src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::INotify;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::Tools;
  11
  12 use base qw(PVE::AbstractConfig);
  13
  14 my $nodename = PVE::INotify::nodename();
  15 my $lock_handles =  {};
  16 my $lockdir = "/run/lock/lxc";
  17 mkdir $lockdir;
  18 mkdir "/etc/pve/nodes/$nodename/lxc";
  19 my $MAX_MOUNT_POINTS = 10;
  20 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  21
  22 # BEGIN implemented abstract methods from PVE::AbstractConfig
  23
  24 sub guest_type {
  25     return "CT";
  26 }
  27
  28 sub __config_max_unused_disks {
  29     my ($class) = @_;
  30
  31     return $MAX_UNUSED_DISKS;
  32 }
  33
  34 sub config_file_lock {
  35     my ($class, $vmid) = @_;
  36
  37     return "$lockdir/pve-config-${vmid}.lock";
  38 }
  39
  40 sub cfs_config_path {
  41     my ($class, $vmid, $node) = @_;
  42
  43     $node = $nodename if !$node;
  44     return "nodes/$node/lxc/$vmid.conf";
  45 }
  46
  47 sub has_feature {
  48     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  49     my $err;
  50
  51     $class->foreach_mountpoint($conf, sub {
  52         my ($ms, $mountpoint) = @_;
  53
  54         return if $err; # skip further test
  55         return if $backup_only && $ms ne 'rootfs' && !$mountpoint->{backup};
  56
  57         $err = 1
  58             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  59                                                  $mountpoint->{volume},
  60                                                  $snapname, $running);
  61     });
  62
  63     return $err ? 0 : 1;
  64 }
  65
  66 sub __snapshot_save_vmstate {
  67     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  68     die "implement me - snapshot_save_vmstate\n";
  69 }
  70
  71 sub __snapshot_check_running {
  72     my ($class, $vmid) = @_;
  73     return PVE::LXC::check_running($vmid);
  74 }
  75
  76 sub __snapshot_check_freeze_needed {
  77     my ($class, $vmid, $config, $save_vmstate) = @_;
  78
  79     my $ret = $class->__snapshot_check_running($vmid);
  80     return ($ret, $ret);
  81 }
  82
  83 sub __snapshot_freeze {
  84     my ($class, $vmid, $unfreeze) = @_;
  85
  86     if ($unfreeze) {
  87         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
  88         warn $@ if $@;
  89     } else {
  90         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
  91         PVE::LXC::sync_container_namespace($vmid);
  92     }
  93 }
  94
  95 sub __snapshot_create_vol_snapshot {
  96     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
  97
  98     my $storecfg = PVE::Storage::config();
  99
 100     return if $snapname eq 'vzdump' && $ms ne 'rootfs' && !$mountpoint->{backup};
 101     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 102 }
 103
 104 sub __snapshot_delete_remove_drive {
 105     my ($class, $snap, $remove_drive) = @_;
 106
 107     if ($remove_drive eq 'vmstate') {
 108         die "implement me - saving vmstate\n";
 109     } else {
 110         my $value = $snap->{$remove_drive};
 111         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 112         delete $snap->{$remove_drive};
 113         $class->add_unused_volume($snap, $mountpoint->{volume});
 114     }
 115 }
 116
 117 sub __snapshot_delete_vmstate_file {
 118     my ($class, $snap, $force) = @_;
 119
 120     die "implement me - saving vmstate\n";
 121 }
 122
 123 sub __snapshot_delete_vol_snapshot {
 124     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 125
 126     my $storecfg = PVE::Storage::config();
 127     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 128     push @$unused, $mountpoint->{volume};
 129 }
 130
 131 sub __snapshot_rollback_vol_possible {
 132     my ($class, $mountpoint, $snapname) = @_;
 133
 134     my $storecfg = PVE::Storage::config();
 135     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 136 }
 137
 138 sub __snapshot_rollback_vol_rollback {
 139     my ($class, $mountpoint, $snapname) = @_;
 140
 141     my $storecfg = PVE::Storage::config();
 142     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 143 }
 144
 145 sub __snapshot_rollback_vm_stop {
 146     my ($class, $vmid) = @_;
 147
 148     PVE::Tools::run_command(['/usr/bin/lxc-stop', '-n', $vmid, '--kill'])
 149         if $class->__snapshot_check_running($vmid);
 150 }
 151
 152 sub __snapshot_rollback_vm_start {
 153     my ($class, $vmid, $vmstate, $forcemachine);
 154
 155     die "implement me - save vmstate\n";
 156 }
 157
 158 sub __snapshot_foreach_volume {
 159     my ($class, $conf, $func) = @_;
 160
 161     $class->foreach_mountpoint($conf, $func);
 162 }
 163
