src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::AccessControl;
  12 use PVE::Firewall;
  13 use PVE::Storage;
  14 use PVE::RESTHandler;
  15 use PVE::RPCEnvironment;
  16 use PVE::ReplicationConfig;
  17 use PVE::LXC;
  18 use PVE::LXC::Create;
  19 use PVE::LXC::Migrate;
  20 use PVE::GuestHelpers;
  21 use PVE::API2::LXC::Config;
  22 use PVE::API2::LXC::Status;
  23 use PVE::API2::LXC::Snapshot;
  24 use PVE::JSONSchema qw(get_standard_option);
  25 use base qw(PVE::RESTHandler);
  26
  27 BEGIN {
  28     if (!$ENV{PVE_GENERATING_DOCS}) {
  29         require PVE::HA::Env::PVE2;
  30         import  PVE::HA::Env::PVE2;
  31         require PVE::HA::Config;
  32         import  PVE::HA::Config;
  33     }
  34 }
  35
  36 __PACKAGE__->register_method ({
  37     subclass => "PVE::API2::LXC::Config",
  38     path => '{vmid}/config',
  39 });
  40
  41 __PACKAGE__->register_method ({
  42     subclass => "PVE::API2::LXC::Status",
  43     path => '{vmid}/status',
  44 });
  45
  46 __PACKAGE__->register_method ({
  47     subclass => "PVE::API2::LXC::Snapshot",
  48     path => '{vmid}/snapshot',
  49 });
  50
  51 __PACKAGE__->register_method ({
  52     subclass => "PVE::API2::Firewall::CT",
  53     path => '{vmid}/firewall',
  54 });
  55
  56 __PACKAGE__->register_method({
  57     name => 'vmlist',
  58     path => '',
  59     method => 'GET',
  60     description => "LXC container index (per node).",
  61     permissions => {
  62         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  63         user => 'all',
  64     },
  65     proxyto => 'node',
  66     protected => 1, # /proc files are only readable by root
  67     parameters => {
  68         additionalProperties => 0,
  69         properties => {
  70             node => get_standard_option('pve-node'),
  71         },
  72     },
  73     returns => {
  74         type => 'array',
  75         items => {
  76             type => "object",
  77             properties => {},
  78         },
  79         links => [ { rel => 'child', href => "{vmid}" } ],
  80     },
  81     code => sub {
  82         my ($param) = @_;
  83
  84         my $rpcenv = PVE::RPCEnvironment::get();
  85         my $authuser = $rpcenv->get_user();
  86
  87         my $vmstatus = PVE::LXC::vmstatus();
  88
  89         my $res = [];
  90         foreach my $vmid (keys %$vmstatus) {
  91             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  92
  93             my $data = $vmstatus->{$vmid};
  94             $data->{vmid} = $vmid;
  95             push @$res, $data;
  96         }
  97
  98         return $res;
  99
 100     }});
 101
 102 __PACKAGE__->register_method({
 103     name => 'create_vm',
 104     path => '',
 105     method => 'POST',
 106     description => "Create or restore a container.",
 107     permissions => {
 108         user => 'all', # check inside
 109         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 110             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 111             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 112     },
 113     protected => 1,
 114     proxyto => 'node',
 115     parameters => {
 116         additionalProperties => 0,
 117         properties => PVE::LXC::Config->json_config_properties({
 118             node => get_standard_option('pve-node'),
 119             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 120             ostemplate => {
 121                 description => "The OS template or backup file.",
 122                 type => 'string',
 123                 maxLength => 255,
 124                 completion => \&PVE::LXC::complete_os_templates,
 125             },
 126             password => {
 127                 optional => 1,
 128                 type => 'string',
 129                 description => "Sets root password inside container.",
 130                 minLength => 5,
 131             },
 132             storage => get_standard_option('pve-storage-id', {
 133                 description => "Default Storage.",
 134                 default => 'local',
 135                 optional => 1,
 136                 completion => \&PVE::Storage::complete_storage_enabled,
 137             }),
 138             force => {
 139                 optional => 1,
 140                 type => 'boolean',
 141                 description => "Allow to overwrite existing container.",
 142             },
 143             restore => {
 144                 optional => 1,
 145                 type => 'boolean',
 146                 description => "Mark this as restore task.",
 147             },
 148             pool => {
 149                 optional => 1,
 150                 type => 'string', format => 'pve-poolid',
 151                 description => "Add the VM to the specified pool.",
 152             },
 153             'ignore-unpack-errors' => {
 154                 optional => 1,
 155                 type => 'boolean',
 156                 description => "Ignore errors when extracting the template.",
 157             },
 158             'ssh-public-keys' => {
 159                 optional => 1,
 160                 type => 'string',
 161                 description => "Setup public SSH keys (one key per line, " .
