src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::AccessControl;
  12 use PVE::Firewall;
  13 use PVE::Storage;
  14 use PVE::RESTHandler;
  15 use PVE::RPCEnvironment;
  16 use PVE::ReplicationConfig;
  17 use PVE::LXC;
  18 use PVE::LXC::Create;
  19 use PVE::LXC::Migrate;
  20 use PVE::GuestHelpers;
  21 use PVE::API2::LXC::Config;
  22 use PVE::API2::LXC::Status;
  23 use PVE::API2::LXC::Snapshot;
  24 use PVE::JSONSchema qw(get_standard_option);
  25 use base qw(PVE::RESTHandler);
  26
  27 BEGIN {
  28     if (!$ENV{PVE_GENERATING_DOCS}) {
  29         require PVE::HA::Env::PVE2;
  30         import  PVE::HA::Env::PVE2;
  31         require PVE::HA::Config;
  32         import  PVE::HA::Config;
  33     }
  34 }
  35
  36 __PACKAGE__->register_method ({
  37     subclass => "PVE::API2::LXC::Config",
  38     path => '{vmid}/config',
  39 });
  40
  41 __PACKAGE__->register_method ({
  42     subclass => "PVE::API2::LXC::Status",
  43     path => '{vmid}/status',
  44 });
  45
  46 __PACKAGE__->register_method ({
  47     subclass => "PVE::API2::LXC::Snapshot",
  48     path => '{vmid}/snapshot',
  49 });
  50
  51 __PACKAGE__->register_method ({
  52     subclass => "PVE::API2::Firewall::CT",
  53     path => '{vmid}/firewall',
  54 });
  55
  56 __PACKAGE__->register_method({
  57     name => 'vmlist',
  58     path => '',
  59     method => 'GET',
  60     description => "LXC container index (per node).",
  61     permissions => {
  62         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  63         user => 'all',
  64     },
  65     proxyto => 'node',
  66     protected => 1, # /proc files are only readable by root
  67     parameters => {
  68         additionalProperties => 0,
  69         properties => {
  70             node => get_standard_option('pve-node'),
  71         },
  72     },
  73     returns => {
  74         type => 'array',
  75         items => {
  76             type => "object",
  77             properties => $PVE::LXC::vmstatus_return_properties,
  78         },
  79         links => [ { rel => 'child', href => "{vmid}" } ],
  80     },
  81     code => sub {
  82         my ($param) = @_;
  83
  84         my $rpcenv = PVE::RPCEnvironment::get();
  85         my $authuser = $rpcenv->get_user();
  86
  87         my $vmstatus = PVE::LXC::vmstatus();
  88
  89         my $res = [];
  90         foreach my $vmid (keys %$vmstatus) {
  91             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  92
  93             my $data = $vmstatus->{$vmid};
  94             push @$res, $data;
  95         }
  96
  97         return $res;
  98
  99     }});
 100
 101 __PACKAGE__->register_method({
 102     name => 'create_vm',
 103     path => '',
 104     method => 'POST',
 105     description => "Create or restore a container.",
 106     permissions => {
 107         user => 'all', # check inside
 108         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 109             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 110             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 111     },
 112     protected => 1,
 113     proxyto => 'node',
 114     parameters => {
 115         additionalProperties => 0,
 116         properties => PVE::LXC::Config->json_config_properties({
 117             node => get_standard_option('pve-node'),
 118             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 119             ostemplate => {
 120                 description => "The OS template or backup file.",
 121                 type => 'string',
 122                 maxLength => 255,
 123                 completion => \&PVE::LXC::complete_os_templates,
 124             },
 125             password => {
 126                 optional => 1,
 127                 type => 'string',
 128                 description => "Sets root password inside container.",
 129                 minLength => 5,
 130             },
 131             storage => get_standard_option('pve-storage-id', {
 132                 description => "Default Storage.",
 133                 default => 'local',
 134                 optional => 1,
 135                 completion => \&PVE::Storage::complete_storage_enabled,
 136             }),
 137             force => {
 138                 optional => 1,
 139                 type => 'boolean',
 140                 description => "Allow to overwrite existing container.",
 141             },
 142             restore => {
 143                 optional => 1,
 144                 type => 'boolean',
 145                 description => "Mark this as restore task.",
 146             },
 147             pool => {
 148                 optional => 1,
 149                 type => 'string', format => 'pve-poolid',
 150                 description => "Add the VM to the specified pool.",
 151             },
 152             'ignore-unpack-errors' => {
 153                 optional => 1,
 154                 type => 'boolean',
 155                 description => "Ignore errors when extracting the template.",
 156             },
 157             'ssh-public-keys' => {
 158                 optional => 1,
 159                 type => 'string',
 160                 description => "Setup public SSH keys (one key per line, " .