 164 # END implemented abstract methods from PVE::AbstractConfig
 165
 166 # BEGIN JSON config code
 167
 168 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 169
 170 my $rootfs_desc = {
 171     volume => {
 172         type => 'string',
 173         default_key => 1,
 174         format => 'pve-lxc-mp-string',
 175         format_description => 'volume',
 176         description => 'Volume, device or directory to mount into the container.',
 177     },
 178     backup => {
 179         type => 'boolean',
 180         format_description => '[1|0]',
 181         description => 'Whether to include the mountpoint in backups.',
 182         optional => 1,
 183     },
 184     size => {
 185         type => 'string',
 186         format => 'disk-size',
 187         format_description => 'DiskSize',
 188         description => 'Volume size (read only value).',
 189         optional => 1,
 190     },
 191     acl => {
 192         type => 'boolean',
 193         format_description => 'acl',
 194         description => 'Explicitly enable or disable ACL support.',
 195         optional => 1,
 196     },
 197     ro => {
 198         type => 'boolean',
 199         format_description => 'ro',
 200         description => 'Read-only mountpoint (not supported with bind mounts)',
 201         optional => 1,
 202     },
 203     quota => {
 204         type => 'boolean',
 205         format_description => '[0|1]',
 206         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 207         optional => 1,
 208     },
 209 };
 210
 211 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 212     type => 'string', format => $rootfs_desc,
 213     description => "Use volume as container root.",
 214     optional => 1,
 215 });
 216
 217 PVE::JSONSchema::register_standard_option('pve-lxc-snapshot-name', {
 218     description => "The name of the snapshot.",
 219     type => 'string', format => 'pve-configid',
 220     maxLength => 40,
 221 });
 222
 223 my $confdesc = {
 224     lock => {
 225         optional => 1,
 226         type => 'string',
 227         description => "Lock/unlock the VM.",
 228         enum => [qw(migrate backup snapshot rollback)],
 229     },
 230     onboot => {
 231         optional => 1,
 232         type => 'boolean',
 233         description => "Specifies whether a VM will be started during system bootup.",
 234         default => 0,
 235     },
 236     startup => get_standard_option('pve-startup-order'),
 237     template => {
 238         optional => 1,
 239         type => 'boolean',
 240         description => "Enable/disable Template.",
 241         default => 0,
 242     },
 243     arch => {
 244         optional => 1,
 245         type => 'string',
 246         enum => ['amd64', 'i386'],
 247         description => "OS architecture type.",
 248         default => 'amd64',
 249     },
 250     ostype => {
 251         optional => 1,
 252         type => 'string',
 253         enum => ['debian', 'ubuntu', 'centos', 'fedora', 'opensuse', 'archlinux', 'alpine', 'unmanaged'],
 254         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 255     },
 256     console => {
 257         optional => 1,
 258         type => 'boolean',
 259         description => "Attach a console device (/dev/console) to the container.",
 260         default => 1,
 261     },
 262     tty => {
 263         optional => 1,
 264         type => 'integer',
 265         description => "Specify the number of tty available to the container",
 266         minimum => 0,
 267         maximum => 6,
 268         default => 2,
 269     },
 270     cpulimit => {
 271         optional => 1,
 272         type => 'number',
 273         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 274         minimum => 0,
 275         maximum => 128,
 276         default => 0,
 277     },
 278     cpuunits => {
 279         optional => 1,
 280         type => 'integer',
 281         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 282         minimum => 0,
 283         maximum => 500000,
 284         default => 1024,
 285     },
 286     memory => {
 287         optional => 1,
 288         type => 'integer',
 289         description => "Amount of RAM for the VM in MB.",
 290         minimum => 16,
 291         default => 512,
 292     },
 293     swap => {
 294         optional => 1,
 295         type => 'integer',
 296         description => "Amount of SWAP for the VM in MB.",
 297         minimum => 0,
 298         default => 512,
 299     },
 300     hostname => {
 301         optional => 1,
 302         description => "Set a host name for the container.",
 303         type => 'string', format => 'dns-name',
