src/PVE/API2/LXC.pm

   1 package PVE::API2::LXC;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::SafeSyslog;
   7 use PVE::Tools qw(extract_param run_command);
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::Cluster qw(cfs_read_file);
  11 use PVE::RRD;
  12 use PVE::DataCenterConfig;
  13 use PVE::AccessControl;
  14 use PVE::Firewall;
  15 use PVE::Storage;
  16 use PVE::RESTHandler;
  17 use PVE::RPCEnvironment;
  18 use PVE::ReplicationConfig;
  19 use PVE::LXC;
  20 use PVE::LXC::Create;
  21 use PVE::LXC::Migrate;
  22 use PVE::GuestHelpers;
  23 use PVE::VZDump::Plugin;
  24 use PVE::API2::LXC::Config;
  25 use PVE::API2::LXC::Status;
  26 use PVE::API2::LXC::Snapshot;
  27 use PVE::JSONSchema qw(get_standard_option);
  28 use base qw(PVE::RESTHandler);
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import  PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import  PVE::HA::Config;
  36     }
  37 }
  38
  39 __PACKAGE__->register_method ({
  40     subclass => "PVE::API2::LXC::Config",
  41     path => '{vmid}/config',
  42 });
  43
  44 __PACKAGE__->register_method ({
  45     subclass => "PVE::API2::LXC::Status",
  46     path => '{vmid}/status',
  47 });
  48
  49 __PACKAGE__->register_method ({
  50     subclass => "PVE::API2::LXC::Snapshot",
  51     path => '{vmid}/snapshot',
  52 });
  53
  54 __PACKAGE__->register_method ({
  55     subclass => "PVE::API2::Firewall::CT",
  56     path => '{vmid}/firewall',
  57 });
  58
  59 __PACKAGE__->register_method({
  60     name => 'vmlist',
  61     path => '',
  62     method => 'GET',
  63     description => "LXC container index (per node).",
  64     permissions => {
  65         description => "Only list CTs where you have VM.Audit permissons on /vms/<vmid>.",
  66         user => 'all',
  67     },
  68     proxyto => 'node',
  69     protected => 1, # /proc files are only readable by root
  70     parameters => {
  71         additionalProperties => 0,
  72         properties => {
  73             node => get_standard_option('pve-node'),
  74         },
  75     },
  76     returns => {
  77         type => 'array',
  78         items => {
  79             type => "object",
  80             properties => $PVE::LXC::vmstatus_return_properties,
  81         },
  82         links => [ { rel => 'child', href => "{vmid}" } ],
  83     },
  84     code => sub {
  85         my ($param) = @_;
  86
  87         my $rpcenv = PVE::RPCEnvironment::get();
  88         my $authuser = $rpcenv->get_user();
  89
  90         my $vmstatus = PVE::LXC::vmstatus();
  91
  92         my $res = [];
  93         foreach my $vmid (keys %$vmstatus) {
  94             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
  95
  96             my $data = $vmstatus->{$vmid};
  97             push @$res, $data;
  98         }
  99
 100         return $res;
 101
 102     }});
 103
 104 __PACKAGE__->register_method({
 105     name => 'create_vm',
 106     path => '',
 107     method => 'POST',
 108     description => "Create or restore a container.",
 109     permissions => {
 110         user => 'all', # check inside
 111         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 112             "For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 113             "You also need 'Datastore.AllocateSpace' permissions on the storage.",
 114     },
 115     protected => 1,
 116     proxyto => 'node',
 117     parameters => {
 118         additionalProperties => 0,
 119         properties => PVE::LXC::Config->json_config_properties({
 120             node => get_standard_option('pve-node'),
 121             vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 122             ostemplate => {
 123                 description => "The OS template or backup file.",
 124                 type => 'string',
 125                 maxLength => 255,
 126                 completion => \&PVE::LXC::complete_os_templates,
 127             },
 128             password => {
 129                 optional => 1,
 130                 type => 'string',
 131                 description => "Sets root password inside container.",
 132                 minLength => 5,
 133             },
 134             storage => get_standard_option('pve-storage-id', {
 135                 description => "Default Storage.",
 136                 default => 'local',
 137                 optional => 1,
 138                 completion => \&PVE::Storage::complete_storage_enabled,
 139             }),
 140             force => {
 141                 optional => 1,
 142                 type => 'boolean',
 143                 description => "Allow to overwrite existing container.",
 144             },
 145             restore => {
 146                 optional => 1,
 147                 type => 'boolean',
 148                 description => "Mark this as restore task.",
 149             },
 150             unique => {
 151                 optional => 1,
 152                 type => 'boolean',
 153                 description => "Assign a unique random ethernet address.",
 154                 requires => 'restore',
 155             },
 156             pool => {
 157                 optional => 1,
 158                 type => 'string', format => 'pve-poolid',
 159                 description => "Add the VM to the specified pool.",
 160             },
 161             'ignore-unpack-errors' => {
 162                 optional => 1,
 163                 type => 'boolean',
 164                 description => "Ignore errors when extracting the template.",
 165             },
 166             'ssh-public-keys' => {
 167                 optional => 1,
 168                 type => 'string',
 169                 description => "Setup public SSH keys (one key per line, " .
 170                                 "OpenSSH format).",
 171             },
 172             bwlimit => {
 173                 description => "Override I/O bandwidth limit (in KiB/s).",
 174                 optional => 1,
 175                 type => 'number',
 176                 minimum => '0',
 177                 default => 'restore limit from datacenter or storage config',
 178             },
 179             start => {
 180                 optional => 1,
 181                 type => 'boolean',
 182                 default => 0,
 183                 description => "Start the CT after its creation finished successfully.",
 184             },
 185         }),
 186     },
 187     returns => {
 188         type => 'string',
 189     },
 190     code => sub {
 191         my ($param) = @_;
 192
 193         PVE::Cluster::check_cfs_quorum();
 194
 195         my $rpcenv = PVE::RPCEnvironment::get();
 196         my $authuser = $rpcenv->get_user();
 197
 198         my $node = extract_param($param, 'node');
 199         my $vmid = extract_param($param, 'vmid');
 200         my $ignore_unpack_errors = extract_param($param, 'ignore-unpack-errors');
 201         my $bwlimit = extract_param($param, 'bwlimit');
 202         my $start_after_create = extract_param($param, 'start');
 203
 204         my $basecfg_fn = PVE::LXC::Config->config_file($vmid);
 205         my $same_container_exists = -f $basecfg_fn;
 206
 207         # 'unprivileged' is read-only, so we can't pass it to update_pct_config
 208         my $unprivileged = extract_param($param, 'unprivileged');
 209         my $restore = extract_param($param, 'restore');
 210         my $unique = extract_param($param, 'unique');
 211
 212         # used to skip firewall config restore if user lacks permission
 213         my $skip_fw_config_restore = 0;
 214
 215         if ($restore) {
 216             # fixme: limit allowed parameters
 217         }
 218
 219         my $force = extract_param($param, 'force');
 220
 221         if (!($same_container_exists && $restore && $force)) {
 222             PVE::Cluster::check_vmid_unused($vmid);
 223         } else {
 224             die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 225             my $conf = PVE::LXC::Config->load_config($vmid);
 226             PVE::LXC::Config->check_protection($conf, "unable to restore CT $vmid");
 227         }
 228
 229         my $password = extract_param($param, 'password');
 230         my $ssh_keys = extract_param($param, 'ssh-public-keys');
 231         PVE::Tools::validate_ssh_public_keys($ssh_keys) if defined($ssh_keys);
 232
 233         my $pool = extract_param($param, 'pool');
 234         if (defined($pool)) {
 235             $rpcenv->check_pool_exist($pool);
 236             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 237         }
 238
 239         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 240             # OK
 241         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 242             # OK
 243         } elsif ($restore && $force && $same_container_exists &&
 244                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 245             # OK: user has VM.Backup permissions, and want to restore an existing VM
 246
 247             # we don't want to restore a container-provided FW conf in this case
 248             # since the user is lacking permission to configure the container's FW
 249             $skip_fw_config_restore = 1;
 250         } else {
 251             raise_perm_exc();
 252         }
 253
 254         my $ostemplate = extract_param($param, 'ostemplate');
 255         my $storage = extract_param($param, 'storage') // 'local';
 256
 257         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, $param, []);
 258
 259         my $storage_cfg = cfs_read_file("storage.cfg");
 260
 261         my $archive;
 262         if ($ostemplate eq '-') {
 263             die "pipe requires cli environment\n"
 264                 if $rpcenv->{type} ne 'cli';
 265             die "pipe can only be used with restore tasks\n"
 266                 if !$restore;
 267             $archive = '-';
 268             die "restore from pipe requires rootfs parameter\n" if !defined($param->{rootfs});
 269         } else {
 270             PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, $vmid, $ostemplate);
 271             $archive = $ostemplate;
 272         }
 273
 274         my %used_storages;
 275         my $check_and_activate_storage = sub {
 276             my ($sid) = @_;
 277
 278             my $scfg = PVE::Storage::storage_check_node($storage_cfg, $sid, $node);
 279
 280             raise_param_exc({ storage => "storage '$sid' does not support container directories"})
 281                 if !$scfg->{content}->{rootdir};
 282
 283             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 284
 285             PVE::Storage::activate_storage($storage_cfg, $sid);