 161                                 "OpenSSH format).",
 162             },
 163             bwlimit => {
 164                 description => "Override i/o bandwidth limit (in KiB/s).",
 165                 optional => 1,
 166                 type => 'number',
 167                 minimum => '0',
 168             },
 169             start => {
 170                 optional => 1,
 171                 type => 'boolean',
 172                 default => 0,
 173                 description => "Start the CT after its creation finished successfully.",
 174             },
 175         }),
 176     },
 177     returns => {
 178         type => 'string',
 179     },
 180     code => sub {
 181         my ($param) = @_;
 182
 183         my $rpcenv = PVE::RPCEnvironment::get();
 184
 185         my $authuser = $rpcenv->get_user();
 186
 187         my $node = extract_param($param, 'node');
 188
 189         my $vmid = extract_param($param, 'vmid');
 190
 191         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 192
 193         my $bwlimit = extract_param($param, 'bwlimit');
 194
 195         my $start_after_create = extract_param($param, 'start');
 196
 197         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 198
 199         my $same_container_exists = -f $basecfg_fn;
 200
 201         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 202         my $unprivileged = extract_param($param, 'unprivileged');
 203
 204         my $restore = extract_param($param, 'restore');
 205
 206         if ($restore) {
 207             # fixme: limit allowed parameters
 208
 209         }
 210
 211         my $force = extract_param($param, 'force');
 212
 213         if (!($same_container_exists && $restore && $force)) {
 214             PVE::Cluster::check_vmid_unused($vmid);
 215         } else {
 216             my $conf = PVE::LXC::Config->load_config($vmid);
 217             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 218         }
 219
 220         my $password = extract_param($param, 'password');
 221
 222         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 223         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 224
 225         my $pool = extract_param($param, 'pool');
 226
 227         if (defined($pool)) {
 228             $rpcenv->check_pool_exist($pool);
 229             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 230         }
 231
 232         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 233             # OK
 234         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 235             # OK
 236         } elsif ($restore && $force && $same_container_exists &&
 237                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 238             # OK: user has VM.Backup permissions, and want to restore an existing VM
 239         } else {
 240             raise_perm_exc();
 241         }
 242
 243         my $ostemplate = extract_param($param, 'ostemplate');
 244         my $storage = extract_param($param, 'storage') // 'local';
 245
 246         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
 247
 248         my $storage_cfg = cfs_read_file("storage.cfg");
 249
 250
 251         my $archive;
 252
 253         if ($ostemplate eq '-') {
 254             die "pipe requires cli environment\n"
 255                 if $rpcenv->{type} ne 'cli';
 256             die "pipe can only be used with restore tasks\n"
 257                 if !$restore;
 258             $archive = '-';
 259             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 260         } else {
 261             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 262             $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate);
 263         }
 264
 265         my %used_storages;
 266         my $check_and_activate_storage = sub {
 267             my ($sid) = @_;
 268
 269             my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
 270
 271             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 272                 if !$scfg->{content}->{rootdir};
 273
 274             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 275
 276             PVE::Storage::activate_storage($storage_cfg, $sid);
 277
 278             $used_storages{$sid} = 1;
 279         };
 280
 281         my $conf = {};
 282
 283         my $no_disk_param = {};
 284         my $mp_param = {};
 285         my $storage_only_mode = 1;
 286         foreach my $opt (keys %$param) {
 287             my $value = $param->{$opt};
 288             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 289                 # allow to use simple numbers (add default storage in that case)
 290                 if ($value =~ m/^\d+(\.\d+)?$/) {
 291                     $mp_param->{$opt} = "$storage:$value";
 292                 } else {
 293                     $mp_param->{$opt} = $value;
 294                 }
 295                 $storage_only_mode = 0;
 296             } elsif ($opt =~ m/^unused\d+$/) {
 297                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 298                 delete $param->{$opt};
 299             } else {
 300                 $no_disk_param->{$opt} = $value;
 301             }
 302         }
 303
 304         die "mount points configured, but 'rootfs' not set - aborting\n"
 305             if !$storage_only_mode && !defined($mp_param->{rootfs});
 306
 307         # check storage access, activate storage
 308         my $delayed_mp_param = {};
 309         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 310             my ($ms, $mountpoint) = @_;
 311
 312             my $volid = $mountpoint->{volume};
 313             my $mp = $mountpoint->{mp};
 314
 315             if ($mountpoint->{type} ne 'volume') { # bind or device
 316                 die "Only root can pass arbitrary filesystem paths.\n"
 317                     if $authuser ne 'root@pam';
 318             } else {
 319                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 320                 &$check_and_activate_storage($sid);
 321             }
 322         });
 323
 324         # check/activate default storage
 325         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 326
 327         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 328
 329         $conf->{unprivileged} = 1 if $unprivileged;
 330
 331         my $check_vmid_usage = sub {
 332             if ($force) {
 333                 die "can't overwrite running container\n"
 334                     if PVE::LXC::check_running($vmid);
 335             } else {
 336                 PVE::Cluster::check_vmid_unused($vmid);
 337             }
 338         };
 339
 340         my $code = sub {
 341             &$check_vmid_usage(); # final check after locking
 342             my $old_conf;
 343
 344             my $config_fn = PVE::LXC::Config->config_file($vmid);
 345             if (-f $config_fn) {
 346                 die "container exists" if !$restore; # just to be sure
 347                 $old_conf = PVE::LXC::Config->load_config($vmid);
 348             } else {
 349                 eval {
 350                     # try to create empty config on local node, we have an flock
 351                     PVE::LXC::Config->write_config($vmid, {});
 352                 };
 353
 354                 # another node was faster, abort
 355                 die "Could not reserve ID $vmid, already taken\n" if $@;
 356             }
 357
 358             PVE::Cluster::check_cfs_quorum();
 359             my $vollist = [];
 360
 361             eval {
 362                 if ($storage_only_mode) {
 363                     if ($restore) {
 364                         (undef, $mp_param) = PVE::LXC::Create::recover_config($archive);
 365                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 366                             if !defined($mp_param->{rootfs});
 367                         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 368                             my ($ms, $mountpoint) = @_;
 369                             my $type = $mountpoint->{type};
 370                             if ($type eq 'volume') {
 371                                 die "unable to detect disk size - please specify $ms (size)\n"
 372                                     if !defined($mountpoint->{size});
 373                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 374                                 delete $mountpoint->{size};
 375                                 $mountpoint->{volume} = "$storage:$disksize";
 376                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 377                             } else {
 378                                 my $type = $mountpoint->{type};
 379                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 380                                     if ($ms eq 'rootfs');
 381                                 die "restoring '$ms' to $type mount is only possible for root\n"
 382                                     if $authuser ne 'root@pam';
 383
 384                                 if ($mountpoint->{backup}) {
 385                                     warn "WARNING - unsupported configuration!\n";
 386                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 387                                     warn "mount point configuration will be restored after archive extraction!\n";
 388                                     warn "contained files will be restored to wrong directory!\n";
 389                                 }
 390                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 391                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 392                             }
 393                         });
 394                     } else {
 395                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 396                     }
 397                 }
 398
 399                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 400
 401                 if (defined($old_conf)) {
 402                     # destroy old container volumes
 403                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, {});
 404                 }
 405
 406                 eval {
 407                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 408                     $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
 409                     PVE::LXC::Create::restore_archive($archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
 410
 411                     if ($restore) {
 412                         PVE::LXC::Create::restore_configuration($vmid, $rootdir, $conf, $authuser ne 'root@pam');
 413                     } else {
 414                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 415                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 416                         $lxc_setup->post_create_hook($password, $ssh_keys);
 417                     }
 418                 };
 419                 my $err = $@;