 304         maxLength => 255,
 305     },
 306     description => {
 307         optional => 1,
 308         type => 'string',
 309         description => "Container description. Only used on the configuration web interface.",
 310     },
 311     searchdomain => {
 312         optional => 1,
 313         type => 'string', format => 'dns-name-list',
 314         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 315     },
 316     nameserver => {
 317         optional => 1,
 318         type => 'string', format => 'address-list',
 319         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 320     },
 321     rootfs => get_standard_option('pve-ct-rootfs'),
 322     parent => {
 323         optional => 1,
 324         type => 'string', format => 'pve-configid',
 325         maxLength => 40,
 326         description => "Parent snapshot name. This is used internally, and should not be modified.",
 327     },
 328     snaptime => {
 329         optional => 1,
 330         description => "Timestamp for snapshots.",
 331         type => 'integer',
 332         minimum => 0,
 333     },
 334     cmode => {
 335         optional => 1,
 336         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 337         type => 'string',
 338         enum => ['shell', 'console', 'tty'],
 339         default => 'tty',
 340     },
 341     protection => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 345         default => 0,
 346     },
 347     unprivileged => {
 348         optional => 1,
 349         type => 'boolean',
 350         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 351         default => 0,
 352     },
 353 };
 354
 355 my $valid_lxc_conf_keys = {
 356     'lxc.include' => 1,
 357     'lxc.arch' => 1,
 358     'lxc.utsname' => 1,
 359     'lxc.haltsignal' => 1,
 360     'lxc.rebootsignal' => 1,
 361     'lxc.stopsignal' => 1,
 362     'lxc.init_cmd' => 1,
 363     'lxc.network.type' => 1,
 364     'lxc.network.flags' => 1,
 365     'lxc.network.link' => 1,
 366     'lxc.network.mtu' => 1,
 367     'lxc.network.name' => 1,
 368     'lxc.network.hwaddr' => 1,
 369     'lxc.network.ipv4' => 1,
 370     'lxc.network.ipv4.gateway' => 1,
 371     'lxc.network.ipv6' => 1,
 372     'lxc.network.ipv6.gateway' => 1,
 373     'lxc.network.script.up' => 1,
 374     'lxc.network.script.down' => 1,
 375     'lxc.pts' => 1,
 376     'lxc.console.logfile' => 1,
 377     'lxc.console' => 1,
 378     'lxc.tty' => 1,
 379     'lxc.devttydir' => 1,
 380     'lxc.hook.autodev' => 1,
 381     'lxc.autodev' => 1,
 382     'lxc.kmsg' => 1,
 383     'lxc.mount' => 1,
 384     'lxc.mount.entry' => 1,
 385     'lxc.mount.auto' => 1,
 386     'lxc.rootfs' => 'lxc.rootfs is auto generated from rootfs',
 387     'lxc.rootfs.mount' => 1,
 388     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 389                             ', please use mountpoint options in the "rootfs" key',
 390     # lxc.cgroup.*
 391     'lxc.cap.drop' => 1,
 392     'lxc.cap.keep' => 1,
 393     'lxc.aa_profile' => 1,
 394     'lxc.aa_allow_incomplete' => 1,
 395     'lxc.se_context' => 1,
 396     'lxc.seccomp' => 1,
 397     'lxc.id_map' => 1,
 398     'lxc.hook.pre-start' => 1,
 399     'lxc.hook.pre-mount' => 1,
 400     'lxc.hook.mount' => 1,
 401     'lxc.hook.start' => 1,
 402     'lxc.hook.stop' => 1,
 403     'lxc.hook.post-stop' => 1,
 404     'lxc.hook.clone' => 1,
 405     'lxc.hook.destroy' => 1,
 406     'lxc.loglevel' => 1,
 407     'lxc.logfile' => 1,
 408     'lxc.start.auto' => 1,
 409     'lxc.start.delay' => 1,
 410     'lxc.start.order' => 1,
 411     'lxc.group' => 1,
 412     'lxc.environment' => 1,
 413 };
 414
 415 our $netconf_desc = {
 416     type => {
 417         type => 'string',
 418         optional => 1,
 419         description => "Network interface type.",
 420         enum => [qw(veth)],
 421     },
 422     name => {
 423         type => 'string',
 424         format_description => 'String',
 425         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 426         pattern => '[-_.\w\d]+',
 427     },
 428     bridge => {
 429         type => 'string',
 430         format_description => 'vmbr<Number>',
 431         description => 'Bridge to attach the network device to.',
 432         pattern => '[-_.\w\d]+',
 433         optional => 1,
 434     },
 435     hwaddr => {
 436         type => 'string',
 437         format_description => 'MAC',
 438         description => 'Bridge to attach the network device to. (lxc.network.hwaddr)',
 439         pattern => qr/(?:[a-f0-9]{2}:){5}[a-f0-9]{2}/i,
 440         optional => 1,
 441     },
 442     mtu => {
 443         type => 'integer',