 162                                 "OpenSSH format).",
 163             },
 164         }),
 165     },
 166     returns => {
 167         type => 'string',
 168     },
 169     code => sub {
 170         my ($param) = @_;
 171
 172         my $rpcenv = PVE::RPCEnvironment::get();
 173
 174         my $authuser = $rpcenv->get_user();
 175
 176         my $node = extract_param($param, 'node');
 177
 178         my $vmid = extract_param($param, 'vmid');
 179
 180         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 181
 182         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 183
 184         my $same_container_exists = -f $basecfg_fn;
 185
 186         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 187         my $unprivileged = extract_param($param, 'unprivileged');
 188
 189         my $restore = extract_param($param, 'restore');
 190
 191         if ($restore) {
 192             # fixme: limit allowed parameters
 193
 194         }
 195
 196         my $force = extract_param($param, 'force');
 197
 198         if (!($same_container_exists && $restore && $force)) {
 199             PVE::Cluster::check_vmid_unused($vmid);
 200         } else {
 201             my $conf = PVE::LXC::Config->load_config($vmid);
 202             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 203         }
 204
 205         my $password = extract_param($param, 'password');
 206
 207         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 208         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 209
 210         my $pool = extract_param($param, 'pool');
 211
 212         if (defined($pool)) {
 213             $rpcenv->check_pool_exist($pool);
 214             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 215         }
 216
 217         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 218             # OK
 219         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 220             # OK
 221         } elsif ($restore && $force && $same_container_exists &&
 222                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 223             # OK: user has VM.Backup permissions, and want to restore an existing VM
 224         } else {
 225             raise_perm_exc();
 226         }
 227
 228         my $ostemplate = extract_param($param, 'ostemplate');
 229         my $storage = extract_param($param, 'storage') // 'local';
 230
 231         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
 232
 233         my $storage_cfg = cfs_read_file("storage.cfg");
 234
 235
 236         my $archive;
 237
 238         if ($ostemplate eq '-') {
 239             die "pipe requires cli environment\n"
 240                 if $rpcenv->{type} ne 'cli';
 241             die "pipe can only be used with restore tasks\n"
 242                 if !$restore;
 243             $archive = '-';
 244             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 245         } else {
 246             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 247             $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $ostemplate);
 248         }
 249
 250         my $check_and_activate_storage = sub {
 251             my ($sid) = @_;
 252
 253             my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
 254
 255             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 256                 if !$scfg->{content}->{rootdir};
 257
 258             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 259
 260             PVE::Storage::activate_storage($storage_cfg, $sid);
 261         };
 262
 263         my $conf = {};
 264
 265         my $no_disk_param = {};
 266         my $mp_param = {};
 267         my $storage_only_mode = 1;
 268         foreach my $opt (keys %$param) {
 269             my $value = $param->{$opt};
 270             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 271                 # allow to use simple numbers (add default storage in that case)
 272                 if ($value =~ m/^\d+(\.\d+)?$/) {
 273                     $mp_param->{$opt} = "$storage:$value";
 274                 } else {
 275                     $mp_param->{$opt} = $value;
 276                 }
 277                 $storage_only_mode = 0;
 278             } elsif ($opt =~ m/^unused\d+$/) {
 279                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 280                 delete $param->{$opt};
 281             } else {
 282                 $no_disk_param->{$opt} = $value;
 283             }
 284         }
 285
 286         die "mount points configured, but 'rootfs' not set - aborting\n"
 287             if !$storage_only_mode && !defined($mp_param->{rootfs});
 288
 289         # check storage access, activate storage
 290         my $delayed_mp_param = {};
 291         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 292             my ($ms, $mountpoint) = @_;
 293
 294             my $volid = $mountpoint->{volume};
 295             my $mp = $mountpoint->{mp};
 296
 297             if ($mountpoint->{type} ne 'volume') { # bind or device
 298                 die "Only root can pass arbitrary filesystem paths.\n"
 299                     if $authuser ne 'root@pam';
 300             } else {
 301                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 302                 &$check_and_activate_storage($sid);
 303             }
 304         });
 305
 306         # check/activate default storage
 307         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 308
 309         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 310
 311         $conf->{unprivileged} = 1 if $unprivileged;
 312
 313         my $check_vmid_usage = sub {
 314             if ($force) {
 315                 die "can't overwrite running container\n"
 316                     if PVE::LXC::check_running($vmid);
 317             } else {
 318                 PVE::Cluster::check_vmid_unused($vmid);
 319             }
 320         };
 321
 322         my $code = sub {
 323             &$check_vmid_usage(); # final check after locking
 324             my $old_conf;
 325
 326             my $config_fn = PVE::LXC::Config->config_file($vmid);
 327             if (-f $config_fn) {
 328                 die "container exists" if !$restore; # just to be sure
 329                 $old_conf = PVE::LXC::Config->load_config($vmid);
 330             } else {
 331                 eval {
 332                     # try to create empty config on local node, we have an flock
 333                     PVE::LXC::Config->write_config($vmid, {});
 334                 };
 335
 336                 # another node was faster, abort
 337                 die "Could not reserve ID $vmid, already taken\n" if $@;
 338             }
 339
 340             PVE::Cluster::check_cfs_quorum();
 341             my $vollist = [];
 342
 343             eval {
 344                 if ($storage_only_mode) {
 345                     if ($restore) {
 346                         (undef, $mp_param) = PVE::LXC::Create::recover_config($archive);
 347                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 348                             if !defined($mp_param->{rootfs});
 349                         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 350                             my ($ms, $mountpoint) = @_;
 351                             my $type = $mountpoint->{type};
 352                             if ($type eq 'volume') {
 353                                 die "unable to detect disk size - please specify $ms (size)\n"
 354                                     if !defined($mountpoint->{size});
 355                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 356                                 delete $mountpoint->{size};
 357                                 $mountpoint->{volume} = "$storage:$disksize";
 358                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 359                             } else {
 360                                 my $type = $mountpoint->{type};
 361                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 362                                     if ($ms eq 'rootfs');
