src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::DataCenterConfig;
   9 use PVE::GuestHelpers;
  10 use PVE::INotify;
  11 use PVE::JSONSchema qw(get_standard_option);
  12 use PVE::Tools;
  13
  14 use base qw(PVE::AbstractConfig);
  15
  16 my $nodename = PVE::INotify::nodename();
  17 my $lock_handles =  {};
  18 my $lockdir = "/run/lock/lxc";
  19 mkdir $lockdir;
  20 mkdir "/etc/pve/nodes/$nodename/lxc";
  21 my $MAX_MOUNT_POINTS = 256;
  22 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  23
  24 # BEGIN implemented abstract methods from PVE::AbstractConfig
  25
  26 sub guest_type {
  27     return "CT";
  28 }
  29
  30 sub __config_max_unused_disks {
  31     my ($class) = @_;
  32
  33     return $MAX_UNUSED_DISKS;
  34 }
  35
  36 sub config_file_lock {
  37     my ($class, $vmid) = @_;
  38
  39     return "$lockdir/pve-config-${vmid}.lock";
  40 }
  41
  42 sub cfs_config_path {
  43     my ($class, $vmid, $node) = @_;
  44
  45     $node = $nodename if !$node;
  46     return "nodes/$node/lxc/$vmid.conf";
  47 }
  48
  49 sub mountpoint_backup_enabled {
  50     my ($class, $mp_key, $mountpoint) = @_;
  51
  52     return 1 if $mp_key eq 'rootfs';
  53
  54     return 0 if $mountpoint->{type} ne 'volume';
  55
  56     return 1 if $mountpoint->{backup};
  57
  58     return 0;
  59 }
  60
  61 sub has_feature {
  62     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  63     my $err;
  64
  65     $class->foreach_mountpoint($conf, sub {
  66         my ($ms, $mountpoint) = @_;
  67
  68         return if $err; # skip further test
  69         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  70
  71         $err = 1
  72             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  73                                                  $mountpoint->{volume},
  74                                                  $snapname, $running);
  75     });
  76
  77     return $err ? 0 : 1;
  78 }
  79
  80 sub __snapshot_save_vmstate {
  81     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  82     die "implement me - snapshot_save_vmstate\n";
  83 }
  84
  85 sub __snapshot_check_running {
  86     my ($class, $vmid) = @_;
  87     return PVE::LXC::check_running($vmid);
  88 }
  89
  90 sub __snapshot_check_freeze_needed {
  91     my ($class, $vmid, $config, $save_vmstate) = @_;
  92
  93     my $ret = $class->__snapshot_check_running($vmid);
  94     return ($ret, $ret);
  95 }
  96
  97 sub __snapshot_freeze {
  98     my ($class, $vmid, $unfreeze) = @_;
  99
 100     if ($unfreeze) {
 101         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 102         warn $@ if $@;
 103     } else {
 104         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 105         PVE::LXC::sync_container_namespace($vmid);
 106     }
 107 }
 108
 109 sub __snapshot_create_vol_snapshot {
 110     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 111
 112     my $storecfg = PVE::Storage::config();
 113
 114     return if $snapname eq 'vzdump' &&
 115         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 116
 117     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 118 }
 119
 120 sub __snapshot_delete_remove_drive {
 121     my ($class, $snap, $remove_drive) = @_;
 122
 123     if ($remove_drive eq 'vmstate') {
 124         die "implement me - saving vmstate\n";
 125     } else {
 126         my $value = $snap->{$remove_drive};
 127         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 128         delete $snap->{$remove_drive};
 129
 130         $class->add_unused_volume($snap, $mountpoint->{volume})
 131             if ($mountpoint->{type} eq 'volume');
 132     }
 133 }
 134
 135 sub __snapshot_delete_vmstate_file {
 136     my ($class, $snap, $force) = @_;
 137
 138     die "implement me - saving vmstate\n";
 139 }
 140
 141 sub __snapshot_delete_vol_snapshot {
 142     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 143
 144     return if $snapname eq 'vzdump' &&
 145         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 146
 147     my $storecfg = PVE::Storage::config();
 148     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 149     push @$unused, $mountpoint->{volume};
 150 }
 151
 152 sub __snapshot_rollback_vol_possible {
 153     my ($class, $mountpoint, $snapname) = @_;
 154
 155     my $storecfg = PVE::Storage::config();
 156     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 157 }
 158
 159 sub __snapshot_rollback_vol_rollback {
 160     my ($class, $mountpoint, $snapname) = @_;
 161
 162     my $storecfg = PVE::Storage::config();
 163     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 164 }
 165
 166 sub __snapshot_rollback_vm_stop {
 167     my ($class, $vmid) = @_;
 168
 169     PVE::LXC::vm_stop($vmid, 1)
 170         if $class->__snapshot_check_running($vmid);
 171 }
 172
 173 sub __snapshot_rollback_vm_start {
 174     my ($class, $vmid, $vmstate, $data);
 175
 176     die "implement me - save vmstate\n";
 177 }
 178
 179 sub __snapshot_rollback_get_unused {
 180     my ($class, $conf, $snap) = @_;
 181
 182     my $unused = [];
 183
 184     $class->__snapshot_foreach_volume($conf, sub {
 185         my ($vs, $volume) = @_;
 186
 187         return if $volume->{type} ne 'volume';
 188
 189         my $found = 0;
 190         my $volid = $volume->{volume};
 191
 192         $class->__snapshot_foreach_volume($snap, sub {
 193             my ($ms, $mountpoint) = @_;
 194
 195             return if $found;
 196             return if ($mountpoint->{type} ne 'volume');
 197
 198             $found = 1
 199                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 200         });
 201
 202         push @$unused, $volid if !$found;
 203     });
 204
 205     return $unused;
 206 }
 207
 208 sub __snapshot_foreach_volume {
 209     my ($class, $conf, $func) = @_;
 210
 211     $class->foreach_mountpoint($conf, $func);
 212 }
 213
 214 # END implemented abstract methods from PVE::AbstractConfig
 215
 216 # BEGIN JSON config code
 217
 218 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 219
 220
 221 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 222
 223 sub is_valid_mount_option {
 224     my ($option) = @_;
 225     return $option =~ $valid_mount_option_re;
 226 }
 227
 228 my $rootfs_desc = {
 229     volume => {
 230         type => 'string',
 231         default_key => 1,
 232         format => 'pve-lxc-mp-string',
 233         format_description => 'volume',
 234         description => 'Volume, device or directory to mount into the container.',
 235     },
 236     size => {
 237         type => 'string',
 238         format => 'disk-size',
 239         format_description => 'DiskSize',
 240         description => 'Volume size (read only value).',
 241         optional => 1,
 242     },
 243     acl => {
 244         type => 'boolean',
 245         description => 'Explicitly enable or disable ACL support.',
 246         optional => 1,
 247     },
 248     mountoptions => {
 249         optional => 1,
 250         type => 'string',
 251         description => 'Extra mount options for rootfs/mps.',
 252         format_description => 'opt[;opt...]',
 253         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 254     },
 255     ro => {
 256         type => 'boolean',
 257         description => 'Read-only mount point',
 258         optional => 1,
 259     },
 260     quota => {
 261         type => 'boolean',
 262         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 263         optional => 1,
 264     },
 265     replicate => {
 266         type => 'boolean',
 267         description => 'Will include this volume to a storage replica job.',
 268         optional => 1,
 269         default => 1,
 270     },
 271     shared => {
 272         type => 'boolean',
 273         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 274         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 275         optional => 1,
 276         default => 0,
 277     },
 278 };
 279
 280 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 281     type => 'string', format => $rootfs_desc,
 282     description => "Use volume as container root.",
 283     optional => 1,
 284 });
 285
 286 my $features_desc = {
 287     mount => {
 288         optional => 1,
 289         type => 'string',
 290         description => "Allow mounting file systems of specific types."
