src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::RRD;
  12 use PVE::DataCenterConfig;
  13 use PVE::AccessControl;
  14 use PVE::Firewall;
  15 use PVE::Storage;
  16 use PVE::RESTHandler;
  17 use PVE::RPCEnvironment;
  18 use PVE::ReplicationConfig;
  19 use PVE::LXC;
  20 use PVE::LXC::Create;
  21 use PVE::LXC::Migrate;
  22 use PVE::GuestHelpers;
  23 use PVE::VZDump::Plugin;
  24 use PVE::API2::LXC::Config;
  25 use PVE::API2::LXC::Status;
  26 use PVE::API2::LXC::Snapshot;
  27 use PVE::JSONSchema qw(get_standard_option);
  28 use base qw(PVE::RESTHandler);
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import  PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import  PVE::HA::Config;
  36     }
  37 }
  38
  39 __PACKAGE__->register_method ({
  40     subclass => "PVE::API2::LXC::Config",
  41     path => '{vmid}/config',
  42 });
  43
  44 __PACKAGE__->register_method ({
  45     subclass => "PVE::API2::LXC::Status",
  46     path => '{vmid}/status',
  47 });
  48
  49 __PACKAGE__->register_method ({
  50     subclass => "PVE::API2::LXC::Snapshot",
  51     path => '{vmid}/snapshot',
  52 });
  53
  54 __PACKAGE__->register_method ({
  55     subclass => "PVE::API2::Firewall::CT",
  56     path => '{vmid}/firewall',
  57 });
  58
  59 __PACKAGE__->register_method({
  60     name => 'vmlist',
  61     path => '',
  62     method => 'GET',
  63     description => "LXC container index (per node).",
  64     permissions => {
  65         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  66         user => 'all',
  67     },
  68     proxyto => 'node',
  69     protected => 1, # /proc files are only readable by root
  70     parameters => {
  71         additionalProperties => 0,
  72         properties => {
  73             node => get_standard_option('pve-node'),
  74         },
  75     },
  76     returns => {
  77         type => 'array',
  78         items => {
  79             type => "object",
  80             properties => $PVE::LXC::vmstatus_return_properties,
  81         },
  82         links => [ { rel => 'child', href => "{vmid}" } ],
  83     },
  84     code => sub {
  85         my ($param) = @_;
  86
  87         my $rpcenv = PVE::RPCEnvironment::get();
  88         my $authuser = $rpcenv->get_user();
  89
  90         my $vmstatus = PVE::LXC::vmstatus();
  91
  92         my $res = [];
  93         foreach my $vmid (keys %$vmstatus) {
  94             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  95
  96             my $data = $vmstatus->{$vmid};
  97             push @$res, $data;
  98         }
  99
 100         return $res;
 101
 102     }});
 103
 104 __PACKAGE__->register_method({
 105     name => 'create_vm',
 106     path => '',
 107     method => 'POST',
 108     description => "Create or restore a container.",
 109     permissions => {
 110         user => 'all', # check inside
 111         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 112             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 113             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 114     },
 115     protected => 1,
 116     proxyto => 'node',
 117     parameters => {
 118         additionalProperties => 0,
 119         properties => PVE::LXC::Config->json_config_properties({
 120             node => get_standard_option('pve-node'),
 121             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 122             ostemplate => {
 123                 description => "The OS template or backup file.",
 124                 type => 'string',
 125                 maxLength => 255,
 126                 completion => \&PVE::LXC::complete_os_templates,
 127             },
 128             password => {
 129                 optional => 1,
 130                 type => 'string',
 131                 description => "Sets root password inside container.",
 132                 minLength => 5,
 133             },
 134             storage => get_standard_option('pve-storage-id', {
 135                 description => "Default Storage.",
 136                 default => 'local',
 137                 optional => 1,
 138                 completion => \&PVE::Storage::complete_storage_enabled,
 139             }),
 140             force => {
 141                 optional => 1,
 142                 type => 'boolean',
 143                 description => "Allow to overwrite existing container.",
 144             },
 145             restore => {
 146                 optional => 1,
 147                 type => 'boolean',
 148                 description => "Mark this as restore task.",
 149             },
 150             unique => {
 151                 optional => 1,
 152                 type => 'boolean',
 153                 description => "Assign a unique random ethernet address.",
 154                 requires => 'restore',
 155             },
 156             pool => {
 157                 optional => 1,
 158                 type => 'string', format => 'pve-poolid',
 159                 description => "Add the VM to the specified pool.",
 160             },
 161             'ignore-unpack-errors' => {
 162                 optional => 1,
 163                 type => 'boolean',
 164                 description => "Ignore errors when extracting the template.",
 165             },
 166             'ssh-public-keys' => {
 167                 optional => 1,
 168                 type => 'string',
 169                 description => "Setup public SSH keys (one key per line, " .
 170                                 "OpenSSH format).",
 171             },
 172             bwlimit => {
 173                 description => "Override I/O bandwidth limit (in KiB/s).",
 174                 optional => 1,
 175                 type => 'number',
 176                 minimum => '0',
 177                 default => 'restore limit from datacenter or storage config',
 178             },
 179             start => {
 180                 optional => 1,
 181                 type => 'boolean',
 182                 default => 0,
 183                 description => "Start the CT after its creation finished successfully.",
 184             },
 185         }),
 186     },
 187     returns => {
 188         type => 'string',
 189     },
 190     code => sub {
 191         my ($param) = @_;
 192
 193         PVE::Cluster::check_cfs_quorum();
 194
 195         my $rpcenv = PVE::RPCEnvironment::get();
 196         my $authuser = $rpcenv->get_user();
 197
 198         my $node = extract_param($param, 'node');
 199         my $vmid = extract_param($param, 'vmid');
 200         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 201         my $bwlimit = extract_param($param, 'bwlimit');
 202         my $start_after_create = extract_param($param, 'start');
 203
 204         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 205         my $same_container_exists = -f $basecfg_fn;
 206
 207         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 208         my $unprivileged = extract_param($param, 'unprivileged');
 209         my $restore = extract_param($param, 'restore');
 210         my $unique = extract_param($param, 'unique');
 211
 212         # used to skip firewall config restore if user lacks permission
 213         my $skip_fw_config_restore = 0;
 214
 215         if ($restore) {
 216             # fixme: limit allowed parameters
 217         }
 218
 219         my $force = extract_param($param, 'force');
 220
 221         if (!($same_container_exists && $restore && $force)) {
 222             PVE::Cluster::check_vmid_unused($vmid);
 223         } else {
 224             die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 225             my $conf = PVE::LXC::Config->load_config($vmid);
 226             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 227         }
 228
 229         my $password = extract_param($param, 'password');
 230         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 231         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 232
 233         my $pool = extract_param($param, 'pool');
 234         if (defined($pool)) {
 235             $rpcenv->check_pool_exist($pool);
 236             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 237         }
 238
 239         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 240             # OK
 241         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 242             # OK
 243         } elsif ($restore && $force && $same_container_exists &&
 244                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 245             # OK: user has VM.Backup permissions, and want to restore an existing VM
 246
 247             # we don't want to restore a container-provided FW conf in this case
 248             # since the user is lacking permission to configure the container's FW
 249             $skip_fw_config_restore = 1;
 250
 251             # error out if a user tries to change from unprivileged to privileged
 252             # explicit change is checked here, implicit is checked down below or happening in root-only paths
 253             my $conf = PVE::LXC::Config->load_config($vmid);
 254             if ($conf->{unprivileged} && defined($unprivileged) && !$unprivileged) {
 255                 raise_perm_exc("cannot change from unprivileged to privileged without VM.Allocate");
 256             }
 257         } else {
 258             raise_perm_exc();
 259         }
 260
 261         my $ostemplate = extract_param($param, 'ostemplate');
 262         my $storage = extract_param($param, 'storage') // 'local';
 263
 264         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, undef, $param, [], $unprivileged);
 265
 266         my $storage_cfg = cfs_read_file("storage.cfg");
 267
 268         my $archive;
 269         if ($ostemplate eq '-') {
 270             die "pipe requires cli environment\n"
 271                 if $rpcenv->{type} ne 'cli';
 272             die "pipe can only be used with restore tasks\n"
 273                 if !$restore;
 274             $archive = '-';
 275             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 276         } else {
 277             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 278             $archive = $ostemplate;
 279         }
 280
 281         my %used_storages;
 282         my $check_and_activate_storage = sub {
 283             my ($sid) = @_;
 284
 285             my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $sid, $node);
 286
 287             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 288                 if !$scfg->{content}->{rootdir};
 289
 290             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 291
 292             PVE::Storage::activate_storage($storage_cfg, $sid);
 293             $used_storages{$sid} = 1;
 294         };
 295
 296         my $conf = {};
 297
 298         my $is_root = $authuser eq 'root@pam';
 299
 300         my $no_disk_param = {};
 301         my $mp_param = {};
 302         my $storage_only_mode = 1;
 303         foreach my $opt (keys %$param) {
 304             my $value = $param->{$opt};
 305             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 306                 # allow to use simple numbers (add default storage in that case)
 307                 if ($value =~ m/^\d+(\.\d+)?$/) {
 308                     $mp_param->{$opt} = "$storage:$value";
 309                 } else {
 310                     $mp_param->{$opt} = $value;
 311                 }
 312                 $storage_only_mode = 0;
 313             } elsif ($opt =~ m/^unused\d+$/) {
 314                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 315                 delete $param->{$opt};