 420                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 421                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 422                 die $err if $err;
 423                 # set some defaults
 424                 $conf->{hostname} ||= "CT$vmid";
 425                 $conf->{memory} ||= 512;
 426                 $conf->{swap} //= 512;
 427                 foreach my $mp (keys %$delayed_mp_param) {
 428                     $conf->{$mp} = $delayed_mp_param->{$mp};
 429                 }
 430                 PVE::LXC::Config->write_config($vmid, $conf);
 431             };
 432             if (my $err = $@) {
 433                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 434                 PVE::LXC::destroy_config($vmid);
 435                 die $err;
 436             }
 437             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 438
 439             PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
 440                 if $start_after_create;
 441         };
 442
 443         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 444
 445         &$check_vmid_usage(); # first check before locking
 446
 447         return $rpcenv->fork_worker($restore ? 'vzrestore' : 'vzcreate',
 448                                     $vmid, $authuser, $realcmd);
 449
 450     }});
 451
 452 __PACKAGE__->register_method({
 453     name => 'vmdiridx',
 454     path => '{vmid}',
 455     method => 'GET',
 456     proxyto => 'node',
 457     description => "Directory index",
 458     permissions => {
 459         user => 'all',
 460     },
 461     parameters => {
 462         additionalProperties => 0,
 463         properties => {
 464             node => get_standard_option('pve-node'),
 465             vmid => get_standard_option('pve-vmid'),
 466         },
 467     },
 468     returns => {
 469         type => 'array',
 470         items => {
 471             type => "object",
 472             properties => {
 473                 subdir => { type => 'string' },
 474             },
 475         },
 476         links => [ { rel => 'child', href => "{subdir}" } ],
 477     },
 478     code => sub {
 479         my ($param) = @_;
 480
 481         # test if VM exists
 482         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 483
 484         my $res = [
 485             { subdir => 'config' },
 486             { subdir => 'status' },
 487             { subdir => 'vncproxy' },
 488             { subdir => 'termproxy' },
 489             { subdir => 'vncwebsocket' },
 490             { subdir => 'spiceproxy' },
 491             { subdir => 'migrate' },
 492             { subdir => 'clone' },
 493 #           { subdir => 'initlog' },
 494             { subdir => 'rrd' },
 495             { subdir => 'rrddata' },
 496             { subdir => 'firewall' },
 497             { subdir => 'snapshot' },
 498             { subdir => 'resize' },
 499             ];
 500
 501         return $res;
 502     }});
 503
 504
 505 __PACKAGE__->register_method({
 506     name => 'rrd',
 507     path => '{vmid}/rrd',
 508     method => 'GET',
 509     protected => 1, # fixme: can we avoid that?
 510     permissions => {
 511         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 512     },
 513     description => "Read VM RRD statistics (returns PNG)",
 514     parameters => {
 515         additionalProperties => 0,
 516         properties => {
 517             node => get_standard_option('pve-node'),
 518             vmid => get_standard_option('pve-vmid'),
 519             timeframe => {
 520                 description => "Specify the time frame you are interested in.",
 521                 type => 'string',
 522                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 523             },
 524             ds => {
 525                 description => "The list of datasources you want to display.",
 526                 type => 'string', format => 'pve-configid-list',
 527             },
 528             cf => {
 529                 description => "The RRD consolidation function",
 530                 type => 'string',
 531                 enum => [ 'AVERAGE', 'MAX' ],
 532                 optional => 1,
 533             },
 534         },
 535     },
 536     returns => {
 537         type => "object",
 538         properties => {
 539             filename => { type => 'string' },
 540         },
 541     },
 542     code => sub {
 543         my ($param) = @_;
 544
 545         return PVE::Cluster::create_rrd_graph(
 546             "pve2-vm/$param->{vmid}", $param->{timeframe},
 547             $param->{ds}, $param->{cf});
 548
 549     }});
 550
 551 __PACKAGE__->register_method({
 552     name => 'rrddata',
 553     path => '{vmid}/rrddata',
 554     method => 'GET',
 555     protected => 1, # fixme: can we avoid that?
 556     permissions => {
 557         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 558     },
 559     description => "Read VM RRD statistics",
 560     parameters => {
 561         additionalProperties => 0,
 562         properties => {
 563             node => get_standard_option('pve-node'),
 564             vmid => get_standard_option('pve-vmid'),
 565             timeframe => {
 566                 description => "Specify the time frame you are interested in.",
 567                 type => 'string',
 568                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 569             },
 570             cf => {
 571                 description => "The RRD consolidation function",
 572                 type => 'string',
 573                 enum => [ 'AVERAGE', 'MAX' ],
 574                 optional => 1,
 575             },
 576         },
 577     },
 578     returns => {
 579         type => "array",
 580         items => {
 581             type => "object",
 582             properties => {},
 583         },
 584     },
 585     code => sub {
 586         my ($param) = @_;
 587
 588         return PVE::Cluster::create_rrd_data(
 589             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 590     }});
 591
 592 __PACKAGE__->register_method({
 593     name => 'destroy_vm',
 594     path => '{vmid}',
 595     method => 'DELETE',
 596     protected => 1,
 597     proxyto => 'node',
 598     description => "Destroy the container (also delete all uses files).",
 599     permissions => {
 600         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 601     },
 602     parameters => {
 603         additionalProperties => 0,
 604         properties => {
 605             node => get_standard_option('pve-node'),
 606             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 607         },
 608     },
 609     returns => {
 610         type => 'string',
 611     },
 612     code => sub {
 613         my ($param) = @_;
 614
 615         my $rpcenv = PVE::RPCEnvironment::get();
 616
 617         my $authuser = $rpcenv->get_user();
 618
 619         my $vmid = $param->{vmid};
 620
 621         # test if container exists
 622         my $conf = PVE::LXC::Config->load_config($vmid);
 623
 624         my $storage_cfg = cfs_read_file("storage.cfg");
 625
 626         PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 627
 628         die "unable to remove CT $vmid - used in HA resources\n"
 629             if PVE::HA::Config::vm_is_ha_managed($vmid);
 630
 631         # do not allow destroy if there are replication jobs
 632         my $repl_conf = PVE::ReplicationConfig->new();
 633         $repl_conf->check_for_existing_jobs($vmid);
 634
 635         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 636
 637         die $running_error_msg if PVE::LXC::check_running($vmid); # check early
 638
 639         my $code = sub {
 640             # reload config after lock
 641             $conf = PVE::LXC::Config->load_config($vmid);
 642             PVE::LXC::Config->check_lock($conf);
 643
 644             die $running_error_msg if PVE::LXC::check_running($vmid);
 645
 646             PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf);
 647             PVE::AccessControl::remove_vm_access($vmid);
 648             PVE::Firewall::remove_vmfw_conf($vmid);
 649         };
 650
 651         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 652
 653         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 654     }});
 655
 656 my $sslcert;
 657
 658 __PACKAGE__->register_method ({
 659     name => 'vncproxy',
 660     path => '{vmid}/vncproxy',
 661     method => 'POST',
 662     protected => 1,
 663     permissions => {
 664         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 665     },
 666     description => "Creates a TCP VNC proxy connections.",
 667     parameters => {
 668         additionalProperties => 0,
 669         properties => {
 670             node => get_standard_option('pve-node'),
 671             vmid => get_standard_option('pve-vmid'),
 672             websocket => {
 673                 optional => 1,
 674                 type => 'boolean',
 675                 description => "use websocket instead of standard VNC.",
 676             },
 677             width => {
 678                 optional => 1,
 679                 description => "sets the width of the console in pixels.",
 680                 type => 'integer',
 681                 minimum => 16,
 682                 maximum => 4096,
 683             },
 684             height => {
 685                 optional => 1,
 686                 description => "sets the height of the console in pixels.",
 687                 type => 'integer',
 688                 minimum => 16,
 689                 maximum => 2160,
 690             },
 691         },
 692     },
 693     returns => {
 694         additionalProperties => 0,
 695         properties => {
 696             user => { type => 'string' },
 697             ticket => { type => 'string' },
 698             cert => { type => 'string' },
 699             port => { type => 'integer' },
 700             upid => { type => 'string' },
 701         },
 702     },
 703     code => sub {
 704         my ($param) = @_;
 705
 706         my $rpcenv = PVE::RPCEnvironment::get();
 707
 708         my $authuser = $rpcenv->get_user();
 709
 710         my $vmid = $param->{vmid};
 711         my $node = $param->{node};
 712
 713         my $authpath = "/vms/$vmid";
 714
 715         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 716
 717         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 718             if !$sslcert;
 719
 720         my ($remip, $family);
 721
 722         if ($node ne PVE::INotify::nodename()) {
 723             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 724         } else {
 725             $family = PVE::Tools::get_host_address_family($node);
 726         }
 727
 728         my $port = PVE::Tools::next_vnc_port($family);
 729
 730         # NOTE: vncterm VNC traffic is already TLS encrypted,
 731         # so we select the fastest chipher here (or 'none'?)