 363                                 die "restoring '$ms' to $type mount is only possible for root\n"
 364                                     if $authuser ne 'root@pam';
 365
 366                                 if ($mountpoint->{backup}) {
 367                                     warn "WARNING - unsupported configuration!\n";
 368                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 369                                     warn "mount point configuration will be restored after archive extraction!\n";
 370                                     warn "contained files will be restored to wrong directory!\n";
 371                                 }
 372                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 373                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 374                             }
 375                         });
 376                     } else {
 377                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 378                     }
 379                 }
 380
 381                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 382
 383                 if (defined($old_conf)) {
 384                     # destroy old container volumes
 385                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, {});
 386                 }
 387
 388                 eval {
 389                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 390                     PVE::LXC::Create::restore_archive($archive, $rootdir, $conf, $ignore_unpack_errors);
 391
 392                     if ($restore) {
 393                         PVE::LXC::Create::restore_configuration($vmid, $rootdir, $conf, $authuser ne 'root@pam');
 394                     } else {
 395                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 396                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 397                         $lxc_setup->post_create_hook($password, $ssh_keys);
 398                     }
 399                 };
 400                 my $err = $@;
 401                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 402                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 403                 die $err if $err;
 404                 # set some defaults
 405                 $conf->{hostname} ||= "CT$vmid";
 406                 $conf->{memory} ||= 512;
 407                 $conf->{swap} //= 512;
 408                 foreach my $mp (keys %$delayed_mp_param) {
 409                     $conf->{$mp} = $delayed_mp_param->{$mp};
 410                 }
 411                 PVE::LXC::Config->write_config($vmid, $conf);
 412             };
 413             if (my $err = $@) {
 414                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 415                 PVE::LXC::destroy_config($vmid);
 416                 die $err;
 417             }
 418             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 419         };
 420
 421         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 422
 423         &$check_vmid_usage(); # first check before locking
 424
 425         return $rpcenv->fork_worker($restore ? 'vzrestore' : 'vzcreate',
 426                                     $vmid, $authuser, $realcmd);
 427
 428     }});
 429
 430 __PACKAGE__->register_method({
 431     name => 'vmdiridx',
 432     path => '{vmid}',
 433     method => 'GET',
 434     proxyto => 'node',
 435     description => "Directory index",
 436     permissions => {
 437         user => 'all',
 438     },
 439     parameters => {
 440         additionalProperties => 0,
 441         properties => {
 442             node => get_standard_option('pve-node'),
 443             vmid => get_standard_option('pve-vmid'),
 444         },
 445     },
 446     returns => {
 447         type => 'array',
 448         items => {
 449             type => "object",
 450             properties => {
 451                 subdir => { type => 'string' },
 452             },
 453         },
 454         links => [ { rel => 'child', href => "{subdir}" } ],
 455     },
 456     code => sub {
 457         my ($param) = @_;
 458
 459         # test if VM exists
 460         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 461
 462         my $res = [
 463             { subdir => 'config' },
 464             { subdir => 'status' },
 465             { subdir => 'vncproxy' },
 466             { subdir => 'termproxy' },
 467             { subdir => 'vncwebsocket' },
 468             { subdir => 'spiceproxy' },
 469             { subdir => 'migrate' },
 470             { subdir => 'clone' },
 471 #           { subdir => 'initlog' },
 472             { subdir => 'rrd' },
 473             { subdir => 'rrddata' },
 474             { subdir => 'firewall' },
 475             { subdir => 'snapshot' },
 476             { subdir => 'resize' },
 477             ];
 478
 479         return $res;
 480     }});
 481
 482
 483 __PACKAGE__->register_method({
 484     name => 'rrd',
 485     path => '{vmid}/rrd',
 486     method => 'GET',
 487     protected => 1, # fixme: can we avoid that?
 488     permissions => {
 489         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 490     },
 491     description => "Read VM RRD statistics (returns PNG)",
 492     parameters => {
 493         additionalProperties => 0,
 494         properties => {
 495             node => get_standard_option('pve-node'),
 496             vmid => get_standard_option('pve-vmid'),
 497             timeframe => {
 498                 description => "Specify the time frame you are interested in.",
 499                 type => 'string',
 500                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 501             },
 502             ds => {
 503                 description => "The list of datasources you want to display.",
 504                 type => 'string', format => 'pve-configid-list',
 505             },
 506             cf => {
 507                 description => "The RRD consolidation function",
 508                 type => 'string',
 509                 enum => [ 'AVERAGE', 'MAX' ],
 510                 optional => 1,
 511             },
 512         },
 513     },
 514     returns => {
 515         type => "object",
 516         properties => {
 517             filename => { type => 'string' },
 518         },
 519     },
 520     code => sub {
 521         my ($param) = @_;
 522
 523         return PVE::Cluster::create_rrd_graph(
 524             "pve2-vm/$param->{vmid}", $param->{timeframe},
 525             $param->{ds}, $param->{cf});
 526
 527     }});
 528
 529 __PACKAGE__->register_method({
 530     name => 'rrddata',
 531     path => '{vmid}/rrddata',
 532     method => 'GET',
 533     protected => 1, # fixme: can we avoid that?
 534     permissions => {
 535         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 536     },
 537     description => "Read VM RRD statistics",
 538     parameters => {
 539         additionalProperties => 0,
 540         properties => {
 541             node => get_standard_option('pve-node'),
 542             vmid => get_standard_option('pve-vmid'),
 543             timeframe => {
 544                 description => "Specify the time frame you are interested in.",
 545                 type => 'string',
 546                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 547             },
 548             cf => {
 549                 description => "The RRD consolidation function",
 550                 type => 'string',
 551                 enum => [ 'AVERAGE', 'MAX' ],
 552                 optional => 1,
 553             },
 554         },
 555     },
 556     returns => {
 557         type => "array",
 558         items => {
 559             type => "object",
 560             properties => {},
 561         },
 562     },
 563     code => sub {
 564         my ($param) = @_;
 565
 566         return PVE::Cluster::create_rrd_data(
 567             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 568     }});
 569
 570 __PACKAGE__->register_method({
 571     name => 'destroy_vm',
 572     path => '{vmid}',
 573     method => 'DELETE',
 574     protected => 1,