 286             $used_storages{$sid} = 1;
 287         };
 288
 289         my $conf = {};
 290
 291         my $is_root = $authuser eq 'root@pam';
 292
 293         my $no_disk_param = {};
 294         my $mp_param = {};
 295         my $storage_only_mode = 1;
 296         foreach my $opt (keys %$param) {
 297             my $value = $param->{$opt};
 298             if ($opt eq 'rootfs' || $opt =~ m/^mp\d+$/) {
 299                 # allow to use simple numbers (add default storage in that case)
 300                 if ($value =~ m/^\d+(\.\d+)?$/) {
 301                     $mp_param->{$opt} = "$storage:$value";
 302                 } else {
 303                     $mp_param->{$opt} = $value;
 304                 }
 305                 $storage_only_mode = 0;
 306             } elsif ($opt =~ m/^unused\d+$/) {
 307                 warn "ignoring '$opt', cannot create/restore with unused volume\n";
 308                 delete $param->{$opt};
 309             } else {
 310                 $no_disk_param->{$opt} = $value;
 311             }
 312         }
 313
 314         die "mount points configured, but 'rootfs' not set - aborting\n"
 315             if !$storage_only_mode && !defined($mp_param->{rootfs});
 316
 317         # check storage access, activate storage
 318         my $delayed_mp_param = {};
 319         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 320             my ($ms, $mountpoint) = @_;
 321
 322             my $volid = $mountpoint->{volume};
 323             my $mp = $mountpoint->{mp};
 324
 325             if ($mountpoint->{type} ne 'volume') { # bind or device
 326                 die "Only root can pass arbitrary filesystem paths.\n"
 327                     if !$is_root;
 328             } else {
 329                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 330                 &$check_and_activate_storage($sid);
 331             }
 332         });
 333
 334         # check/activate default storage
 335         &$check_and_activate_storage($storage) if !defined($mp_param->{rootfs});
 336
 337         PVE::LXC::Config->update_pct_config($vmid, $conf, 0, $no_disk_param);
 338
 339         $conf->{unprivileged} = 1 if $unprivileged;
 340
 341         my $emsg = $restore ? "unable to restore CT $vmid -" : "unable to create CT $vmid -";
 342
 343         eval { PVE::LXC::Config->create_and_lock_config($vmid, $force) };
 344         die "$emsg $@" if $@;
 345
 346         my $code = sub {
 347             my $old_conf = PVE::LXC::Config->load_config($vmid);
 348             my $was_template;
 349
 350             my $vollist = [];
 351             eval {
 352                 my $orig_mp_param; # only used if $restore
 353                 if ($restore) {
 354                     die "can't overwrite running container\n" if PVE::LXC::check_running($vmid);
 355                     if ($is_root && $archive ne '-') {
 356                         my $orig_conf;
 357                         ($orig_conf, $orig_mp_param) = PVE::LXC::Create::recover_config($storage_cfg, $archive);
 358                         $was_template = delete $orig_conf->{template};
 359                         # When we're root call 'restore_configuration' with restricted=0,
 360                         # causing it to restore the raw lxc entries, among which there may be
 361                         # 'lxc.idmap' entries. We need to make sure that the extracted contents
 362                         # of the container match up with the restored configuration afterwards:
 363                         $conf->{lxc} = $orig_conf->{lxc};
 364                     }
 365                 }
 366                 if ($storage_only_mode) {
 367                     if ($restore) {
 368                         if (!defined($orig_mp_param)) {
 369                             (undef, $orig_mp_param) = PVE::LXC::Create::recover_config($storage_cfg, $archive);
 370                         }
 371                         $mp_param = $orig_mp_param;
 372                         die "rootfs configuration could not be recovered, please check and specify manually!\n"
 373                             if !defined($mp_param->{rootfs});
 374                         PVE::LXC::Config->foreach_mountpoint($mp_param, sub {
 375                             my ($ms, $mountpoint) = @_;
 376                             my $type = $mountpoint->{type};
 377                             if ($type eq 'volume') {
 378                                 die "unable to detect disk size - please specify $ms (size)\n"
 379                                     if !defined($mountpoint->{size});
 380                                 my $disksize = $mountpoint->{size} / (1024 * 1024 * 1024); # create_disks expects GB as unit size
 381                                 delete $mountpoint->{size};
 382                                 $mountpoint->{volume} = "$storage:$disksize";
 383                                 $mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 384                             } else {
 385                                 my $type = $mountpoint->{type};
 386                                 die "restoring rootfs to $type mount is only possible by specifying -rootfs manually!\n"
 387                                     if ($ms eq 'rootfs');
 388                                 die "restoring '$ms' to $type mount is only possible for root\n"
 389                                     if !$is_root;
 390
 391                                 if ($mountpoint->{backup}) {
 392                                     warn "WARNING - unsupported configuration!\n";
 393                                     warn "backup was enabled for $type mount point $ms ('$mountpoint->{mp}')\n";
 394                                     warn "mount point configuration will be restored after archive extraction!\n";
 395                                     warn "contained files will be restored to wrong directory!\n";
 396                                 }
 397                                 delete $mp_param->{$ms}; # actually delay bind/dev mps
 398                                 $delayed_mp_param->{$ms} = PVE::LXC::Config->print_ct_mountpoint($mountpoint, $ms eq 'rootfs');
 399                             }
 400                         });
 401                     } else {
 402                         $mp_param->{rootfs} = "$storage:4"; # defaults to 4GB
 403                     }
 404                 }
 405
 406                 $vollist = PVE::LXC::create_disks($storage_cfg, $vmid, $mp_param, $conf);
 407
 408                 # we always have the 'create' lock so check for more than 1 entry
 409                 if (scalar(keys %$old_conf) > 1) {
 410                     # destroy old container volumes
 411                     PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf, { lock => 'create' });
 412                 }
 413
 414                 eval {
 415                     my $rootdir = PVE::LXC::mount_all($vmid, $storage_cfg, $conf, 1);
 416                     $bwlimit = PVE::Storage::get_bandwidth_limit('restore', [keys %used_storages], $bwlimit);
 417                     PVE::LXC::Create::restore_archive($storage_cfg, $archive, $rootdir, $conf, $ignore_unpack_errors, $bwlimit);
 418
 419                     if ($restore) {
 420                         PVE::LXC::Create::restore_configuration($vmid, $storage_cfg, $archive, $rootdir, $conf, !$is_root, $unique, $skip_fw_config_restore);
 421                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir);
 422                         $lxc_setup->template_fixup($conf);
 423                     } else {
 424                         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 425                         PVE::LXC::Config->write_config($vmid, $conf); # safe config (after OS detection)
 426                         $lxc_setup->post_create_hook($password, $ssh_keys);
 427                     }
 428                 };
 429                 my $err = $@;
 430                 PVE::LXC::umount_all($vmid, $storage_cfg, $conf, $err ? 1 : 0);
 431                 PVE::Storage::deactivate_volumes($storage_cfg, PVE::LXC::Config->get_vm_volumes($conf));
 432                 die $err if $err;
 433                 # set some defaults
 434                 $conf->{hostname} ||= "CT$vmid";
 435                 $conf->{memory} ||= 512;
 436                 $conf->{swap} //= 512;
 437                 foreach my $mp (keys %$delayed_mp_param) {
 438                     $conf->{$mp} = $delayed_mp_param->{$mp};
 439                 }
 440                 # If the template flag was set, we try to convert again to template after restore
 441                 if ($was_template) {
 442                     print STDERR "Convert restored container to template...\n";
 443                     if (my $err = check_storage_supports_templates($conf)) {
 444                         warn $err;
 445                         warn "Leave restored backup as container instead of converting to template.\n"
 446                     } else {
 447                         PVE::LXC::template_create($vmid, $conf);
 448                         $conf->{template} = 1;
 449                     }
 450                 }
 451                 PVE::LXC::Config->write_config($vmid, $conf);
 452             };
 453             if (my $err = $@) {
 454                 PVE::LXC::destroy_disks($storage_cfg, $vollist);
 455                 eval { PVE::LXC::Config->destroy_config($vmid) };
 456                 warn $@ if $@;
 457                 die "$emsg $err";
 458             }
 459             PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 460
 461             PVE::API2::LXC::Status->vm_start({ vmid => $vmid, node => $node })
 462                 if $start_after_create;
 463         };
 464
 465         my $workername = $restore ? 'vzrestore' : 'vzcreate';
 466         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 467
 468         return $rpcenv->fork_worker($workername, $vmid, $authuser, $realcmd);
 469     }});
 470
 471 sub check_storage_supports_templates {
 472     my ($conf) = @_;
 473
 474     my $scfg = PVE::Storage::config();
 475     eval {
 476         PVE::LXC::Config->foreach_mountpoint($conf, sub {
 477             my ($ms, $mp) = @_;
 478
 479             my ($sid) = PVE::Storage::parse_volume_id($mp->{volume}, 0);
 480             die "Warning: Directory storage '$sid' does not support container templates!\n"
 481                 if $scfg->{ids}->{$sid}->{path};
 482         });
 483     };
 484     return $@
 485 }
 486
 487 __PACKAGE__->register_method({
 488     name => 'vmdiridx',
 489     path => '{vmid}',
 490     method => 'GET',