 444         format_description => 'Number',
 445         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 446         minimum => 64, # minimum ethernet frame is 64 bytes
 447         optional => 1,
 448     },
 449     ip => {
 450         type => 'string',
 451         format => 'pve-ipv4-config',
 452         format_description => 'IPv4Format/CIDR',
 453         description => 'IPv4 address in CIDR format.',
 454         optional => 1,
 455     },
 456     gw => {
 457         type => 'string',
 458         format => 'ipv4',
 459         format_description => 'GatewayIPv4',
 460         description => 'Default gateway for IPv4 traffic.',
 461         optional => 1,
 462     },
 463     ip6 => {
 464         type => 'string',
 465         format => 'pve-ipv6-config',
 466         format_description => 'IPv6Format/CIDR',
 467         description => 'IPv6 address in CIDR format.',
 468         optional => 1,
 469     },
 470     gw6 => {
 471         type => 'string',
 472         format => 'ipv6',
 473         format_description => 'GatewayIPv6',
 474         description => 'Default gateway for IPv6 traffic.',
 475         optional => 1,
 476     },
 477     firewall => {
 478         type => 'boolean',
 479         format_description => '[1|0]',
 480         description => "Controls whether this interface's firewall rules should be used.",
 481         optional => 1,
 482     },
 483     tag => {
 484         type => 'integer',
 485         format_description => 'VlanNo',
 486         minimum => '2',
 487         maximum => '4094',
 488         description => "VLAN tag for this interface.",
 489         optional => 1,
 490     },
 491     trunks => {
 492         type => 'string',
 493         pattern => qr/\d+(?:;\d+)*/,
 494         format_description => 'vlanid[;vlanid...]',
 495         description => "VLAN ids to pass through the interface",
 496         optional => 1,
 497     },
 498     rate => {
 499         type => 'number',
 500         format_description => 'mbps',
 501         description => "Apply rate limiting to the interface",
 502         optional => 1,
 503     },
 504 };
 505 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 506
 507 my $MAX_LXC_NETWORKS = 10;
 508 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 509     $confdesc->{"net$i"} = {
 510         optional => 1,
 511         type => 'string', format => $netconf_desc,
 512         description => "Specifies network interfaces for the container.",
 513     };
 514 }
 515
 516 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 517 sub verify_lxc_mp_string {
 518     my ($mp, $noerr) = @_;
 519
 520     # do not allow:
 521     # /./ or /../
 522     # /. or /.. at the end
 523     # ../ at the beginning
 524
 525     if($mp =~ m@/\.\.?/@ ||
 526        $mp =~ m@/\.\.?$@ ||
 527        $mp =~ m@^\.\./@) {
 528         return undef if $noerr;
 529         die "$mp contains illegal character sequences\n";
 530     }
 531     return $mp;
 532 }
 533
 534 my $mp_desc = {
 535     %$rootfs_desc,
 536     mp => {
 537         type => 'string',
 538         format => 'pve-lxc-mp-string',
 539         format_description => 'Path',
 540         description => 'Path to the mountpoint as seen from inside the container.',
 541     },
 542 };
 543 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 544
 545 my $unuseddesc = {
 546     optional => 1,
 547     type => 'string', format => 'pve-volume-id',
 548     description => "Reference to unused volumes.",
 549 };
 550
 551 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 552     $confdesc->{"mp$i"} = {
 553         optional => 1,
 554         type => 'string', format => $mp_desc,
 555         description => "Use volume as container mount point (experimental feature).",
 556         optional => 1,
 557     };
 558 }
 559
 560 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 561     $confdesc->{"unused$i"} = $unuseddesc;
 562 }
 563
 564 sub parse_pct_config {
 565     my ($filename, $raw) = @_;
 566
 567     return undef if !defined($raw);
 568
 569     my $res = {
 570         digest => Digest::SHA::sha1_hex($raw),
 571         snapshots => {},
 572     };
 573
 574     $filename =~ m|/lxc/(\d+).conf$|
 575         || die "got strange filename '$filename'";
 576
 577     my $vmid = $1;
 578
 579     my $conf = $res;
 580     my $descr = '';
 581     my $section = '';
 582
 583     my @lines = split(/\n/, $raw);
 584     foreach my $line (@lines) {
 585         next if $line =~ m/^\s*$/;
 586
 587         if ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 588             $section = $1;
 589             $conf->{description} = $descr if $descr;
 590             $descr = '';
