
1360                         if ($mp->{type} eq 'volume') {
1361                             my $volid = $mp->{volume};
1362
1363                             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
1364                             $sid = $storage if defined($storage);
1365                             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
1366                             if (!$scfg->{shared}) {
1367                                 $sharedvm = 0;
1368                                 warn "found non-shared volume: $volid\n" if $target;
1369                             }
1370
1371                             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1372
1373                             if ($full) {
1374                                 die "Cannot do full clones on a running container without snapshots\n"
1375                                     if $running && !defined($snapname);
1376                                 $fullclone->{$opt} = 1;
1377                             } else {
1378                                 # not full means clone instead of copy
1379                                 die "Linked clone feature for '$volid' is not available\n"
1380                                     if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running);
1381                             }
1382
1383                             $mountpoints->{$opt} = $mp;
1384                             push @$vollist, $volid;
1385
1386                         } else {
1387                             # TODO: allow bind mounts?
1388                             die "unable to clone mountpint '$opt' (type $mp->{type})\n";
1389                         }
1390                     } elsif ($opt =~ m/^net(\d+)$/) {
1391                         # always change MAC! address
1392                         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1393                         my $net = PVE::LXC::Config->parse_lxc_network($value);
1394                         $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1395                         $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1396                     } else {
1397                         # copy everything else
1398                         $newconf->{$opt} = $value;
1399                     }
1400                 }
1401                 die "can't clone CT to node '$target' (CT uses local storage)\n"
1402                     if $target && !$sharedvm;
1403
1404                 # Replace the 'disk' lock with a 'create' lock.
1405                 $newconf->{lock} = 'create';
1406
1407                 delete $newconf->{template};
1408                 if ($param->{hostname}) {
1409                     $newconf->{hostname} = $param->{hostname};
1410                 }
1411
1412                 if ($param->{description}) {
1413                     $newconf->{description} = $param->{description};
1414                 }
1415
1416                 # create empty/temp config - this fails if CT already exists on other node
1417                 PVE::LXC::Config->write_config($newid, $newconf);
1418             };
1419             if (my $err = $@) {
1420                 eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1421                 warn $@ if $@;
1422                 die $err;
1423             }
1424         });
1425
1426         my $update_conf = sub {
1427             my ($key, $value) = @_;
1428             return PVE::LXC::Config->lock_config($newid, sub {
1429                 my $conf = PVE::LXC::Config->load_config($newid);
1430                 die "Lost 'create' config lock, aborting.\n"
1431                     if !PVE::LXC::Config->has_lock($conf, 'create');
1432                 $conf->{$key} = $value;
1433                 PVE::LXC::Config->write_config($newid, $conf);
1434             });
1435         };
1436
1437         my $realcmd = sub {
1438             my ($upid) = @_;
1439
1440             my $newvollist = [];
1441
1442             my $verify_running = PVE::LXC::check_running($vmid) || 0;
1443             die "unexpected state change\n" if $verify_running != $running;
1444
1445             eval {
1446                 local $SIG{INT} =
1447                     local $SIG{TERM} =
1448                     local $SIG{QUIT} =
1449                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1450
1451                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1452
1453                 foreach my $opt (keys %$mountpoints) {
1454                     my $mp = $mountpoints->{$opt};
1455                     my $volid = $mp->{volume};
1456
1457                     my $newvolid;
1458                     if ($fullclone->{$opt}) {
1459                         print "create full clone of mountpoint $opt ($volid)\n";
1460                         my $target_storage = $storage // PVE::Storage::parse_volume_id($volid);
1461                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname);
1462                     } else {
1463                         print "create linked clone of mount point $opt ($volid)\n";
1464                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1465                     }
1466
1467                     push @$newvollist, $newvolid;
1468                     $mp->{volume} = $newvolid;
1469
1470                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1471                 }
1472
1473                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1474                 PVE::LXC::Config->remove_lock($newid, 'create');
1475
1476                 if ($target) {
1477                     # always deactivate volumes - avoid lvm LVs to be active on several nodes
1478                     PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
1479                     PVE::Storage::deactivate_volumes($storecfg, $newvollist);
1480
1481                     my $newconffile = PVE::LXC::Config->config_file($newid, $target);
1482                     die "Failed to move config to node '$target' - rename failed: $!\n"
1483                         if !rename($conffile, $newconffile);
1484                 }
1485             };
1486             my $err = $@;
1487
1488             # Unlock the source config in any case:
1489             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1490             warn $@ if $@;
1491
1492             if ($err) {
1493                 # Now cleanup the config & disks:
1494                 unlink $conffile;
1495
1496                 sleep 1; # some storages like rbd need to wait before release volume - really?