 316             } else {
 317                 $no_disk_param->{$opt} = $value;
 318             }
 319         }
 320
 321         die "mount points configured, but 'rootfs' not set - aborting\n"
 322             if !$storage_only_mode && !defined($mp_param->{rootfs});
 323
 324         # check storage access, activate storage
 325         my $delayed_mp_param = {};
 326         PVE::LXC::Config->foreach_volume($mp_param, sub {
 327             my ($ms, $mountpoint) = @_;
 328
 329             my $volid = $mountpoint->{volume};
 330             my $mp = $mountpoint->{mp};
 331
 332             if ($mountpoint->{type} ne 'volume') { # bind or device
 333                 die "Only root can pass arbitrary filesystem paths.\n"
 334                     if !$is_root;
 335             } else {
 336                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 337                 &$check_and_activate_storage($sid);
 338             }
 339         });
 340
 341         # check/activate default storage
 342         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 343
 344         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 345
 346         $conf->{unprivileged} = 1 if $unprivileged;
 347
 348         my $emsg = $restore ? "unable to restore CT $vmid -" : "unable to create CT $vmid -";
 349
 350         eval { PVE::LXC::Config->create_and_lock_config($vmid, $force) };
 351         die "$emsg $@" if $@;
 352
 353         my $remove_lock = 1;
 354
 355         my $code = sub {
 356             my $old_conf = PVE::LXC::Config->load_config($vmid);
 357             my $was_template;
 358
 359             eval {
 360                 my $orig_mp_param; # only used if $restore
 361                 if ($restore) {
 362                     die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 363                     if ($archive ne '-') {
 364                         my $orig_conf;
 365                         print "recovering backed-up configuration from '$archive'\n";
 366                         ($orig_conf, $orig_mp_param) = PVE::LXC::Create::recover_config($storage_cfg, $archive, $vmid);
 367
 368                         $was_template = delete $orig_conf->{template};
 369
 370                         # When we're root call 'restore_configuration' with restricted=0,
 371                         # causing it to restore the raw lxc entries, among which there may be
 372                         # 'lxc.idmap' entries. We need to make sure that the extracted contents
 373                         # of the container match up with the restored configuration afterwards:
 374                         $conf->{lxc} = $orig_conf->{lxc} if $is_root;
 375
 376                         $conf->{unprivileged} = $orig_conf->{unprivileged}
 377                             if !defined($unprivileged) && defined($orig_conf->{unprivileged});
 378
 379                         # implicit privileged change is checked here
 380                         if ($old_conf->{unprivileged} && !$conf->{unprivileged}) {
 381                             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Allocate']);
 382                         }
 383                     }
 384                 }
 385                 if ($storage_only_mode) {
 386                     if ($restore) {
 387                         if (!defined($orig_mp_param)) {
 388                             print "recovering backed-up configuration from '$archive'\n";
 389                             (undef, $orig_mp_param) = PVE::LXC::Create::recover_config($storage_cfg, $archive, $vmid);
 390                         }
 391                         $mp_param = $orig_mp_param;
 392                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 393                             if !defined($mp_param->{rootfs});
 394                         PVE::LXC::Config->foreach_volume($mp_param, sub {
 395                             my ($ms, $mountpoint) = @_;
 396                             my $type = $mountpoint->{type};
 397                             if ($type eq 'volume') {
 398                                 die "unable to detect disk size - please specify $ms (size)\n"
 399                                     if !defined($mountpoint->{size});
 400                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 401                                 delete $mountpoint->{size};
 402                                 $mountpoint->{volume} = "$storage:$disksize";
 403                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 404                             } else {
 405                                 my $type = $mountpoint->{type};
 406                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 407                                     if ($ms eq 'rootfs');
 408                                 die "restoring '$ms' to $type mount is only possible for root\n"
 409                                     if !$is_root;
 410
 411                                 if ($mountpoint->{backup}) {
 412                                     warn "WARNING - unsupported configuration!\n";
 413                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 414                                     warn "mount point configuration will be restored after archive extraction!\n";
 415                                     warn "contained files will be restored to wrong directory!\n";
 416                                 }
 417                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 418                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 419                             }
 420                         });
 421                     } else {
 422                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 423                     }
 424                 }
 425             };
 426             die "$emsg $@" if $@;
 427
 428             # up until here we did not modify the container, besides the lock
 429             $remove_lock = 0;
 430
 431             my $vollist = [];
 432             eval {
 433                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 434
 435                 # we always have the 'create' lock so check for more than 1 entry
 436                 if (scalar(keys %$old_conf) > 1) {
 437                     # destroy old container volumes
 438                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, { lock => 'create' });
 439                 }
 440
 441                 eval {
 442                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 443                     $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
 444                     print "restoring '$archive' now..\n"
 445                         if $restore && $archive ne '-';
 446                     PVE::LXC::Create::restore_archive($storage_cfg, $archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
 447
 448                     if ($restore) {
 449                         print "merging backed-up and given configuration..\n";
 450                         PVE::LXC::Create::restore_configuration($vmid, $storage_cfg, $archive, $rootdir, $conf, !$is_root, $unique, $skip_fw_config_restore);
 451                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir);
 452                         $lxc_setup->template_fixup($conf);
 453                     } else {
 454                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 455                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 456                         $lxc_setup->post_create_hook($password, $ssh_keys);
 457                     }
 458                 };
 459                 my $err = $@;
 460                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 461                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 462                 die $err if $err;
 463                 # set some defaults
 464                 $conf->{hostname} ||= "CT$vmid";
 465                 $conf->{memory} ||= 512;
 466                 $conf->{swap} //= 512;
 467                 foreach my $mp (keys %$delayed_mp_param) {
 468                     $conf->{$mp} = $delayed_mp_param->{$mp};
 469                 }
 470                 # If the template flag was set, we try to convert again to template after restore
 471                 if ($was_template) {
 472                     print STDERR "Convert restored container to template...\n";
 473                     PVE::LXC::template_create($vmid, $conf);
 474                     $conf->{template} = 1;
 475                 }
 476                 PVE::LXC::Config->write_config($vmid, $conf);
 477             };
 478             if (my $err = $@) {
 479                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 480                 eval { PVE::LXC::Config->destroy_config($vmid) };
 481                 warn $@ if $@;
 482                 die "$emsg $err";
 483             }
 484             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 485
 486             PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
 487                 if $start_after_create;
 488         };
 489
 490         my $workername = $restore ? 'vzrestore' : 'vzcreate';
 491         my $realcmd = sub {
 492             eval {
 493                 PVE::LXC::Config->lock_config($vmid, $code);
 494             };
 495             if (my $err = $@) {
 496                 # if we aborted before changing the container, we must remove the create lock
 497                 if ($remove_lock) {
 498                     PVE::LXC::Config->remove_lock($vmid, 'create');
 499                 }
 500                 die $err;
 501             }
 502         };
 503
 504         return $rpcenv->fork_worker($workername, $vmid, $authuser, $realcmd);
 505     }});
 506
 507 __PACKAGE__->register_method({
 508     name => 'vmdiridx',
 509     path => '{vmid}',
 510     method => 'GET',
 511     proxyto => 'node',
 512     description => "Directory index",
 513     permissions => {
 514         user => 'all',
 515     },
 516     parameters => {
 517         additionalProperties => 0,
 518         properties => {
 519             node => get_standard_option('pve-node'),
 520             vmid => get_standard_option('pve-vmid'),
 521         },
 522     },
 523     returns => {
 524         type => 'array',
 525         items => {
 526             type => "object",
 527             properties => {
 528                 subdir => { type => 'string' },
 529             },
 530         },
 531         links => [ { rel => 'child', href => "{subdir}" } ],
 532     },
 533     code => sub {
 534         my ($param) = @_;
 535
 536         # test if VM exists
 537         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 538
 539         my $res = [
 540             { subdir => 'config' },
 541             { subdir => 'pending' },
 542             { subdir => 'status' },
 543             { subdir => 'vncproxy' },
 544             { subdir => 'termproxy' },
 545             { subdir => 'vncwebsocket' },
 546             { subdir => 'spiceproxy' },
 547             { subdir => 'migrate' },
 548             { subdir => 'clone' },
 549 #           { subdir => 'initlog' },
 550             { subdir => 'rrd' },
 551             { subdir => 'rrddata' },
 552             { subdir => 'firewall' },
 553             { subdir => 'snapshot' },
 554             { subdir => 'resize' },
 555             ];
 556
 557         return $res;
 558     }});
 559
 560
 561 __PACKAGE__->register_method({
 562     name => 'rrd',
 563     path => '{vmid}/rrd',
 564     method => 'GET',
 565     protected => 1, # fixme: can we avoid that?