 291             ." This should be a list of file system types as used with the mount command."
 292             ." Note that this can have negative effects on the container's security."
 293             ." With access to a loop device, mounting a file can circumvent the mknod"
 294             ." permission of the devices cgroup, mounting an NFS file system can"
 295             ." block the host's I/O completely and prevent it from rebooting, etc.",
 296         format_description => 'fstype;fstype;...',
 297         pattern => qr/[a-zA-Z0-9_; ]+/,
 298     },
 299     nesting => {
 300         optional => 1,
 301         type => 'boolean',
 302         default => 0,
 303         description => "Allow nesting."
 304             ." Best used with unprivileged containers with additional id mapping."
 305             ." Note that this will expose procfs and sysfs contents of the host"
 306             ." to the guest.",
 307     },
 308     keyctl => {
 309         optional => 1,
 310         type => 'boolean',
 311         default => 0,
 312         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 313             ." This is required to use docker inside a container."
 314             ." By default unprivileged containers will see this system call as non-existent."
 315             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 316             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 317             ." Essentially, you can choose between running systemd-networkd or docker.",
 318     },
 319     fuse => {
 320         optional => 1,
 321         type => 'boolean',
 322         default => 0,
 323         description => "Allow using 'fuse' file systems in a container."
 324             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 325     },
 326     mknod => {
 327         optional => 1,
 328         type => 'boolean',
 329         default => 0,
 330         description => "Allow unprivileged containers to use mknod() to add certain device nodes."
 331             ." This requires a kernel with seccomp trap to user space support (5.3 or newer)."
 332             ." This is experimental.",
 333     },
 334     force_rw_sys => {
 335         optional => 1,
 336         type => 'boolean',
 337         default => 0,
 338         description => "Mount /sys in unprivileged containers as `rw` instead of `mixed`."
 339             ." This can break networking under newer (>= v245) systemd-network use."
 340     },
 341 };
 342
 343 my $confdesc = {
 344     lock => {
 345         optional => 1,
 346         type => 'string',
 347         description => "Lock/unlock the VM.",
 348         enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 349     },
 350     onboot => {
 351         optional => 1,
 352         type => 'boolean',
 353         description => "Specifies whether a VM will be started during system bootup.",
 354         default => 0,
 355     },
 356     startup => get_standard_option('pve-startup-order'),
 357     template => {
 358         optional => 1,
 359         type => 'boolean',
 360         description => "Enable/disable Template.",
 361         default => 0,
 362     },
 363     arch => {
 364         optional => 1,
 365         type => 'string',
 366         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 367         description => "OS architecture type.",
 368         default => 'amd64',
 369     },
 370     ostype => {
 371         optional => 1,
 372         type => 'string',
 373         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 374         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 375     },
 376     console => {
 377         optional => 1,
 378         type => 'boolean',
 379         description => "Attach a console device (/dev/console) to the container.",
 380         default => 1,
 381     },
 382     tty => {
 383         optional => 1,
 384         type => 'integer',
 385         description => "Specify the number of tty available to the container",
 386         minimum => 0,
 387         maximum => 6,
 388         default => 2,
 389     },
 390     cores => {
 391         optional => 1,
 392         type => 'integer',
 393         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 394         minimum => 1,
 395         maximum => 128,
 396     },
 397     cpulimit => {
 398         optional => 1,
 399         type => 'number',
 400         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 401         minimum => 0,
 402         maximum => 128,
 403         default => 0,
 404     },
 405     cpuunits => {
 406         optional => 1,
 407         type => 'integer',
 408         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 409         minimum => 0,
 410         maximum => 500000,
 411         default => 1024,
 412     },
 413     memory => {
 414         optional => 1,
 415         type => 'integer',
 416         description => "Amount of RAM for the VM in MB.",
 417         minimum => 16,
 418         default => 512,
 419     },
 420     swap => {
 421         optional => 1,
 422         type => 'integer',
 423         description => "Amount of SWAP for the VM in MB.",
 424         minimum => 0,
 425         default => 512,
 426     },
 427     hostname => {
 428         optional => 1,
 429         description => "Set a host name for the container.",
 430         type => 'string', format => 'dns-name',
 431         maxLength => 255,
 432     },
 433     description => {
 434         optional => 1,
 435         type => 'string',
 436         description => "Container description. Only used on the configuration web interface.",
 437     },
 438     searchdomain => {
 439         optional => 1,
 440         type => 'string', format => 'dns-name-list',