 491     proxyto => 'node',
 492     description => "Directory index",
 493     permissions => {
 494         user => 'all',
 495     },
 496     parameters => {
 497         additionalProperties => 0,
 498         properties => {
 499             node => get_standard_option('pve-node'),
 500             vmid => get_standard_option('pve-vmid'),
 501         },
 502     },
 503     returns => {
 504         type => 'array',
 505         items => {
 506             type => "object",
 507             properties => {
 508                 subdir => { type => 'string' },
 509             },
 510         },
 511         links => [ { rel => 'child', href => "{subdir}" } ],
 512     },
 513     code => sub {
 514         my ($param) = @_;
 515
 516         # test if VM exists
 517         my $conf = PVE::LXC::Config->load_config($param->{vmid});
 518
 519         my $res = [
 520             { subdir => 'config' },
 521             { subdir => 'pending' },
 522             { subdir => 'status' },
 523             { subdir => 'vncproxy' },
 524             { subdir => 'termproxy' },
 525             { subdir => 'vncwebsocket' },
 526             { subdir => 'spiceproxy' },
 527             { subdir => 'migrate' },
 528             { subdir => 'clone' },
 529 #           { subdir => 'initlog' },
 530             { subdir => 'rrd' },
 531             { subdir => 'rrddata' },
 532             { subdir => 'firewall' },
 533             { subdir => 'snapshot' },
 534             { subdir => 'resize' },
 535             ];
 536
 537         return $res;
 538     }});
 539
 540
 541 __PACKAGE__->register_method({
 542     name => 'rrd',
 543     path => '{vmid}/rrd',
 544     method => 'GET',
 545     protected => 1, # fixme: can we avoid that?
 546     permissions => {
 547         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 548     },
 549     description => "Read VM RRD statistics (returns PNG)",
 550     parameters => {
 551         additionalProperties => 0,
 552         properties => {
 553             node => get_standard_option('pve-node'),
 554             vmid => get_standard_option('pve-vmid'),
 555             timeframe => {
 556                 description => "Specify the time frame you are interested in.",
 557                 type => 'string',
 558                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 559             },
 560             ds => {
 561                 description => "The list of datasources you want to display.",
 562                 type => 'string', format => 'pve-configid-list',
 563             },
 564             cf => {
 565                 description => "The RRD consolidation function",
 566                 type => 'string',
 567                 enum => [ 'AVERAGE', 'MAX' ],
 568                 optional => 1,
 569             },
 570         },
 571     },
 572     returns => {
 573         type => "object",
 574         properties => {
 575             filename => { type => 'string' },
 576         },
 577     },
 578     code => sub {
 579         my ($param) = @_;
 580
 581         return PVE::RRD::create_rrd_graph(
 582             "pve2-vm/$param->{vmid}", $param->{timeframe},
 583             $param->{ds}, $param->{cf});
 584
 585     }});
 586
 587 __PACKAGE__->register_method({
 588     name => 'rrddata',
 589     path => '{vmid}/rrddata',
 590     method => 'GET',
 591     protected => 1, # fixme: can we avoid that?
 592     permissions => {
 593         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 594     },
 595     description => "Read VM RRD statistics",
 596     parameters => {
 597         additionalProperties => 0,
 598         properties => {
 599             node => get_standard_option('pve-node'),
 600             vmid => get_standard_option('pve-vmid'),
 601             timeframe => {
 602                 description => "Specify the time frame you are interested in.",
 603                 type => 'string',
 604                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 605             },
 606             cf => {
 607                 description => "The RRD consolidation function",
 608                 type => 'string',
 609                 enum => [ 'AVERAGE', 'MAX' ],
 610                 optional => 1,
 611             },
 612         },
 613     },
 614     returns => {
 615         type => "array",
 616         items => {
 617             type => "object",
 618             properties => {},
 619         },
 620     },
 621     code => sub {
 622         my ($param) = @_;
 623
 624         return PVE::RRD::create_rrd_data(
 625             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 626     }});
 627
 628 __PACKAGE__->register_method({
 629     name => 'destroy_vm',
 630     path => '{vmid}',
 631     method => 'DELETE',
 632     protected => 1,
 633     proxyto => 'node',
 634     description => "Destroy the container (also delete all uses files).",
 635     permissions => {
 636         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 637     },
 638     parameters => {
 639         additionalProperties => 0,
 640         properties => {
 641             node => get_standard_option('pve-node'),
 642             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
 643             purge => {
 644                 type => 'boolean',
 645                 description => "Remove vmid from backup cron jobs.",
 646                 optional => 1,
 647             },
 648         },
 649     },
 650     returns => {
 651         type => 'string',
 652     },
 653     code => sub {
 654         my ($param) = @_;
 655
 656         my $rpcenv = PVE::RPCEnvironment::get();
 657         my $authuser = $rpcenv->get_user();
 658         my $vmid = $param->{vmid};
 659
 660         # test if container exists
 661         my $conf = PVE::LXC::Config->load_config($vmid);
 662         my $storage_cfg = cfs_read_file("storage.cfg");
 663         PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid");
 664
 665         my $ha_managed = PVE::HA::Config::service_is_configured("ct:$vmid");
 666
 667         if (!$param->{purge}) {
 668             die "unable to remove CT $vmid - used in HA resources and purge parameter not set.\n"
 669                 if $ha_managed;
 670
 671             # do not allow destroy if there are replication jobs without purge
 672             my $repl_conf = PVE::ReplicationConfig->new();
 673             $repl_conf->check_for_existing_jobs($vmid);
 674         }
 675
 676         my $running_error_msg = "unable to destroy CT $vmid - container is running\n";
 677
 678         die $running_error_msg if PVE::LXC::check_running($vmid); # check early
 679
 680         my $code = sub {
 681             # reload config after lock
 682             $conf = PVE::LXC::Config->load_config($vmid);
 683             PVE::LXC::Config->check_lock($conf);
 684
 685             die $running_error_msg if PVE::LXC::check_running($vmid);
 686
 687             PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $conf, { lock => 'destroyed' });
 688
 689             PVE::AccessControl::remove_vm_access($vmid);
 690             PVE::Firewall::remove_vmfw_conf($vmid);
 691             if ($param->{purge}) {
 692                 print "purging CT $vmid from related configurations..\n";
 693                 PVE::ReplicationConfig::remove_vmid_jobs($vmid);
 694                 PVE::VZDump::Plugin::remove_vmid_from_backup_jobs($vmid);
 695
 696                 if ($ha_managed) {
 697                     PVE::HA::Config::delete_service_from_config("ct:$vmid");
 698                     print "NOTE: removed CT $vmid from HA resource configuration.\n";
 699                 }
 700             }
 701
 702             # only now remove the zombie config, else we can have reuse race
 703             PVE::LXC::Config->destroy_config($vmid);
 704         };
 705
 706         my $realcmd = sub { PVE::LXC::Config->lock_config($vmid, $code); };
 707
 708         return $rpcenv->fork_worker('vzdestroy', $vmid, $authuser, $realcmd);
 709     }});
 710
 711 my $sslcert;
 712
 713 __PACKAGE__->register_method ({
 714     name => 'vncproxy',
 715     path => '{vmid}/vncproxy',
 716     method => 'POST',
 717     protected => 1,
 718     permissions => {
 719         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 720     },
 721     description => "Creates a TCP VNC proxy connections.",
 722     parameters => {
 723         additionalProperties => 0,
 724         properties => {
 725             node => get_standard_option('pve-node'),
 726             vmid => get_standard_option('pve-vmid'),
 727             websocket => {
 728                 optional => 1,
 729                 type => 'boolean',
 730                 description => "use websocket instead of standard VNC.",
 731             },
 732             width => {
 733                 optional => 1,
 734                 description => "sets the width of the console in pixels.",
 735                 type => 'integer',
 736                 minimum => 16,
 737                 maximum => 4096,
 738             },
 739             height => {
 740                 optional => 1,
 741                 description => "sets the height of the console in pixels.",
 742                 type => 'integer',
 743                 minimum => 16,
 744                 maximum => 2160,
 745             },
 746         },
 747     },
 748     returns => {
 749         additionalProperties => 0,
 750         properties => {
 751             user => { type => 'string' },
 752             ticket => { type => 'string' },
 753             cert => { type => 'string' },
 754             port => { type => 'integer' },
 755             upid => { type => 'string' },
 756         },
 757     },
 758     code => sub {
 759         my ($param) = @_;
 760
 761         my $rpcenv = PVE::RPCEnvironment::get();
 762
 763         my $authuser = $rpcenv->get_user();
 764
 765         my $vmid = $param->{vmid};
 766         my $node = $param->{node};
 767
 768         my $authpath = "/vms/$vmid";
 769
 770         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 771
 772         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 773             if !$sslcert;
 774
 775         my ($remip, $family);
 776
 777         if ($node ne PVE::INotify::nodename()) {
 778             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 779         } else {
 780             $family = PVE::Tools::get_host_address_family($node);
 781         }
 782
 783         my $port = PVE::Tools::next_vnc_port($family);
 784
 785         # NOTE: vncterm VNC traffic is already TLS encrypted,
 786         # so we select the fastest chipher here (or 'none'?)
