1 package PVE
::LXC
::Config
;
6 use PVE
::AbstractConfig
;
7 use PVE
::Cluster
qw(cfs_register_file);
8 use PVE
::DataCenterConfig
;
11 use PVE
::JSONSchema
qw(get_standard_option);
14 use base
qw(PVE::AbstractConfig);
16 my $nodename = PVE
::INotify
::nodename
();
17 my $lock_handles = {};
18 my $lockdir = "/run/lock/lxc";
20 mkdir "/etc/pve/nodes/$nodename/lxc";
21 my $MAX_MOUNT_POINTS = 256;
22 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
24 # BEGIN implemented abstract methods from PVE::AbstractConfig
30 sub __config_max_unused_disks
{
33 return $MAX_UNUSED_DISKS;
36 sub config_file_lock
{
37 my ($class, $vmid) = @_;
39 return "$lockdir/pve-config-${vmid}.lock";
43 my ($class, $vmid, $node) = @_;
45 $node = $nodename if !$node;
46 return "nodes/$node/lxc/$vmid.conf";
49 sub mountpoint_backup_enabled
{
50 my ($class, $mp_key, $mountpoint) = @_;
52 return 1 if $mp_key eq 'rootfs';
54 return 0 if $mountpoint->{type
} ne 'volume';
56 return 1 if $mountpoint->{backup
};
62 my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
66 if ($feature eq 'copy' || $feature eq 'clone') {
67 $opts = {'valid_target_formats' => ['raw', 'subvol']};
70 $class->foreach_volume($conf, sub {
71 my ($ms, $mountpoint) = @_;
73 return if $err; # skip further test
74 return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
77 if !PVE
::Storage
::volume_has_feature
($storecfg, $feature,
78 $mountpoint->{volume
},
79 $snapname, $running, $opts);
85 sub __snapshot_save_vmstate
{
86 my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
87 die "implement me - snapshot_save_vmstate\n";
90 sub __snapshot_check_running
{
91 my ($class, $vmid) = @_;
92 return PVE
::LXC
::check_running
($vmid);
95 sub __snapshot_check_freeze_needed
{
96 my ($class, $vmid, $config, $save_vmstate) = @_;
98 my $ret = $class->__snapshot_check_running($vmid);
102 sub __snapshot_freeze
{
103 my ($class, $vmid, $unfreeze) = @_;
106 eval { PVE
::Tools
::run_command
(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
109 PVE
::Tools
::run_command
(['/usr/bin/lxc-freeze', '-n', $vmid]);
110 PVE
::LXC
::sync_container_namespace
($vmid);
114 sub __snapshot_create_vol_snapshot
{
115 my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
117 my $storecfg = PVE
::Storage
::config
();
119 return if $snapname eq 'vzdump' &&
120 !$class->mountpoint_backup_enabled($ms, $mountpoint);
122 PVE
::Storage
::volume_snapshot
($storecfg, $mountpoint->{volume
}, $snapname);
125 sub __snapshot_delete_remove_drive
{
126 my ($class, $snap, $remove_drive) = @_;
128 if ($remove_drive eq 'vmstate') {
129 die "implement me - saving vmstate\n";
131 my $value = $snap->{$remove_drive};
132 my $mountpoint = $class->parse_volume($remove_drive, $value, 1);
133 delete $snap->{$remove_drive};
135 $class->add_unused_volume($snap, $mountpoint->{volume
})
136 if ($mountpoint->{type
} eq 'volume');
140 sub __snapshot_delete_vmstate_file
{
141 my ($class, $snap, $force) = @_;
143 die "implement me - saving vmstate\n";
146 sub __snapshot_delete_vol_snapshot
{
147 my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
149 return if $snapname eq 'vzdump' &&
150 !$class->mountpoint_backup_enabled($ms, $mountpoint);
152 my $storecfg = PVE
::Storage
::config
();
153 PVE
::Storage
::volume_snapshot_delete
($storecfg, $mountpoint->{volume
}, $snapname);
154 push @$unused, $mountpoint->{volume
};
157 sub __snapshot_rollback_vol_possible
{
158 my ($class, $mountpoint, $snapname) = @_;
160 my $storecfg = PVE
::Storage
::config
();
161 PVE
::Storage
::volume_rollback_is_possible
($storecfg, $mountpoint->{volume
}, $snapname);
164 sub __snapshot_rollback_vol_rollback
{
165 my ($class, $mountpoint, $snapname) = @_;
167 my $storecfg = PVE
::Storage
::config
();
168 PVE
::Storage
::volume_snapshot_rollback
($storecfg, $mountpoint->{volume
}, $snapname);
171 sub __snapshot_rollback_vm_stop
{
172 my ($class, $vmid) = @_;
174 PVE
::LXC
::vm_stop
($vmid, 1)
175 if $class->__snapshot_check_running($vmid);
178 sub __snapshot_rollback_vm_start
{
179 my ($class, $vmid, $vmstate, $data);
181 die "implement me - save vmstate\n";
184 sub __snapshot_rollback_get_unused
{
185 my ($class, $conf, $snap) = @_;
189 $class->foreach_volume($conf, sub {
190 my ($vs, $volume) = @_;
192 return if $volume->{type
} ne 'volume';
195 my $volid = $volume->{volume
};
197 $class->foreach_volume($snap, sub {
198 my ($ms, $mountpoint) = @_;
201 return if ($mountpoint->{type