 575     proxyto => 'node',
 576     description => "Destroy the container (also delete all uses files).",
 577     permissions => {
 578         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 579     },
 580     parameters => {
 581         additionalProperties => 0,
 582         properties => {
 583             node => get_standard_option('pve-node'),
 584             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 585         },
 586     },
 587     returns => {
 588         type => 'string',
 589     },
 590     code => sub {
 591         my ($param) = @_;
 592
 593         my $rpcenv = PVE::RPCEnvironment::get();
 594
 595         my $authuser = $rpcenv->get_user();
 596
 597         my $vmid = $param->{vmid};
 598
 599         # test if container exists
 600         my $conf = PVE::LXC::Config->load_config($vmid);
 601
 602         my $storage_cfg = cfs_read_file("storage.cfg");
 603
 604         PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 605
 606         die "unable to remove CT $vmid - used in HA resources\n"
 607             if PVE::HA::Config::vm_is_ha_managed($vmid);
 608
 609         # do not allow destroy if there are replication jobs
 610         my $repl_conf = PVE::ReplicationConfig->new();
 611         $repl_conf->check_for_existing_jobs($vmid);
 612
 613         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 614
 615         die $running_error_msg if PVE::LXC::check_running($vmid); # check early
 616
 617         my $code = sub {
 618             # reload config after lock
 619             $conf = PVE::LXC::Config->load_config($vmid);
 620             PVE::LXC::Config->check_lock($conf);
 621
 622             die $running_error_msg if PVE::LXC::check_running($vmid);
 623
 624             PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf);
 625             PVE::AccessControl::remove_vm_access($vmid);
 626             PVE::Firewall::remove_vmfw_conf($vmid);
 627         };
 628
 629         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 630
 631         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 632     }});
 633
 634 my $sslcert;
 635
 636 __PACKAGE__->register_method ({
 637     name => 'vncproxy',
 638     path => '{vmid}/vncproxy',
 639     method => 'POST',
 640     protected => 1,
 641     permissions => {
 642         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 643     },
 644     description => "Creates a TCP VNC proxy connections.",
 645     parameters => {
 646         additionalProperties => 0,
 647         properties => {
 648             node => get_standard_option('pve-node'),
 649             vmid => get_standard_option('pve-vmid'),
 650             websocket => {
 651                 optional => 1,
 652                 type => 'boolean',
 653                 description => "use websocket instead of standard VNC.",
 654             },
 655             width => {
 656                 optional => 1,
 657                 description => "sets the width of the console in pixels.",
 658                 type => 'integer',
 659                 minimum => 16,
 660                 maximum => 4096,
 661             },
 662             height => {
 663                 optional => 1,
 664                 description => "sets the height of the console in pixels.",
 665                 type => 'integer',
 666                 minimum => 16,
 667                 maximum => 2160,
 668             },
 669         },
 670     },
 671     returns => {
 672         additionalProperties => 0,
 673         properties => {
 674             user => { type => 'string' },
 675             ticket => { type => 'string' },
 676             cert => { type => 'string' },
 677             port => { type => 'integer' },
 678             upid => { type => 'string' },
 679         },
 680     },
 681     code => sub {
 682         my ($param) = @_;
 683
 684         my $rpcenv = PVE::RPCEnvironment::get();
 685
 686         my $authuser = $rpcenv->get_user();
 687
 688         my $vmid = $param->{vmid};
 689         my $node = $param->{node};
 690
 691         my $authpath = "/vms/$vmid";
 692
 693         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 694
 695         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 696             if !$sslcert;
 697
 698         my ($remip, $family);
 699
 700         if ($node ne PVE::INotify::nodename()) {
 701             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 702         } else {
 703             $family = PVE::Tools::get_host_address_family($node);
 704         }
 705
 706         my $port = PVE::Tools::next_vnc_port($family);
 707
 708         # NOTE: vncterm VNC traffic is already TLS encrypted,
 709         # so we select the fastest chipher here (or 'none'?)
 710         my $remcmd = $remip ?
 711             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 712
 713         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 714         my $concmd = PVE::LXC::get_console_command($vmid, $conf, 1);
 715
 716         my $shcmd = [ '/usr/bin/dtach', '-A',
 717                       "/var/run/dtach/vzctlconsole$vmid",
 718                       '-r', 'winch', '-z', @$concmd];
 719
 720         my $realcmd = sub {
 721             my $upid = shift;
 722
 723             syslog ('info', "starting lxc vnc proxy $upid\n");
 724
 725             my $timeout = 10;
 726
 727             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 728                        '-timeout', $timeout, '-authpath', $authpath,
 729                        '-perm', 'VM.Console'];
 730
 731             if ($param->{width}) {
 732                 push @$cmd, '-width', $param->{width};
 733             }
 734
 735             if ($param->{height}) {
 736                 push @$cmd, '-height', $param->{height};
 737             }
 738
 739             if ($param->{websocket}) {
 740                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 741                 push @$cmd, '-notls', '-listen', 'localhost';
 742             }
 743
 744             push @$cmd, '-c', @$remcmd, @$shcmd;
 745
 746             run_command($cmd, keeplocale => 1);
 747
 748             return;
 749         };
 750
 751         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 752
 753         PVE::Tools::wait_for_vnc_port($port);
 754
 755         return {
 756             user => $authuser,
 757             ticket => $ticket,
 758             port => $port,
 759             upid => $upid,
 760             cert => $sslcert,
 761         };
 762     }});
 763
 764 __PACKAGE__->register_method ({
 765     name => 'termproxy',
 766     path => '{vmid}/termproxy',
 767     method => 'POST',
 768     protected => 1,
 769     permissions => {
 770         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 771     },
 772     description => "Creates a TCP proxy connection.",
 773     parameters => {
 774         additionalProperties => 0,
 775         properties => {
 776             node => get_standard_option('pve-node'),
 777             vmid => get_standard_option('pve-vmid'),
 778         },
 779     },
 780     returns => {
 781         additionalProperties => 0,
 782         properties => {
 783             user => { type => 'string' },
 784             ticket => { type => 'string' },
 785             port => { type => 'integer' },
 786             upid => { type => 'string' },
 787         },
 788     },
 789     code => sub {
 790         my ($param) = @_;
 791
 792         my $rpcenv = PVE::RPCEnvironment::get();
 793
 794         my $authuser = $rpcenv->get_user();
 795
 796         my $vmid = $param->{vmid};
 797         my $node = $param->{node};
 798
 799         my $authpath = "/vms/$vmid";
 800
 801         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 802
 803         my ($remip, $family);
 804
 805         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 806             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 807         } else {
 808             $family = PVE::Tools::get_host_address_family($node);
 809         }
 810
 811         my $port = PVE::Tools::next_vnc_port($family);
 812
 813         my $remcmd = $remip ?