 732         my $remcmd = $remip ?
 733             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 734
 735         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 736         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 737
 738         my $shcmd = [ '/usr/bin/dtach', '-A',
 739                       "/var/run/dtach/vzctlconsole$vmid",
 740                       '-r', 'winch', '-z', @$concmd];
 741
 742         my $realcmd = sub {
 743             my $upid = shift;
 744
 745             syslog ('info', "starting lxc vnc proxy $upid\n");
 746
 747             my $timeout = 10;
 748
 749             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 750                        '-timeout', $timeout, '-authpath', $authpath,
 751                        '-perm', 'VM.Console'];
 752
 753             if ($param->{width}) {
 754                 push @$cmd, '-width', $param->{width};
 755             }
 756
 757             if ($param->{height}) {
 758                 push @$cmd, '-height', $param->{height};
 759             }
 760
 761             if ($param->{websocket}) {
 762                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 763                 push @$cmd, '-notls', '-listen', 'localhost';
 764             }
 765
 766             push @$cmd, '-c', @$remcmd, @$shcmd;
 767
 768             run_command($cmd, keeplocale => 1);
 769
 770             return;
 771         };
 772
 773         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 774
 775         PVE::Tools::wait_for_vnc_port($port);
 776
 777         return {
 778             user => $authuser,
 779             ticket => $ticket,
 780             port => $port,
 781             upid => $upid,
 782             cert => $sslcert,
 783         };
 784     }});
 785
 786 __PACKAGE__->register_method ({
 787     name => 'termproxy',
 788     path => '{vmid}/termproxy',
 789     method => 'POST',
 790     protected => 1,
 791     permissions => {
 792         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 793     },
 794     description => "Creates a TCP proxy connection.",
 795     parameters => {
 796         additionalProperties => 0,
 797         properties => {
 798             node => get_standard_option('pve-node'),
 799             vmid => get_standard_option('pve-vmid'),
 800         },
 801     },
 802     returns => {
 803         additionalProperties => 0,
 804         properties => {
 805             user => { type => 'string' },
 806             ticket => { type => 'string' },
 807             port => { type => 'integer' },
 808             upid => { type => 'string' },
 809         },
 810     },
 811     code => sub {
 812         my ($param) = @_;
 813
 814         my $rpcenv = PVE::RPCEnvironment::get();
 815
 816         my $authuser = $rpcenv->get_user();
 817
 818         my $vmid = $param->{vmid};
 819         my $node = $param->{node};
 820
 821         my $authpath = "/vms/$vmid";
 822
 823         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 824
 825         my ($remip, $family);
 826
 827         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 828             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 829         } else {
 830             $family = PVE::Tools::get_host_address_family($node);
 831         }
 832
 833         my $port = PVE::Tools::next_vnc_port($family);
 834
 835         my $remcmd = $remip ?