} ne 'volume');
204 if ($mountpoint->{volume
} && $mountpoint->{volume
} eq $volid);
207 push @$unused, $volid if !$found;
213 # END implemented abstract methods from PVE::AbstractConfig
215 # BEGIN JSON config code
217 cfs_register_file
('/lxc/', \
&parse_pct_config
, \
&write_pct_config
);
220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
222 sub is_valid_mount_option
{
224 return $option =~ $valid_mount_option_re;
231 format
=> 'pve-lxc-mp-string',
232 format_description
=> 'volume',
233 description
=> 'Volume, device or directory to mount into the container.',
237 format
=> 'disk-size',
238 format_description
=> 'DiskSize',
239 description
=> 'Volume size (read only value).',
244 description
=> 'Explicitly enable or disable ACL support.',
250 description
=> 'Extra mount options for rootfs/mps.',
251 format_description
=> 'opt[;opt...]',
252 pattern
=> qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
256 description
=> 'Read-only mount point',
261 description
=> 'Enable user quotas inside the container (not supported with zfs subvolumes)',
266 description
=> 'Will include this volume to a storage replica job.',
272 description
=> 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
273 verbose_description
=> "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
279 PVE
::JSONSchema
::register_standard_option
('pve-ct-rootfs', {
280 type
=> 'string', format
=> $rootfs_desc,
281 description
=> "Use volume as container root.",
285 my $features_desc = {
289 description
=> "Allow mounting file systems of specific types."
290 ." This should be a list of file system types as used with the mount command."
291 ." Note that this can have negative effects on the container's security."
292 ." With access to a loop device, mounting a file can circumvent the mknod"
293 ." permission of the devices cgroup, mounting an NFS file system can"
294 ." block the host's I/O completely and prevent it from rebooting, etc.",
295 format_description
=> 'fstype;fstype;...',
296 pattern
=> qr/[a-zA-Z0-9_; ]+/,
302 description
=> "Allow nesting."
303 ." Best used with unprivileged containers with additional id mapping."
304 ." Note that this will expose procfs and sysfs contents of the host"
311 description
=> "For unprivileged containers only: Allow the use of the keyctl() system call."
312 ." This is required to use docker inside a container."
313 ." By default unprivileged containers will see this system call as non-existent."
314 ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
315 ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
316 ." Essentially, you can choose between running systemd-networkd or docker.",
322 description
=> "Allow using 'fuse' file systems in a container."
323 ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
329 description
=> "Allow unprivileged containers to use mknod() to add certain device nodes."
330 ." This requires a kernel with seccomp trap to user space support (5.3 or newer)."
331 ." This is experimental.",
337 description
=> "Mount /sys in unprivileged containers as `rw` instead of `mixed`."
338 ." This can break networking under newer (>= v245) systemd-network use."
346 description
=> "Lock/unlock the VM.",
347 enum
=> [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
352 description
=> "Specifies whether a VM will be started during system bootup.",
355 startup
=> get_standard_option
('pve-startup-order'),
359 description
=> "Enable/disable Template.",
365 enum
=> ['amd64', 'i386', 'arm64', 'armhf'],
366 description
=> "OS architecture type.",
372 enum
=> [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
373 description
=> "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
378 description
=> "Attach a console device (/dev/console) to the container.",
384 description
=> "Specify the number of tty available to the container",
392 description
=> "The number of cores assigned to the container. A container can use all available cores by default.",
399 description
=> "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
407 description
=> "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
415 description
=> "Amount of RAM for the VM in MB.",
422 description
=> "Amount of SWAP for the VM in MB.",
428 description
=> "Set a host name for the container.",
429 type
=> 'string', format
=> 'dns-name',
435 description
=> "Container description. Only used on the configuration web interface.",