 814             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 815
 816         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 817         my $concmd = PVE::LXC::get_console_command($vmid, $conf, 1);
 818
 819         my $shcmd = [ '/usr/bin/dtach', '-A',
 820                       "/var/run/dtach/vzctlconsole$vmid",
 821                       '-r', 'winch', '-z', @$concmd];
 822
 823         my $realcmd = sub {
 824             my $upid = shift;
 825
 826             syslog ('info', "starting lxc termproxy $upid\n");
 827
 828             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 829                        '--perm', 'VM.Console', '--'];
 830             push @$cmd, @$remcmd, @$shcmd;
 831
 832             PVE::Tools::run_command($cmd);
 833         };
 834
 835         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 836
 837         PVE::Tools::wait_for_vnc_port($port);
 838
 839         return {
 840             user => $authuser,
 841             ticket => $ticket,
 842             port => $port,
 843             upid => $upid,
 844         };
 845     }});
 846
 847 __PACKAGE__->register_method({
 848     name => 'vncwebsocket',
 849     path => '{vmid}/vncwebsocket',
 850     method => 'GET',
 851     permissions => {
 852         description => "You also need to pass a valid ticket (vncticket).",
 853         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 854     },
 855     description => "Opens a weksocket for VNC traffic.",
 856     parameters => {
 857         additionalProperties => 0,
 858         properties => {
 859             node => get_standard_option('pve-node'),
 860             vmid => get_standard_option('pve-vmid'),
 861             vncticket => {
 862                 description => "Ticket from previous call to vncproxy.",
 863                 type => 'string',
 864                 maxLength => 512,
 865             },
 866             port => {
 867                 description => "Port number returned by previous vncproxy call.",
 868                 type => 'integer',
 869                 minimum => 5900,
 870                 maximum => 5999,
 871             },
 872         },
 873     },
 874     returns => {
 875         type => "object",
 876         properties => {
 877             port => { type => 'string' },
 878         },
 879     },
 880     code => sub {
 881         my ($param) = @_;
 882
 883         my $rpcenv = PVE::RPCEnvironment::get();
 884
 885         my $authuser = $rpcenv->get_user();
 886
 887         my $authpath = "/vms/$param->{vmid}";
 888
 889         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
 890
 891         my $port = $param->{port};
 892
 893         return { port => $port };
 894     }});
 895
 896 __PACKAGE__->register_method ({
 897     name => 'spiceproxy',
 898     path => '{vmid}/spiceproxy',
 899     method => 'POST',
 900     protected => 1,
 901     proxyto => 'node',
 902     permissions => {
 903         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 904     },
 905     description => "Returns a SPICE configuration to connect to the CT.",
 906     parameters => {
 907         additionalProperties => 0,
 908         properties => {
 909             node => get_standard_option('pve-node'),
 910             vmid => get_standard_option('pve-vmid'),
 911             proxy => get_standard_option('spice-proxy', { optional => 1 }),
 912         },
 913     },
 914     returns => get_standard_option('remote-viewer-config'),
 915     code => sub {
 916         my ($param) = @_;
 917
 918         my $vmid = $param->{vmid};
 919         my $node = $param->{node};
 920         my $proxy = $param->{proxy};
 921
 922         my $authpath = "/vms/$vmid";
 923         my $permissions = 'VM.Console';
 924
 925         my $conf = PVE::LXC::Config->load_config($vmid);
 926
 927         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
 928
 929         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
 930
 931         my $shcmd = ['/usr/bin/dtach', '-A',
 932                      "/var/run/dtach/vzctlconsole$vmid",
 933                      '-r', 'winch', '-z', @$concmd];
 934
 935         my $title = "CT $vmid";
 936
 937         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
 938     }});
 939
 940
 941 __PACKAGE__->register_method({
 942     name => 'migrate_vm',
 943     path => '{vmid}/migrate',
 944     method => 'POST',
 945     protected => 1,
 946     proxyto => 'node',
 947     description => "Migrate the container to another node. Creates a new migration task.",
 948     permissions => {
 949         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
 950     },
 951     parameters => {
 952         additionalProperties => 0,
 953         properties => {
 954             node => get_standard_option('pve-node'),
 955             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
 956             target => get_standard_option('pve-node', {
 957                 description => "Target node.",
 958                 completion => \&PVE::Cluster::complete_migration_target,
 959             }),
 960             online => {
 961                 type => 'boolean',
 962                 description => "Use online/live migration.",
 963                 optional => 1,
 964             },
 965             restart => {
 966                 type => 'boolean',
 967                 description => "Use restart migration",
 968                 optional => 1,
 969             },
 970             timeout => {
 971                 type => 'integer',
 972                 description => "Timeout in seconds for shutdown for restart migration",
 973                 optional => 1,
 974                 default => 180,
 975             },
 976             force => {
 977                 type => 'boolean',
 978                 description => "Force migration despite local bind / device" .
 979                     " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
 980                 optional => 1,
 981             },
 982         },
 983     },
 984     returns => {
 985         type => 'string',
 986         description => "the task ID.",
 987     },
 988     code => sub {
 989         my ($param) = @_;
 990
 991         my $rpcenv = PVE::RPCEnvironment::get();
 992
 993         my $authuser = $rpcenv->get_user();
 994
 995         my $target = extract_param($param, 'target');
 996
 997         my $localnode = PVE::INotify::nodename();
 998         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
 999
1000         PVE::Cluster::check_cfs_quorum();
1001
1002         PVE::Cluster::check_node_exists($target);
1003
1004         my $targetip = PVE::Cluster::remote_node_ip($target);
1005
1006         my $vmid = extract_param($param, 'vmid');
1007
1008         # test if VM exists
1009         PVE::LXC::Config->load_config($vmid);
1010
1011         # try to detect errors early
1012         if (PVE::LXC::check_running($vmid)) {
1013             die "can't migrate running container without --online or --restart\n"
1014                 if !$param->{online} && !$param->{restart};
1015         }
1016
1017         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1018
1019             my $hacmd = sub {
1020                 my $upid = shift;
1021
1022                 my $service = "ct:$vmid";
1023
1024                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1025
1026                 print "Requesting HA migration for CT $vmid to node $target\n";
1027
1028                 PVE::Tools::run_command($cmd);
1029
1030                 return;
1031             };
1032
1033             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1034
1035         } else {
1036
1037             my $realcmd = sub {
1038                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1039             };
1040
1041             my $worker = sub {
1042                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1043             };
1044
1045             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1046         }
1047     }});
1048
1049 __PACKAGE__->register_method({
1050     name => 'vm_feature',
1051     path => '{vmid}/feature',
1052     method => 'GET',
1053     proxyto => 'node',
1054     protected => 1,
1055     description => "Check if feature for virtual machine is available.",
1056     permissions => {
1057         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1058     },
1059     parameters => {
1060         additionalProperties => 0,
1061         properties => {
1062             node => get_standard_option('pve-node'),
1063             vmid => get_standard_option('pve-vmid'),
1064             feature => {
1065                 description => "Feature to check.",
1066                 type => 'string',
1067                 enum => [ 'snapshot' ],