1497
1498                 foreach my $volid (@$newvollist) {
1499                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1500                     warn $@ if $@;
1501                 }
1502                 die "clone failed: $err";
1503             }
1504
1505             return;
1506         };
1507
1508         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1509         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1510     }});
1511
1512
1513 __PACKAGE__->register_method({
1514     name => 'resize_vm',
1515     path => '{vmid}/resize',
1516     method => 'PUT',
1517     protected => 1,
1518     proxyto => 'node',
1519     description => "Resize a container mount point.",
1520     permissions => {
1521         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1522     },
1523     parameters => {
1524         additionalProperties => 0,
1525         properties => {
1526             node => get_standard_option('pve-node'),
1527             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1528             disk => {
1529                 type => 'string',
1530                 description => "The disk you want to resize.",
1531                 enum => [PVE::LXC::Config->mountpoint_names()],
1532             },
1533             size => {
1534                 type => 'string',
1535                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1536                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1537             },
1538             digest => {
1539                 type => 'string',
1540                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1541                 maxLength => 40,
1542                 optional => 1,
1543             }
1544         },
1545     },
1546     returns => {
1547         type => 'string',
1548         description => "the task ID.",
1549     },
1550     code => sub {
1551         my ($param) = @_;
1552
1553         my $rpcenv = PVE::RPCEnvironment::get();
1554
1555         my $authuser = $rpcenv->get_user();
1556
1557         my $node = extract_param($param, 'node');
1558
1559         my $vmid = extract_param($param, 'vmid');
1560
1561         my $digest = extract_param($param, 'digest');
1562
1563         my $sizestr = extract_param($param, 'size');
1564         my $ext = ($sizestr =~ s/^\+//);
1565         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1566         die "invalid size string" if !defined($newsize);
1567
1568         die "no options specified\n" if !scalar(keys %$param);
1569
1570         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
1571
1572         my $storage_cfg = cfs_read_file("storage.cfg");
1573
1574         my $code = sub {
1575
1576             my $conf = PVE::LXC::Config->load_config($vmid);
1577             PVE::LXC::Config->check_lock($conf);
1578
1579             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1580
1581             my $running = PVE::LXC::check_running($vmid);
1582
1583             my $disk = $param->{disk};
1584             my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
1585                 PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
1586
1587             my $volid = $mp->{volume};
1588
1589             my (undef, undef, $owner, undef, undef, undef, $format) =
1590                 PVE::Storage::parse_volname($storage_cfg, $volid);
1591
1592             die "can't resize mount point owned by another container ($owner)"
1593                 if $vmid != $owner;
1594
1595             die "can't resize volume: $disk if snapshot exists\n"
1596                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1597
1598             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1599
1600             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1601
1602             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1603
1604             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1605             $newsize += $size if $ext;
1606             $newsize = int($newsize);
1607
1608             die "unable to shrink disk size\n" if $newsize < $size;
1609
1610             return if $size == $newsize;
1611
1612             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1613             my $realcmd = sub {
1614                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1615                 # we pass 0 here (parameter only makes sense for qemu)
1616                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1617
1618                 $mp->{size} = $newsize;
1619                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1620
1621                 PVE::LXC::Config->write_config($vmid, $conf);
1622
1623                 if ($format eq 'raw') {
1624                     my $path = PVE::Storage::path($storage_cfg, $volid, undef);
1625                     if ($running) {
1626
1627                         $mp->{mp} = '/';
1628                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1629                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1630                         die "internal error: CT running but mount point not attached to a loop device"
1631                             if !$path;
1632                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1633
1634                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1635                         # to be visible to it in its namespace.
1636                         # To not interfere with the rest of the system we unshare the current mount namespace,
1637                         # mount over /tmp and then run resize2fs.
1638
1639                         # interestingly we don't need to e2fsck on mounted systems...