 836             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 837
 838         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 839         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 840
 841         my $shcmd = [ '/usr/bin/dtach', '-A',
 842                       "/var/run/dtach/vzctlconsole$vmid",
 843                       '-r', 'winch', '-z', @$concmd];
 844
 845         my $realcmd = sub {
 846             my $upid = shift;
 847
 848             syslog ('info', "starting lxc termproxy $upid\n");
 849
 850             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 851                        '--perm', 'VM.Console', '--'];
 852             push @$cmd, @$remcmd, @$shcmd;
 853
 854             PVE::Tools::run_command($cmd);
 855         };
 856
 857         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 858
 859         PVE::Tools::wait_for_vnc_port($port);
 860
 861         return {
 862             user => $authuser,
 863             ticket => $ticket,
 864             port => $port,
 865             upid => $upid,
 866         };
 867     }});
 868
 869 __PACKAGE__->register_method({
 870     name => 'vncwebsocket',
 871     path => '{vmid}/vncwebsocket',
 872     method => 'GET',
 873     permissions => {
 874         description => "You also need to pass a valid ticket (vncticket).",
 875         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 876     },
 877     description => "Opens a weksocket for VNC traffic.",
 878     parameters => {
 879         additionalProperties => 0,
 880         properties => {
 881             node => get_standard_option('pve-node'),
 882             vmid => get_standard_option('pve-vmid'),
 883             vncticket => {
 884                 description => "Ticket from previous call to vncproxy.",
 885                 type => 'string',
 886                 maxLength => 512,
 887             },
 888             port => {
 889                 description => "Port number returned by previous vncproxy call.",
 890                 type => 'integer',
 891                 minimum => 5900,
 892                 maximum => 5999,
 893             },
 894         },
 895     },
 896     returns => {
 897         type => "object",
 898         properties => {
 899             port => { type => 'string' },
 900         },
 901     },
 902     code => sub {
 903         my ($param) = @_;
 904
 905         my $rpcenv = PVE::RPCEnvironment::get();
 906
 907         my $authuser = $rpcenv->get_user();
 908
 909         my $authpath = "/vms/$param->{vmid}";
 910
 911         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
 912
 913         my $port = $param->{port};
 914
 915         return { port => $port };
 916     }});
 917
 918 __PACKAGE__->register_method ({
 919     name => 'spiceproxy',
 920     path => '{vmid}/spiceproxy',
 921     method => 'POST',
 922     protected => 1,
 923     proxyto => 'node',
 924     permissions => {
 925         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 926     },
 927     description => "Returns a SPICE configuration to connect to the CT.",
 928     parameters => {
 929         additionalProperties => 0,
 930         properties => {
 931             node => get_standard_option('pve-node'),
 932             vmid => get_standard_option('pve-vmid'),
 933             proxy => get_standard_option('spice-proxy', { optional => 1 }),
 934         },
 935     },
 936     returns => get_standard_option('remote-viewer-config'),
 937     code => sub {
 938         my ($param) = @_;
 939
 940         my $vmid = $param->{vmid};
 941         my $node = $param->{node};
 942         my $proxy = $param->{proxy};
 943
 944         my $authpath = "/vms/$vmid";
 945         my $permissions = 'VM.Console';
 946
 947         my $conf = PVE::LXC::Config->load_config($vmid);
 948
 949         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
 950
 951         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
 952
 953         my $shcmd = ['/usr/bin/dtach', '-A',
 954                      "/var/run/dtach/vzctlconsole$vmid",
 955                      '-r', 'winch', '-z', @$concmd];
 956
 957         my $title = "CT $vmid";
 958
 959         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
 960     }});
 961
 962
 963 __PACKAGE__->register_method({
 964     name => 'migrate_vm',
 965     path => '{vmid}/migrate',
 966     method => 'POST',
 967     protected => 1,
 968     proxyto => 'node',
 969     description => "Migrate the container to another node. Creates a new migration task.",
 970     permissions => {
 971         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
 972     },
 973     parameters => {
 974         additionalProperties => 0,
 975         properties => {
 976             node => get_standard_option('pve-node'),
 977             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
 978             target => get_standard_option('pve-node', {
 979                 description => "Target node.",
 980                 completion => \&PVE::Cluster::complete_migration_target,
 981             }),
 982             online => {
 983                 type => 'boolean',
 984                 description => "Use online/live migration.",
 985                 optional => 1,
 986             },
 987             restart => {
 988                 type => 'boolean',
 989                 description => "Use restart migration",
 990                 optional => 1,
 991             },
 992             timeout => {
 993                 type => 'integer',
 994                 description => "Timeout in seconds for shutdown for restart migration",
 995                 optional => 1,
 996                 default => 180,
 997             },
 998             force => {
 999                 type => 'boolean',
1000                 description => "Force migration despite local bind / device" .
1001                     " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
1002                 optional => 1,
1003             },
1004         },
1005     },
1006     returns => {
1007         type => 'string',
1008         description => "the task ID.",
1009     },
1010     code => sub {
1011         my ($param) = @_;
1012
1013         my $rpcenv = PVE::RPCEnvironment::get();
1014
1015         my $authuser = $rpcenv->get_user();
1016
1017         my $target = extract_param($param, 'target');
1018
1019         my $localnode = PVE::INotify::nodename();
1020         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1021
1022         PVE::Cluster::check_cfs_quorum();
1023
1024         PVE::Cluster::check_node_exists($target);
1025
1026         my $targetip = PVE::Cluster::remote_node_ip($target);
1027
1028         my $vmid = extract_param($param, 'vmid');
1029
1030         # test if VM exists
1031         PVE::LXC::Config->load_config($vmid);
1032
1033         # try to detect errors early
1034         if (PVE::LXC::check_running($vmid)) {
1035             die "can't migrate running container without --online or --restart\n"
1036                 if !$param->{online} && !$param->{restart};
1037         }
1038
1039         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1040
1041             my $hacmd = sub {
1042                 my $upid = shift;
1043
1044                 my $service = "ct:$vmid";
1045
1046                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1047
1048                 print "Requesting HA migration for CT $vmid to node $target\n";
1049
1050                 PVE::Tools::run_command($cmd);
1051
1052                 return;
1053             };
1054
1055             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1056
1057         } else {
1058
1059             my $realcmd = sub {
1060                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1061             };
1062
1063             my $worker = sub {
1064                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1065             };
1066
1067             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1068         }
1069     }});
1070
1071 __PACKAGE__->register_method({
1072     name => 'vm_feature',
1073     path => '{vmid}/feature',
1074     method => 'GET',
1075     proxyto => 'node',
1076     protected => 1,
1077     description => "Check if feature for virtual machine is available.",
1078     permissions => {
1079         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1080     },
1081     parameters => {
1082         additionalProperties => 0,
1083         properties => {
1084             node => get_standard_option('pve-node'),
1085             vmid => get_standard_option('pve-vmid'),
1086             feature => {
1087                 description => "Feature to check.",
1088                 type => 'string',
1089                 enum => [ 'snapshot', 'clone', 'copy' ],
1090             },
1091             snapname => get_standard_option('pve-lxc-snapshot-name', {
1092                 optional => 1,
1093             }),
1094         },
1095     },
1096     returns => {
1097         type => "object",
1098         properties => {
1099             hasFeature => { type => 'boolean' },
1100             #nodes => {
1101                 #type => 'array',
1102                 #items => { type => 'string' },
1103             #}
1104         },
1105     },
1106     code => sub {
1107         my ($param) = @_;
1108