439 type
=> 'string', format
=> 'dns-name-list',
440 description
=> "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
444 type
=> 'string', format
=> 'address-list',
445 description
=> "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
447 rootfs
=> get_standard_option
('pve-ct-rootfs'),
450 type
=> 'string', format
=> 'pve-configid',
452 description
=> "Parent snapshot name. This is used internally, and should not be modified.",
456 description
=> "Timestamp for snapshots.",
462 description
=> "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
464 enum
=> ['shell', 'console', 'tty'],
470 description
=> "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
476 description
=> "Makes the container run as unprivileged user. (Should not be modified manually.)",
482 format
=> $features_desc,
483 description
=> "Allow containers access to advanced features.",
488 format
=> 'pve-volume-id',
489 description
=> 'Script that will be exectued during various steps in the containers lifetime.',
492 type
=> 'string', format
=> 'pve-tag-list',
493 description
=> 'Tags of the Container. This is only meta information.',
498 my $valid_lxc_conf_keys = {
499 'lxc.apparmor.profile' => 1,
500 'lxc.apparmor.allow_incomplete' => 1,
501 'lxc.apparmor.allow_nesting' => 1,
502 'lxc.apparmor.raw' => 1,
503 'lxc.selinux.context' => 1,
507 'lxc.signal.halt' => 1,
508 'lxc.signal.reboot' => 1,
509 'lxc.signal.stop' => 1,
512 'lxc.console.logfile' => 1,
513 'lxc.console.path' => 1,
515 'lxc.devtty.dir' => 1,
516 'lxc.hook.autodev' => 1,
519 'lxc.mount.fstab' => 1,
520 'lxc.mount.entry' => 1,
521 'lxc.mount.auto' => 1,
522 'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
523 'lxc.rootfs.mount' => 1,
524 'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
525 ', please use mount point options in the "rootfs" key',
531 'lxc.seccomp.profile' => 1,
532 'lxc.seccomp.notify.proxy' => 1,
533 'lxc.seccomp.notify.cookie' => 1,
535 'lxc.hook.pre-start' => 1,
536 'lxc.hook.pre-mount' => 1,
537 'lxc.hook.mount' => 1,
538 'lxc.hook.start' => 1,
539 'lxc.hook.stop' => 1,
540 'lxc.hook.post-stop' => 1,
541 'lxc.hook.clone' => 1,
542 'lxc.hook.destroy' => 1,
543 'lxc.hook.version' => 1,
544 'lxc.log.level' => 1,
546 'lxc.start.auto' => 1,
547 'lxc.start.delay' => 1,
548 'lxc.start.order' => 1,
550 'lxc.environment' => 1,
552 # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
553 'lxc.sysctl.fs.mqueue' => 1,
554 'lxc.sysctl.kernel.msgmax' => 1,
555 'lxc.sysctl.kernel.msgmnb' => 1,
556 'lxc.sysctl.kernel.msgmni' => 1,
557 'lxc.sysctl.kernel.sem' => 1,
558 'lxc.sysctl.kernel.shmall' => 1,
559 'lxc.sysctl.kernel.shmmax' => 1,
560 'lxc.sysctl.kernel.shmmni' => 1,
561 'lxc.sysctl.kernel.shm_rmid_forced' => 1,
564 my $deprecated_lxc_conf_keys = {
565 # Deprecated (removed with lxc 3.0):
566 'lxc.aa_profile' => 'lxc.apparmor.profile',
567 'lxc.aa_allow_incomplete' => 'lxc.apparmor.allow_incomplete',
568 'lxc.console' => 'lxc.console.path',
569 'lxc.devttydir' => 'lxc.tty.dir',
570 'lxc.haltsignal' => 'lxc.signal.halt',
571 'lxc.rebootsignal' => 'lxc.signal.reboot',
572 'lxc.stopsignal' => 'lxc.signal.stop',
573 'lxc.id_map' => 'lxc.idmap',
574 'lxc.init_cmd' => 'lxc.init.cmd',
575 'lxc.loglevel' => 'lxc.log.level',
576 'lxc.logfile' => 'lxc.log.file',
577 'lxc.mount' => 'lxc.mount.fstab',
578 'lxc.network.type' => 'lxc.net.INDEX.type',
579 'lxc.network.flags' => 'lxc.net.INDEX.flags',
580 'lxc.network.link' => 'lxc.net.INDEX.link',
581 'lxc.network.mtu' => 'lxc.net.INDEX.mtu',
582 'lxc.network.name' => 'lxc.net.INDEX.name',
583 'lxc.network.hwaddr' => 'lxc.net.INDEX.hwaddr',
584 'lxc.network.ipv4' => 'lxc.net.INDEX.ipv4.address',
585 'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
586 'lxc.network.ipv6' => 'lxc.net.INDEX.ipv6.address',
587 'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
588 'lxc.network.script.up' => 'lxc.net.INDEX.script.up',
589 'lxc.network.script.down' => 'lxc.net.INDEX.script.down',
590 'lxc.pts' => 'lxc.pty.max',
591 'lxc.se_context' => 'lxc.selinux.context',
592 'lxc.seccomp' => 'lxc.seccomp.profile',
593 'lxc.tty' => 'lxc.tty.max',
594 'lxc.utsname' => 'lxc.uts.name',
597 sub is_valid_lxc_conf_key
{
598 my ($vmid, $key) = @_;
599 if ($key =~ /^lxc\.limit\./) {
600 warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
603 if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
604 warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