 441         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 442     },
 443     nameserver => {
 444         optional => 1,
 445         type => 'string', format => 'address-list',
 446         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 447     },
 448     rootfs => get_standard_option('pve-ct-rootfs'),
 449     parent => {
 450         optional => 1,
 451         type => 'string', format => 'pve-configid',
 452         maxLength => 40,
 453         description => "Parent snapshot name. This is used internally, and should not be modified.",
 454     },
 455     snaptime => {
 456         optional => 1,
 457         description => "Timestamp for snapshots.",
 458         type => 'integer',
 459         minimum => 0,
 460     },
 461     cmode => {
 462         optional => 1,
 463         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 464         type => 'string',
 465         enum => ['shell', 'console', 'tty'],
 466         default => 'tty',
 467     },
 468     protection => {
 469         optional => 1,
 470         type => 'boolean',
 471         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 472         default => 0,
 473     },
 474     unprivileged => {
 475         optional => 1,
 476         type => 'boolean',
 477         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 478         default => 0,
 479     },
 480     features => {
 481         optional => 1,
 482         type => 'string',
 483         format => $features_desc,
 484         description => "Allow containers access to advanced features.",
 485     },
 486     hookscript => {
 487         optional => 1,
 488         type => 'string',
 489         format => 'pve-volume-id',
 490         description => 'Script that will be exectued during various steps in the containers lifetime.',
 491     },
 492     tags => {
 493         type => 'string', format => 'pve-tag-list',
 494         description => 'Tags of the Container. This is only meta information.',
 495         optional => 1,
 496     },
 497 };
 498
 499 my $valid_lxc_conf_keys = {
 500     'lxc.apparmor.profile' => 1,
 501     'lxc.apparmor.allow_incomplete' => 1,
 502     'lxc.apparmor.allow_nesting' => 1,
 503     'lxc.apparmor.raw' => 1,
 504     'lxc.selinux.context' => 1,
 505     'lxc.include' => 1,
 506     'lxc.arch' => 1,
 507     'lxc.uts.name' => 1,
 508     'lxc.signal.halt' => 1,
 509     'lxc.signal.reboot' => 1,
 510     'lxc.signal.stop' => 1,
 511     'lxc.init.cmd' => 1,
 512     'lxc.pty.max' => 1,
 513     'lxc.console.logfile' => 1,
 514     'lxc.console.path' => 1,
 515     'lxc.tty.max' => 1,
 516     'lxc.devtty.dir' => 1,
 517     'lxc.hook.autodev' => 1,
 518     'lxc.autodev' => 1,
 519     'lxc.kmsg' => 1,
 520     'lxc.mount.fstab' => 1,
 521     'lxc.mount.entry' => 1,
 522     'lxc.mount.auto' => 1,
 523     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 524     'lxc.rootfs.mount' => 1,
 525     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 526                             ', please use mount point options in the "rootfs" key',
 527     # lxc.cgroup.*
 528     # lxc.prlimit.*
 529     # lxc.net.*
 530     'lxc.cap.drop' => 1,
 531     'lxc.cap.keep' => 1,
 532     'lxc.seccomp.profile' => 1,
 533     'lxc.seccomp.notify.proxy' => 1,
 534     'lxc.seccomp.notify.cookie' => 1,
 535     'lxc.idmap' => 1,
 536     'lxc.hook.pre-start' => 1,
 537     'lxc.hook.pre-mount' => 1,
 538     'lxc.hook.mount' => 1,
 539     'lxc.hook.start' => 1,
 540     'lxc.hook.stop' => 1,
 541     'lxc.hook.post-stop' => 1,
 542     'lxc.hook.clone' => 1,
 543     'lxc.hook.destroy' => 1,
 544     'lxc.hook.version' => 1,
 545     'lxc.log.level' => 1,
 546     'lxc.log.file' => 1,
 547     'lxc.start.auto' => 1,
 548     'lxc.start.delay' => 1,
 549     'lxc.start.order' => 1,
 550     'lxc.group' => 1,
 551     'lxc.environment' => 1,
 552
 553     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 554     'lxc.sysctl.fs.mqueue' => 1,
 555     'lxc.sysctl.kernel.msgmax' => 1,
 556     'lxc.sysctl.kernel.msgmnb' => 1,
 557     'lxc.sysctl.kernel.msgmni' => 1,
 558     'lxc.sysctl.kernel.sem' => 1,
 559     'lxc.sysctl.kernel.shmall' => 1,
 560     'lxc.sysctl.kernel.shmmax' => 1,
 561     'lxc.sysctl.kernel.shmmni' => 1,
 562     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 563 };
 564
 565 my $deprecated_lxc_conf_keys = {
 566     # Deprecated (removed with lxc 3.0):
 567     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 568     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 569     'lxc.console'              => 'lxc.console.path',
 570     'lxc.devttydir'            => 'lxc.tty.dir',
 571     'lxc.haltsignal'           => 'lxc.signal.halt',
 572     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 573     'lxc.stopsignal'           => 'lxc.signal.stop',
 574     'lxc.id_map'               => 'lxc.idmap',
 575     'lxc.init_cmd'             => 'lxc.init.cmd',
 576     'lxc.loglevel'             => 'lxc.log.level',
 577     'lxc.logfile'              => 'lxc.log.file',
 578     'lxc.mount'                => 'lxc.mount.fstab',
 579     'lxc.network.type'         => 'lxc.net.INDEX.type',
 580     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 581     'lxc.network.link'         => 'lxc.net.INDEX.link',
 582     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 583     'lxc.network.name'         => 'lxc.net.INDEX.name',
 584     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 585     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 586     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 587     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 588     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 589     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 590     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 591     'lxc.pts'                  => 'lxc.pty.max',