 591             $conf = $res->{snapshots}->{$section} = {};
 592             next;
 593         }
 594
 595         if ($line =~ m/^\#(.*)\s*$/) {
 596             $descr .= PVE::Tools::decode_text($1) . "\n";
 597             next;
 598         }
 599
 600         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 601             my $key = $1;
 602             my $value = $3;
 603             my $validity = $valid_lxc_conf_keys->{$key} || 0;
 604             if ($validity eq 1 || $key =~ m/^lxc\.cgroup\./) {
 605                 push @{$conf->{lxc}}, [$key, $value];
 606             } elsif (my $errmsg = $validity) {
 607                 warn "vm $vmid - $key: $errmsg\n";
 608             } else {
 609                 warn "vm $vmid - unable to parse config: $line\n";
 610             }
 611         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 612             $descr .= PVE::Tools::decode_text($2);
 613         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 614             $conf->{snapstate} = $1;
 615         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 616             my $key = $1;
 617             my $value = $2;
 618             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 619             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 620             $conf->{$key} = $value;
 621         } else {
 622             warn "vm $vmid - unable to parse config: $line\n";
 623         }
 624     }
 625
 626     $conf->{description} = $descr if $descr;
 627
 628     delete $res->{snapstate}; # just to be sure
 629
 630     return $res;
 631 }
 632
 633 sub write_pct_config {
 634     my ($filename, $conf) = @_;
 635
 636     delete $conf->{snapstate}; # just to be sure
 637
 638     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 639     my $used_volids = {};
 640     foreach my $vid (@$volidlist) {
 641         $used_volids->{$vid} = 1;
 642     }
 643
 644     # remove 'unusedX' settings if the volume is still used
 645     foreach my $key (keys %$conf) {
 646         my $value = $conf->{$key};
 647         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 648             delete $conf->{$key};
 649         }
 650     }
 651
 652     my $generate_raw_config = sub {
 653         my ($conf) = @_;
 654
 655         my $raw = '';
 656
 657         # add description as comment to top of file
 658         my $descr = $conf->{description} || '';
 659         foreach my $cl (split(/\n/, $descr)) {
 660             $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 661         }
 662
 663         foreach my $key (sort keys %$conf) {
 664             next if $key eq 'digest' || $key eq 'description' ||
 665                     $key eq 'pending' || $key eq 'snapshots' ||
 666                     $key eq 'snapname' || $key eq 'lxc';
 667             my $value = $conf->{$key};
 668             die "detected invalid newline inside property '$key'\n"
 669                 if $value =~ m/\n/;
 670             $raw .= "$key: $value\n";
 671         }
 672
 673         if (my $lxcconf = $conf->{lxc}) {
 674             foreach my $entry (@$lxcconf) {
 675                 my ($k, $v) = @$entry;
 676                 $raw .= "$k: $v\n";
 677             }
 678         }
 679
 680         return $raw;
 681     };
 682
 683     my $raw = &$generate_raw_config($conf);
 684
 685     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 686         $raw .= "\n[$snapname]\n";
 687         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 688     }
 689
 690     return $raw;
 691 }
 692
 693 sub update_pct_config {
 694     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 695
 696     my @nohotplug;
 697
 698     my $new_disks = 0;
 699     my @deleted_volumes;
 700
 701     my $rootdir;
 702     if ($running) {
 703         my $pid = PVE::LXC::find_lxc_pid($vmid);
 704         $rootdir = "/proc/$pid/root";
 705     }
 706
 707     my $hotplug_error = sub {
 708         if ($running) {
 709             push @nohotplug, @_;
 710             return 1;
 711         } else {
 712             return 0;
 713         }
 714     };
 715
 716     if (defined($delete)) {
 717         foreach my $opt (@$delete) {
 718             if (!exists($conf->{$opt})) {
 719                 warn "no such option: $opt\n";
 720                 next;
 721             }
 722
 723             if ($opt eq 'hostname' || $opt eq 'memory' || $opt eq 'rootfs') {
 724                 die "unable to delete required option '$opt'\n";
 725             } elsif ($opt eq 'swap') {
 726                 delete $conf->{$opt};
 727                 PVE::LXC::write_cgroup_value("memory", $vmid,