607 my $validity = $valid_lxc_conf_keys->{$key};
608 return $validity if defined($validity);
609 return 1 if $key =~ /^lxc\.cgroup2?\./ # allow all cgroup values
610 || $key =~ /^lxc\.prlimit\./ # allow all prlimits
611 || $key =~ /^lxc\.net\./; # allow custom network definitions
615 our $netconf_desc = {
619 description
=> "Network interface type.",
624 format_description
=> 'string',
625 description
=> 'Name of the network device as seen from inside the container. (lxc.network.name)',
626 pattern
=> '[-_.\w\d]+',
630 format_description
=> 'bridge',
631 description
=> 'Bridge to attach the network device to.',
632 pattern
=> '[-_.\w\d]+',
635 hwaddr
=> get_standard_option
('mac-addr', {
636 description
=> 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
640 description
=> 'Maximum transfer unit of the interface. (lxc.network.mtu)',
641 minimum
=> 64, # minimum ethernet frame is 64 bytes
646 format
=> 'pve-ipv4-config',
647 format_description
=> '(IPv4/CIDR|dhcp|manual)',
648 description
=> 'IPv4 address in CIDR format.',
654 format_description
=> 'GatewayIPv4',
655 description
=> 'Default gateway for IPv4 traffic.',
660 format
=> 'pve-ipv6-config',
661 format_description
=> '(IPv6/CIDR|auto|dhcp|manual)',
662 description
=> 'IPv6 address in CIDR format.',
668 format_description
=> 'GatewayIPv6',
669 description
=> 'Default gateway for IPv6 traffic.',
674 description
=> "Controls whether this interface's firewall rules should be used.",
681 description
=> "VLAN tag for this interface.",
686 pattern
=> qr/\d+(?:;\d+)*/,
687 format_description
=> 'vlanid[;vlanid...]',
688 description
=> "VLAN ids to pass through the interface",
693 format_description
=> 'mbps',
694 description
=> "Apply rate limiting to the interface",
698 PVE
::JSONSchema
::register_format
('pve-lxc-network', $netconf_desc);
700 my $MAX_LXC_NETWORKS = 10;
701 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
702 $confdesc->{"net$i"} = {
704 type
=> 'string', format
=> $netconf_desc,
705 description
=> "Specifies network interfaces for the container.",
709 PVE
::JSONSchema
::register_format
('pve-lxc-mp-string', \
&verify_lxc_mp_string
);
710 sub verify_lxc_mp_string
{
711 my ($mp, $noerr) = @_;
715 # /. or /.. at the end
716 # ../ at the beginning
718 if($mp =~ m
@/\.\
.?
/@ ||
721 return undef if $noerr;
722 die "$mp contains illegal character sequences\n";
731 description
=> 'Whether to include the mount point in backups.',
732 verbose_description
=> 'Whether to include the mount point in backups '.
733 '(only used for volume mount points).',
738 format
=> 'pve-lxc-mp-string',
739 format_description
=> 'Path',
740 description
=> 'Path to the mount point as seen from inside the container '.
741 '(must not contain symlinks).',
742 verbose_description
=> "Path to the mount point as seen from inside the container.\n\n".
743 "NOTE: Must not contain any symlinks for security reasons."
746 PVE
::JSONSchema
::register_format
('pve-ct-mountpoint', $mp_desc);
752 format
=> 'pve-volume-id',
753 format_description
=> 'volume',
754 description
=> 'The volume that is not used currently.',
758 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
759 $confdesc->{"mp$i"} = {
761 type
=> 'string', format
=> $mp_desc,
762 description
=> "Use volume as container mount point.",
767 for (my $i = 0; $i < $MAX_UNUSED_DISKS; $i++) {
768 $confdesc->{"unused$i"} = {
770 type
=> 'string', format
=> $unused_desc,
771 description
=> "Reference to unused volumes. This is used internally, and should not be modified manually.",
775 sub parse_pct_config
{
776 my ($filename, $raw) = @_;
778 return undef if !defined($raw);
781 digest
=> Digest
::SHA
::sha1_hex
($raw),
786 $filename =~ m
|/lxc/(\d
+).conf
$|
787 || die "got strange filename '$filename'";
795 my @lines = split(/\n/, $raw);
796 foreach my $line (@lines) {
797 next if $line =~ m/^\s*$/;
799 if ($line =~ m/^\[pve:pending\]\s*$/i) {
800 $section = 'pending';
801 $conf->{description
} = $descr if $descr;
803 $conf = $res->{$section} = {};
805 } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
807 $conf->{description
} = $descr if $descr;
809 $conf = $res->{snapshots
}->{$section} = {};
813 if ($line =~ m/^\#(.*)\s*$/) {
814 $descr .= PVE
::Tools
::decode_text
($1) . "\n";
818 if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
821 my $validity = is_valid_lxc_conf_key
($vmid, $key);
822 if ($validity eq 1) {
823 push @{$conf->{lxc