 566     permissions => {
 567         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 568     },
 569     description => "Read VM RRD statistics (returns PNG)",
 570     parameters => {
 571         additionalProperties => 0,
 572         properties => {
 573             node => get_standard_option('pve-node'),
 574             vmid => get_standard_option('pve-vmid'),
 575             timeframe => {
 576                 description => "Specify the time frame you are interested in.",
 577                 type => 'string',
 578                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 579             },
 580             ds => {
 581                 description => "The list of datasources you want to display.",
 582                 type => 'string', format => 'pve-configid-list',
 583             },
 584             cf => {
 585                 description => "The RRD consolidation function",
 586                 type => 'string',
 587                 enum => [ 'AVERAGE', 'MAX' ],
 588                 optional => 1,
 589             },
 590         },
 591     },
 592     returns => {
 593         type => "object",
 594         properties => {
 595             filename => { type => 'string' },
 596         },
 597     },
 598     code => sub {
 599         my ($param) = @_;
 600
 601         return PVE::RRD::create_rrd_graph(
 602             "pve2-vm/$param->{vmid}", $param->{timeframe},
 603             $param->{ds}, $param->{cf});
 604
 605     }});
 606
 607 __PACKAGE__->register_method({
 608     name => 'rrddata',
 609     path => '{vmid}/rrddata',
 610     method => 'GET',
 611     protected => 1, # fixme: can we avoid that?
 612     permissions => {
 613         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 614     },
 615     description => "Read VM RRD statistics",
 616     parameters => {
 617         additionalProperties => 0,
 618         properties => {
 619             node => get_standard_option('pve-node'),
 620             vmid => get_standard_option('pve-vmid'),
 621             timeframe => {
 622                 description => "Specify the time frame you are interested in.",
 623                 type => 'string',
 624                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 625             },
 626             cf => {
 627                 description => "The RRD consolidation function",
 628                 type => 'string',
 629                 enum => [ 'AVERAGE', 'MAX' ],
 630                 optional => 1,
 631             },
 632         },
 633     },
 634     returns => {
 635         type => "array",
 636         items => {
 637             type => "object",
 638             properties => {},
 639         },
 640     },
 641     code => sub {
 642         my ($param) = @_;
 643
 644         return PVE::RRD::create_rrd_data(
 645             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 646     }});
 647
 648 __PACKAGE__->register_method({
 649     name => 'destroy_vm',
 650     path => '{vmid}',
 651     method => 'DELETE',
 652     protected => 1,
 653     proxyto => 'node',
 654     description => "Destroy the container (also delete all uses files).",
 655     permissions => {
 656         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 657     },
 658     parameters => {
 659         additionalProperties => 0,
 660         properties => {
 661             node => get_standard_option('pve-node'),
 662             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 663             force => {
 664                 type => 'boolean',
 665                 description => "Force destroy, even if running.",
 666                 default => 0,
 667                 optional => 1,
 668             },
 669             purge => {
 670                 type => 'boolean',
 671                 description => "Remove container from all related configurations."
 672                     ." For example, backup jobs, replication jobs or HA."
 673                     ." Related ACLs and Firewall entries will *always* be removed.",
 674                 default => 0,
 675                 optional => 1,
 676             },
 677             'destroy-unreferenced-disks' => {
 678                 type => 'boolean',
 679                 description => "If set, destroy additionally all disks with the VMID from all"
 680                     ." enabled storages which are not referenced in the config.",
 681                 optional => 1,
 682             },
 683         },
 684     },
 685     returns => {
 686         type => 'string',
 687     },
 688     code => sub {
 689         my ($param) = @_;
 690
 691         my $rpcenv = PVE::RPCEnvironment::get();
 692         my $authuser = $rpcenv->get_user();
 693         my $vmid = $param->{vmid};
 694
 695         # test if container exists
 696
 697         my $conf = PVE::LXC::Config->load_config($vmid);
 698         my $early_checks = sub {
 699             my ($conf) = @_;
 700             PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 701             PVE::LXC::Config->check_lock($conf);
 702
 703             my $ha_managed = PVE::HA::Config::service_is_configured("ct:$vmid");
 704
 705             if (!$param->{purge}) {
 706                 die "unable to remove CT $vmid - used in HA resources and purge parameter not set.\n"
 707                     if $ha_managed;
 708
 709                 # do not allow destroy if there are replication jobs without purge
 710                 my $repl_conf = PVE::ReplicationConfig->new();
 711                 $repl_conf->check_for_existing_jobs($vmid);
 712             }
 713
 714             return $ha_managed;
 715         };
 716
 717         $early_checks->($conf);
 718
 719         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 720         die $running_error_msg if !$param->{force} && PVE::LXC::check_running($vmid); # check early
 721
 722         my $code = sub {
 723             # reload config after lock
 724             $conf = PVE::LXC::Config->load_config($vmid);
 725             my $ha_managed = $early_checks->($conf);
 726
 727             if (PVE::LXC::check_running($vmid)) {
 728                 die $running_error_msg if !$param->{force};
 729                 warn "forced to stop CT $vmid before destroying!\n";
 730                 if (!$ha_managed) {
 731                     PVE::LXC::vm_stop($vmid, 1);
 732                 } else {
 733                     run_command(['ha-manager', 'crm-command', 'stop',  "ct:$vmid", '120']);
 734                 }
 735             }
 736
 737             my $storage_cfg = cfs_read_file("storage.cfg");
 738             PVE::LXC::destroy_lxc_container(
 739                 $storage_cfg,
 740                 $vmid,
 741                 $conf,
 742                 { lock => 'destroyed' },
 743                 $param->{'destroy-unreferenced-disks'},
 744             );
 745
 746             PVE::AccessControl::remove_vm_access($vmid);
 747             PVE::Firewall::remove_vmfw_conf($vmid);
 748             if ($param->{purge}) {
 749                 print "purging CT $vmid from related configurations..\n";
 750                 PVE::ReplicationConfig::remove_vmid_jobs($vmid);
 751                 PVE::VZDump::Plugin::remove_vmid_from_backup_jobs($vmid);
 752
 753                 if ($ha_managed) {
 754                     PVE::HA::Config::delete_service_from_config("ct:$vmid");
 755                     print "NOTE: removed CT $vmid from HA resource configuration.\n";
 756                 }
 757             }
 758
 759             # only now remove the zombie config, else we can have reuse race
 760             PVE::LXC::Config->destroy_config($vmid);
 761         };
 762
 763         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 764
 765         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 766     }});
 767
 768 my $sslcert;
 769
 770 __PACKAGE__->register_method ({
 771     name => 'vncproxy',
 772     path => '{vmid}/vncproxy',
 773     method => 'POST',
 774     protected => 1,
 775     permissions => {
 776         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 777     },
 778     description => "Creates a TCP VNC proxy connections.",
 779     parameters => {
 780         additionalProperties => 0,
 781         properties => {
 782             node => get_standard_option('pve-node'),
 783             vmid => get_standard_option('pve-vmid'),
 784             websocket => {
 785                 optional => 1,
 786                 type => 'boolean',
 787                 description => "use websocket instead of standard VNC.",
 788             },
 789             width => {
 790                 optional => 1,
 791                 description => "sets the width of the console in pixels.",
 792                 type => 'integer',
 793                 minimum => 16,
 794                 maximum => 4096,
 795             },
 796             height => {
 797                 optional => 1,
 798                 description => "sets the height of the console in pixels.",
 799                 type => 'integer',
 800                 minimum => 16,
 801                 maximum => 2160,
 802             },
 803         },
 804     },
 805     returns => {
 806         additionalProperties => 0,
 807         properties => {
 808             user => { type => 'string' },
 809             ticket => { type => 'string' },
 810             cert => { type => 'string' },
 811             port => { type => 'integer' },
 812             upid => { type => 'string' },
 813         },
 814     },
 815     code => sub {
 816         my ($param) = @_;
 817
 818         my $rpcenv = PVE::RPCEnvironment::get();
 819
 820         my $authuser = $rpcenv->get_user();
 821
 822         my $vmid = $param->{vmid};
 823         my $node = $param->{node};
 824
 825         my $authpath = "/vms/$vmid";
 826
 827         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 828
 829         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 830             if !$sslcert;
 831
 832         my ($remip, $family);
 833
 834         if ($node ne PVE::INotify::nodename()) {
 835             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 836         } else {
 837             $family = PVE::Tools::get_host_address_family($node);
 838         }
 839
 840         my $port = PVE::Tools::next_vnc_port($family);
 841
 842         # NOTE: vncterm VNC traffic is already TLS encrypted,
 843         # so we select the fastest chipher here (or 'none'?)
 844         my $remcmd = $remip ?