 592     'lxc.se_context'           => 'lxc.selinux.context',
 593     'lxc.seccomp'              => 'lxc.seccomp.profile',
 594     'lxc.tty'                  => 'lxc.tty.max',
 595     'lxc.utsname'              => 'lxc.uts.name',
 596 };
 597
 598 sub is_valid_lxc_conf_key {
 599     my ($vmid, $key) = @_;
 600     if ($key =~ /^lxc\.limit\./) {
 601         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 602         return 1;
 603     }
 604     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 605         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 606         return 1;
 607     }
 608     my $validity = $valid_lxc_conf_keys->{$key};
 609     return $validity if defined($validity);
 610     return 1 if $key =~ /^lxc\.cgroup\./  # allow all cgroup values
 611              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 612              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 613     return 0;
 614 }
 615
 616 our $netconf_desc = {
 617     type => {
 618         type => 'string',
 619         optional => 1,
 620         description => "Network interface type.",
 621         enum => [qw(veth)],
 622     },
 623     name => {
 624         type => 'string',
 625         format_description => 'string',
 626         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 627         pattern => '[-_.\w\d]+',
 628     },
 629     bridge => {
 630         type => 'string',
 631         format_description => 'bridge',
 632         description => 'Bridge to attach the network device to.',
 633         pattern => '[-_.\w\d]+',
 634         optional => 1,
 635     },
 636     hwaddr => get_standard_option('mac-addr', {
 637         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 638         }),
 639     mtu => {
 640         type => 'integer',
 641         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 642         minimum => 64, # minimum ethernet frame is 64 bytes
 643         optional => 1,
 644     },
 645     ip => {
 646         type => 'string',
 647         format => 'pve-ipv4-config',
 648         format_description => '(IPv4/CIDR|dhcp|manual)',
 649         description => 'IPv4 address in CIDR format.',
 650         optional => 1,
 651     },
 652     gw => {
 653         type => 'string',
 654         format => 'ipv4',
 655         format_description => 'GatewayIPv4',
 656         description => 'Default gateway for IPv4 traffic.',
 657         optional => 1,
 658     },
 659     ip6 => {
 660         type => 'string',
 661         format => 'pve-ipv6-config',
 662         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 663         description => 'IPv6 address in CIDR format.',
 664         optional => 1,
 665     },
 666     gw6 => {
 667         type => 'string',
 668         format => 'ipv6',
 669         format_description => 'GatewayIPv6',
 670         description => 'Default gateway for IPv6 traffic.',
 671         optional => 1,
 672     },
 673     firewall => {
 674         type => 'boolean',
 675         description => "Controls whether this interface's firewall rules should be used.",
 676         optional => 1,
 677     },
 678     tag => {
 679         type => 'integer',
 680         minimum => 1,
 681         maximum => 4094,
 682         description => "VLAN tag for this interface.",
 683         optional => 1,
 684     },
 685     trunks => {
 686         type => 'string',
 687         pattern => qr/\d+(?:;\d+)*/,
 688         format_description => 'vlanid[;vlanid...]',
 689         description => "VLAN ids to pass through the interface",
 690         optional => 1,
 691     },
 692     rate => {
 693         type => 'number',
 694         format_description => 'mbps',
 695         description => "Apply rate limiting to the interface",
 696         optional => 1,
 697     },
 698 };
 699 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 700
 701 my $MAX_LXC_NETWORKS = 10;
 702 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 703     $confdesc->{"net$i"} = {
 704         optional => 1,
 705         type => 'string', format => $netconf_desc,
 706         description => "Specifies network interfaces for the container.",
 707     };
 708 }
 709
 710 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 711 sub verify_lxc_mp_string {
 712     my ($mp, $noerr) = @_;
 713
 714     # do not allow:
 715     # /./ or /../
 716     # /. or /.. at the end
 717     # ../ at the beginning
 718
 719     if($mp =~ m@/\.\.?/@ ||
 720        $mp =~ m@/\.\.?$@ ||
 721        $mp =~ m@^\.\./@) {
 722         return undef if $noerr;
 723         die "$mp contains illegal character sequences\n";
 724     }
 725     return $mp;
 726 }
 727
 728 my $mp_desc = {
 729     %$rootfs_desc,
 730     backup => {
 731         type => 'boolean',
 732         description => 'Whether to include the mount point in backups.',
 733         verbose_description => 'Whether to include the mount point in backups '.
 734                                '(only used for volume mount points).',
 735         optional => 1,
 736     },
 737     mp => {
 738         type => 'string',
 739         format => 'pve-lxc-mp-string',
 740         format_description => 'Path',
 741         description => 'Path to the mount point as seen from inside the container '.
 742                        '(must not contain symlinks).',
 743         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 744                                "NOTE: Must not contain any symlinks for security reasons."