 787         my $remcmd = $remip ?
 788             ['/usr/bin/ssh', '-e', 'none', '-t', $remip] : [];
 789
 790         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 791         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 792
 793         my $shcmd = [ '/usr/bin/dtach', '-A',
 794                       "/var/run/dtach/vzctlconsole$vmid",
 795                       '-r', 'winch', '-z', @$concmd];
 796
 797         my $realcmd = sub {
 798             my $upid = shift;
 799
 800             syslog ('info', "starting lxc vnc proxy $upid\n");
 801
 802             my $timeout = 10;
 803
 804             my $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
 805                        '-timeout', $timeout, '-authpath', $authpath,
 806                        '-perm', 'VM.Console'];
 807
 808             if ($param->{width}) {
 809                 push @$cmd, '-width', $param->{width};
 810             }
 811
 812             if ($param->{height}) {
 813                 push @$cmd, '-height', $param->{height};
 814             }
 815
 816             if ($param->{websocket}) {
 817                 $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
 818                 push @$cmd, '-notls', '-listen', 'localhost';
 819             }
 820
 821             push @$cmd, '-c', @$remcmd, @$shcmd;
 822
 823             run_command($cmd, keeplocale => 1);
 824
 825             return;
 826         };
 827
 828         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
 829
 830         PVE::Tools::wait_for_vnc_port($port);
 831
 832         return {
 833             user => $authuser,
 834             ticket => $ticket,
 835             port => $port,
 836             upid => $upid,
 837             cert => $sslcert,
 838         };
 839     }});
 840
 841 __PACKAGE__->register_method ({
 842     name => 'termproxy',
 843     path => '{vmid}/termproxy',
 844     method => 'POST',
 845     protected => 1,
 846     permissions => {
 847         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 848     },
 849     description => "Creates a TCP proxy connection.",
 850     parameters => {
 851         additionalProperties => 0,
 852         properties => {
 853             node => get_standard_option('pve-node'),
 854             vmid => get_standard_option('pve-vmid'),
 855         },
 856     },
 857     returns => {
 858         additionalProperties => 0,
 859         properties => {
 860             user => { type => 'string' },
 861             ticket => { type => 'string' },
 862             port => { type => 'integer' },
 863             upid => { type => 'string' },
 864         },
 865     },
 866     code => sub {
 867         my ($param) = @_;
 868
 869         my $rpcenv = PVE::RPCEnvironment::get();
 870
 871         my $authuser = $rpcenv->get_user();
 872
 873         my $vmid = $param->{vmid};
 874         my $node = $param->{node};
 875
 876         my $authpath = "/vms/$vmid";
 877
 878         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 879
 880         my ($remip, $family);
 881
 882         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
 883             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
 884         } else {
 885             $family = PVE::Tools::get_host_address_family($node);
 886         }
 887
 888         my $port = PVE::Tools::next_vnc_port($family);
 889
 890         my $remcmd = $remip ?
 891             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
 892
 893         my $conf = PVE::LXC::Config->load_config($vmid, $node);
 894         my $concmd = PVE::LXC::get_console_command($vmid, $conf, -1);
 895
 896         my $shcmd = [ '/usr/bin/dtach', '-A',
 897                       "/var/run/dtach/vzctlconsole$vmid",
 898                       '-r', 'winch', '-z', @$concmd];
 899
 900         my $realcmd = sub {
 901             my $upid = shift;
 902
 903             syslog ('info', "starting lxc termproxy $upid\n");
 904
 905             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
 906                        '--perm', 'VM.Console', '--'];
 907             push @$cmd, @$remcmd, @$shcmd;
 908
 909             PVE::Tools::run_command($cmd);
 910         };
 911
 912         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
 913
 914         PVE::Tools::wait_for_vnc_port($port);
 915
 916         return {
 917             user => $authuser,
 918             ticket => $ticket,
 919             port => $port,
 920             upid => $upid,
 921         };
 922     }});
 923
 924 __PACKAGE__->register_method({
 925     name => 'vncwebsocket',
 926     path => '{vmid}/vncwebsocket',
 927     method => 'GET',
 928     permissions => {
 929         description => "You also need to pass a valid ticket (vncticket).",
 930         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 931     },
 932     description => "Opens a weksocket for VNC traffic.",
 933     parameters => {
 934         additionalProperties => 0,
 935         properties => {
 936             node => get_standard_option('pve-node'),
 937             vmid => get_standard_option('pve-vmid'),
 938             vncticket => {
 939                 description => "Ticket from previous call to vncproxy.",
 940                 type => 'string',
 941                 maxLength => 512,
 942             },
 943             port => {
 944                 description => "Port number returned by previous vncproxy call.",
 945                 type => 'integer',
 946                 minimum => 5900,
 947                 maximum => 5999,
 948             },
 949         },
 950     },
 951     returns => {
 952         type => "object",
 953         properties => {
 954             port => { type => 'string' },
 955         },
 956     },
 957     code => sub {
 958         my ($param) = @_;
 959
 960         my $rpcenv = PVE::RPCEnvironment::get();
 961
 962         my $authuser = $rpcenv->get_user();
 963
 964         my $authpath = "/vms/$param->{vmid}";
 965
 966         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
 967
 968         my $port = $param->{port};
 969
 970         return { port => $port };
 971     }});
 972
 973 __PACKAGE__->register_method ({
 974     name => 'spiceproxy',
 975     path => '{vmid}/spiceproxy',
 976     method => 'POST',
 977     protected => 1,
 978     proxyto => 'node',
 979     permissions => {
 980         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 981     },
 982     description => "Returns a SPICE configuration to connect to the CT.",
 983     parameters => {
 984         additionalProperties => 0,
 985         properties => {
 986             node => get_standard_option('pve-node'),
 987             vmid => get_standard_option('pve-vmid'),
 988             proxy => get_standard_option('spice-proxy', { optional => 1 }),
 989         },
 990     },
 991     returns => get_standard_option('remote-viewer-config'),
 992     code => sub {
 993         my ($param) = @_;
 994
 995         my $vmid = $param->{vmid};
 996         my $node = $param->{node};
 997         my $proxy = $param->{proxy};
 998
 999         my $authpath = "/vms/$vmid";
1000         my $permissions = 'VM.Console';
1001
1002         my $conf = PVE::LXC::Config->load_config($vmid);
1003
1004         die "CT $vmid not running\n" if !PVE::LXC::check_running($vmid);
1005
1006         my $concmd = PVE::LXC::get_console_command($vmid, $conf);
1007
1008         my $shcmd = ['/usr/bin/dtach', '-A',
1009                      "/var/run/dtach/vzctlconsole$vmid",
1010                      '-r', 'winch', '-z', @$concmd];
1011
1012         my $title = "CT $vmid";
1013
1014         return PVE::API2Tools::run_spiceterm($authpath, $permissions, $vmid, $node, $proxy, $title, $shcmd);
1015     }});
1016
1017
1018 __PACKAGE__->register_method({
1019     name => 'migrate_vm',
1020     path => '{vmid}/migrate',
1021     method => 'POST',
1022     protected => 1,
1023     proxyto => 'node',
1024     description => "Migrate the container to another node. Creates a new migration task.",
1025     permissions => {
1026         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
1027     },
1028     parameters => {
1029         additionalProperties => 0,
1030         properties => {
1031             node => get_standard_option('pve-node'),
1032             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1033             target => get_standard_option('pve-node', {
1034                 description => "Target node.",
1035                 completion => \&PVE::Cluster::complete_migration_target,
1036             }),
1037             online => {
1038                 type => 'boolean',
1039                 description => "Use online/live migration.",
1040                 optional => 1,
1041             },
1042             restart => {
1043                 type => 'boolean',
1044                 description => "Use restart migration",
1045                 optional => 1,
1046             },
1047             timeout => {
1048                 type => 'integer',
1049                 description => "Timeout in seconds for shutdown for restart migration",
1050                 optional => 1,
1051                 default => 180,
1052             },
1053             force => {
1054                 type => 'boolean',
1055                 description => "Force migration despite local bind / device" .