}}, [$key, $value];
824 } elsif (my $errmsg = $validity) {
825 warn "vm $vmid - $key: $errmsg\n";
827 warn "vm $vmid - unable to parse config: $line\n";
829 } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
830 $descr .= PVE
::Tools
::decode_text
($2);
831 } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
832 $conf->{snapstate
} = $1;
833 } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
835 if ($section eq 'pending') {
836 $conf->{delete} = $value;
838 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
840 } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
843 eval { $value = PVE
::LXC
::Config-
>check_type($key, $value); };
844 warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
845 $conf->{$key} = $value;
847 warn "vm $vmid - unable to parse config: $line\n";
851 $conf->{description
} = $descr if $descr;
853 delete $res->{snapstate
}; # just to be sure
858 sub write_pct_config
{
859 my ($filename, $conf) = @_;
861 delete $conf->{snapstate
}; # just to be sure
863 my $volidlist = PVE
::LXC
::Config-
>get_vm_volumes($conf);
864 my $used_volids = {};
865 foreach my $vid (@$volidlist) {
866 $used_volids->{$vid} = 1;
869 # remove 'unusedX' settings if the volume is still used
870 foreach my $key (keys %$conf) {
871 my $value = $conf->{$key};
872 if ($key =~ m/^unused/ && $used_volids->{$value}) {
873 delete $conf->{$key};
877 my $generate_raw_config = sub {
882 # add description as comment to top of file
883 my $descr = $conf->{description
} || '';
884 foreach my $cl (split(/\n/, $descr)) {
885 $raw .= '#' . PVE
::Tools
::encode_text
($cl) . "\n";
888 foreach my $key (sort keys %$conf) {
889 next if $key eq 'digest' || $key eq 'description' ||
890 $key eq 'pending' || $key eq 'snapshots' ||
891 $key eq 'snapname' || $key eq 'lxc';
892 my $value = $conf->{$key};
893 die "detected invalid newline inside property '$key'\n"
895 $raw .= "$key: $value\n";
898 if (my $lxcconf = $conf->{lxc
}) {
899 foreach my $entry (@$lxcconf) {
900 my ($k, $v) = @$entry;
908 my $raw = &$generate_raw_config($conf);
910 if (scalar(keys %{$conf->{pending
}})){
911 $raw .= "\n[pve:pending]\n";
912 $raw .= &$generate_raw_config($conf->{pending
});
915 foreach my $snapname (sort keys %{$conf->{snapshots
}}) {
916 $raw .= "\n[$snapname]\n";
917 $raw .= &$generate_raw_config($conf->{snapshots
}->{$snapname});
923 sub update_pct_config
{
924 my ($class, $vmid, $conf, $running, $param, $delete, $revert) = @_;
926 my $storage_cfg = PVE
::Storage
::config
();
928 foreach my $opt (@$revert) {
929 delete $conf->{pending
}->{$opt};
930 $class->remove_from_pending_delete($conf, $opt); # also remove from deletion queue
933 # write updates to pending section
934 my $modified = {}; # record modified options
936 foreach my $opt (@$delete) {
937 if (!defined($conf->{$opt}) && !defined($conf->{pending
}->{$opt})) {
938 warn "cannot delete '$opt' - not set in current configuration!\n";
941 $modified->{$opt} = 1;
942 if ($opt eq 'memory' || $opt eq 'rootfs' || $opt eq 'ostype') {
943 die "unable to delete required option '$opt'\n";
944 } elsif ($opt =~ m/^unused(\d+)$/) {
945 $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
946 } elsif ($opt =~ m/^mp(\d+)$/) {
947 $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
948 } elsif ($opt eq 'unprivileged') {
949 die "unable to delete read-only option: '$opt'\n";
951 $class->add_to_pending_delete($conf, $opt);
954 my $check_content_type = sub {
956 my $sid = PVE
::Storage
::parse_volume_id
($mp->{volume
});
957 my $storage_config = PVE
::Storage
::storage_config
($storage_cfg, $sid);
958 die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
959 if !$storage_config->{content
}->{rootdir
};
962 foreach my $opt (sort keys %$param) { # add/change
963 $modified->{$opt} = 1;
964 my $value = $param->{$opt};
965 if ($opt =~ m/^mp(\d+)$/ || $opt eq 'rootfs') {
966 $class->check_protection($conf, "can't update CT $vmid drive '$opt'");
967 my $mp = $class->parse_volume($opt, $value);
968 $check_content_type->($mp) if ($mp->{type
} eq 'volume');
969 } elsif ($opt eq 'hookscript') {
970 PVE
::GuestHelpers
::check_hookscript
($value);
971 } elsif ($opt eq 'nameserver') {
972 $value = PVE
::LXC
::verify_nameserver_list
($value);
973 } elsif ($opt eq 'searchdomain') {
974 $value = PVE
::LXC
::verify_searchdomain_list
($value);
975 } elsif ($opt eq 'unprivileged') {
976 die "unable to modify read-only option: '$opt'\n";