 728                                              "memory.memsw.limit_in_bytes", -1);
 729             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup') {
 730                 delete $conf->{$opt};
 731             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 732                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 733                 next if $hotplug_error->($opt);
 734                 delete $conf->{$opt};
 735             } elsif ($opt eq 'cpulimit') {
 736                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 737                 delete $conf->{$opt};
 738             } elsif ($opt eq 'cpuunits') {
 739                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 740                 delete $conf->{$opt};
 741             } elsif ($opt =~ m/^net(\d)$/) {
 742                 delete $conf->{$opt};
 743                 next if !$running;
 744                 my $netid = $1;
 745                 PVE::Network::veth_delete("veth${vmid}i$netid");
 746             } elsif ($opt eq 'protection') {
 747                 delete $conf->{$opt};
 748             } elsif ($opt =~ m/^unused(\d+)$/) {
 749                 next if $hotplug_error->($opt);
 750                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 751                 push @deleted_volumes, $conf->{$opt};
 752                 delete $conf->{$opt};
 753             } elsif ($opt =~ m/^mp(\d+)$/) {
 754                 next if $hotplug_error->($opt);
 755                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 756                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 757                 delete $conf->{$opt};
 758                 if ($mp->{type} eq 'volume') {
 759                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 760                 }
 761             } elsif ($opt eq 'unprivileged') {
 762                 die "unable to delete read-only option: '$opt'\n";
 763             } else {
 764                 die "implement me (delete: $opt)"
 765             }
 766             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 767         }
 768     }
 769
 770     # There's no separate swap size to configure, there's memory and "total"
 771     # memory (iow. memory+swap). This means we have to change them together.
 772     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 773     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 774     if (defined($wanted_memory) || defined($wanted_swap)) {
 775
 776         my $old_memory = ($conf->{memory} || 512);
 777         my $old_swap = ($conf->{swap} || 0);
 778
 779         $wanted_memory //= $old_memory;
 780         $wanted_swap //= $old_swap;
 781
 782         my $total = $wanted_memory + $wanted_swap;
 783         if ($running) {
 784             my $old_total = $old_memory + $old_swap;
 785             if ($total > $old_total) {
 786                 PVE::LXC::write_cgroup_value("memory", $vmid,
 787                                              "memory.memsw.limit_in_bytes",
 788                                              int($total*1024*1024));
 789                 PVE::LXC::write_cgroup_value("memory", $vmid,
 790                                              "memory.limit_in_bytes",
 791                                              int($wanted_memory*1024*1024));
 792             } else {
 793                 PVE::LXC::write_cgroup_value("memory", $vmid,
 794                                              "memory.limit_in_bytes",
 795                                              int($wanted_memory*1024*1024));
 796                 PVE::LXC::write_cgroup_value("memory", $vmid,
 797                                              "memory.memsw.limit_in_bytes",
 798                                              int($total*1024*1024));
 799             }
 800         }
 801         $conf->{memory} = $wanted_memory;
 802         $conf->{swap} = $wanted_swap;
 803
 804         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 805     }
 806
 807     my $used_volids = {};
 808     my $check_content_type = sub {
 809         my ($mp) = @_;
 810         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 811         my $scfg = PVE::Storage::config();
 812         my $storage_config = PVE::Storage::storage_config($scfg, $sid);
 813         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 814             if !$storage_config->{content}->{rootdir};
 815     };
 816
 817     foreach my $opt (keys %$param) {
 818         my $value = $param->{$opt};
 819         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
 820         if ($opt eq 'hostname') {
 821             $conf->{$opt} = $value;