 845             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 846
 847         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 848         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 849
 850         my $shcmd = [ '/usr/bin/dtach', '-A',
 851                       "/var/run/dtach/vzctlconsole$vmid",
 852                       '-r', 'winch', '-z', @$concmd];
 853
 854         my $realcmd = sub {
 855             my $upid = shift;
 856
 857             syslog ('info', "starting lxc vnc proxy $upid\n");
 858
 859             my $timeout = 10;
 860
 861             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 862                        '-timeout', $timeout, '-authpath', $authpath,
 863                        '-perm', 'VM.Console'];
 864
 865             if ($param->{width}) {
 866                 push @$cmd, '-width', $param->{width};
 867             }
 868
 869             if ($param->{height}) {
 870                 push @$cmd, '-height', $param->{height};
 871             }
 872
 873             if ($param->{websocket}) {
 874                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 875                 push @$cmd, '-notls', '-listen', 'localhost';
 876             }
 877
 878             push @$cmd, '-c', @$remcmd, @$shcmd;
 879
 880             run_command($cmd, keeplocale => 1);
 881
 882             return;
 883         };
 884
 885         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 886
 887         PVE::Tools::wait_for_vnc_port($port);
 888
 889         return {
 890             user => $authuser,
 891             ticket => $ticket,
 892             port => $port,
 893             upid => $upid,
 894             cert => $sslcert,
 895         };
 896     }});
 897
 898 __PACKAGE__->register_method ({
 899     name => 'termproxy',
 900     path => '{vmid}/termproxy',
 901     method => 'POST',
 902     protected => 1,
 903     permissions => {
 904         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 905     },
 906     description => "Creates a TCP proxy connection.",
 907     parameters => {
 908         additionalProperties => 0,
 909         properties => {
 910             node => get_standard_option('pve-node'),
 911             vmid => get_standard_option('pve-vmid'),
 912         },
 913     },
 914     returns => {
 915         additionalProperties => 0,
 916         properties => {
 917             user => { type => 'string' },
 918             ticket => { type => 'string' },
 919             port => { type => 'integer' },
 920             upid => { type => 'string' },
 921         },
 922     },
 923     code => sub {
 924         my ($param) = @_;
 925
 926         my $rpcenv = PVE::RPCEnvironment::get();
 927
 928         my $authuser = $rpcenv->get_user();
 929
 930         my $vmid = $param->{vmid};
 931         my $node = $param->{node};
 932
 933         my $authpath = "/vms/$vmid";
 934
 935         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 936
 937         my ($remip, $family);
 938
 939         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 940             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 941         } else {
 942             $family = PVE::Tools::get_host_address_family($node);
 943         }
 944
 945         my $port = PVE::Tools::next_vnc_port($family);
 946
 947         my $remcmd = $remip ?
 948             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 949
 950         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 951         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 952
 953         my $shcmd = [ '/usr/bin/dtach', '-A',
 954                       "/var/run/dtach/vzctlconsole$vmid",
 955                       '-r', 'winch', '-z', @$concmd];
 956
 957         my $realcmd = sub {
 958             my $upid = shift;
 959
 960             syslog ('info', "starting lxc termproxy $upid\n");
 961
 962             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 963                        '--perm', 'VM.Console', '--'];
 964             push @$cmd, @$remcmd, @$shcmd;
 965
 966             PVE::Tools::run_command($cmd);
 967         };
 968
 969         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 970
 971         PVE::Tools::wait_for_vnc_port($port);
 972
 973         return {
 974             user => $authuser,
 975             ticket => $ticket,
 976             port => $port,
 977             upid => $upid,
 978         };
 979     }});
 980
 981 __PACKAGE__->register_method({
 982     name => 'vncwebsocket',
 983     path => '{vmid}/vncwebsocket',
 984     method => 'GET',
 985     permissions => {
 986         description => "You also need to pass a valid ticket (vncticket).",
 987         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 988     },
 989     description => "Opens a weksocket for VNC traffic.",
 990     parameters => {
 991         additionalProperties => 0,
 992         properties => {
 993             node => get_standard_option('pve-node'),
 994             vmid => get_standard_option('pve-vmid'),
 995             vncticket => {
 996                 description => "Ticket from previous call to vncproxy.",
 997                 type => 'string',
 998                 maxLength => 512,
 999             },
1000             port => {
1001                 description => "Port number returned by previous vncproxy call.",
1002                 type => 'integer',
1003                 minimum => 5900,
1004                 maximum => 5999,
1005             },
1006         },
1007     },
1008     returns => {
1009         type => "object",
1010         properties => {
1011             port => { type => 'string' },
1012         },
1013     },
1014     code => sub {
1015         my ($param) = @_;
1016
1017         my $rpcenv = PVE::RPCEnvironment::get();
1018
1019         my $authuser = $rpcenv->get_user();
1020
1021         my $authpath = "/vms/$param->{vmid}";
1022
1023         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1024
1025         my $port = $param->{port};
1026
1027         return { port => $port };
1028     }});
1029
1030 __PACKAGE__->register_method ({
1031     name => 'spiceproxy',
1032     path => '{vmid}/spiceproxy',
1033     method => 'POST',
1034     protected => 1,
1035     proxyto => 'node',
1036     permissions => {
1037         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1038     },
1039     description => "Returns a SPICE configuration to connect to the CT.",
1040     parameters => {
1041         additionalProperties => 0,
1042         properties => {
1043             node => get_standard_option('pve-node'),
1044             vmid => get_standard_option('pve-vmid'),
1045             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1046         },
1047     },
1048     returns => get_standard_option('remote-viewer-config'),
1049     code => sub {
1050         my ($param) = @_;
1051
1052         my $vmid = $param->{vmid};
1053         my $node = $param->{node};
1054         my $proxy = $param->{proxy};
1055
1056         my $authpath = "/vms/$vmid";
1057         my $permissions = 'VM.Console';
1058
1059         my $conf = PVE::LXC::Config->load_config($vmid);
1060
1061         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
1062
1063         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
1064
1065         my $shcmd = ['/usr/bin/dtach', '-A',
1066                      "/var/run/dtach/vzctlconsole$vmid",
1067                      '-r', 'winch', '-z', @$concmd];
1068
1069         my $title = "CT $vmid";
1070
1071         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
1072     }});
1073
1074
1075 __PACKAGE__->register_method({
1076     name => 'migrate_vm',
1077     path => '{vmid}/migrate',
1078     method => 'POST',
1079     protected => 1,
1080     proxyto => 'node',
1081     description => "Migrate the container to another node. Creates a new migration task.",
1082     permissions => {
1083         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
1084     },
1085     parameters => {
1086         additionalProperties => 0,
1087         properties => {
1088             node => get_standard_option('pve-node'),
1089             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1090             target => get_standard_option('pve-node', {
1091                 description => "Target node.",
1092                 completion => \&PVE::Cluster::complete_migration_target,
1093             }),
1094             online => {
1095                 type => 'boolean',
1096                 description => "Use online/live migration.",
1097                 optional => 1,
1098             },
1099             restart => {
1100                 type => 'boolean',
1101                 description => "Use restart migration",
1102                 optional => 1,
1103             },
1104             timeout => {
1105                 type => 'integer',
1106                 description => "Timeout in seconds for shutdown for restart migration",
1107                 optional => 1,
1108                 default => 180,
1109             },
1110             bwlimit => {
1111                 description => "Override I/O bandwidth limit (in KiB/s).",
1112                 optional => 1,
1113                 type => 'number',
1114                 minimum => '0',
1115                 default => 'migrate limit from datacenter or storage config',
1116             },
1117         },
1118     },
1119     returns => {
1120         type => 'string',
1121         description => "the task ID.",
1122     },
1123     code => sub {
1124         my ($param) = @_;
1125
1126         my $rpcenv = PVE::RPCEnvironment::get();
1127
1128         my $authuser = $rpcenv->get_user();
1129
1130         my $target = extract_param($param, 'target');
1131
1132         my $localnode = PVE::INotify::nodename();
1133         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1134
1135         PVE::Cluster::check_cfs_quorum();
1136
1137         PVE::Cluster::check_node_exists($target);
1138
1139         my $targetip = PVE::Cluster::remote_node_ip($target);
1140
1141         my $vmid = extract_param($param, 'vmid');
1142
1143         # test if VM exists
1144         PVE::LXC::Config->load_config($vmid);
1145
1146         # try to detect errors early
1147         if (PVE::LXC::check_running($vmid)) {
1148             die "can't migrate running container without --online or --restart\n"
1149                 if !$param->{online} && !$param->{restart};
1150         }
1151
1152         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1153
1154             my $hacmd = sub {
1155                 my $upid = shift;
1156
1157                 my $service = "ct:$vmid";
1158
1159                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1160
1161                 print "Requesting HA migration for CT $vmid to node $target\n";
1162
1163                 PVE::Tools::run_command($cmd);
1164
1165                 return;
1166             };
1167
1168             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1169
1170         } else {
1171
1172             my $realcmd = sub {
1173                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1174             };
1175
1176             my $worker = sub {
1177                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1178             };
1179
1180             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1181         }
1182     }});
1183
1184 __PACKAGE__->register_method({
1185     name => 'vm_feature',
1186     path => '{vmid}/feature',
1187     method => 'GET',
1188     proxyto => 'node',
1189     protected => 1,
1190     description => "Check if feature for virtual machine is available.",
1191     permissions => {
1192         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1193     },
1194     parameters => {
1195         additionalProperties => 0,
1196         properties => {