978 $conf->{pending
}->{$opt} = $value;
979 $class->remove_from_pending_delete($conf, $opt);
982 my $changes = $class->cleanup_pending($conf);
986 $class->vmconfig_hotplug_pending($vmid, $conf, $storage_cfg, $modified, $errors);
988 $class->vmconfig_apply_pending($vmid, $conf, $storage_cfg, $modified, $errors);
995 my ($class, $key, $value) = @_;
997 die "unknown setting '$key'\n" if !$confdesc->{$key};
999 my $type = $confdesc->{$key}->{type
};
1001 if (!defined($value)) {
1002 die "got undefined value\n";
1005 if ($value =~ m/[\n\r]/) {
1006 die "property contains a line feed\n";
1009 if ($type eq 'boolean') {
1010 return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1011 return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1012 die "type check ('boolean') failed - got '$value'\n";
1013 } elsif ($type eq 'integer') {
1014 return int($1) if $value =~ m/^(\d+)$/;
1015 die "type check ('integer') failed - got '$value'\n";
1016 } elsif ($type eq 'number') {
1017 return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1018 die "type check ('number') failed - got '$value'\n";
1019 } elsif ($type eq 'string') {
1020 if (my $fmt = $confdesc->{$key}->{format
}) {
1021 PVE
::JSONSchema
::check_format
($fmt, $value);
1026 die "internal error"
1031 # add JSON properties for create and set function
1032 sub json_config_properties
{
1033 my ($class, $prop) = @_;
1035 foreach my $opt (keys %$confdesc) {
1036 next if $opt eq 'parent' || $opt eq 'snaptime';
1037 next if $prop->{$opt};
1038 $prop->{$opt} = $confdesc->{$opt};
1044 my $parse_ct_mountpoint_full = sub {
1045 my ($class, $desc, $data, $noerr) = @_;
1050 eval { $res = PVE
::JSONSchema
::parse_property_string
($desc, $data) };
1052 return undef if $noerr;
1056 if (defined(my $size = $res->{size
})) {
1057 $size = PVE
::JSONSchema
::parse_size
($size);
1058 if (!defined($size)) {
1059 return undef if $noerr;
1060 die "invalid size: $size\n";
1062 $res->{size
} = $size;
1065 $res->{type
} = $class->classify_mountpoint($res->{volume
});
1070 sub print_ct_mountpoint
{
1071 my ($class, $info, $nomp) = @_;
1072 my $skip = [ 'type' ];
1073 push @$skip, 'mp' if $nomp;
1074 return PVE
::JSONSchema
::print_property_string
($info, $mp_desc, $skip);
1078 my ($class, $key, $volume_string, $noerr) = @_;
1080 if ($key eq 'rootfs') {
1081 my $res = $parse_ct_mountpoint_full->($class, $rootfs_desc, $volume_string, $noerr);
1082 $res->{mp
} = '/' if defined($res);
1084 } elsif ($key =~ m/^mp\d+$/) {
1085 return $parse_ct_mountpoint_full->($class, $mp_desc, $volume_string, $noerr);
1086 } elsif ($key =~ m/^unused\d+$/) {
1087 return $parse_ct_mountpoint_full->($class, $unused_desc, $volume_string, $noerr);
1090 die "parse_volume - unknown type: $key\n";
1094 my ($class, $key, $volume) = @_;
1096 return $class->print_ct_mountpoint($volume, $key eq 'rootfs');
1105 sub print_lxc_network
{
1106 my ($class, $net) = @_;
1107 return PVE
::JSONSchema
::print_property_string
($net, $netconf_desc);
1110 sub parse_lxc_network
{
1111 my ($class, $data) = @_;
1115 return $res if !$data;
1117 $res = PVE
::JSONSchema
::parse_property_string
($netconf_desc, $data);
1119 $res->{type
} = 'veth';
1120 if (!$res->{hwaddr
}) {
1121 my $dc = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
1122 $res->{hwaddr
} = PVE
::Tools
::random_ether_addr
($dc->{mac_prefix
});
1128 sub parse_features
{
1129 my ($class, $data) = @_;
1130 return {} if !$data;
1131 return PVE
::JSONSchema
::parse_property_string
($features_desc, $data);
1135 my ($class, $name) = @_;
1137 return defined($confdesc->{$name});
1139 # END JSON config code
1141 my $LXC_FASTPLUG_OPTIONS= {
1153 sub vmconfig_hotplug_pending
{
1154 my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1156 my $pid = PVE
::LXC
::find_lxc_pid
($vmid);
1157 my $rootdir = "/proc/$pid/root";
1159 my $add_hotplug_error = sub {
1160 my ($opt, $msg) = @_;
1161 $errors->{$opt} = "unable to hotplug $opt: $msg";
1165 foreach my $opt (sort keys %{$conf->{pending
}}) { # add/change
1166 next if $selection && !$selection->{$opt};
1167 if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1168 $conf->{$opt} = delete $conf->{pending
}->{$opt};
1174 $class->write_config($vmid, $conf);
1177 my $cgroup = PVE
::LXC
::CGroup-
>new($vmid);
1179 # There's no separate swap size to configure, there's memory and "total"
1180 # memory (iow. memory+swap). This means we have to change them together.