1056                     " mounts. NOTE: deprecated, use 'shared' property of mount point instead.",
1057                 optional => 1,
1058             },
1059             bwlimit => {
1060                 description => "Override I/O bandwidth limit (in KiB/s).",
1061                 optional => 1,
1062                 type => 'number',
1063                 minimum => '0',
1064                 default => 'migrate limit from datacenter or storage config',
1065             },
1066         },
1067     },
1068     returns => {
1069         type => 'string',
1070         description => "the task ID.",
1071     },
1072     code => sub {
1073         my ($param) = @_;
1074
1075         my $rpcenv = PVE::RPCEnvironment::get();
1076
1077         my $authuser = $rpcenv->get_user();
1078
1079         my $target = extract_param($param, 'target');
1080
1081         my $localnode = PVE::INotify::nodename();
1082         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1083
1084         PVE::Cluster::check_cfs_quorum();
1085
1086         PVE::Cluster::check_node_exists($target);
1087
1088         my $targetip = PVE::Cluster::remote_node_ip($target);
1089
1090         my $vmid = extract_param($param, 'vmid');
1091
1092         # test if VM exists
1093         PVE::LXC::Config->load_config($vmid);
1094
1095         # try to detect errors early
1096         if (PVE::LXC::check_running($vmid)) {
1097             die "can't migrate running container without --online or --restart\n"
1098                 if !$param->{online} && !$param->{restart};
1099         }
1100
1101         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1102
1103             my $hacmd = sub {
1104                 my $upid = shift;
1105
1106                 my $service = "ct:$vmid";
1107
1108                 my $cmd = ['ha-manager', 'migrate', $service, $target];
1109
1110                 print "Requesting HA migration for CT $vmid to node $target\n";
1111
1112                 PVE::Tools::run_command($cmd);
1113
1114                 return;
1115             };
1116
1117             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1118
1119         } else {
1120
1121             my $realcmd = sub {
1122                 PVE::LXC::Migrate->migrate($target, $targetip, $vmid, $param);
1123             };
1124
1125             my $worker = sub {
1126                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
1127             };
1128
1129             return $rpcenv->fork_worker('vzmigrate', $vmid, $authuser, $worker);
1130         }
1131     }});
1132
1133 __PACKAGE__->register_method({
1134     name => 'vm_feature',
1135     path => '{vmid}/feature',
1136     method => 'GET',
1137     proxyto => 'node',
1138     protected => 1,
1139     description => "Check if feature for virtual machine is available.",
1140     permissions => {
1141         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1142     },
1143     parameters => {
1144         additionalProperties => 0,
1145         properties => {
1146             node => get_standard_option('pve-node'),
1147             vmid => get_standard_option('pve-vmid'),
1148             feature => {
1149                 description => "Feature to check.",
1150                 type => 'string',
1151                 enum => [ 'snapshot', 'clone', 'copy' ],
1152             },
1153             snapname => get_standard_option('pve-snapshot-name', {
1154                 optional => 1,
1155             }),
1156         },
1157     },
1158     returns => {
1159         type => "object",
1160         properties => {
1161             hasFeature => { type => 'boolean' },
1162             #nodes => {
1163                 #type => 'array',
1164                 #items => { type => 'string' },
1165             #}
1166         },
1167     },
1168     code => sub {
1169         my ($param) = @_;
1170
1171         my $node = extract_param($param, 'node');
1172
1173         my $vmid = extract_param($param, 'vmid');
1174
1175         my $snapname = extract_param($param, 'snapname');
1176
1177         my $feature = extract_param($param, 'feature');
1178
1179         my $conf = PVE::LXC::Config->load_config($vmid);
1180
1181         if($snapname){
1182             my $snap = $conf->{snapshots}->{$snapname};
1183             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1184             $conf = $snap;
1185         }
1186         my $storage_cfg = PVE::Storage::config();
1187         #Maybe include later
1188         #my $nodelist = PVE::LXC::shared_nodes($conf, $storage_cfg);
1189         my $hasFeature = PVE::LXC::Config->has_feature($feature, $conf, $storage_cfg, $snapname);
1190
1191         return {
1192             hasFeature => $hasFeature,
1193             #nodes => [ keys %$nodelist ],
1194         };
1195     }});
1196
1197 __PACKAGE__->register_method({
1198     name => 'template',
1199     path => '{vmid}/template',
1200     method => 'POST',
1201     protected => 1,
1202     proxyto => 'node',
1203     description => "Create a Template.",
1204     permissions => {
1205         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
1206         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1207     },
1208     parameters => {
1209         additionalProperties => 0,
1210         properties => {
1211             node => get_standard_option('pve-node'),
1212             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid_stopped }),
1213         },
1214     },
1215     returns => { type => 'null'},
1216     code => sub {
1217         my ($param) = @_;
1218
1219         my $rpcenv = PVE::RPCEnvironment::get();
1220
1221         my $authuser = $rpcenv->get_user();
1222
1223         my $node = extract_param($param, 'node');
1224
1225         my $vmid = extract_param($param, 'vmid');
1226
1227         my $updatefn =  sub {
1228
1229             my $conf = PVE::LXC::Config->load_config($vmid);
1230             PVE::LXC::Config->check_lock($conf);
1231
1232             die "unable to create template, because CT contains snapshots\n"
1233                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
1234
1235             die "you can't convert a template to a template\n"
1236                 if PVE::LXC::Config->is_template($conf);
1237
1238             die "you can't convert a CT to template if the CT is running\n"
1239                 if PVE::LXC::check_running($vmid);
1240
1241             if (my $err = check_storage_supports_templates($conf)) {
1242                 die $err;
1243             }
1244
1245             my $realcmd = sub {
1246                 PVE::LXC::template_create($vmid, $conf);
1247
1248                 $conf->{template} = 1;
1249
1250                 PVE::LXC::Config->write_config($vmid, $conf);
1251                 # and remove lxc config
1252                 PVE::LXC::update_lxc_config($vmid, $conf);
1253             };
1254
1255             return $rpcenv->fork_worker('vztemplate', $vmid, $authuser, $realcmd);
1256         };
1257
1258         PVE::LXC::Config->lock_config($vmid, $updatefn);
1259
1260         return undef;
1261     }});
1262
1263 __PACKAGE__->register_method({
1264     name => 'clone_vm',
1265     path => '{vmid}/clone',
1266     method => 'POST',
1267     protected => 1,
1268     proxyto => 'node',
1269     description => "Create a container clone/copy",
1270     permissions => {
1271         description => "You need 'VM.Clone' permissions on /vms/{vmid}, " .