1197             node => get_standard_option('pve-node'),
1198             vmid => get_standard_option('pve-vmid'),
1199             feature => {
1200                 description => "Feature to check.",
1201                 type => 'string',
1202                 enum => [ 'snapshot', 'clone', 'copy' ],
1203             },
1204             snapname => get_standard_option('pve-snapshot-name', {
1205                 optional => 1,
1206             }),
1207         },
1208     },
1209     returns => {
1210         type => "object",
1211         properties => {
1212             hasFeature => { type => 'boolean' },
1213             #nodes => {
1214                 #type => 'array',
1215                 #items => { type => 'string' },
1216             #}
1217         },
1218     },
1219     code => sub {
1220         my ($param) = @_;
1221
1222         my $node = extract_param($param, 'node');
1223
1224         my $vmid = extract_param($param, 'vmid');
1225
1226         my $snapname = extract_param($param, 'snapname');
1227
1228         my $feature = extract_param($param, 'feature');
1229
1230         my $conf = PVE::LXC::Config->load_config($vmid);
1231
1232         if($snapname){
1233             my $snap = $conf->{snapshots}->{$snapname};
1234             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1235             $conf = $snap;
1236         }
1237         my $storage_cfg = PVE::Storage::config();
1238         #Maybe include later
1239         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1240         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1241
1242         return {
1243             hasFeature => $hasFeature,
1244             #nodes => [ keys %$nodelist ],
1245         };
1246     }});
1247
1248 __PACKAGE__->register_method({
1249     name => 'template',
1250     path => '{vmid}/template',
1251     method => 'POST',
1252     protected => 1,
1253     proxyto => 'node',
1254     description => "Create a Template.",
1255     permissions => {
1256         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1257         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1258     },
1259     parameters => {
1260         additionalProperties => 0,
1261         properties => {
1262             node => get_standard_option('pve-node'),
1263             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1264         },
1265     },
1266     returns => { type => 'null'},
1267     code => sub {
1268         my ($param) = @_;
1269
1270         my $rpcenv = PVE::RPCEnvironment::get();
1271
1272         my $authuser = $rpcenv->get_user();
1273
1274         my $node = extract_param($param, 'node');
1275
1276         my $vmid = extract_param($param, 'vmid');
1277
1278         my $updatefn =  sub {
1279
1280             my $conf = PVE::LXC::Config->load_config($vmid);
1281             PVE::LXC::Config->check_lock($conf);
1282
1283             die "unable to create template, because CT contains snapshots\n"
1284                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1285
1286             die "you can't convert a template to a template\n"
1287                 if PVE::LXC::Config->is_template($conf);
1288
1289             die "you can't convert a CT to template if the CT is running\n"
1290                 if PVE::LXC::check_running($vmid);
1291
1292             my $realcmd = sub {
1293                 PVE::LXC::template_create($vmid, $conf);
1294
1295                 $conf->{template} = 1;
1296
1297                 PVE::LXC::Config->write_config($vmid, $conf);
1298                 # and remove lxc config
1299                 PVE::LXC::update_lxc_config($vmid, $conf);
1300             };
1301
1302             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1303         };
1304
1305         PVE::LXC::Config->lock_config($vmid, $updatefn);
1306
1307         return undef;
1308     }});
1309
1310 __PACKAGE__->register_method({
1311     name => 'clone_vm',
1312     path => '{vmid}/clone',
1313     method => 'POST',
1314     protected => 1,
1315     proxyto => 'node',
1316     description => "Create a container clone/copy",
1317     permissions => {
1318         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1319             "and 'VM.Allocate' permissions " .
1320             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1321             "'Datastore.AllocateSpace' on any used storage.",
1322         check =>
1323         [ 'and',
1324           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1325           [ 'or',
1326             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1327             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1328           ],
1329         ]
1330     },
1331     parameters => {
1332         additionalProperties => 0,
1333         properties => {
1334             node => get_standard_option('pve-node'),
1335             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1336             newid => get_standard_option('pve-vmid', {
1337                 completion => \&PVE::Cluster::complete_next_vmid,
1338                 description => 'VMID for the clone.' }),
1339             hostname => {
1340                 optional => 1,
1341                 type => 'string', format => 'dns-name',
1342                 description => "Set a hostname for the new CT.",
1343             },
1344             description => {
1345                 optional => 1,
1346                 type => 'string',
1347                 description => "Description for the new CT.",
1348             },
1349             pool => {
1350                 optional => 1,
1351                 type => 'string', format => 'pve-poolid',
1352                 description => "Add the new CT to the specified pool.",
1353             },
1354             snapname => get_standard_option('pve-snapshot-name', {
1355                 optional => 1,
1356             }),
1357             storage => get_standard_option('pve-storage-id', {
1358                 description => "Target storage for full clone.",
1359                 optional => 1,
1360             }),
1361             full => {
1362                 optional => 1,
1363                 type => 'boolean',
1364                 description => "Create a full copy of all disks. This is always done when " .
1365                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1366             },
1367             target => get_standard_option('pve-node', {
1368                 description => "Target node. Only allowed if the original VM is on shared storage.",
1369                 optional => 1,
1370             }),
1371             bwlimit => {
1372                 description => "Override I/O bandwidth limit (in KiB/s).",
1373                 optional => 1,
1374                 type => 'number',
1375                 minimum => '0',
1376                 default => 'clone limit from datacenter or storage config',
1377             },
1378         },
1379     },
1380     returns => {
1381         type => 'string',
1382     },
1383     code => sub {
1384         my ($param) = @_;
1385
1386         my $rpcenv = PVE::RPCEnvironment::get();
1387         my $authuser = $rpcenv->get_user();
1388
1389         my $node = extract_param($param, 'node');
1390         my $vmid = extract_param($param, 'vmid');
1391         my $newid = extract_param($param, 'newid');
1392         my $pool = extract_param($param, 'pool');
1393         if (defined($pool)) {
1394             $rpcenv->check_pool_exist($pool);
1395         }
1396         my $snapname = extract_param($param, 'snapname');
1397         my $storage = extract_param($param, 'storage');
1398         my $target = extract_param($param, 'target');
1399         my $localnode = PVE::INotify::nodename();
1400
1401         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1402
1403         PVE::Cluster::check_node_exists($target) if $target;
1404
1405         my $storecfg = PVE::Storage::config();
1406
1407         if ($storage) {
1408             # check if storage is enabled on local node
1409             PVE::Storage::storage_check_enabled($storecfg, $storage);
1410             if ($target) {
1411                 # check if storage is available on target node
1412                 PVE::Storage::storage_check_enabled($storecfg, $storage, $target);
1413                 # clone only works if target storage is shared
1414                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1415                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1416             }
1417         }
1418
1419         PVE::Cluster::check_cfs_quorum();
1420
1421         my $newconf = {};
1422         my $mountpoints = {};
1423         my $fullclone = {};
1424         my $vollist = [];
1425         my $running;
1426
1427         PVE::LXC::Config->create_and_lock_config($newid, 0);
1428         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1429
1430         my $lock_and_reload = sub {
1431             my ($vmid, $code) = @_;
1432             return PVE::LXC::Config->lock_config($vmid, sub {
1433                 my $conf = PVE::LXC::Config->load_config($vmid);
1434                 die "Lost 'create' config lock, aborting.\n"
1435                     if !PVE::LXC::Config->has_lock($conf, 'create');
1436
1437                 return $code->($conf);
1438             });
1439         };
1440
1441         my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1442
1443         $running = PVE::LXC::check_running($vmid) || 0;
1444
1445         my $full = extract_param($param, 'full');
1446         if (!defined($full)) {
1447             $full = !PVE::LXC::Config->is_template($src_conf);
1448         }
1449
1450         eval {
1451             die "parameter 'storage' not allowed for linked clones\n"
1452                 if defined($storage) && !$full;
1453
1454             die "snapshot '$snapname' does not exist\n"
1455                 if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1456
1457             my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1458
1459             my $sharedvm = 1;
1460             for my $opt (sort keys %$src_conf) {
1461                 next if $opt =~ m/^unused\d+$/;
1462
1463                 my $value = $src_conf->{$opt};
1464
1465                 if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1466                     my $mp = PVE::LXC::Config->parse_volume($opt, $value);
1467
1468                     if ($mp->{type} eq 'volume') {
1469                         my $volid = $mp->{volume};
1470
1471                         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
1472                         $sid = $storage if defined($storage);
1473                         my $scfg = PVE::Storage::storage_config($storecfg, $sid);
1474                         if (!$scfg->{shared}) {
1475                             $sharedvm = 0;
1476                             warn "found non-shared volume: $volid\n" if $target;
1477                         }
1478
1479                         $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1480
1481                         if ($full) {
1482                             die "Cannot do full clones on a running container without snapshots\n"
1483                                 if $running && !defined($snapname);
1484                             $fullclone->{$opt} = 1;
1485                         } else {
1486                             # not full means clone instead of copy
1487                             die "Linked clone feature for '$volid' is not available\n"
1488                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running, {'valid_target_formats' => ['raw', 'subvol']});
1489                         }
1490
1491                         $mountpoints->{$opt} = $mp;
1492                         push @$vollist, $volid;
1493
1494                     } else {
1495                         # TODO: allow bind mounts?