1109         my $node = extract_param($param, 'node');
1110
1111         my $vmid = extract_param($param, 'vmid');
1112
1113         my $snapname = extract_param($param, 'snapname');
1114
1115         my $feature = extract_param($param, 'feature');
1116
1117         my $conf = PVE::LXC::Config->load_config($vmid);
1118
1119         if($snapname){
1120             my $snap = $conf->{snapshots}->{$snapname};
1121             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1122             $conf = $snap;
1123         }
1124         my $storage_cfg = PVE::Storage::config();
1125         #Maybe include later
1126         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1127         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1128
1129         return {
1130             hasFeature => $hasFeature,
1131             #nodes => [ keys %$nodelist ],
1132         };
1133     }});
1134
1135 __PACKAGE__->register_method({
1136     name => 'template',
1137     path => '{vmid}/template',
1138     method => 'POST',
1139     protected => 1,
1140     proxyto => 'node',
1141     description => "Create a Template.",
1142     permissions => {
1143         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1144         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1145     },
1146     parameters => {
1147         additionalProperties => 0,
1148         properties => {
1149             node => get_standard_option('pve-node'),
1150             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1151         },
1152     },
1153     returns => { type => 'null'},
1154     code => sub {
1155         my ($param) = @_;
1156
1157         my $rpcenv = PVE::RPCEnvironment::get();
1158
1159         my $authuser = $rpcenv->get_user();
1160
1161         my $node = extract_param($param, 'node');
1162
1163         my $vmid = extract_param($param, 'vmid');
1164
1165         my $updatefn =  sub {
1166
1167             my $conf = PVE::LXC::Config->load_config($vmid);
1168             PVE::LXC::Config->check_lock($conf);
1169
1170             die "unable to create template, because CT contains snapshots\n"
1171                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1172
1173             die "you can't convert a template to a template\n"
1174                 if PVE::LXC::Config->is_template($conf);
1175
1176             die "you can't convert a CT to template if the CT is running\n"
1177                 if PVE::LXC::check_running($vmid);
1178
1179             my $scfg = PVE::Storage::config();
1180             PVE::LXC::Config->foreach_mountpoint($conf, sub {
1181                 my ($ms, $mp) = @_;
1182
1183                 my ($sid) =PVE::Storage::parse_volume_id($mp->{volume}, 0);
1184                 die "Directory storage '$sid' does not support container templates!\n"
1185                     if $scfg->{ids}->{$sid}->{path};
1186             });
1187
1188             my $realcmd = sub {
1189                 PVE::LXC::template_create($vmid, $conf);
1190
1191                 $conf->{template} = 1;
1192
1193                 PVE::LXC::Config->write_config($vmid, $conf);
1194                 # and remove lxc config
1195                 PVE::LXC::update_lxc_config($vmid, $conf);
1196             };
1197
1198             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1199         };
1200
1201         PVE::LXC::Config->lock_config($vmid, $updatefn);
1202
1203         return undef;
1204     }});
1205
1206 __PACKAGE__->register_method({
1207     name => 'clone_vm',
1208     path => '{vmid}/clone',
1209     method => 'POST',
1210     protected => 1,
1211     proxyto => 'node',
1212     description => "Create a container clone/copy",
1213     permissions => {
1214         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1215             "and 'VM.Allocate' permissions " .
1216             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1217             "'Datastore.AllocateSpace' on any used storage.",
1218         check =>
1219         [ 'and',
1220           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1221           [ 'or',
1222             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1223             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1224           ],
1225         ]
1226     },
1227     parameters => {
1228         additionalProperties => 0,
1229         properties => {
1230             node => get_standard_option('pve-node'),
1231             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1232             newid => get_standard_option('pve-vmid', {
1233                 completion => \&PVE::Cluster::complete_next_vmid,
1234                 description => 'VMID for the clone.' }),
1235             hostname => {
1236                 optional => 1,
1237                 type => 'string', format => 'dns-name',
1238                 description => "Set a hostname for the new CT.",
1239             },
1240             description => {
1241                 optional => 1,
1242                 type => 'string',
1243                 description => "Description for the new CT.",
1244             },
1245             pool => {
1246                 optional => 1,
1247                 type => 'string', format => 'pve-poolid',
1248                 description => "Add the new CT to the specified pool.",
1249             },
1250             snapname => get_standard_option('pve-lxc-snapshot-name', {
1251                 optional => 1,
1252             }),
1253             storage => get_standard_option('pve-storage-id', {
1254                 description => "Target storage for full clone.",
1255                 optional => 1,
1256             }),
1257             full => {
1258                 optional => 1,
1259                 type => 'boolean',
1260                 description => "Create a full copy of all disks. This is always done when " .
1261                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1262             },
1263             target => get_standard_option('pve-node', {
1264                 description => "Target node. Only allowed if the original VM is on shared storage.",
1265                 optional => 1,
1266             }),
1267         },
1268     },
1269     returns => {
1270         type => 'string',
1271     },
1272     code => sub {
1273         my ($param) = @_;
1274
1275         my $rpcenv = PVE::RPCEnvironment::get();
1276
1277         my $authuser = $rpcenv->get_user();
1278
1279         my $node = extract_param($param, 'node');
1280
1281         my $vmid = extract_param($param, 'vmid');
1282
1283         my $newid = extract_param($param, 'newid');
1284
1285         my $pool = extract_param($param, 'pool');
1286
1287         if (defined($pool)) {
1288             $rpcenv->check_pool_exist($pool);
1289         }
1290
1291         my $snapname = extract_param($param, 'snapname');
1292
1293         my $storage = extract_param($param, 'storage');
1294
1295         my $target = extract_param($param, 'target');
1296
1297         my $localnode = PVE::INotify::nodename();
1298
1299         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1300
1301         PVE::Cluster::check_node_exists($target) if $target;
1302
1303         my $storecfg = PVE::Storage::config();
1304
1305         if ($storage) {
1306             # check if storage is enabled on local node
1307             PVE::Storage::storage_check_enabled($storecfg, $storage);
1308             if ($target) {
1309                 # check if storage is available on target node
1310                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
1311                 # clone only works if target storage is shared
1312                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1313                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1314             }
1315         }
1316
1317         PVE::Cluster::check_cfs_quorum();
1318
1319         my $conffile;
1320         my $newconf = {};
1321         my $mountpoints = {};
1322         my $fullclone = {};
1323         my $vollist = [];
1324         my $running;
1325
1326         PVE::LXC::Config->lock_config($vmid, sub {
1327             my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1328
1329             $running = PVE::LXC::check_running($vmid) || 0;
1330
1331             my $full = extract_param($param, 'full');
1332             if (!defined($full)) {
1333                 $full = !PVE::LXC::Config->is_template($src_conf);
1334             }
1335             die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
1336
1337             eval {
1338                 die "snapshot '$snapname' does not exist\n"
1339                     if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1340
1341
1342                 my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1343
1344                 $conffile = PVE::LXC::Config->config_file($newid);
1345                 die "unable to create CT $newid: config file already exists\n"
1346                     if -f $conffile;
1347
1348                 my $sharedvm = 1;
1349                 foreach my $opt (keys %$src_conf) {
1350                     next if $opt =~ m/^unused\d+$/;
1351
1352                     my $value = $src_conf->{$opt};
1353
1354                     if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1355                         my $mp = $opt eq 'rootfs' ?