1640                         my $quoted = PVE::Tools::shellquote($path);
1641                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1642                         eval {
1643                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1644                         };
1645                         warn "Failed to update the container's filesystem: $@\n" if $@;
1646                     } else {
1647                         eval {
1648                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1649                             PVE::Tools::run_command(['resize2fs', $path]);
1650                         };
1651                         warn "Failed to update the container's filesystem: $@\n" if $@;
1652                     }
1653                 }
1654             };
1655
1656             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1657         };
1658
1659         return PVE::LXC::Config->lock_config($vmid, $code);;
1660     }});
1661
1662 __PACKAGE__->register_method({
1663     name => 'move_volume',
1664     path => '{vmid}/move_volume',
1665     method => 'POST',
1666     protected => 1,
1667     proxyto => 'node',
1668     description => "Move a rootfs-/mp-volume to a different storage",
1669     permissions => {
1670         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1671             "and 'Datastore.AllocateSpace' permissions on the storage.",
1672         check =>
1673         [ 'and',
1674           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1675           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
1676         ],
1677     },
1678     parameters => {
1679         additionalProperties => 0,
1680         properties => {
1681             node => get_standard_option('pve-node'),
1682             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1683             volume => {
1684                 type => 'string',
1685                 enum => [ PVE::LXC::Config->mountpoint_names() ],
1686                 description => "Volume which will be moved.",
1687             },
1688             storage => get_standard_option('pve-storage-id', {
1689                 description => "Target Storage.",
1690                 completion => \&PVE::Storage::complete_storage_enabled,
1691             }),
1692             delete => {
1693                 type => 'boolean',
1694                 description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
1695                 optional => 1,
1696                 default => 0,
1697             },
1698             digest => {
1699                 type => 'string',
1700                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1701                 maxLength => 40,
1702                 optional => 1,
1703             }
1704         },
1705     },
1706     returns => {
1707         type => 'string',
1708     },
1709     code => sub {
1710         my ($param) = @_;
1711
1712         my $rpcenv = PVE::RPCEnvironment::get();
1713
1714         my $authuser = $rpcenv->get_user();
1715
1716         my $vmid = extract_param($param, 'vmid');
1717
1718         my $storage = extract_param($param, 'storage');
1719
1720         my $mpkey = extract_param($param, 'volume');
1721
1722         my $lockname = 'disk';
1723
1724         my ($mpdata, $old_volid);
1725
1726         PVE::LXC::Config->lock_config($vmid, sub {
1727             my $conf = PVE::LXC::Config->load_config($vmid);
1728             PVE::LXC::Config->check_lock($conf);
1729
1730             die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
1731
1732             if ($mpkey eq 'rootfs') {
1733                 $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
1734             } elsif ($mpkey =~ m/mp\d+/) {
1735                 $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
1736             } else {
1737                 die "Can't parse $mpkey\n";
1738             }
1739             $old_volid = $mpdata->{volume};
1740
1741             die "you can't move a volume with snapshots and delete the source\n"
1742                 if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1743
1744             PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
1745
1746             PVE::LXC::Config->set_lock($vmid, $lockname);
1747         });
1748
1749         my $realcmd = sub {
1750             eval {
1751                 PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
1752
1753                 my $conf = PVE::LXC::Config->load_config($vmid);
1754                 my $storage_cfg = PVE::Storage::config();
1755
1756                 my $new_volid;
1757
1758                 eval {
1759                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1760                     $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf);
1761                     $mpdata->{volume} = $new_volid;
1762
1763                     PVE::LXC::Config->lock_config($vmid, sub {
1764                         my $digest = $conf->{digest};
1765                         $conf = PVE::LXC::Config->load_config($vmid);
1766                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1767
1768                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
1769
1770                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1771
1772                         PVE::LXC::Config->write_config($vmid, $conf);
1773                     });
1774
1775                     eval {
1776                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1777                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1778                     };
1779                     warn $@ if $@;
1780                 };
1781                 if (my $err = $@) {
1782                     eval {
1783                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
1784                             if defined($new_volid);
1785                     };
1786                     warn $@ if $@;
1787                     die $err;
1788                 }
1789
1790                 if ($param->{delete}) {
1791                     eval {
1792                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
1793                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
1794                     };
1795                     warn $@ if $@;
1796                 }
1797             };
1798             my $err = $@;
1799             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1800             warn $@ if $@;
1801             die $err if $err;
1802         };
1803         my $task = eval {
1804             $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
1805         };
1806         if (my $err = $@) {
1807             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1808             warn $@ if $@;
1809             die $err;
1810         }
1811         return $task;
1812   }});
1813
1814 1;