1496                         die "unable to clone mountpoint '$opt' (type $mp->{type})\n";
1497                     }
1498                 } elsif ($opt =~ m/^net(\d+)$/) {
1499                     # always change MAC! address
1500                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1501                     my $net = PVE::LXC::Config->parse_lxc_network($value);
1502                     $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1503                     $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1504                 } else {
1505                     # copy everything else
1506                     $newconf->{$opt} = $value;
1507                 }
1508             }
1509             die "can't clone CT to node '$target' (CT uses local storage)\n"
1510                 if $target && !$sharedvm;
1511
1512             # Replace the 'disk' lock with a 'create' lock.
1513             $newconf->{lock} = 'create';
1514
1515             # delete all snapshot related config options
1516             delete $newconf->@{qw(snapshots parent snaptime snapstate)};
1517
1518             delete $newconf->{pending};
1519             delete $newconf->{template};
1520
1521             $newconf->{hostname} = $param->{hostname} if $param->{hostname};
1522             $newconf->{description} = $param->{description} if $param->{description};
1523
1524             $lock_and_reload->($newid, sub {
1525                 PVE::LXC::Config->write_config($newid, $newconf);
1526             });
1527         };
1528         if (my $err = $@) {
1529             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1530             warn "Failed to remove source CT config lock - $@\n" if $@;
1531
1532             eval {
1533                 $lock_and_reload->($newid, sub {
1534                     PVE::LXC::Config->destroy_config($newid);
1535                     PVE::Firewall::remove_vmfw_conf($newid);
1536                 });
1537             };
1538             warn "Failed to remove target CT config - $@\n" if $@;
1539
1540             die $err;
1541         }
1542
1543         my $update_conf = sub {
1544             my ($key, $value) = @_;
1545             return $lock_and_reload->($newid, sub {
1546                 my $conf = shift;
1547                 $conf->{$key} = $value;
1548                 PVE::LXC::Config->write_config($newid, $conf);
1549             });
1550         };
1551
1552         my $realcmd = sub {
1553             my ($upid) = @_;
1554
1555             my $newvollist = [];
1556
1557             my $verify_running = PVE::LXC::check_running($vmid) || 0;
1558             die "unexpected state change\n" if $verify_running != $running;
1559
1560             eval {
1561                 local $SIG{INT} =
1562                     local $SIG{TERM} =
1563                     local $SIG{QUIT} =
1564                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1565
1566                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1567                 my $bwlimit = extract_param($param, 'bwlimit');
1568
1569                 foreach my $opt (keys %$mountpoints) {
1570                     my $mp = $mountpoints->{$opt};
1571                     my $volid = $mp->{volume};
1572
1573                     my $newvolid;
1574                     if ($fullclone->{$opt}) {
1575                         print "create full clone of mountpoint $opt ($volid)\n";
1576                         my $source_storage = PVE::Storage::parse_volume_id($volid);
1577                         my $target_storage = $storage // $source_storage;
1578                         my $clonelimit = PVE::Storage::get_bandwidth_limit('clone', [$source_storage, $target_storage], $bwlimit);
1579                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname, $clonelimit);
1580                     } else {
1581                         print "create linked clone of mount point $opt ($volid)\n";
1582                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1583                     }
1584
1585                     push @$newvollist, $newvolid;
1586                     $mp->{volume} = $newvolid;
1587
1588                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1589                 }
1590
1591                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1592
1593                 $lock_and_reload->($newid, sub {
1594                     my $conf = shift;
1595                     my $rootdir = PVE::LXC::mount_all($newid, $storecfg, $conf, 1);
1596                     eval {
1597                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir);
1598                         $lxc_setup->post_clone_hook($conf);
1599                     };
1600                     my $err = $@;
1601                     eval { PVE::LXC::umount_all($newid, $storecfg, $conf, 1); };
1602                     if ($err) {
1603                         warn "$@\n" if $@;
1604                         die $err;
1605                     } else {
1606                         die $@ if $@;
1607                     }
1608                 });
1609             };
1610             my $err = $@;
1611             # Unlock the source config in any case:
1612             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1613             warn $@ if $@;
1614
1615             if ($err) {
1616                 # Now cleanup the config & disks:
1617                 sleep 1; # some storages like rbd need to wait before release volume - really?
1618
1619                 foreach my $volid (@$newvollist) {
1620                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1621                     warn $@ if $@;
1622                 }
1623
1624                 eval {
1625                     $lock_and_reload->($newid, sub {
1626                         PVE::LXC::Config->destroy_config($newid);
1627                         PVE::Firewall::remove_vmfw_conf($newid);
1628                     });
1629                 };
1630                 warn "Failed to remove target CT config - $@\n" if $@;
1631
1632                 die "clone failed: $err";
1633             }
1634
1635             $lock_and_reload->($newid, sub {
1636                 PVE::LXC::Config->remove_lock($newid, 'create');
1637
1638                 if ($target) {
1639                     # always deactivate volumes - avoid lvm LVs to be active on several nodes
1640                     PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
1641                     PVE::Storage::deactivate_volumes($storecfg, $newvollist);
1642
1643                     PVE::LXC::Config->move_config_to_node($newid, $target);
1644                 }
1645             });
1646
1647             return;
1648         };
1649
1650         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1651     }});
1652
1653
1654 __PACKAGE__->register_method({
1655     name => 'resize_vm',
1656     path => '{vmid}/resize',
1657     method => 'PUT',
1658     protected => 1,
1659     proxyto => 'node',
1660     description => "Resize a container mount point.",
1661     permissions => {
1662         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1663     },
1664     parameters => {
1665         additionalProperties => 0,
1666         properties => {
1667             node => get_standard_option('pve-node'),
1668             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1669             disk => {
1670                 type => 'string',
1671                 description => "The disk you want to resize.",
1672                 enum => [PVE::LXC::Config->valid_volume_keys()],
1673             },
1674             size => {
1675                 type => 'string',
1676                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1677                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1678             },
1679             digest => {
1680                 type => 'string',
1681                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1682                 maxLength => 40,
1683                 optional => 1,
1684             }
1685         },
1686     },
1687     returns => {
1688         type => 'string',
1689         description => "the task ID.",
1690     },
1691     code => sub {
1692         my ($param) = @_;
1693
1694         my $rpcenv = PVE::RPCEnvironment::get();
1695
1696         my $authuser = $rpcenv->get_user();
1697
1698         my $node = extract_param($param, 'node');
1699
1700         my $vmid = extract_param($param, 'vmid');
1701
1702         my $digest = extract_param($param, 'digest');
1703
1704         my $sizestr = extract_param($param, 'size');
1705         my $ext = ($sizestr =~ s/^\+//);
1706         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1707         die "invalid size string" if !defined($newsize);
1708
1709         die "no options specified\n" if !scalar(keys %$param);
1710
1711         my $storage_cfg = cfs_read_file("storage.cfg");
1712
1713         my $code = sub {
1714
1715             my $conf = PVE::LXC::Config->load_config($vmid);
1716             PVE::LXC::Config->check_lock($conf);
1717
1718             PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $conf, $param, [], $conf->{unprivileged});
1719
1720             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1721
1722             my $running = PVE::LXC::check_running($vmid);
1723
1724             my $disk = $param->{disk};
1725             my $mp = PVE::LXC::Config->parse_volume($disk, $conf->{$disk});
1726
1727             my $volid = $mp->{volume};
1728
1729             my (undef, undef, $owner, undef, undef, undef, $format) =
1730                 PVE::Storage::parse_volname($storage_cfg, $volid);
1731
1732             die "can't resize mount point owned by another container ($owner)"
1733                 if $vmid != $owner;
1734
1735             die "can't resize volume: $disk if snapshot exists\n"
1736                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1737
1738             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1739
1740             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1741
1742             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1743
1744             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1745
1746             die "Could not determine current size of volume '$volid'\n" if !defined($size);
1747
1748             $newsize += $size if $ext;
1749             $newsize = int($newsize);
1750
1751             die "unable to shrink disk size\n" if $newsize < $size;
1752
1753             die "disk is already at specified size\n" if $size == $newsize;
1754
1755             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1756             my $realcmd = sub {
1757                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1758                 # we pass 0 here (parameter only makes sense for qemu)
1759                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1760
1761                 $mp->{size} = $newsize;
1762                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1763
1764                 PVE::LXC::Config->write_config($vmid, $conf);
1765
1766                 if ($format eq 'raw') {
1767                     # we need to ensure that the volume is mapped, if not needed this is a NOP
1768                     my $path = PVE::Storage::map_volume($storage_cfg, $volid);
1769                     $path = PVE::Storage::path($storage_cfg, $volid) if !defined($path);
1770                     if ($running) {
1771
1772                         $mp->{mp} = '/';
1773                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1774                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1775                         die "internal error: CT running but mount point not attached to a loop device"
1776                             if !$path;
1777                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1778
1779                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1780                         # to be visible to it in its namespace.
1781                         # To not interfere with the rest of the system we unshare the current mount namespace,
1782                         # mount over /tmp and then run resize2fs.