1068             },
1069             snapname => get_standard_option('pve-lxc-snapshot-name', {
1070                 optional => 1,
1071             }),
1072         },
1073     },
1074     returns => {
1075         type => "object",
1076         properties => {
1077             hasFeature => { type => 'boolean' },
1078             #nodes => {
1079                 #type => 'array',
1080                 #items => { type => 'string' },
1081             #}
1082         },
1083     },
1084     code => sub {
1085         my ($param) = @_;
1086
1087         my $node = extract_param($param, 'node');
1088
1089         my $vmid = extract_param($param, 'vmid');
1090
1091         my $snapname = extract_param($param, 'snapname');
1092
1093         my $feature = extract_param($param, 'feature');
1094
1095         my $conf = PVE::LXC::Config->load_config($vmid);
1096
1097         if($snapname){
1098             my $snap = $conf->{snapshots}->{$snapname};
1099             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1100             $conf = $snap;
1101         }
1102         my $storage_cfg = PVE::Storage::config();
1103         #Maybe include later
1104         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1105         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1106
1107         return {
1108             hasFeature => $hasFeature,
1109             #nodes => [ keys %$nodelist ],
1110         };
1111     }});
1112
1113 __PACKAGE__->register_method({
1114     name => 'template',
1115     path => '{vmid}/template',
1116     method => 'POST',
1117     protected => 1,
1118     proxyto => 'node',
1119     description => "Create a Template.",
1120     permissions => {
1121         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1122         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1123     },
1124     parameters => {
1125         additionalProperties => 0,
1126         properties => {
1127             node => get_standard_option('pve-node'),
1128             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1129         },
1130     },
1131     returns => { type => 'null'},
1132     code => sub {
1133         my ($param) = @_;
1134
1135         my $rpcenv = PVE::RPCEnvironment::get();
1136
1137         my $authuser = $rpcenv->get_user();
1138
1139         my $node = extract_param($param, 'node');
1140
1141         my $vmid = extract_param($param, 'vmid');
1142
1143         my $updatefn =  sub {
1144
1145             my $conf = PVE::LXC::Config->load_config($vmid);
1146             PVE::LXC::Config->check_lock($conf);
1147
1148             die "unable to create template, because CT contains snapshots\n"
1149                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1150
1151             die "you can't convert a template to a template\n"
1152                 if PVE::LXC::Config->is_template($conf);
1153
1154             die "you can't convert a CT to template if the CT is running\n"
1155                 if PVE::LXC::check_running($vmid);
1156
1157             my $realcmd = sub {
1158                 PVE::LXC::template_create($vmid, $conf);
1159             };
1160
1161             $conf->{template} = 1;
1162
1163             PVE::LXC::Config->write_config($vmid, $conf);
1164             # and remove lxc config
1165             PVE::LXC::update_lxc_config($vmid, $conf);
1166
1167             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1168         };
1169
1170         PVE::LXC::Config->lock_config($vmid, $updatefn);
1171
1172         return undef;
1173     }});
1174
1175 __PACKAGE__->register_method({
1176     name => 'clone_vm',
1177     path => '{vmid}/clone',
1178     method => 'POST',
1179     protected => 1,
1180     proxyto => 'node',
1181     description => "Create a container clone/copy",
1182     permissions => {
1183         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1184             "and 'VM.Allocate' permissions " .
1185             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1186             "'Datastore.AllocateSpace' on any used storage.",
1187         check =>
1188         [ 'and',
1189           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1190           [ 'or',
1191             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1192             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1193           ],
1194         ]
1195     },
1196     parameters => {
1197         additionalProperties => 0,
1198         properties => {
1199             node => get_standard_option('pve-node'),
1200             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1201             newid => get_standard_option('pve-vmid', {
1202                 completion => \&PVE::Cluster::complete_next_vmid,
1203                 description => 'VMID for the clone.' }),
1204             hostname => {
1205                 optional => 1,
1206                 type => 'string', format => 'dns-name',
1207                 description => "Set a hostname for the new CT.",
1208             },
1209             description => {
1210                 optional => 1,
1211                 type => 'string',
1212                 description => "Description for the new CT.",
1213             },
1214             pool => {
1215                 optional => 1,
1216                 type => 'string', format => 'pve-poolid',
1217                 description => "Add the new CT to the specified pool.",
1218             },
1219             snapname => get_standard_option('pve-lxc-snapshot-name', {
1220                 optional => 1,
1221             }),
1222             storage => get_standard_option('pve-storage-id', {
1223                 description => "Target storage for full clone.",
1224                 optional => 1,
1225             }),
1226             full => {
1227                 optional => 1,
1228                 type => 'boolean',
1229                 description => "Create a full copy of all disks. This is always done when " .
1230                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1231             },
1232 #           target => get_standard_option('pve-node', {
1233 #               description => "Target node. Only allowed if the original VM is on shared storage.",
1234 #               optional => 1,
1235 #           }),
1236         },
1237     },
1238     returns => {
1239         type => 'string',
1240     },
1241     code => sub {
1242         my ($param) = @_;
1243
1244         my $rpcenv = PVE::RPCEnvironment::get();
1245
1246         my $authuser = $rpcenv->get_user();
1247
1248         my $node = extract_param($param, 'node');
1249
1250         my $vmid = extract_param($param, 'vmid');
1251
1252         my $newid = extract_param($param, 'newid');
1253
1254         my $pool = extract_param($param, 'pool');
1255
1256         if (defined($pool)) {
1257             $rpcenv->check_pool_exist($pool);
1258         }
1259
1260         my $snapname = extract_param($param, 'snapname');
1261
1262         my $storage = extract_param($param, 'storage');
1263
1264         my $localnode = PVE::INotify::nodename();
1265
1266         my $storecfg = PVE::Storage::config();
1267
1268         if ($storage) {
1269             # check if storage is enabled on local node
1270             PVE::Storage::storage_check_enabled($storecfg, $storage);
1271         }
1272
1273         PVE::Cluster::check_cfs_quorum();
1274
1275         my $conffile;
1276         my $newconf = {};
1277         my $mountpoints = {};
1278         my $fullclone = {};
1279         my $vollist = [];
1280
1281         PVE::LXC::Config->lock_config($vmid, sub {
1282             my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1283
1284             my $full = extract_param($param, 'full');
1285             if (!defined($full)) {
1286                 $full = !PVE::LXC::Config->is_template($src_conf);
1287             }
1288             die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
1289
1290             eval {
1291                 die "snapshot '$snapname' does not exist\n"
1292                     if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1293
1294                 my $running = PVE::LXC::check_running($vmid) || 0;
1295
1296                 my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1297
1298                 $conffile = PVE::LXC::Config->config_file($newid);
1299                 die "unable to create CT $newid: config file already exists\n"
1300                     if -f $conffile;
1301
1302                 foreach my $opt (keys %$src_conf) {
1303                     next if $opt =~ m/^unused\d+$/;
1304
1305                     my $value = $src_conf->{$opt};
1306
1307                     if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1308                         my $mp = $opt eq 'rootfs' ?