 745     },
 746 };
 747 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 748
 749 my $unuseddesc = {
 750     optional => 1,
 751     type => 'string', format => 'pve-volume-id',
 752     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 753 };
 754
 755 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 756     $confdesc->{"mp$i"} = {
 757         optional => 1,
 758         type => 'string', format => $mp_desc,
 759         description => "Use volume as container mount point.",
 760         optional => 1,
 761     };
 762 }
 763
 764 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 765     $confdesc->{"unused$i"} = $unuseddesc;
 766 }
 767
 768 sub parse_pct_config {
 769     my ($filename, $raw) = @_;
 770
 771     return undef if !defined($raw);
 772
 773     my $res = {
 774         digest => Digest::SHA::sha1_hex($raw),
 775         snapshots => {},
 776         pending => {},
 777     };
 778
 779     $filename =~ m|/lxc/(\d+).conf$|
 780         || die "got strange filename '$filename'";
 781
 782     my $vmid = $1;
 783
 784     my $conf = $res;
 785     my $descr = '';
 786     my $section = '';
 787
 788     my @lines = split(/\n/, $raw);
 789     foreach my $line (@lines) {
 790         next if $line =~ m/^\s*$/;
 791
 792         if ($line =~ m/^\[pve:pending\]\s*$/i) {
 793             $section = 'pending';
 794             $conf->{description} = $descr if $descr;
 795             $descr = '';
 796             $conf = $res->{$section} = {};
 797             next;
 798         } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 799             $section = $1;
 800             $conf->{description} = $descr if $descr;
 801             $descr = '';
 802             $conf = $res->{snapshots}->{$section} = {};
 803             next;
 804         }
 805
 806         if ($line =~ m/^\#(.*)\s*$/) {
 807             $descr .= PVE::Tools::decode_text($1) . "\n";
 808             next;
 809         }
 810
 811         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 812             my $key = $1;
 813             my $value = $3;
 814             my $validity = is_valid_lxc_conf_key($vmid, $key);
 815             if ($validity eq 1) {
 816                 push @{$conf->{lxc}}, [$key, $value];
 817             } elsif (my $errmsg = $validity) {
 818                 warn "vm $vmid - $key: $errmsg\n";
 819             } else {
 820                 warn "vm $vmid - unable to parse config: $line\n";
 821             }
 822         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 823             $descr .= PVE::Tools::decode_text($2);
 824         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 825             $conf->{snapstate} = $1;
 826         } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
 827             my $value = $1;
 828             if ($section eq 'pending') {
 829                 $conf->{delete} = $value;
 830             } else {
 831                 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
 832             }
 833         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 834             my $key = $1;
 835             my $value = $2;
 836             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 837             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 838             $conf->{$key} = $value;
 839         } else {
 840             warn "vm $vmid - unable to parse config: $line\n";
 841         }
 842     }
 843
 844     $conf->{description} = $descr if $descr;
 845
 846     delete $res->{snapstate}; # just to be sure
 847
 848     return $res;
 849 }
 850
 851 sub write_pct_config {
 852     my ($filename, $conf) = @_;
 853
 854     delete $conf->{snapstate}; # just to be sure
 855
 856     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 857     my $used_volids = {};
 858     foreach my $vid (@$volidlist) {
 859         $used_volids->{$vid} = 1;
 860     }
 861
 862     # remove 'unusedX' settings if the volume is still used
 863     foreach my $key (keys %$conf) {
 864         my $value = $conf->{$key};
 865         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 866             delete $conf->{$key};
 867         }
 868     }
 869
 870     my $generate_raw_config = sub {
 871         my ($conf) = @_;
 872
 873         my $raw = '';
 874
 875         # add description as comment to top of file
 876         my $descr = $conf->{description} || '';
 877         foreach my $cl (split(/\n/, $descr)) {
 878             $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
 879         }
 880
 881         foreach my $key (sort keys %$conf) {
 882             next if $key eq 'digest' || $key eq 'description' ||
 883                     $key eq 'pending' || $key eq 'snapshots' ||
 884                     $key eq 'snapname' || $key eq 'lxc';
 885             my $value = $conf->{$key};
 886             die "detected invalid newline inside property '$key'\n"
 887                 if $value =~ m/\n/;
 888             $raw .= "$key: $value\n";
 889         }
 890
 891         if (my $lxcconf = $conf->{lxc}) {
 892             foreach my $entry (@$lxcconf) {
 893                 my ($k, $v) = @$entry;
 894                 $raw .= "$k: $v\n";
 895             }
 896         }
 897
 898         return $raw;
 899     };
 900
 901     my $raw = &$generate_raw_config($conf);
 902
 903     if (scalar(keys %{$conf->{pending}})){
 904         $raw .= "\n[pve:pending]\n";
 905         $raw .= &$generate_raw_config($conf->{pending});
 906     }
 907
 908     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 909         $raw .= "\n[$snapname]\n";
 910         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 911     }
 912
 913     return $raw;
 914 }
 915
 916 sub update_pct_config {
 917     my ($class, $vmid, $conf, $running, $param, $delete, $revert) = @_;
 918
 919     my $storage_cfg = PVE::Storage::config();
 920
 921     foreach my $opt (@$revert) {
 922         delete $conf->{pending}->{$opt};
 923         $class->remove_from_pending_delete($conf, $opt); # also remove from deletion queue
 924     }
 925
 926     # write updates to pending section
 927     my $modified = {}; # record modified options
 928
 929     foreach my $opt (@$delete) {
 930         if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
 931             warn "cannot delete '$opt' - not set in current configuration!\n";
 932             next;
 933         }
 934         $modified->{$opt} = 1;
 935         if ($opt eq 'memory' || $opt eq 'rootfs' || $opt eq 'ostype') {
 936             die "unable to delete required option '$opt'\n";
 937         } elsif ($opt =~ m/^unused(\d+)$/) {
 938             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 939         } elsif ($opt =~ m/^mp(\d+)$/) {
 940             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 941         } elsif ($opt eq 'unprivileged') {
 942             die "unable to delete read-only option: '$opt'\n";