1181 my $hotplug_memory_done;
1182 my $hotplug_memory = sub {
1183 my ($wanted_memory, $wanted_swap) = @_;
1185 $wanted_memory = int($wanted_memory * 1024 * 1024) if defined($wanted_memory);
1186 $wanted_swap = int($wanted_swap * 1024 * 1024) if defined($wanted_swap);
1187 $cgroup->change_memory_limit($wanted_memory, $wanted_swap);
1189 $hotplug_memory_done = 1;
1192 my $pending_delete_hash = $class->parse_pending_delete($conf->{pending
}->{delete});
1193 # FIXME: $force deletion is not implemented for CTs
1194 foreach my $opt (sort keys %$pending_delete_hash) {
1195 next if $selection && !$selection->{$opt};
1197 if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1199 } elsif ($opt =~ m/^unused(\d+)$/) {
1200 PVE
::LXC
::delete_mountpoint_volume
($storecfg, $vmid, $conf->{$opt})
1201 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1202 } elsif ($opt eq 'swap') {
1203 $hotplug_memory->(undef, 0);
1204 } elsif ($opt eq 'cpulimit') {
1205 $cgroup->change_cpu_quota(-1, 100000);
1206 } elsif ($opt eq 'cpuunits') {
1207 $cgroup->change_cpu_shares(undef, $confdesc->{cpuunits
}->{default});
1208 } elsif ($opt =~ m/^net(\d)$/) {
1210 PVE
::Network
::veth_delete
("veth${vmid}i$netid");
1212 die "skip\n"; # skip non-hotpluggable opts
1216 $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1218 delete $conf->{$opt};
1219 $class->remove_from_pending_delete($conf, $opt);
1223 foreach my $opt (sort keys %{$conf->{pending
}}) {
1224 next if $opt eq 'delete'; # just to be sure
1225 next if $selection && !$selection->{$opt};
1226 my $value = $conf->{pending
}->{$opt};
1228 if ($opt eq 'cpulimit') {
1229 my $quota = 100000 * $value;
1230 $cgroup->change_cpu_quota(int(100000 * $value), 100000);
1231 } elsif ($opt eq 'cpuunits') {
1232 $cgroup->change_cpu_shares($value, $confdesc->{cpuunits
}->{default});
1233 } elsif ($opt =~ m/^net(\d+)$/) {
1235 my $net = $class->parse_lxc_network($value);
1236 $value = $class->print_lxc_network($net);
1237 PVE
::LXC
::update_net
($vmid, $conf, $opt, $net, $netid, $rootdir);
1238 } elsif ($opt eq 'memory' || $opt eq 'swap') {
1239 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1240 $hotplug_memory->($conf->{pending
}->{memory
}, $conf->{pending
}->{swap
});
1242 } elsif ($opt =~ m/^mp(\d+)$/) {
1243 if (!PVE
::LXC
::Tools
::can_use_new_mount_api
()) {
1247 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 1);
1248 # apply_pending_mountpoint modifies the value if it creates a new disk
1249 $value = $conf->{pending
}->{$opt};
1251 die "skip\n"; # skip non-hotpluggable
1255 $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1257 $conf->{$opt} = $value;
1258 delete $conf->{pending
}->{$opt};
1262 $class->write_config($vmid, $conf);
1265 sub vmconfig_apply_pending
{
1266 my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1268 my $add_apply_error = sub {
1269 my ($opt, $msg) = @_;
1270 my $err_msg = "unable to apply pending change $opt : $msg";
1271 $errors->{$opt} = $err_msg;
1275 my $pending_delete_hash = $class->parse_pending_delete($conf->{pending
}->{delete});
1276 # FIXME: $force deletion is not implemented for CTs
1277 foreach my $opt (sort keys %$pending_delete_hash) {
1278 next if $selection && !$selection->{$opt};
1280 if ($opt =~ m/^mp(\d+)$/) {
1281 my $mp = $class->parse_volume($opt, $conf->{$opt});
1282 if ($mp->{type
} eq 'volume') {
1283 $class->add_unused_volume($conf, $mp->{volume
})
1284 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1286 } elsif ($opt =~ m/^unused(\d+)$/) {
1287 PVE
::LXC
::delete_mountpoint_volume
($storecfg, $vmid, $conf->{$opt})
1288 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1292 $add_apply_error->($opt, $err);
1294 delete $conf->{$opt};
1295 $class->remove_from_pending_delete($conf, $opt);
1299 $class->cleanup_pending($conf);
1301 foreach my $opt (sort keys %{$conf->{pending
}}) { # add/change
1302 next if $opt eq 'delete'; # just to be sure
1303 next if $selection && !$selection->{$opt};
1305 if ($opt =~ m/^mp(\d+)$/) {
1306 $class->apply_pending_mountpoint($vmid, $conf, $opt, $storecfg, 0);
1307 } elsif ($opt =~ m/^net(\d+)$/) {
1309 my $net = $class->parse_lxc_network($conf->{pending
}->{$opt});
1310 $conf->{pending
}->{$opt} = $class->print_lxc_network($net);
1314 $add_apply_error->($opt, $err);
1316 $conf->{$opt} = delete $conf->{pending
}->{$opt};
1320 $class->write_config($vmid, $conf);
1323 my $rescan_volume = sub {
1324 my ($storecfg, $mp) = @_;
1326 $mp->{size
} = PVE
::Storage
::volume_size_info
($storecfg, $mp->{volume
}, 5);
1328 warn "Could not rescan volume size - $@\n" if $@;
1331 sub apply_pending_mountpoint
{
1332 my ($class, $vmid, $conf, $opt, $storecfg, $running) = @_;
1334 my $mp = $class->parse_volume($opt, $conf->{pending
}->{$opt});
1335 my $old = $conf->{$opt};
1336 if ($mp->{type
} eq 'volume') {
1337 if ($mp->{volume
} =~ $PVE::LXC
::NEW_DISK_RE
) {
1338 my $original_value = $conf->{pending
}->{$opt};
1339 my $vollist = PVE
::LXC
::create_disks
(
1342 { $opt => $original_value },
1347 # Re-parse mount point:
1348 my $mp = $class->parse_volume($opt, $conf->{pending
}->{$opt});
1350 PVE
::LXC
::mountpoint_hotplug
($vmid, $conf, $opt, $mp, $storecfg);
1354 PVE
::LXC
::destroy_disks
($storecfg, $vollist);
1355 # The pending-changes code collects errors but keeps on looping through further
1356 # pending changes, so unroll the change in $conf as well if destroy_disks()
1358 $conf->{pending
}->{$opt} = $original_value;
1363 die "skip\n" if $running && defined($old); # TODO: "changing" mount points?