1272             "and 'VM.Allocate' permissions " .
1273             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
1274             "'Datastore.AllocateSpace' on any used storage.",
1275         check =>
1276         [ 'and',
1277           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
1278           [ 'or',
1279             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
1280             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
1281           ],
1282         ]
1283     },
1284     parameters => {
1285         additionalProperties => 0,
1286         properties => {
1287             node => get_standard_option('pve-node'),
1288             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1289             newid => get_standard_option('pve-vmid', {
1290                 completion => \&PVE::Cluster::complete_next_vmid,
1291                 description => 'VMID for the clone.' }),
1292             hostname => {
1293                 optional => 1,
1294                 type => 'string', format => 'dns-name',
1295                 description => "Set a hostname for the new CT.",
1296             },
1297             description => {
1298                 optional => 1,
1299                 type => 'string',
1300                 description => "Description for the new CT.",
1301             },
1302             pool => {
1303                 optional => 1,
1304                 type => 'string', format => 'pve-poolid',
1305                 description => "Add the new CT to the specified pool.",
1306             },
1307             snapname => get_standard_option('pve-snapshot-name', {
1308                 optional => 1,
1309             }),
1310             storage => get_standard_option('pve-storage-id', {
1311                 description => "Target storage for full clone.",
1312                 optional => 1,
1313             }),
1314             full => {
1315                 optional => 1,
1316                 type => 'boolean',
1317                 description => "Create a full copy of all disks. This is always done when " .
1318                     "you clone a normal CT. For CT templates, we try to create a linked clone by default.",
1319             },
1320             target => get_standard_option('pve-node', {
1321                 description => "Target node. Only allowed if the original VM is on shared storage.",
1322                 optional => 1,
1323             }),
1324             bwlimit => {
1325                 description => "Override I/O bandwidth limit (in KiB/s).",
1326                 optional => 1,
1327                 type => 'number',
1328                 minimum => '0',
1329                 default => 'clone limit from datacenter or storage config',
1330             },
1331         },
1332     },
1333     returns => {
1334         type => 'string',
1335     },
1336     code => sub {
1337         my ($param) = @_;
1338
1339         my $rpcenv = PVE::RPCEnvironment::get();
1340
1341         my $authuser = $rpcenv->get_user();
1342
1343         my $node = extract_param($param, 'node');
1344
1345         my $vmid = extract_param($param, 'vmid');
1346
1347         my $newid = extract_param($param, 'newid');
1348
1349         my $pool = extract_param($param, 'pool');
1350
1351         if (defined($pool)) {
1352             $rpcenv->check_pool_exist($pool);
1353         }
1354
1355         my $snapname = extract_param($param, 'snapname');
1356
1357         my $storage = extract_param($param, 'storage');
1358
1359         my $target = extract_param($param, 'target');
1360
1361         my $localnode = PVE::INotify::nodename();
1362
1363         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
1364
1365         PVE::Cluster::check_node_exists($target) if $target;
1366
1367         my $storecfg = PVE::Storage::config();
1368
1369         if ($storage) {
1370             # check if storage is enabled on local node
1371             PVE::Storage::storage_check_enabled($storecfg, $storage);
1372             if ($target) {
1373                 # check if storage is available on target node
1374                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
1375                 # clone only works if target storage is shared
1376                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
1377                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
1378             }
1379         }
1380
1381         PVE::Cluster::check_cfs_quorum();
1382
1383         my $conffile;
1384         my $newconf = {};
1385         my $mountpoints = {};
1386         my $fullclone = {};
1387         my $vollist = [];
1388         my $running;
1389
1390         PVE::LXC::Config->lock_config($vmid, sub {
1391             my $src_conf = PVE::LXC::Config->set_lock($vmid, 'disk');
1392
1393             $running = PVE::LXC::check_running($vmid) || 0;
1394
1395             my $full = extract_param($param, 'full');
1396             if (!defined($full)) {
1397                 $full = !PVE::LXC::Config->is_template($src_conf);
1398             }
1399             die "parameter 'storage' not allowed for linked clones\n" if defined($storage) && !$full;
1400
1401             eval {
1402                 die "snapshot '$snapname' does not exist\n"
1403                     if $snapname && !defined($src_conf->{snapshots}->{$snapname});
1404
1405
1406                 my $src_conf = $snapname ? $src_conf->{snapshots}->{$snapname} : $src_conf;
1407
1408                 $conffile = PVE::LXC::Config->config_file($newid);
1409                 die "unable to create CT $newid: config file already exists\n"
1410                     if -f $conffile;
1411
1412                 my $sharedvm = 1;
1413                 foreach my $opt (keys %$src_conf) {
1414                     next if $opt =~ m/^unused\d+$/;
1415
1416                     my $value = $src_conf->{$opt};
1417
1418                     if (($opt eq 'rootfs') || ($opt =~ m/^mp\d+$/)) {
1419                         my $mp = $opt eq 'rootfs' ?
1420                             PVE::LXC::Config->parse_ct_rootfs($value) :
1421                             PVE::LXC::Config->parse_ct_mountpoint($value);
1422
1423                         if ($mp->{type} eq 'volume') {
1424                             my $volid = $mp->{volume};
1425
1426                             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
1427                             $sid = $storage if defined($storage);
1428                             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
1429                             if (!$scfg->{shared}) {
1430                                 $sharedvm = 0;
1431                                 warn "found non-shared volume: $volid\n" if $target;
1432                             }
1433
1434                             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1435
1436                             if ($full) {
1437                                 die "Cannot do full clones on a running container without snapshots\n"
1438                                     if $running && !defined($snapname);
1439                                 $fullclone->{$opt} = 1;
1440                             } else {
1441                                 # not full means clone instead of copy
1442                                 die "Linked clone feature for '$volid' is not available\n"
1443                                     if !PVE::Storage::volume_has_feature($storecfg, 'clone', $volid, $snapname, $running, {'valid_target_formats' => ['raw', 'subvol']});
1444                             }
1445
1446                             $mountpoints->{$opt} = $mp;
1447                             push @$vollist, $volid;
1448
1449                         } else {
1450                             # TODO: allow bind mounts?
1451                             die "unable to clone mountpint '$opt' (type $mp->{type})\n";
1452                         }
1453                     } elsif ($opt =~ m/^net(\d+)$/) {
1454                         # always change MAC! address
1455                         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1456                         my $net = PVE::LXC::Config->parse_lxc_network($value);
1457                         $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1458                         $newconf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1459                     } else {
1460                         # copy everything else
1461                         $newconf->{$opt} = $value;
1462                     }
1463                 }
1464                 die "can't clone CT to node '$target' (CT uses local storage)\n"
1465                     if $target && !$sharedvm;
1466
1467                 # Replace the 'disk' lock with a 'create' lock.