1309                             PVE::LXC::Config->parse_ct_rootfs($value) :
1310                             PVE::LXC::Config->parse_ct_mountpoint($value);
1311
1312                         if ($mp->{type} eq 'volume') {
1313                             my $volid = $mp->{volume};
1314                             if ($full) {
1315                                 die "Cannot do full clones on a running container without snapshots\n"
1316                                     if $running && !defined($snapname);
1317                                 $fullclone->{$opt} = 1;
1318                             } else {
1319                                 # not full means clone instead of copy
1320                                 die "Linked clone feature for '$volid' is not available\n"
1321                                     if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running);
1322                             }
1323
1324                             $mountpoints->{$opt} = $mp;
1325                             push @$vollist, $volid;
1326
1327                         } else {
1328                             # TODO: allow bind mounts?
1329                             die "unable to clone mountpint '$opt' (type $mp->{type})\n";
1330                         }
1331                     } else {
1332                         # copy everything else
1333                         $newconf->{$opt} = $value;
1334                     }
1335                 }
1336
1337                 # Replace the 'disk' lock with a 'create' lock.
1338                 $newconf->{lock} = 'create';
1339
1340                 delete $newconf->{template};
1341                 if ($param->{hostname}) {
1342                     $newconf->{hostname} = $param->{hostname};
1343                 }
1344
1345                 if ($param->{description}) {
1346                     $newconf->{description} = $param->{description};
1347                 }
1348
1349                 # create empty/temp config - this fails if CT already exists on other node
1350                 PVE::LXC::Config->write_config($newid, $newconf);
1351             };
1352             if (my $err = $@) {
1353                 eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1354                 warn $@ if $@;
1355                 die $err;
1356             }
1357         });
1358
1359         my $update_conf = sub {
1360             my ($key, $value) = @_;
1361             return PVE::LXC::Config->lock_config($newid, sub {
1362                 my $conf = PVE::LXC::Config->load_config($newid);
1363                 die "Lost 'create' config lock, aborting.\n"
1364                     if !PVE::LXC::Config->has_lock($conf, 'create');
1365                 $conf->{$key} = $value;
1366                 PVE::LXC::Config->write_config($newid, $conf);
1367             });
1368         };
1369
1370         my $realcmd = sub {
1371             my ($upid) = @_;
1372
1373             my $newvollist = [];
1374
1375             eval {
1376                 local $SIG{INT} =
1377                     local $SIG{TERM} =
1378                     local $SIG{QUIT} =
1379                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1380
1381                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1382
1383                 foreach my $opt (keys %$mountpoints) {
1384                     my $mp = $mountpoints->{$opt};
1385                     my $volid = $mp->{volume};
1386
1387                     my $newvolid;
1388                     if ($fullclone->{$opt}) {
1389                         print "create full clone of mountpoint $opt ($volid)\n";
1390                         my $target_storage = $storage // PVE::Storage::parse_volume_id($volid);
1391                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname);
1392                     } else {
1393                         print "create linked clone of mount point $opt ($volid)\n";
1394                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1395                     }
1396
1397                     push @$newvollist, $newvolid;
1398                     $mp->{volume} = $newvolid;
1399
1400                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1401                 }
1402
1403                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1404                 PVE::LXC::Config->remove_lock($newid, 'create');
1405             };
1406             my $err = $@;
1407
1408             # Unlock the source config in any case:
1409             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1410             warn $@ if $@;
1411
1412             if ($err) {
1413                 # Now cleanup the config & disks:
1414                 unlink $conffile;
1415
1416                 sleep 1; # some storages like rbd need to wait before release volume - really?
1417
1418                 foreach my $volid (@$newvollist) {
1419                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1420                     warn $@ if $@;
1421                 }
1422                 die "clone failed: $err";
1423             }
1424
1425             return;
1426         };
1427
1428         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1429         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1430     }});
1431
1432
1433 __PACKAGE__->register_method({
1434     name => 'resize_vm',
1435     path => '{vmid}/resize',
1436     method => 'PUT',
1437     protected => 1,
1438     proxyto => 'node',
1439     description => "Resize a container mount point.",
1440     permissions => {
1441         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1442     },
1443     parameters => {
1444         additionalProperties => 0,
1445         properties => {
1446             node => get_standard_option('pve-node'),
1447             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1448             disk => {
1449                 type => 'string',
1450                 description => "The disk you want to resize.",
1451                 enum => [PVE::LXC::Config->mountpoint_names()],
1452             },
1453             size => {
1454                 type => 'string',
1455                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1456                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1457             },
1458             digest => {
1459                 type => 'string',
1460                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1461                 maxLength => 40,
1462                 optional => 1,
1463             }
1464         },
1465     },
1466     returns => {
1467         type => 'string',
1468         description => "the task ID.",
1469     },
1470     code => sub {
1471         my ($param) = @_;
1472
1473         my $rpcenv = PVE::RPCEnvironment::get();
1474
1475         my $authuser = $rpcenv->get_user();
1476
1477         my $node = extract_param($param, 'node');
1478
1479         my $vmid = extract_param($param, 'vmid');
1480
1481         my $digest = extract_param($param, 'digest');
1482
1483         my $sizestr = extract_param($param, 'size');
1484         my $ext = ($sizestr =~ s/^\+//);
1485         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1486         die "invalid size string" if !defined($newsize);
1487
1488         die "no options specified\n" if !scalar(keys %$param);
1489
1490         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
1491
1492         my $storage_cfg = cfs_read_file("storage.cfg");
1493
1494         my $code = sub {
1495
1496             my $conf = PVE::LXC::Config->load_config($vmid);
1497             PVE::LXC::Config->check_lock($conf);
1498
1499             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1500
1501             my $running = PVE::LXC::check_running($vmid);
1502
1503             my $disk = $param->{disk};
1504             my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
1505                 PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
1506
1507             my $volid = $mp->{volume};
1508
1509             my (undef, undef, $owner, undef, undef, undef, $format) =
1510                 PVE::Storage::parse_volname($storage_cfg, $volid);
1511
1512             die "can't resize mount point owned by another container ($owner)"
1513                 if $vmid != $owner;
1514
1515             die "can't resize volume: $disk if snapshot exists\n"
1516                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1517
1518             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1519
1520             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1521
1522             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1523
1524             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1525             $newsize += $size if $ext;
1526             $newsize = int($newsize);
1527
1528             die "unable to shrink disk size\n" if $newsize < $size;
1529
1530             return if $size == $newsize;
1531
1532             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1533             my $realcmd = sub {
1534                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1535                 # we pass 0 here (parameter only makes sense for qemu)
1536                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1537
1538                 $mp->{size} = $newsize;
1539                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1540
1541                 PVE::LXC::Config->write_config($vmid, $conf);
1542
1543                 if ($format eq 'raw') {
1544                     my $path = PVE::Storage::path($storage_cfg, $volid, undef);
1545                     if ($running) {
1546
1547                         $mp->{mp} = '/';
1548                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1549                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1550                         die "internal error: CT running but mount point not attached to a loop device"
1551                             if !$path;
1552                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1553
1554                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1555                         # to be visible to it in its namespace.