1356                             PVE::LXC::Config->parse_ct_rootfs($value) :
1357                             PVE::LXC::Config->parse_ct_mountpoint($value);
1358
1359                         if ($mp->{type} eq 'volume') {
1360                             my $volid = $mp->{volume};
1361
1362                             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
1363                             $sid = $storage if defined($storage);
1364                             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
1365                             if (!$scfg->{shared}) {
1366                                 $sharedvm = 0;
1367                                 warn "found non-shared volume: $volid\n" if $target;
1368                             }
1369
1370                             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1371
1372                             if ($full) {
1373                                 die "Cannot do full clones on a running container without snapshots\n"
1374                                     if $running && !defined($snapname);
1375                                 $fullclone->{$opt} = 1;
1376                             } else {
1377                                 # not full means clone instead of copy
1378                                 die "Linked clone feature for '$volid' is not available\n"
1379                                     if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running);
1380                             }
1381
1382                             $mountpoints->{$opt} = $mp;
1383                             push @$vollist, $volid;
1384
1385                         } else {
1386                             # TODO: allow bind mounts?
1387                             die "unable to clone mountpint '$opt' (type $mp->{type})\n";
1388                         }
1389                     } elsif ($opt =~ m/^net(\d+)$/) {
1390                         # always change MAC! address
1391                         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1392                         my $net = PVE::LXC::Config->parse_lxc_network($value);
1393                         $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1394                         $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1395                     } else {
1396                         # copy everything else
1397                         $newconf->{$opt} = $value;
1398                     }
1399                 }
1400                 die "can't clone CT to node '$target' (CT uses local storage)\n"
1401                     if $target && !$sharedvm;
1402
1403                 # Replace the 'disk' lock with a 'create' lock.
1404                 $newconf->{lock} = 'create';
1405
1406                 delete $newconf->{template};
1407                 if ($param->{hostname}) {
1408                     $newconf->{hostname} = $param->{hostname};
1409                 }
1410
1411                 if ($param->{description}) {
1412                     $newconf->{description} = $param->{description};
1413                 }
1414
1415                 # create empty/temp config - this fails if CT already exists on other node
1416                 PVE::LXC::Config->write_config($newid, $newconf);
1417             };
1418             if (my $err = $@) {
1419                 eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1420                 warn $@ if $@;
1421                 die $err;
1422             }
1423         });
1424
1425         my $update_conf = sub {
1426             my ($key, $value) = @_;
1427             return PVE::LXC::Config->lock_config($newid, sub {
1428                 my $conf = PVE::LXC::Config->load_config($newid);
1429                 die "Lost 'create' config lock, aborting.\n"
1430                     if !PVE::LXC::Config->has_lock($conf, 'create');
1431                 $conf->{$key} = $value;
1432                 PVE::LXC::Config->write_config($newid, $conf);
1433             });
1434         };
1435
1436         my $realcmd = sub {
1437             my ($upid) = @_;
1438
1439             my $newvollist = [];
1440
1441             my $verify_running = PVE::LXC::check_running($vmid) || 0;
1442             die "unexpected state change\n" if $verify_running != $running;
1443
1444             eval {
1445                 local $SIG{INT} =
1446                     local $SIG{TERM} =
1447                     local $SIG{QUIT} =
1448                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1449
1450                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1451
1452                 foreach my $opt (keys %$mountpoints) {
1453                     my $mp = $mountpoints->{$opt};
1454                     my $volid = $mp->{volume};
1455
1456                     my $newvolid;
1457                     if ($fullclone->{$opt}) {
1458                         print "create full clone of mountpoint $opt ($volid)\n";
1459                         my $target_storage = $storage // PVE::Storage::parse_volume_id($volid);
1460                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname);
1461                     } else {
1462                         print "create linked clone of mount point $opt ($volid)\n";
1463                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1464                     }
1465
1466                     push @$newvollist, $newvolid;
1467                     $mp->{volume} = $newvolid;
1468
1469                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1470                 }
1471
1472                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1473                 PVE::LXC::Config->remove_lock($newid, 'create');
1474
1475                 if ($target) {
1476                     # always deactivate volumes - avoid lvm LVs to be active on several nodes
1477                     PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
1478                     PVE::Storage::deactivate_volumes($storecfg, $newvollist);
1479
1480                     my $newconffile = PVE::LXC::Config->config_file($newid, $target);
1481                     die "Failed to move config to node '$target' - rename failed: $!\n"
1482                         if !rename($conffile, $newconffile);
1483                 }
1484             };
1485             my $err = $@;
1486
1487             # Unlock the source config in any case:
1488             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1489             warn $@ if $@;
1490
1491             if ($err) {
1492                 # Now cleanup the config & disks:
1493                 unlink $conffile;
1494
1495                 sleep 1; # some storages like rbd need to wait before release volume - really?
1496
1497                 foreach my $volid (@$newvollist) {
1498                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1499                     warn $@ if $@;
1500                 }
1501                 die "clone failed: $err";
1502             }
1503
1504             return;
1505         };
1506
1507         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1508         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1509     }});
1510
1511
1512 __PACKAGE__->register_method({
1513     name => 'resize_vm',
1514     path => '{vmid}/resize',
1515     method => 'PUT',
1516     protected => 1,
1517     proxyto => 'node',
1518     description => "Resize a container mount point.",
1519     permissions => {
1520         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1521     },
1522     parameters => {
1523         additionalProperties => 0,
1524         properties => {
1525             node => get_standard_option('pve-node'),
1526             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1527             disk => {
1528                 type => 'string',
1529                 description => "The disk you want to resize.",
1530                 enum => [PVE::LXC::Config->mountpoint_names()],
1531             },
1532             size => {
1533                 type => 'string',
1534                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1535                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1536             },
1537             digest => {
1538                 type => 'string',
1539                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1540                 maxLength => 40,
1541                 optional => 1,
1542             }
1543         },
1544     },
1545     returns => {
1546         type => 'string',
1547         description => "the task ID.",
1548     },
1549     code => sub {
1550         my ($param) = @_;
1551
1552         my $rpcenv = PVE::RPCEnvironment::get();
1553
1554         my $authuser = $rpcenv->get_user();
1555
1556         my $node = extract_param($param, 'node');
1557
1558         my $vmid = extract_param($param, 'vmid');
1559
1560         my $digest = extract_param($param, 'digest');
1561
1562         my $sizestr = extract_param($param, 'size');
1563         my $ext = ($sizestr =~ s/^\+//);
1564         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1565         die "invalid size string" if !defined($newsize);
1566
1567         die "no options specified\n" if !scalar(keys %$param);
1568
1569         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
1570
1571         my $storage_cfg = cfs_read_file("storage.cfg");
1572
1573         my $code = sub {
1574
1575             my $conf = PVE::LXC::Config->load_config($vmid);
1576             PVE::LXC::Config->check_lock($conf);
1577
1578             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1579
1580             my $running = PVE::LXC::check_running($vmid);
1581
1582             my $disk = $param->{disk};
1583             my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
1584                 PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
1585
1586             my $volid = $mp->{volume};
1587
1588             my (undef, undef, $owner, undef, undef, undef, $format) =
1589                 PVE::Storage::parse_volname($storage_cfg, $volid);
1590
1591             die "can't resize mount point owned by another container ($owner)"
1592                 if $vmid != $owner;
1593
1594             die "can't resize volume: $disk if snapshot exists\n"
1595                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1596
1597             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1598
1599             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1600
1601             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1602
1603             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1604             $newsize += $size if $ext;
1605             $newsize = int($newsize);
1606
1607             die "unable to shrink disk size\n" if $newsize < $size;
1608
1609             return if $size == $newsize;
1610
1611             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1612             my $realcmd = sub {
1613                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1614                 # we pass 0 here (parameter only makes sense for qemu)
1615                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1616
1617                 $mp->{size} = $newsize;
1618                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1619
1620                 PVE::LXC::Config->write_config($vmid, $conf);
1621
1622                 if ($format eq 'raw') {
1623                     my $path = PVE::Storage::path($storage_cfg, $volid, undef);
1624                     if ($running) {
1625
1626                         $mp->{mp} = '/';
1627                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1628                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1629                         die "internal error: CT running but mount point not attached to a loop device"
1630                             if !$path;
1631                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1632
1633                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1634                         # to be visible to it in its namespace.