 822         } elsif ($opt eq 'onboot') {
 823             $conf->{$opt} = $value ? 1 : 0;
 824         } elsif ($opt eq 'startup') {
 825             $conf->{$opt} = $value;
 826         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 827             next if $hotplug_error->($opt);
 828             $conf->{$opt} = $value;
 829         } elsif ($opt eq 'nameserver') {
 830             next if $hotplug_error->($opt);
 831             my $list = PVE::LXC::verify_nameserver_list($value);
 832             $conf->{$opt} = $list;
 833         } elsif ($opt eq 'searchdomain') {
 834             next if $hotplug_error->($opt);
 835             my $list = PVE::LXC::verify_searchdomain_list($value);
 836             $conf->{$opt} = $list;
 837         } elsif ($opt eq 'cpulimit') {
 838             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
 839             $conf->{$opt} = $value;
 840         } elsif ($opt eq 'cpuunits') {
 841             $conf->{$opt} = $value;
 842             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
 843         } elsif ($opt eq 'description') {
 844             $conf->{$opt} = PVE::Tools::encode_text($value);
 845         } elsif ($opt =~ m/^net(\d+)$/) {
 846             my $netid = $1;
 847             my $net = PVE::LXC::Config->parse_lxc_network($value);
 848             if (!$running) {
 849                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
 850             } else {
 851                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
 852             }
 853         } elsif ($opt eq 'protection') {
 854             $conf->{$opt} = $value ? 1 : 0;
 855         } elsif ($opt =~ m/^mp(\d+)$/) {
 856             next if $hotplug_error->($opt);
 857             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 858             my $old = $conf->{$opt};
 859             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
 860             if ($mp->{type} eq 'volume') {
 861                 &$check_content_type($mp);
 862                 $used_volids->{$mp->{volume}} = 1;
 863             }
 864             $conf->{$opt} = $value;
 865             if (defined($old)) {
 866                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
 867                 if ($mp->{type} eq 'volume') {
 868                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 869                 }
 870             }
 871             $new_disks = 1;
 872         } elsif ($opt eq 'rootfs') {
 873             next if $hotplug_error->($opt);
 874             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 875             my $old = $conf->{$opt};
 876             $conf->{$opt} = $value;
 877             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
 878             if ($mp->{type} eq 'volume') {
 879                 &$check_content_type($mp);
 880                 $used_volids->{$mp->{volume}} = 1;
 881             }
 882             if (defined($old)) {
 883                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
 884                 if ($mp->{type} eq 'volume') {
 885                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 886                 }
 887             }
 888             $new_disks = 1;
 889         } elsif ($opt eq 'unprivileged') {
 890             die "unable to modify read-only option: '$opt'\n";
 891         } elsif ($opt eq 'ostype') {
 892             next if $hotplug_error->($opt);
 893             $conf->{$opt} = $value;
 894         } else {
 895             die "implement me: $opt";
 896         }
 897         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 898     }
 899
 900     # Apply deletions and creations of new volumes
 901     if (@deleted_volumes) {
 902         my $storage_cfg = PVE::Storage::config();
 903         foreach my $volume (@deleted_volumes) {
 904             next if $used_volids->{$volume}; # could have been re-added, too
 905             # also check for references in snapshots
 906             next if $class->is_volume_in_use($conf, $volume, 1);
 907             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
 908         }
 909     }
 910
 911     if ($new_disks) {
 912         my $storage_cfg = PVE::Storage::config();
 913         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
 914     }
 915
 916     # This should be the last thing we do here
 917     if ($running && scalar(@nohotplug)) {
 918         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
 919     }
 920 }
 921
 922 sub check_type {
 923     my ($class, $key, $value) = @_;
 924
 925     die "unknown setting '$key'\n" if !$confdesc->{$key};
 926
 927     my $type = $confdesc->{$key}->{type};
 928