1468                 $newconf->{lock} = 'create';
1469
1470                 delete $newconf->{pending};
1471                 delete $newconf->{template};
1472                 if ($param->{hostname}) {
1473                     $newconf->{hostname} = $param->{hostname};
1474                 }
1475
1476                 if ($param->{description}) {
1477                     $newconf->{description} = $param->{description};
1478                 }
1479
1480                 # create empty/temp config - this fails if CT already exists on other node
1481                 PVE::LXC::Config->write_config($newid, $newconf);
1482             };
1483             if (my $err = $@) {
1484                 eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1485                 warn $@ if $@;
1486                 die $err;
1487             }
1488         });
1489
1490         my $update_conf = sub {
1491             my ($key, $value) = @_;
1492             return PVE::LXC::Config->lock_config($newid, sub {
1493                 my $conf = PVE::LXC::Config->load_config($newid);
1494                 die "Lost 'create' config lock, aborting.\n"
1495                     if !PVE::LXC::Config->has_lock($conf, 'create');
1496                 $conf->{$key} = $value;
1497                 PVE::LXC::Config->write_config($newid, $conf);
1498             });
1499         };
1500
1501         my $realcmd = sub {
1502             my ($upid) = @_;
1503
1504             my $newvollist = [];
1505
1506             my $verify_running = PVE::LXC::check_running($vmid) || 0;
1507             die "unexpected state change\n" if $verify_running != $running;
1508
1509             eval {
1510                 local $SIG{INT} =
1511                     local $SIG{TERM} =
1512                     local $SIG{QUIT} =
1513                     local $SIG{HUP} = sub { die "interrupted by signal\n"; };
1514
1515                 PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
1516                 my $bwlimit = extract_param($param, 'bwlimit');
1517
1518                 foreach my $opt (keys %$mountpoints) {
1519                     my $mp = $mountpoints->{$opt};
1520                     my $volid = $mp->{volume};
1521
1522                     my $newvolid;
1523                     if ($fullclone->{$opt}) {
1524                         print "create full clone of mountpoint $opt ($volid)\n";
1525                         my $source_storage = PVE::Storage::parse_volume_id($volid);
1526                         my $target_storage = $storage // $source_storage;
1527                         my $clonelimit = PVE::Storage::get_bandwidth_limit('clone', [$source_storage, $target_storage], $bwlimit);
1528                         $newvolid = PVE::LXC::copy_volume($mp, $newid, $target_storage, $storecfg, $newconf, $snapname, $clonelimit);
1529                     } else {
1530                         print "create linked clone of mount point $opt ($volid)\n";
1531                         $newvolid = PVE::Storage::vdisk_clone($storecfg, $volid, $newid, $snapname);
1532                     }
1533
1534                     push @$newvollist, $newvolid;
1535                     $mp->{volume} = $newvolid;
1536
1537                     $update_conf->($opt, PVE::LXC::Config->print_ct_mountpoint($mp, $opt eq 'rootfs'));
1538                 }
1539
1540                 PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
1541                 PVE::LXC::Config->remove_lock($newid, 'create');
1542
1543                 if ($target) {
1544                     # always deactivate volumes - avoid lvm LVs to be active on several nodes
1545                     PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
1546                     PVE::Storage::deactivate_volumes($storecfg, $newvollist);
1547
1548                     my $newconffile = PVE::LXC::Config->config_file($newid, $target);
1549                     die "Failed to move config to node '$target' - rename failed: $!\n"
1550                         if !rename($conffile, $newconffile);
1551                 }
1552             };
1553             my $err = $@;
1554
1555             # Unlock the source config in any case:
1556             eval { PVE::LXC::Config->remove_lock($vmid, 'disk') };
1557             warn $@ if $@;
1558
1559             if ($err) {
1560                 # Now cleanup the config & disks:
1561                 unlink $conffile;
1562
1563                 sleep 1; # some storages like rbd need to wait before release volume - really?
1564
1565                 foreach my $volid (@$newvollist) {
1566                     eval { PVE::Storage::vdisk_free($storecfg, $volid); };
1567                     warn $@ if $@;
1568                 }
1569                 die "clone failed: $err";
1570             }
1571
1572             return;
1573         };
1574
1575         PVE::Firewall::clone_vmfw_conf($vmid, $newid);
1576         return $rpcenv->fork_worker('vzclone', $vmid, $authuser, $realcmd);
1577     }});
1578
1579
1580 __PACKAGE__->register_method({
1581     name => 'resize_vm',
1582     path => '{vmid}/resize',
1583     method => 'PUT',
1584     protected => 1,
1585     proxyto => 'node',
1586     description => "Resize a container mount point.",
1587     permissions => {
1588         check => ['perm', '/vms/{vmid}', ['VM.Config.Disk'], any => 1],
1589     },
1590     parameters => {
1591         additionalProperties => 0,
1592         properties => {
1593             node => get_standard_option('pve-node'),
1594             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1595             disk => {
1596                 type => 'string',
1597                 description => "The disk you want to resize.",
1598                 enum => [PVE::LXC::Config->mountpoint_names()],
1599             },
1600             size => {
1601                 type => 'string',
1602                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1603                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1604             },
1605             digest => {
1606                 type => 'string',
1607                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1608                 maxLength => 40,
1609                 optional => 1,
1610             }
1611         },
1612     },
1613     returns => {
1614         type => 'string',
1615         description => "the task ID.",
1616     },
1617     code => sub {
1618         my ($param) = @_;
1619
1620         my $rpcenv = PVE::RPCEnvironment::get();
1621
1622         my $authuser = $rpcenv->get_user();
1623
1624         my $node = extract_param($param, 'node');
1625
1626         my $vmid = extract_param($param, 'vmid');
1627
1628         my $digest = extract_param($param, 'digest');
1629
1630         my $sizestr = extract_param($param, 'size');
1631         my $ext = ($sizestr =~ s/^\+//);
1632         my $newsize = PVE::JSONSchema::parse_size($sizestr);
1633         die "invalid size string" if !defined($newsize);
1634
1635         die "no options specified\n" if !scalar(keys %$param);
1636
1637         PVE::LXC::check_ct_modify_config_perm($rpcenv, $authuser, $vmid, undef, $param, []);
1638
1639         my $storage_cfg = cfs_read_file("storage.cfg");
1640
1641         my $code = sub {
1642
1643             my $conf = PVE::LXC::Config->load_config($vmid);
1644             PVE::LXC::Config->check_lock($conf);
1645
1646             PVE::Tools::assert_if_modified($digest, $conf->{digest});
1647
1648             my $running = PVE::LXC::check_running($vmid);
1649
1650             my $disk = $param->{disk};
1651             my $mp = $disk eq 'rootfs' ? PVE::LXC::Config->parse_ct_rootfs($conf->{$disk}) :
1652                 PVE::LXC::Config->parse_ct_mountpoint($conf->{$disk});
1653
1654             my $volid = $mp->{volume};
1655
1656             my (undef, undef, $owner, undef, undef, undef, $format) =
1657                 PVE::Storage::parse_volname($storage_cfg, $volid);
1658
1659             die "can't resize mount point owned by another container ($owner)"
1660                 if $vmid != $owner;
1661
1662             die "can't resize volume: $disk if snapshot exists\n"
1663                 if %{$conf->{snapshots}} && $format eq 'qcow2';
1664
1665             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1666
1667             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1668
1669             PVE::Storage::activate_volumes($storage_cfg, [$volid]);
1670
1671             my $size = PVE::Storage::volume_size_info($storage_cfg, $volid, 5);
1672
1673             die "Could not determine current size of volume '$volid'\n" if !defined($size);
1674
1675             $newsize += $size if $ext;
1676             $newsize = int($newsize);
1677
1678             die "unable to shrink disk size\n" if $newsize < $size;
1679
1680             return if $size == $newsize;
1681
1682             PVE::Cluster::log_msg('info', $authuser, "update CT $vmid: resize --disk $disk --size $sizestr");
1683             my $realcmd = sub {
1684                 # Note: PVE::Storage::volume_resize doesn't do anything if $running=1, so
1685                 # we pass 0 here (parameter only makes sense for qemu)
1686                 PVE::Storage::volume_resize($storage_cfg, $volid, $newsize, 0);
1687
1688                 $mp->{size} = $newsize;
1689                 $conf->{$disk} = PVE::LXC::Config->print_ct_mountpoint($mp, $disk eq 'rootfs');
1690
1691                 PVE::LXC::Config->write_config($vmid, $conf);
1692
1693                 if ($format eq 'raw') {
1694                     # we need to ensure that the volume is mapped, if not needed this is a NOP
1695                     my $path = PVE::Storage::map_volume($storage_cfg, $volid);
1696                     $path = PVE::Storage::path($storage_cfg, $volid) if !defined($path);
1697                     if ($running) {
1698
1699                         $mp->{mp} = '/';
1700                         my $use_loopdev = (PVE::LXC::mountpoint_mount_path($mp, $storage_cfg))[1];
1701                         $path = PVE::LXC::query_loopdev($path) if $use_loopdev;
1702                         die "internal error: CT running but mount point not attached to a loop device"
1703                             if !$path;
1704                         PVE::Tools::run_command(['losetup', '--set-capacity', $path]) if $use_loopdev;
1705
1706                         # In order for resize2fs to know that we need online-resizing a mountpoint needs
1707                         # to be visible to it in its namespace.
1708                         # To not interfere with the rest of the system we unshare the current mount namespace,
1709                         # mount over /tmp and then run resize2fs.
1710
1711                         # interestingly we don't need to e2fsck on mounted systems...