1556                         # To not interfere with the rest of the system we unshare the current mount namespace,
1557                         # mount over /tmp and then run resize2fs.
1558
1559                         # interestingly we don't need to e2fsck on mounted systems...
1560                         my $quoted = PVE::Tools::shellquote($path);
1561                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1562                         eval {
1563                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1564                         };
1565                         warn "Failed to update the container's filesystem: $@\n" if $@;
1566                     } else {
1567                         eval {
1568                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1569                             PVE::Tools::run_command(['resize2fs', $path]);
1570                         };
1571                         warn "Failed to update the container's filesystem: $@\n" if $@;
1572                     }
1573                 }
1574             };
1575
1576             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1577         };
1578
1579         return PVE::LXC::Config->lock_config($vmid, $code);;
1580     }});
1581
1582 __PACKAGE__->register_method({
1583     name => 'move_volume',
1584     path => '{vmid}/move_volume',
1585     method => 'POST',
1586     protected => 1,
1587     proxyto => 'node',
1588     description => "Move a rootfs-/mp-volume to a different storage",
1589     permissions => {
1590         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1591             "and 'Datastore.AllocateSpace' permissions on the storage.",
1592         check =>
1593         [ 'and',
1594           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1595           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
1596         ],
1597     },
1598     parameters => {
1599         additionalProperties => 0,
1600         properties => {
1601             node => get_standard_option('pve-node'),
1602             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1603             volume => {
1604                 type => 'string',
1605                 enum => [ PVE::LXC::Config->mountpoint_names() ],
1606                 description => "Volume which will be moved.",
1607             },
1608             storage => get_standard_option('pve-storage-id', {
1609                 description => "Target Storage.",
1610                 completion => \&PVE::Storage::complete_storage_enabled,
1611             }),
1612             delete => {
1613                 type => 'boolean',
1614                 description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
1615                 optional => 1,
1616                 default => 0,
1617             },
1618             digest => {
1619                 type => 'string',
1620                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1621                 maxLength => 40,
1622                 optional => 1,
1623             }
1624         },
1625     },
1626     returns => {
1627         type => 'string',
1628     },
1629     code => sub {
1630         my ($param) = @_;
1631
1632         my $rpcenv = PVE::RPCEnvironment::get();
1633
1634         my $authuser = $rpcenv->get_user();
1635
1636         my $vmid = extract_param($param, 'vmid');
1637
1638         my $storage = extract_param($param, 'storage');
1639
1640         my $mpkey = extract_param($param, 'volume');
1641
1642         my $lockname = 'disk';
1643
1644         my ($mpdata, $old_volid);
1645
1646         PVE::LXC::Config->lock_config($vmid, sub {
1647             my $conf = PVE::LXC::Config->load_config($vmid);
1648             PVE::LXC::Config->check_lock($conf);
1649
1650             die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
1651
1652             if ($mpkey eq 'rootfs') {
1653                 $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
1654             } elsif ($mpkey =~ m/mp\d+/) {
1655                 $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
1656             } else {
1657                 die "Can't parse $mpkey\n";
1658             }
1659             $old_volid = $mpdata->{volume};
1660
1661             die "you can't move a volume with snapshots and delete the source\n"
1662                 if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1663
1664             PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
1665
1666             PVE::LXC::Config->set_lock($vmid, $lockname);
1667         });
1668
1669         my $realcmd = sub {
1670             eval {
1671                 PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
1672
1673                 my $conf = PVE::LXC::Config->load_config($vmid);
1674                 my $storage_cfg = PVE::Storage::config();
1675
1676                 my $new_volid;
1677
1678                 eval {
1679                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1680                     $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf);
1681                     $mpdata->{volume} = $new_volid;
1682
1683                     PVE::LXC::Config->lock_config($vmid, sub {
1684                         my $digest = $conf->{digest};
1685                         $conf = PVE::LXC::Config->load_config($vmid);
1686                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1687
1688                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
1689
1690                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1691
1692                         PVE::LXC::Config->write_config($vmid, $conf);
1693                     });
1694
1695                     eval {
1696                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1697                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1698                     };
1699                     warn $@ if $@;
1700                 };
1701                 if (my $err = $@) {
1702                     eval {
1703                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
1704                             if defined($new_volid);
1705                     };
1706                     warn $@ if $@;
1707                     die $err;
1708                 }
1709
1710                 if ($param->{delete}) {
1711                     eval {
1712                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
1713                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
1714                     };
1715                     warn $@ if $@;
1716                 }
1717             };
1718             my $err = $@;
1719             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1720             warn $@ if $@;
1721             die $err if $err;
1722         };
1723         my $task = eval {
1724             $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
1725         };
1726         if (my $err = $@) {
1727             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1728             warn $@ if $@;
1729             die $err;
1730         }
1731         return $task;
1732   }});
1733
1734 1;