1364 $rescan_volume->($storecfg, $mp);
1366 PVE
::LXC
::mountpoint_hotplug
($vmid, $conf, $opt, $mp, $storecfg);
1368 $conf->{pending
}->{$opt} = $class->print_ct_mountpoint($mp);
1372 if (defined($old)) {
1373 my $mp = $class->parse_volume($opt, $old);
1374 if ($mp->{type
} eq 'volume') {
1375 $class->add_unused_volume($conf, $mp->{volume
})
1376 if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1381 sub classify_mountpoint
{
1382 my ($class, $vol) = @_;
1383 if ($vol =~ m!^/!) {
1384 return 'device' if $vol =~ m!^/dev/!;
1390 my $__is_volume_in_use = sub {
1391 my ($class, $config, $volid) = @_;
1394 $class->foreach_volume($config, sub {
1395 my ($ms, $mountpoint) = @_;
1397 $used = $mountpoint->{type
} eq 'volume' && $mountpoint->{volume
} eq $volid;
1403 sub is_volume_in_use_by_snapshots
{
1404 my ($class, $config, $volid) = @_;
1406 if (my $snapshots = $config->{snapshots
}) {
1407 foreach my $snap (keys %$snapshots) {
1408 return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1415 sub is_volume_in_use
{
1416 my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1417 return 1 if $__is_volume_in_use->($class, $config, $volid);
1418 return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1419 return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending
}, $volid);
1423 sub has_dev_console
{
1424 my ($class, $conf) = @_;
1426 return !(defined($conf->{console
}) && !$conf->{console
});
1430 my ($class, $conf, $keyname) = @_;
1432 if (my $lxcconf = $conf->{lxc
}) {
1433 foreach my $entry (@$lxcconf) {
1434 my ($key, undef) = @$entry;
1435 return 1 if $key eq $keyname;
1443 my ($class, $conf) = @_;
1445 return $conf->{tty
} // $confdesc->{tty
}->{default};
1449 my ($class, $conf) = @_;
1451 return $conf->{cmode
} // $confdesc->{cmode
}->{default};
1454 sub valid_volume_keys
{
1455 my ($class, $reverse) = @_;
1457 my @names = ('rootfs');
1459 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1460 push @names, "mp$i";
1463 return $reverse ?
reverse @names : @names;
1466 sub get_vm_volumes
{
1467 my ($class, $conf, $excludes) = @_;
1471 $class->foreach_volume($conf, sub {
1472 my ($ms, $mountpoint) = @_;
1474 return if $excludes && $ms eq $excludes;
1476 my $volid = $mountpoint->{volume
};
1477 return if !$volid || $mountpoint->{type
} ne 'volume';
1479 my ($sid, $volname) = PVE
::Storage
::parse_volume_id
($volid, 1);
1482 push @$vollist, $volid;
1488 sub get_replicatable_volumes
{
1489 my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1493 my $test_volid = sub {
1494 my ($volid, $mountpoint) = @_;
1498 my $mptype = $mountpoint->{type
};
1499 my $replicate = $mountpoint->{replicate
} // 1;
1501 if ($mptype ne 'volume') {
1502 # skip bindmounts if replicate = 0 even for cleanup,
1503 # since bind mounts could not have been replicated ever
1504 return if !$replicate;
1505 die "unable to replicate mountpoint type '$mptype'\n";
1508 my ($storeid, $volname) = PVE
::Storage
::parse_volume_id
($volid, $noerr);
1509 return if !$storeid;
1511 my $scfg = PVE
::Storage
::storage_config
($storecfg, $storeid);
1512 return if $scfg->{shared
};
1514 my ($path, $owner, $vtype) = PVE
::Storage
::path
($storecfg, $volid);
1515 return if !$owner || ($owner != $vmid);
1517 die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1519 return if !$cleanup && !$replicate;
1521 if (!PVE
::Storage
::volume_has_feature
($storecfg, 'replicate', $volid)) {
1522 return if $cleanup || $noerr;
1523 die "missing replicate feature on volume '$volid'\n";
1526 $volhash->{$volid} = 1;
1529 $class->foreach_volume($conf, sub {
1530 my ($ms, $mountpoint) = @_;
1531 $test_volid->($mountpoint->{volume
}, $mountpoint);
1534 foreach my $snapname (keys %{$conf->{snapshots
}}) {
1535 my $snap = $conf->{snapshots
}->{$snapname};
1536 $class->foreach_volume($snap, sub {
1537 my ($ms, $mountpoint) = @_;
1538 $test_volid->($mountpoint->{volume
}, $mountpoint);
1542 # add 'unusedX' volumes to volhash
1543 foreach my $key (keys %$conf) {
1544 if ($key =~ m/^unused/) {
1545 $test_volid->($conf->{$key}, { type
=> 'volume', replicate
=> 1 });