 943         }
 944         $class->add_to_pending_delete($conf, $opt);
 945     }
 946
 947     my $check_content_type = sub {
 948         my ($mp) = @_;
 949         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 950         my $storage_config = PVE::Storage::storage_config($storage_cfg, $sid);
 951         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 952             if !$storage_config->{content}->{rootdir};
 953     };
 954
 955     foreach my $opt (sort keys %$param) { # add/change
 956         $modified->{$opt} = 1;
 957         my $value = $param->{$opt};
 958         if ($opt =~ m/^mp(\d+)$/ || $opt eq 'rootfs') {
 959             $class->check_protection($conf, "can't update CT $vmid drive '$opt'");
 960             my $mp = $opt eq 'rootfs' ? $class->parse_ct_rootfs($value) : $class->parse_ct_mountpoint($value);
 961             $check_content_type->($mp) if ($mp->{type} eq 'volume');
 962         } elsif ($opt eq 'hookscript') {
 963             PVE::GuestHelpers::check_hookscript($value);
 964         } elsif ($opt eq 'nameserver') {
 965             $value = PVE::LXC::verify_nameserver_list($value);
 966         } elsif ($opt eq 'searchdomain') {
 967             $value = PVE::LXC::verify_searchdomain_list($value);
 968         } elsif ($opt eq 'unprivileged') {
 969             die "unable to modify read-only option: '$opt'\n";
 970         }
 971         $conf->{pending}->{$opt} = $value;
 972         $class->remove_from_pending_delete($conf, $opt);
 973     }
 974
 975     my $changes = $class->cleanup_pending($conf);
 976
 977     my $errors = {};
 978     if ($running) {
 979         $class->vmconfig_hotplug_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 980     } else {
 981         $class->vmconfig_apply_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 982     }
 983
 984     return $errors;
 985 }
 986
 987 sub check_type {
 988     my ($class, $key, $value) = @_;
 989
 990     die "unknown setting '$key'\n" if !$confdesc->{$key};
 991
 992     my $type = $confdesc->{$key}->{type};
 993
 994     if (!defined($value)) {
 995         die "got undefined value\n";
 996     }
 997
 998     if ($value =~ m/[\n\r]/) {
 999         die "property contains a line feed\n";
1000     }
1001
1002     if ($type eq 'boolean') {
1003         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1004         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1005         die "type check ('boolean') failed - got '$value'\n";
1006     } elsif ($type eq 'integer') {
1007         return int($1) if $value =~ m/^(\d+)$/;
1008         die "type check ('integer') failed - got '$value'\n";
1009     } elsif ($type eq 'number') {
1010         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1011         die "type check ('number') failed - got '$value'\n";
1012     } elsif ($type eq 'string') {
1013         if (my $fmt = $confdesc->{$key}->{format}) {
1014             PVE::JSONSchema::check_format($fmt, $value);
1015             return $value;
1016         }
1017         return $value;
1018     } else {
1019         die "internal error"
1020     }
1021 }
1022
1023
1024 # add JSON properties for create and set function
1025 sub json_config_properties {
1026     my ($class, $prop) = @_;
1027
1028     foreach my $opt (keys %$confdesc) {
1029         next if $opt eq 'parent' || $opt eq 'snaptime';
1030         next if $prop->{$opt};
1031         $prop->{$opt} = $confdesc->{$opt};
1032     }
1033
1034     return $prop;
1035 }
1036
1037 sub __parse_ct_mountpoint_full {
1038     my ($class, $desc, $data, $noerr) = @_;
1039
1040     $data //= '';
1041
1042     my $res;
1043     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1044     if ($@) {
1045         return undef if $noerr;
1046         die $@;
1047     }
1048
1049     if (defined(my $size = $res->{size})) {
1050         $size = PVE::JSONSchema::parse_size($size);
1051         if (!defined($size)) {
1052             return undef if $noerr;
1053             die "invalid size: $size\n";
1054         }
1055         $res->{size} = $size;
1056     }
1057
1058     $res->{type} = $class->classify_mountpoint($res->{volume});
1059
1060     return $res;
1061 };
1062
1063 sub parse_ct_rootfs {
1064     my ($class, $data, $noerr) = @_;
1065
1066     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1067
1068     $res->{mp} = '/' if defined($res);
1069
1070     return $res;
1071 }
1072
1073 sub parse_ct_mountpoint {
1074     my ($class, $data, $noerr) = @_;
1075
1076     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1077 }
1078
1079 sub print_ct_mountpoint {
1080     my ($class, $info, $nomp) = @_;
1081     my $skip = [ 'type' ];
1082     push @$skip, 'mp' if $nomp;
1083     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1084 }
1085
1086 sub print_lxc_network {
1087     my ($class, $net) = @_;
1088     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1089 }
1090
1091 sub parse_lxc_network {
1092     my ($class, $data) = @_;
1093
1094     my $res = {};
1095
1096     return $res if !$data;
1097
1098     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1099
1100     $res->{type} = 'veth';
1101     if (!$res->{hwaddr}) {
1102         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1103         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1104     }
1105
1106     return $res;
1107 }
1108
1109 sub parse_features {
1110     my ($class, $data) = @_;
1111     return {} if !$data;
1112     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1113 }
1114
1115 sub option_exists {
1116     my ($class, $name) = @_;
1117
1118     return defined($confdesc->{$name});
1119 }
1120 # END JSON config code
1121
1122 my $LXC_FASTPLUG_OPTIONS= {
1123     'description' => 1,
1124     'onboot' => 1,
1125     'startup' => 1,
1126     'protection' => 1,
1127     'hostname' => 1,
1128     'hookscript' => 1,
1129     'cores' => 1,
1130     'tags' => 1,
1131     'lock' => 1,
1132 };
1133
1134 sub vmconfig_hotplug_pending {
1135     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1136
1137     my $pid = PVE::LXC::find_lxc_pid($vmid);
1138     my $rootdir = "/proc/$pid/root";
1139
1140     my $add_hotplug_error = sub {
1141         my ($opt, $msg) = @_;
1142         $errors->{$opt} = "unable to hotplug $opt: $msg";
1143     };
1144
1145     my $changes;
1146     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1147         next if $selection && !$selection->{$opt};
1148         if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1149             $conf->{$opt} = delete $conf->{pending}->{$opt};
1150             $changes = 1;
1151         }
1152     }
1153
1154     if ($changes) {
1155         $class->write_config($vmid, $conf);
1156     }
1157
1158     # There's no separate swap size to configure, there's memory and "total"
1159     # memory (iow. memory+swap). This means we have to change them together.