1635                         # To not interfere with the rest of the system we unshare the current mount namespace,
1636                         # mount over /tmp and then run resize2fs.
1637
1638                         # interestingly we don't need to e2fsck on mounted systems...
1639                         my $quoted = PVE::Tools::shellquote($path);
1640                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1641                         eval {
1642                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1643                         };
1644                         warn "Failed to update the container's filesystem: $@\n" if $@;
1645                     } else {
1646                         eval {
1647                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1648                             PVE::Tools::run_command(['resize2fs', $path]);
1649                         };
1650                         warn "Failed to update the container's filesystem: $@\n" if $@;
1651                     }
1652                 }
1653             };
1654
1655             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1656         };
1657
1658         return PVE::LXC::Config->lock_config($vmid, $code);;
1659     }});
1660
1661 __PACKAGE__->register_method({
1662     name => 'move_volume',
1663     path => '{vmid}/move_volume',
1664     method => 'POST',
1665     protected => 1,
1666     proxyto => 'node',
1667     description => "Move a rootfs-/mp-volume to a different storage",
1668     permissions => {
1669         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1670             "and 'Datastore.AllocateSpace' permissions on the storage.",
1671         check =>
1672         [ 'and',
1673           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1674           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
1675         ],
1676     },
1677     parameters => {
1678         additionalProperties => 0,
1679         properties => {
1680             node => get_standard_option('pve-node'),
1681             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1682             volume => {
1683                 type => 'string',
1684                 enum => [ PVE::LXC::Config->mountpoint_names() ],
1685                 description => "Volume which will be moved.",
1686             },
1687             storage => get_standard_option('pve-storage-id', {
1688                 description => "Target Storage.",
1689                 completion => \&PVE::Storage::complete_storage_enabled,
1690             }),
1691             delete => {
1692                 type => 'boolean',
1693                 description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
1694                 optional => 1,
1695                 default => 0,
1696             },
1697             digest => {
1698                 type => 'string',
1699                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1700                 maxLength => 40,
1701                 optional => 1,
1702             }
1703         },
1704     },
1705     returns => {
1706         type => 'string',
1707     },
1708     code => sub {
1709         my ($param) = @_;
1710
1711         my $rpcenv = PVE::RPCEnvironment::get();
1712
1713         my $authuser = $rpcenv->get_user();
1714
1715         my $vmid = extract_param($param, 'vmid');
1716
1717         my $storage = extract_param($param, 'storage');
1718
1719         my $mpkey = extract_param($param, 'volume');
1720
1721         my $lockname = 'disk';
1722
1723         my ($mpdata, $old_volid);
1724
1725         PVE::LXC::Config->lock_config($vmid, sub {
1726             my $conf = PVE::LXC::Config->load_config($vmid);
1727             PVE::LXC::Config->check_lock($conf);
1728
1729             die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
1730
1731             if ($mpkey eq 'rootfs') {
1732                 $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
1733             } elsif ($mpkey =~ m/mp\d+/) {
1734                 $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
1735             } else {
1736                 die "Can't parse $mpkey\n";
1737             }
1738             $old_volid = $mpdata->{volume};
1739
1740             die "you can't move a volume with snapshots and delete the source\n"
1741                 if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1742
1743             PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
1744
1745             PVE::LXC::Config->set_lock($vmid, $lockname);
1746         });
1747
1748         my $realcmd = sub {
1749             eval {
1750                 PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
1751
1752                 my $conf = PVE::LXC::Config->load_config($vmid);
1753                 my $storage_cfg = PVE::Storage::config();
1754
1755                 my $new_volid;
1756
1757                 eval {
1758                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1759                     $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf);
1760                     $mpdata->{volume} = $new_volid;
1761
1762                     PVE::LXC::Config->lock_config($vmid, sub {
1763                         my $digest = $conf->{digest};
1764                         $conf = PVE::LXC::Config->load_config($vmid);
1765                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1766
1767                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
1768
1769                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1770
1771                         PVE::LXC::Config->write_config($vmid, $conf);
1772                     });
1773
1774                     eval {
1775                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1776                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1777                     };
1778                     warn $@ if $@;
1779                 };
1780                 if (my $err = $@) {
1781                     eval {
1782                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
1783                             if defined($new_volid);
1784                     };
1785                     warn $@ if $@;
1786                     die $err;
1787                 }
1788
1789                 if ($param->{delete}) {
1790                     eval {
1791                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
1792                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
1793                     };
1794                     warn $@ if $@;
1795                 }
1796             };
1797             my $err = $@;
1798             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1799             warn $@ if $@;
1800             die $err if $err;
1801         };
1802         my $task = eval {
1803             $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
1804         };
1805         if (my $err = $@) {
1806             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1807             warn $@ if $@;
1808             die $err;
1809         }
1810         return $task;
1811   }});
1812
1813 1;