1783
1784                         # interestingly we don't need to e2fsck on mounted systems...
1785                         my $quoted = PVE::Tools::shellquote($path);
1786                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1787                         eval {
1788                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1789                         };
1790                         warn "Failed to update the container's filesystem: $@\n" if $@;
1791                     } else {
1792                         eval {
1793                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1794                             PVE::Tools::run_command(['resize2fs', $path]);
1795                         };
1796                         warn "Failed to update the container's filesystem: $@\n" if $@;
1797
1798                         # always un-map if not running, this is a NOP if not needed
1799                         PVE::Storage::unmap_volume($storage_cfg, $volid);
1800                     }
1801                 }
1802             };
1803
1804             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1805         };
1806
1807         return PVE::LXC::Config->lock_config($vmid, $code);;
1808     }});
1809
1810 __PACKAGE__->register_method({
1811     name => 'move_volume',
1812     path => '{vmid}/move_volume',
1813     method => 'POST',
1814     protected => 1,
1815     proxyto => 'node',
1816     description => "Move a rootfs-/mp-volume to a different storage or to a different container.",
1817     permissions => {
1818         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1819             "and 'Datastore.AllocateSpace' permissions on the storage. To move ".
1820             "a volume to another container, you need the permissions on the ".
1821             "target container as well.",
1822         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1823     },
1824     parameters => {
1825         additionalProperties => 0,
1826         properties => {
1827             node => get_standard_option('pve-node'),
1828             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1829             'target-vmid' => get_standard_option('pve-vmid', {
1830                 completion => \&PVE::LXC::complete_ctid,
1831                 optional => 1,
1832             }),
1833             volume => {
1834                 type => 'string',
1835                 #TODO: check how to handle unused mount points as the mp parameter is not configured
1836                 enum => [ PVE::LXC::Config->valid_volume_keys_with_unused() ],
1837                 description => "Volume which will be moved.",
1838             },
1839             storage => get_standard_option('pve-storage-id', {
1840                 description => "Target Storage.",
1841                 completion => \&PVE::Storage::complete_storage_enabled,
1842                 optional => 1,
1843             }),
1844             delete => {
1845                 type => 'boolean',
1846                 description => "Delete the original volume after successful copy. By default the " .
1847                     "original is kept as an unused volume entry.",
1848                 optional => 1,
1849                 default => 0,
1850             },
1851             digest => {
1852                 type => 'string',
1853                 description => 'Prevent changes if current configuration file has different SHA1 " .
1854                     "digest. This can be used to prevent concurrent modifications.',
1855                 maxLength => 40,
1856                 optional => 1,
1857             },
1858             bwlimit => {
1859                 description => "Override I/O bandwidth limit (in KiB/s).",
1860                 optional => 1,
1861                 type => 'number',
1862                 minimum => '0',
1863                 default => 'clone limit from datacenter or storage config',
1864             },
1865             'target-volume' => {
1866                 type => 'string',
1867                 description => "The config key the volume will be moved to. Default is the " .
1868                     "source volume key.",
1869                 enum => [PVE::LXC::Config->valid_volume_keys_with_unused()],
1870                 optional => 1,
1871             },
1872             'target-digest' => {
1873                 type => 'string',
1874                 description => 'Prevent changes if current configuration file of the target " .
1875                     "container has a different SHA1 digest. This can be used to prevent " .
1876                     "concurrent modifications.',
1877                 maxLength => 40,
1878                 optional => 1,
1879             },
1880         },
1881     },
1882     returns => {
1883         type => 'string',
1884     },
1885     code => sub {
1886         my ($param) = @_;
1887
1888         my $rpcenv = PVE::RPCEnvironment::get();
1889
1890         my $authuser = $rpcenv->get_user();
1891
1892         my $vmid = extract_param($param, 'vmid');
1893
1894         my $target_vmid = extract_param($param, 'target-vmid');
1895
1896         my $storage = extract_param($param, 'storage');
1897
1898         my $mpkey = extract_param($param, 'volume');
1899
1900         my $target_mpkey = extract_param($param, 'target-volume') // $mpkey;
1901
1902         my $digest = extract_param($param, 'digest');
1903
1904         my $target_digest = extract_param($param, 'target-digest');
1905
1906         my $lockname = 'disk';
1907
1908         my ($mpdata, $old_volid);
1909
1910         die "either set storage or target-vmid, but not both\n"
1911             if $storage && $target_vmid;
1912
1913         my $storecfg = PVE::Storage::config();
1914
1915         my $move_to_storage_checks = sub {
1916             PVE::LXC::Config->lock_config($vmid, sub {
1917                 my $conf = PVE::LXC::Config->load_config($vmid);
1918                 PVE::LXC::Config->check_lock($conf);
1919
1920                 die "cannot move volumes of a running container\n"
1921                     if PVE::LXC::check_running($vmid);
1922
1923                 if ($mpkey =~ m/^unused\d+$/) {
1924                     die "cannot move volume '$mpkey', only configured volumes can be moved to ".
1925                         "another storage\n";
1926                 }
1927
1928                 $mpdata = PVE::LXC::Config->parse_volume($mpkey, $conf->{$mpkey});
1929                 $old_volid = $mpdata->{volume};
1930
1931                 die "you can't move a volume with snapshots and delete the source\n"
1932                     if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1933
1934                 PVE::Tools::assert_if_modified($digest, $conf->{digest});
1935
1936                 PVE::LXC::Config->set_lock($vmid, $lockname);
1937             });
1938         };
1939
1940         my $storage_realcmd = sub {
1941             eval {
1942                 PVE::Cluster::log_msg(
1943                     'info',
1944                     $authuser,
1945                     "move volume CT $vmid: move --volume $mpkey --storage $storage"
1946                 );
1947
1948                 my $conf = PVE::LXC::Config->load_config($vmid);
1949                 my $storage_cfg = PVE::Storage::config();
1950
1951                 my $new_volid;
1952
1953                 eval {
1954                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1955                     my $bwlimit = extract_param($param, 'bwlimit');
1956                     my $source_storage = PVE::Storage::parse_volume_id($old_volid);
1957                     my $movelimit = PVE::Storage::get_bandwidth_limit(
1958                         'move',
1959                         [$source_storage, $storage],
1960                         $bwlimit
1961                     );
1962                     $new_volid = PVE::LXC::copy_volume(
1963                         $mpdata,
1964                         $vmid,
1965                         $storage,
1966                         $storage_cfg,
1967                         $conf,
1968                         undef,
1969                         $movelimit
1970                     );
1971                     if (PVE::LXC::Config->is_template($conf)) {
1972                         PVE::Storage::activate_volumes($storage_cfg, [ $new_volid ]);
1973                         my $template_volid = PVE::Storage::vdisk_create_base($storage_cfg, $new_volid);
1974                         $mpdata->{volume} = $template_volid;
1975                     } else {
1976                         $mpdata->{volume} = $new_volid;
1977                     }
1978
1979                     PVE::LXC::Config->lock_config($vmid, sub {
1980                         my $digest = $conf->{digest};
1981                         $conf = PVE::LXC::Config->load_config($vmid);
1982                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1983
1984                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint(
1985                             $mpdata,
1986                             $mpkey eq 'rootfs'
1987                         );
1988
1989                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1990
1991                         PVE::LXC::Config->write_config($vmid, $conf);
1992                     });
1993
1994                     eval {
1995                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1996                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1997                     };
1998                     warn $@ if $@;
1999                 };
2000                 if (my $err = $@) {
2001                     eval {
2002                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
2003                             if defined($new_volid);
2004                     };
2005                     warn $@ if $@;
2006                     die $err;
2007                 }
2008
2009                 if ($param->{delete}) {
2010                     eval {
2011                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
2012                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
2013                     };
2014                     if (my $err = $@) {
2015                         warn $err;
2016                         PVE::LXC::Config->lock_config($vmid, sub {
2017                             my $conf = PVE::LXC::Config->load_config($vmid);
2018                             PVE::LXC::Config->add_unused_volume($conf, $old_volid);
2019                             PVE::LXC::Config->write_config($vmid, $conf);
2020                         });
2021                     }
2022                 }
2023             };
2024             my $err = $@;
2025             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
2026             warn $@ if $@;
2027             die $err if $err;
2028         };
2029
2030         my $load_and_check_reassign_configs = sub {
2031             my $vmlist = PVE::Cluster::get_vmlist()->{ids};
2032
2033             die "Cannot move to/from 'rootfs'\n" if $mpkey eq "rootfs" || $target_mpkey eq "rootfs";
2034
2035             if ($mpkey =~ m/^unused\d+$/ && $target_mpkey !~ m/^unused\d+$/) {