1712                         my $quoted = PVE::Tools::shellquote($path);
1713                         my $cmd = "mount --make-rprivate / && mount $quoted /tmp && resize2fs $quoted";
1714                         eval {
1715                             PVE::Tools::run_command(['unshare', '-m', '--', 'sh', '-c', $cmd]);
1716                         };
1717                         warn "Failed to update the container's filesystem: $@\n" if $@;
1718                     } else {
1719                         eval {
1720                             PVE::Tools::run_command(['e2fsck', '-f', '-y', $path]);
1721                             PVE::Tools::run_command(['resize2fs', $path]);
1722                         };
1723                         warn "Failed to update the container's filesystem: $@\n" if $@;
1724
1725                         # always un-map if not running, this is a NOP if not needed
1726                         PVE::Storage::unmap_volume($storage_cfg, $volid);
1727                     }
1728                 }
1729             };
1730
1731             return $rpcenv->fork_worker('resize', $vmid, $authuser, $realcmd);
1732         };
1733
1734         return PVE::LXC::Config->lock_config($vmid, $code);;
1735     }});
1736
1737 __PACKAGE__->register_method({
1738     name => 'move_volume',
1739     path => '{vmid}/move_volume',
1740     method => 'POST',
1741     protected => 1,
1742     proxyto => 'node',
1743     description => "Move a rootfs-/mp-volume to a different storage",
1744     permissions => {
1745         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
1746             "and 'Datastore.AllocateSpace' permissions on the storage.",
1747         check =>
1748         [ 'and',
1749           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1750           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
1751         ],
1752     },
1753     parameters => {
1754         additionalProperties => 0,
1755         properties => {
1756             node => get_standard_option('pve-node'),
1757             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1758             volume => {
1759                 type => 'string',
1760                 enum => [ PVE::LXC::Config->mountpoint_names() ],
1761                 description => "Volume which will be moved.",
1762             },
1763             storage => get_standard_option('pve-storage-id', {
1764                 description => "Target Storage.",
1765                 completion => \&PVE::Storage::complete_storage_enabled,
1766             }),
1767             delete => {
1768                 type => 'boolean',
1769                 description => "Delete the original volume after successful copy. By default the original is kept as an unused volume entry.",
1770                 optional => 1,
1771                 default => 0,
1772             },
1773             digest => {
1774                 type => 'string',
1775                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1776                 maxLength => 40,
1777                 optional => 1,
1778             },
1779             bwlimit => {
1780                 description => "Override I/O bandwidth limit (in KiB/s).",
1781                 optional => 1,
1782                 type => 'number',
1783                 minimum => '0',
1784                 default => 'clone limit from datacenter or storage config',
1785             },
1786         },
1787     },
1788     returns => {
1789         type => 'string',
1790     },
1791     code => sub {
1792         my ($param) = @_;
1793
1794         my $rpcenv = PVE::RPCEnvironment::get();
1795
1796         my $authuser = $rpcenv->get_user();
1797
1798         my $vmid = extract_param($param, 'vmid');
1799
1800         my $storage = extract_param($param, 'storage');
1801
1802         my $mpkey = extract_param($param, 'volume');
1803
1804         my $lockname = 'disk';
1805
1806         my ($mpdata, $old_volid);
1807
1808         PVE::LXC::Config->lock_config($vmid, sub {
1809             my $conf = PVE::LXC::Config->load_config($vmid);
1810             PVE::LXC::Config->check_lock($conf);
1811
1812             die "cannot move volumes of a running container\n" if PVE::LXC::check_running($vmid);
1813
1814             if ($mpkey eq 'rootfs') {
1815                 $mpdata = PVE::LXC::Config->parse_ct_rootfs($conf->{$mpkey});
1816             } elsif ($mpkey =~ m/mp\d+/) {
1817                 $mpdata = PVE::LXC::Config->parse_ct_mountpoint($conf->{$mpkey});
1818             } else {
1819                 die "Can't parse $mpkey\n";
1820             }
1821             $old_volid = $mpdata->{volume};
1822
1823             die "you can't move a volume with snapshots and delete the source\n"
1824                 if $param->{delete} && PVE::LXC::Config->is_volume_in_use_by_snapshots($conf, $old_volid);
1825
1826             PVE::Tools::assert_if_modified($param->{digest}, $conf->{digest});
1827
1828             PVE::LXC::Config->set_lock($vmid, $lockname);
1829         });
1830
1831         my $realcmd = sub {
1832             eval {
1833                 PVE::Cluster::log_msg('info', $authuser, "move volume CT $vmid: move --volume $mpkey --storage $storage");
1834
1835                 my $conf = PVE::LXC::Config->load_config($vmid);
1836                 my $storage_cfg = PVE::Storage::config();
1837
1838                 my $new_volid;
1839
1840                 eval {
1841                     PVE::Storage::activate_volumes($storage_cfg, [ $old_volid ]);
1842                     my $bwlimit = extract_param($param, 'bwlimit');
1843                     my $source_storage = PVE::Storage::parse_volume_id($old_volid);
1844                     my $movelimit = PVE::Storage::get_bandwidth_limit('move', [$source_storage, $storage], $bwlimit);
1845                     $new_volid = PVE::LXC::copy_volume($mpdata, $vmid, $storage, $storage_cfg, $conf, undef, $movelimit);
1846                     $mpdata->{volume} = $new_volid;
1847
1848                     PVE::LXC::Config->lock_config($vmid, sub {
1849                         my $digest = $conf->{digest};
1850                         $conf = PVE::LXC::Config->load_config($vmid);
1851                         PVE::Tools::assert_if_modified($digest, $conf->{digest});
1852
1853                         $conf->{$mpkey} = PVE::LXC::Config->print_ct_mountpoint($mpdata, $mpkey eq 'rootfs');
1854
1855                         PVE::LXC::Config->add_unused_volume($conf, $old_volid) if !$param->{delete};
1856
1857                         PVE::LXC::Config->write_config($vmid, $conf);
1858                     });
1859
1860                     eval {
1861                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
1862                         PVE::Storage::deactivate_volumes($storage_cfg, [ $new_volid ])
1863                     };
1864                     warn $@ if $@;
1865                 };
1866                 if (my $err = $@) {
1867                     eval {
1868                         PVE::Storage::vdisk_free($storage_cfg, $new_volid)
1869                             if defined($new_volid);
1870                     };
1871                     warn $@ if $@;
1872                     die $err;
1873                 }
1874
1875                 if ($param->{delete}) {
1876                     eval {
1877                         PVE::Storage::deactivate_volumes($storage_cfg, [ $old_volid ]);
1878                         PVE::Storage::vdisk_free($storage_cfg, $old_volid);
1879                     };
1880                     warn $@ if $@;
1881                 }
1882             };
1883             my $err = $@;
1884             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1885             warn $@ if $@;
1886             die $err if $err;
1887         };
1888         my $task = eval {
1889             $rpcenv->fork_worker('move_volume', $vmid, $authuser, $realcmd);
1890         };
1891         if (my $err = $@) {
1892             eval { PVE::LXC::Config->remove_lock($vmid, $lockname) };
1893             warn $@ if $@;
1894             die $err;
1895         }
1896         return $task;
1897   }});
1898
1899 __PACKAGE__->register_method({
1900     name => 'vm_pending',
1901     path => '{vmid}/pending',
1902     method => 'GET',
1903     proxyto => 'node',
1904     description => 'Get container configuration, including pending changes.',
1905     permissions => {
1906         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1907     },
1908     parameters => {
1909         additionalProperties => 0,
1910         properties => {
1911             node => get_standard_option('pve-node'),
1912             vmid => get_standard_option('pve-vmid', { completion => \&PVE::LXC::complete_ctid }),
1913         },
1914     },
1915     returns => {
1916         type => "array",
1917         items => {
1918             type => "object",
1919             properties => {
1920                 key => {
1921                     description => 'Configuration option name.',
1922                     type => 'string',
1923                 },
1924                 value => {
1925                     description => 'Current value.',
1926                     type => 'string',
1927                     optional => 1,
1928                 },
1929                 pending => {
1930                     description => 'Pending value.',
1931                     type => 'string',
1932                     optional => 1,
1933                 },
1934                 delete => {
1935                     description => "Indicates a pending delete request if present and not 0.",
1936                     type => 'integer',
1937                     minimum => 0,
1938                     maximum => 2,
1939                     optional => 1,
1940                 },
1941             },
1942         },
1943     },
1944     code => sub {
1945         my ($param) = @_;
1946
1947         my $conf = PVE::LXC::Config->load_config($param->{vmid});
1948
1949         my $pending_delete_hash = PVE::LXC::Config->parse_pending_delete($conf->{pending}->{delete});
1950
1951         return PVE::GuestHelpers::config_with_pending_array($conf, $pending_delete_hash);
1952     }});
1953
1954 1;