1160     my $hotplug_memory_done;
1161     my $hotplug_memory = sub {
1162         my ($wanted_memory, $wanted_swap) = @_;
1163         my $old_memory = ($conf->{memory} || $confdesc->{memory}->{default});
1164         my $old_swap = ($conf->{swap} || $confdesc->{swap}->{default});
1165
1166         $wanted_memory //= $old_memory;
1167         $wanted_swap //= $old_swap;
1168
1169         my $total = $wanted_memory + $wanted_swap;
1170         my $old_total = $old_memory + $old_swap;
1171
1172         if ($total > $old_total) {
1173             PVE::LXC::write_cgroup_value("memory", $vmid,
1174                                          "memory.memsw.limit_in_bytes",
1175                                          int($total*1024*1024));
1176             PVE::LXC::write_cgroup_value("memory", $vmid,
1177                                          "memory.limit_in_bytes",
1178                                          int($wanted_memory*1024*1024));
1179         } else {
1180             PVE::LXC::write_cgroup_value("memory", $vmid,
1181                                          "memory.limit_in_bytes",
1182                                          int($wanted_memory*1024*1024));
1183             PVE::LXC::write_cgroup_value("memory", $vmid,
1184                                          "memory.memsw.limit_in_bytes",
1185                                          int($total*1024*1024));
1186         }
1187         $hotplug_memory_done = 1;
1188     };
1189
1190     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1191     # FIXME: $force deletion is not implemented for CTs
1192     foreach my $opt (sort keys %$pending_delete_hash) {
1193         next if $selection && !$selection->{$opt};
1194         eval {
1195             if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1196                 # pass
1197             } elsif ($opt =~ m/^unused(\d+)$/) {
1198                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1199                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1200             } elsif ($opt eq 'swap') {
1201                 $hotplug_memory->(undef, 0);
1202             } elsif ($opt eq 'cpulimit') {
1203                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", -1);
1204                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1205             } elsif ($opt eq 'cpuunits') {
1206                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
1207             } elsif ($opt =~ m/^net(\d)$/) {
1208                 my $netid = $1;
1209                 PVE::Network::veth_delete("veth${vmid}i$netid");
1210             } else {
1211                 die "skip\n"; # skip non-hotpluggable opts
1212             }
1213         };
1214         if (my $err = $@) {
1215             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1216         } else {
1217             delete $conf->{$opt};
1218             $class->remove_from_pending_delete($conf, $opt);
1219         }
1220     }
1221
1222     foreach my $opt (sort keys %{$conf->{pending}}) {
1223         next if $opt eq 'delete'; # just to be sure
1224         next if $selection && !$selection->{$opt};
1225         my $value = $conf->{pending}->{$opt};
1226         eval {
1227             if ($opt eq 'cpulimit') {
1228                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", 100000);
1229                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1230             } elsif ($opt eq 'cpuunits') {
1231                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1232             } elsif ($opt =~ m/^net(\d+)$/) {
1233                 my $netid = $1;
1234                 my $net = $class->parse_lxc_network($value);
1235                 $value = $class->print_lxc_network($net);
1236                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1237             } elsif ($opt eq 'memory' || $opt eq 'swap') {
1238                 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1239                     $hotplug_memory->($conf->{pending}->{memory}, $conf->{pending}->{swap});
1240                 }
1241             } elsif ($opt =~ m/^mp(\d+)$/) {
1242                 if (!PVE::LXC::Tools::can_use_new_mount_api()) {
1243                     die "skip\n";
1244                 }
1245
1246                 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 1);
1247                 # apply_pending_mountpoint modifies the value if it creates a new disk
1248                 $value = $conf->{pending}->{$opt};
1249             } else {
1250                 die "skip\n"; # skip non-hotpluggable
1251             }
1252         };
1253         if (my $err = $@) {
1254             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1255         } else {
1256             $conf->{$opt} = $value;
1257             delete $conf->{pending}->{$opt};
1258         }
1259     }
1260
1261     $class->write_config($vmid, $conf);
1262 }
1263
1264 sub vmconfig_apply_pending {
1265     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1266
1267     my $add_apply_error = sub {
1268         my ($opt, $msg) = @_;
1269         my $err_msg = "unable to apply pending change $opt : $msg";
1270         $errors->{$opt} = $err_msg;
1271         warn $err_msg;
1272     };
1273
1274     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1275     # FIXME: $force deletion is not implemented for CTs
1276     foreach my $opt (sort keys %$pending_delete_hash) {
1277         next if $selection && !$selection->{$opt};
1278         eval {
1279             if ($opt =~ m/^mp(\d+)$/) {
1280                 my $mp = $class->parse_ct_mountpoint($conf->{$opt});
1281                 if ($mp->{type} eq 'volume') {
1282                     $class->add_unused_volume($conf, $mp->{volume})
1283                         if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1284                 }
1285             } elsif ($opt =~ m/^unused(\d+)$/) {
1286                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1287                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1288             }
1289         };
1290         if (my $err = $@) {
1291             $add_apply_error->($opt, $err);
1292         } else {
1293             delete $conf->{$opt};
1294             $class->remove_from_pending_delete($conf, $opt);
1295         }
1296     }
1297
1298     $class->cleanup_pending($conf);
1299
1300     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1301         next if $opt eq 'delete'; # just to be sure
1302         next if $selection && !$selection->{$opt};
1303         eval {
1304             if ($opt =~ m/^mp(\d+)$/) {
1305                 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 0);
1306             } elsif ($opt =~ m/^net(\d+)$/) {
1307                 my $netid = $1;
1308                 my $net = $class->parse_lxc_network($conf->{pending}->{$opt});
1309                 $conf->{pending}->{$opt} = $class->print_lxc_network($net);
1310             }
1311         };
1312         if (my $err = $@) {
1313             $add_apply_error->($opt, $err);
1314         } else {
1315             $conf->{$opt} = delete $conf->{pending}->{$opt};
1316         }
1317     }
1318
1319     $class->write_config($vmid, $conf);
1320 }
1321
1322 my $rescan_volume = sub {
1323     my ($storecfg, $mp) = @_;
1324     eval {
1325         $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5);
1326     };
1327     warn "Could not rescan volume size - $@\n" if $@;
1328 };
1329
1330 sub apply_pending_mountpoint {
1331     my ($class, $vmid, $conf, $opt, $storecfg, $running) = @_;
1332
1333     my $mp = $class->parse_ct_mountpoint($conf->{pending}->{$opt});
1334     my $old = $conf->{$opt};
1335     if ($mp->{type} eq 'volume') {
1336         if ($mp->{volume} =~ $PVE::LXC::NEW_DISK_RE) {
1337             my $original_value = $conf->{pending}->{$opt};
1338             my $vollist = PVE::LXC::create_disks(
1339                 $storecfg,
1340                 $vmid,
1341                 { $opt => $original_value },
1342                 $conf,
1343                 1,
1344             );
1345             if ($running) {
1346                 # Re-parse mount point:
1347                 my $mp = $class->parse_ct_mountpoint($conf->{pending}->{$opt});
1348                 eval {
1349                     PVE::LXC::mountpoint_hotplug($vmid, $conf, $opt, $mp, $storecfg);
1350                 };
1351                 my $err = $@;
1352                 if ($err) {
1353                     PVE::LXC::destroy_disks($storecfg, $vollist);
1354                     # The pending-changes code collects errors but keeps on looping through further
1355                     # pending changes, so unroll the change in $conf as well if destroy_disks()
1356                     # didn't die().