2036                 die "Moving an unused volume to a used one is not possible\n";
2037             }
2038             die "could not find CT ${vmid}\n" if !exists($vmlist->{$vmid});
2039             die "could not find CT ${target_vmid}\n" if !exists($vmlist->{$target_vmid});
2040
2041             my $source_node = $vmlist->{$vmid}->{node};
2042             my $target_node = $vmlist->{$target_vmid}->{node};
2043
2044             die "Both containers need to be on the same node ($source_node != $target_node)\n"
2045                 if $source_node ne $target_node;
2046
2047             my $source_conf = PVE::LXC::Config->load_config($vmid);
2048             PVE::LXC::Config->check_lock($source_conf);
2049             my $target_conf = PVE::LXC::Config->load_config($target_vmid);
2050             PVE::LXC::Config->check_lock($target_conf);
2051
2052             die "Can't move volumes from or to template CT\n"
2053                 if ($source_conf->{template} || $target_conf->{template});
2054
2055             if ($digest) {
2056                 eval { PVE::Tools::assert_if_modified($digest, $source_conf->{digest}) };
2057                 die "Container ${vmid}: $@" if $@;
2058             }
2059
2060             if ($target_digest) {
2061                 eval { PVE::Tools::assert_if_modified($target_digest, $target_conf->{digest}) };
2062                 die "Container ${target_vmid}: $@" if $@;
2063             }
2064
2065             die "volume '${mpkey}' for container '$vmid' does not exist\n"
2066                 if !defined($source_conf->{$mpkey});
2067
2068             die "Target volume key '${target_mpkey}' is already in use for container '$target_vmid'\n"
2069                 if exists $target_conf->{$target_mpkey};
2070
2071             my $drive = PVE::LXC::Config->parse_volume(
2072                 $mpkey,
2073                 $source_conf->{$mpkey},
2074             );
2075
2076             my $source_volid = $drive->{volume};
2077
2078             die "Volume '${mpkey}' has no associated image\n"
2079                 if !$source_volid;
2080             die "Cannot move volume used by a snapshot to another container\n"
2081                 if PVE::LXC::Config->is_volume_in_use_by_snapshots($source_conf, $source_volid);
2082             die "Storage does not support moving of this disk to another container\n"
2083                 if !PVE::Storage::volume_has_feature($storecfg, 'rename', $source_volid);
2084             die "Cannot move a bindmount or device mount to another container\n"
2085                 if $drive->{type} ne "volume";
2086             die "Cannot move volume to another container while the source is running - detach first\n"
2087                 if PVE::LXC::check_running($vmid) && $mpkey !~ m/^unused\d+$/;
2088
2089             my $repl_conf = PVE::ReplicationConfig->new();
2090             if ($repl_conf->check_for_existing_jobs($target_vmid, 1)) {
2091                 my ($storeid, undef) = PVE::Storage::parse_volume_id($source_volid);
2092                 my $format = (PVE::Storage::parse_volname($storecfg, $source_volid))[6];
2093
2094                 die "Cannot move volume on storage '$storeid' to a replicated container - missing replication support\n"
2095                     if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
2096             }
2097
2098             return ($source_conf, $target_conf, $drive);
2099         };
2100
2101         my $logfunc = sub {
2102             my ($msg) = @_;
2103             print STDERR "$msg\n";
2104         };
2105
2106         my $volume_reassignfn = sub {
2107             return PVE::LXC::Config->lock_config($vmid, sub {
2108                 return PVE::LXC::Config->lock_config($target_vmid, sub {
2109                     my ($source_conf, $target_conf, $drive) = &$load_and_check_reassign_configs();
2110                     my $source_volid = $drive->{volume};
2111
2112                     my $target_unused = $target_mpkey =~ m/^unused\d+$/;
2113
2114                     print "moving volume '$mpkey' from container '$vmid' to '$target_vmid'\n";
2115
2116                     my ($storage, $source_volname) = PVE::Storage::parse_volume_id($source_volid);
2117
2118                     my $fmt = (PVE::Storage::parse_volname($storecfg, $source_volid))[6];
2119
2120                     my $new_volid = PVE::Storage::rename_volume(
2121                         $storecfg,
2122                         $source_volid,
2123                         $target_vmid,
2124                     );
2125
2126                     $drive->{volume} = $new_volid;
2127
2128                     delete $source_conf->{$mpkey};
2129                     print "removing volume '${mpkey}' from container '${vmid}' config\n";
2130                     PVE::LXC::Config->write_config($vmid, $source_conf);
2131
2132                     my $drive_string;
2133
2134                     if ($target_unused) {
2135                         $drive_string = $new_volid;
2136                     } else {
2137                         $drive_string = PVE::LXC::Config->print_volume($target_mpkey, $drive);
2138                     }
2139
2140                     if ($target_unused) {
2141                         $target_conf->{$target_mpkey} = $drive_string;
2142                     } else {
2143                         my $running = PVE::LXC::check_running($target_vmid);
2144                         my $param = { $target_mpkey => $drive_string };
2145                         my $errors = PVE::LXC::Config->update_pct_config(
2146                             $target_vmid,
2147                             $target_conf,
2148                             $running,
2149                             $param
2150                         );
2151
2152                         foreach my $key (keys %$errors) {
2153                             $rpcenv->warn($errors->{$key});
2154                         }
2155                     }
2156
2157                     PVE::LXC::Config->write_config($target_vmid, $target_conf);
2158                     $target_conf = PVE::LXC::Config->load_config($target_vmid);
2159
2160                     PVE::LXC::update_lxc_config($target_vmid, $target_conf) if !$target_unused;
2161                     print "target container '$target_vmid' updated with '$target_mpkey'\n";
2162
2163                     # remove possible replication snapshots
2164                     if (PVE::Storage::volume_has_feature($storecfg,'replicate', $source_volid)) {
2165                         eval {
2166                             PVE::Replication::prepare(
2167                                 $storecfg,
2168                                 [$new_volid],
2169                                 undef,
2170                                 1,
2171                                 undef,
2172                                 $logfunc,
2173                             )
2174                         };
2175                         if (my $err = $@) {
2176                             $rpcenv->warn("Failed to remove replication snapshots on volume ".
2177                                 "'${target_mpkey}'. Manual cleanup could be necessary. " .
2178                                 "Error: ${err}\n");
2179                         }
2180                     }
2181                 });
2182             });
2183         };
2184
2185         if ($target_vmid && $storage) {
2186             my $msg = "either set 'storage' or 'target-vmid', but not both";
2187             raise_param_exc({ 'target-vmid' => $msg, 'storage' => $msg });
2188         } elsif ($target_vmid) {
2189             $rpcenv->check_vm_perm($authuser, $target_vmid, undef, ['VM.Config.Disk'])
2190                 if $authuser ne 'root@pam';
2191
2192             if ($vmid eq $target_vmid) {
2193                 my $msg = "must be different than source VMID to move disk to another container";
2194                 raise_param_exc({ 'target-vmid' => $msg });
2195             }
2196
2197             my (undef, undef, $drive) = &$load_and_check_reassign_configs();
2198             my $storeid = PVE::Storage::parse_volume_id($drive->{volume});
2199             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
2200             return $rpcenv->fork_worker(
2201                 'move_volume',
2202                 "${vmid}-${mpkey}>${target_vmid}-${target_mpkey}",
2203                 $authuser,
2204                 $volume_reassignfn
2205             );
2206         } elsif ($storage) {
2207             $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace']);
2208             &$move_to_storage_checks();
2209             my $task = eval {
2210                 $rpcenv->fork_worker('move_volume', $vmid, $authuser, $storage_realcmd);
2211             };
2212             if (my $err = $@) {
2213                 eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
2214                 warn $@ if $@;
2215                 die $err;
2216             }
2217             return $task;
2218         } else {
2219             my $msg = "both 'storage' and 'target-vmid' missing, either needs to be set";
2220             raise_param_exc({ 'target-vmid' => $msg, 'storage' => $msg });
2221         }
2222   }});
2223
2224 __PACKAGE__->register_method({
2225     name => 'vm_pending',
2226     path => '{vmid}/pending',
2227     method => 'GET',
2228     proxyto => 'node',
2229     description => 'Get container configuration, including pending changes.',
2230     permissions => {
2231         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2232     },
2233     parameters => {
2234         additionalProperties => 0,
2235         properties => {
2236             node => get_standard_option('pve-node'),
2237             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
2238         },
2239     },
2240     returns => {
2241         type => "array",
2242         items => {
2243             type => "object",
2244             properties => {
2245                 key => {
2246                     description => 'Configuration option name.',
2247                     type => 'string',
2248                 },
2249                 value => {
2250                     description => 'Current value.',
2251                     type => 'string',
2252                     optional => 1,
2253                 },
2254                 pending => {
2255                     description => 'Pending value.',
2256                     type => 'string',
2257                     optional => 1,
2258                 },
2259                 delete => {
2260                     description => "Indicates a pending delete request if present and not 0.",
2261                     type => 'integer',
2262                     minimum => 0,
2263                     maximum => 2,
2264                     optional => 1,
2265                 },
2266             },
2267         },
2268     },
2269     code => sub {
2270         my ($param) = @_;
2271
2272         my $conf = PVE::LXC::Config->load_config($param->{vmid});
2273
2274         my $pending_delete_hash = PVE::LXC::Config->parse_pending_delete($conf->{pending}->{delete});
2275
2276         return PVE::GuestHelpers::config_with_pending_array($conf, $pending_delete_hash);
2277     }});
2278
2279 1;