1357                     $conf->{pending}->{$opt} = $original_value;
1358                     die $err;
1359                 }
1360             }
1361         } else {
1362             die "skip\n" if $running && defined($old); # TODO: "changing" mount points?
1363             $rescan_volume->($storecfg, $mp);
1364             if ($running) {
1365                 PVE::LXC::mountpoint_hotplug($vmid, $conf, $opt, $mp, $storecfg);
1366             }
1367             $conf->{pending}->{$opt} = $class->print_ct_mountpoint($mp);
1368         }
1369     }
1370
1371     if (defined($old)) {
1372         my $mp = $class->parse_ct_mountpoint($old);
1373         if ($mp->{type} eq 'volume') {
1374             $class->add_unused_volume($conf, $mp->{volume})
1375                 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1376         }
1377     }
1378 }
1379
1380 sub classify_mountpoint {
1381     my ($class, $vol) = @_;
1382     if ($vol =~ m!^/!) {
1383         return 'device' if $vol =~ m!^/dev/!;
1384         return 'bind';
1385     }
1386     return 'volume';
1387 }
1388
1389 my $__is_volume_in_use = sub {
1390     my ($class, $config, $volid) = @_;
1391     my $used = 0;
1392
1393     $class->foreach_mountpoint($config, sub {
1394         my ($ms, $mountpoint) = @_;
1395         return if $used;
1396         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1397     });
1398
1399     return $used;
1400 };
1401
1402 sub is_volume_in_use_by_snapshots {
1403     my ($class, $config, $volid) = @_;
1404
1405     if (my $snapshots = $config->{snapshots}) {
1406         foreach my $snap (keys %$snapshots) {
1407             return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1408         }
1409     }
1410
1411     return 0;
1412 }
1413
1414 sub is_volume_in_use {
1415     my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1416     return 1 if $__is_volume_in_use->($class, $config, $volid);
1417     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1418     return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending}, $volid);
1419     return 0;
1420 }
1421
1422 sub has_dev_console {
1423     my ($class, $conf) = @_;
1424
1425     return !(defined($conf->{console}) && !$conf->{console});
1426 }
1427
1428 sub has_lxc_entry {
1429     my ($class, $conf, $keyname) = @_;
1430
1431     if (my $lxcconf = $conf->{lxc}) {
1432         foreach my $entry (@$lxcconf) {
1433             my ($key, undef) = @$entry;
1434             return 1 if $key eq $keyname;
1435         }
1436     }
1437
1438     return 0;
1439 }
1440
1441 sub get_tty_count {
1442     my ($class, $conf) = @_;
1443
1444     return $conf->{tty} // $confdesc->{tty}->{default};
1445 }
1446
1447 sub get_cmode {
1448     my ($class, $conf) = @_;
1449
1450     return $conf->{cmode} // $confdesc->{cmode}->{default};
1451 }
1452
1453 sub mountpoint_names {
1454     my ($class, $reverse) = @_;
1455
1456     my @names = ('rootfs');
1457
1458     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1459         push @names, "mp$i";
1460     }
1461
1462     return $reverse ? reverse @names : @names;
1463 }
1464
1465 sub foreach_mountpoint_full {
1466     my ($class, $conf, $reverse, $func, @param) = @_;
1467
1468     my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1469     foreach my $key (@$mps) {
1470         my $value = $conf->{$key};
1471         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1472         next if !defined($mountpoint);
1473
1474         &$func($key, $mountpoint, @param);
1475     }
1476 }
1477
1478 sub foreach_mountpoint {
1479     my ($class, $conf, $func, @param) = @_;
1480
1481     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1482 }
1483
1484 sub foreach_mountpoint_reverse {
1485     my ($class, $conf, $func, @param) = @_;
1486
1487     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1488 }
1489
1490 sub get_vm_volumes {
1491     my ($class, $conf, $excludes) = @_;
1492
1493     my $vollist = [];
1494
1495     $class->foreach_mountpoint($conf, sub {
1496         my ($ms, $mountpoint) = @_;
1497
1498         return if $excludes && $ms eq $excludes;
1499
1500         my $volid = $mountpoint->{volume};
1501         return if !$volid || $mountpoint->{type} ne 'volume';
1502
1503         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1504         return if !$sid;
1505
1506         push @$vollist, $volid;
1507     });
1508
1509     return $vollist;
1510 }
1511
1512 sub get_replicatable_volumes {
1513     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1514
1515     my $volhash = {};
1516
1517     my $test_volid = sub {
1518         my ($volid, $mountpoint) = @_;
1519
1520         return if !$volid;
1521
1522         my $mptype = $mountpoint->{type};
1523         my $replicate = $mountpoint->{replicate} // 1;
1524
1525         if ($mptype ne 'volume') {
1526             # skip bindmounts if replicate = 0 even for cleanup,
1527             # since bind mounts could not have been replicated ever
1528             return if !$replicate;
1529             die "unable to replicate mountpoint type '$mptype'\n";
1530         }
1531
1532         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1533         return if !$storeid;
1534
1535         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1536         return if $scfg->{shared};
1537
1538         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1539         return if !$owner || ($owner != $vmid);
1540
1541         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1542
1543         return if !$cleanup && !$replicate;
1544
1545         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1546             return if $cleanup || $noerr;
1547             die "missing replicate feature on volume '$volid'\n";
1548         }
1549
1550         $volhash->{$volid} = 1;
1551     };
1552
1553     $class->foreach_mountpoint($conf, sub {
1554         my ($ms, $mountpoint) = @_;
1555         $test_volid->($mountpoint->{volume}, $mountpoint);
1556     });
1557
1558     foreach my $snapname (keys %{$conf->{snapshots}}) {
1559         my $snap = $conf->{snapshots}->{$snapname};
1560         $class->foreach_mountpoint($snap, sub {
1561             my ($ms, $mountpoint) = @_;
1562             $test_volid->($mountpoint->{volume}, $mountpoint);
1563         });
1564     }
1565
1566     # add 'unusedX' volumes to volhash
1567     foreach my $key (keys %$conf) {
1568         if ($key =~ m/^unused/) {
1569             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1570         }
1571     }
1572
1573     return $volhash;
1574 }
1575
1576 1;