 929     if (!defined($value)) {
 930         die "got undefined value\n";
 931     }
 932
 933     if ($value =~ m/[\n\r]/) {
 934         die "property contains a line feed\n";
 935     }
 936
 937     if ($type eq 'boolean') {
 938         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
 939         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
 940         die "type check ('boolean') failed - got '$value'\n";
 941     } elsif ($type eq 'integer') {
 942         return int($1) if $value =~ m/^(\d+)$/;
 943         die "type check ('integer') failed - got '$value'\n";
 944     } elsif ($type eq 'number') {
 945         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
 946         die "type check ('number') failed - got '$value'\n";
 947     } elsif ($type eq 'string') {
 948         if (my $fmt = $confdesc->{$key}->{format}) {
 949             PVE::JSONSchema::check_format($fmt, $value);
 950             return $value;
 951         }
 952         return $value;
 953     } else {
 954         die "internal error"
 955     }
 956 }
 957
 958
 959 # add JSON properties for create and set function
 960 sub json_config_properties {
 961     my ($class, $prop) = @_;
 962
 963     foreach my $opt (keys %$confdesc) {
 964         next if $opt eq 'parent' || $opt eq 'snaptime';
 965         next if $prop->{$opt};
 966         $prop->{$opt} = $confdesc->{$opt};
 967     }
 968
 969     return $prop;
 970 }
 971
 972 sub __parse_ct_mountpoint_full {
 973     my ($class, $desc, $data, $noerr) = @_;
 974
 975     $data //= '';
 976
 977     my $res;
 978     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
 979     if ($@) {
 980         return undef if $noerr;
 981         die $@;
 982     }
 983
 984     if (defined(my $size = $res->{size})) {
 985         $size = PVE::JSONSchema::parse_size($size);
 986         if (!defined($size)) {
 987             return undef if $noerr;
 988             die "invalid size: $size\n";
 989         }
 990         $res->{size} = $size;
 991     }
 992
 993     $res->{type} = $class->classify_mountpoint($res->{volume});
 994
 995     return $res;
 996 };
 997
 998 sub parse_ct_rootfs {
 999     my ($class, $data, $noerr) = @_;
1000
1001     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1002
1003     $res->{mp} = '/' if defined($res);
1004
1005     return $res;
1006 }
1007
1008 sub parse_ct_mountpoint {
1009     my ($class, $data, $noerr) = @_;
1010
1011     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1012 }
1013
1014 sub print_ct_mountpoint {
1015     my ($class, $info, $nomp) = @_;
1016     my $skip = [ 'type' ];
1017     push @$skip, 'mp' if $nomp;
1018     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1019 }
1020
1021 sub print_lxc_network {
1022     my ($class, $net) = @_;
1023     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1024 }
1025
1026 sub parse_lxc_network {
1027     my ($class, $data) = @_;
1028
1029     my $res = {};
1030
1031     return $res if !$data;
1032
1033     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1034
1035     $res->{type} = 'veth';
1036     $res->{hwaddr} = PVE::Tools::random_ether_addr() if !$res->{hwaddr};
1037
1038     return $res;
1039 }
1040
1041 sub option_exists {
1042     my ($class, $name) = @_;
1043
1044     return defined($confdesc->{$name});
1045 }
1046 # END JSON config code
1047
1048 sub classify_mountpoint {
1049     my ($class, $vol) = @_;
1050     if ($vol =~ m!^/!) {
1051         return 'device' if $vol =~ m!^/dev/!;
1052         return 'bind';
1053     }
1054     return 'volume';
1055 }
1056
1057 sub is_volume_in_use {
1058     my ($class, $config, $volid, $include_snapshots) = @_;
1059     my $used = 0;
1060
1061     $class->foreach_mountpoint($config, sub {
1062         my ($ms, $mountpoint) = @_;
1063         return if $used;
1064         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1065     });
1066
1067     my $snapshots = $config->{snapshots};
1068     if ($include_snapshots && $snapshots) {
1069         foreach my $snap (keys %$snapshots) {
1070             $used ||= $class->is_volume_in_use($snapshots->{$snap}, $volid);
1071         }
1072     }
1073
1074     return $used;
1075 }
1076
1077 sub has_dev_console {
1078     my ($class, $conf) = @_;
1079
1080     return !(defined($conf->{console}) && !$conf->{console});
1081 }
1082
1083 sub get_tty_count {
1084     my ($class, $conf) = @_;
1085
1086     return $conf->{tty} // $confdesc->{tty}->{default};
1087 }
1088
1089 sub get_cmode {
1090     my ($class, $conf) = @_;
1091
1092     return $conf->{cmode} // $confdesc->{cmode}->{default};
1093 }
1094
1095 sub mountpoint_names {
1096     my ($class, $reverse) = @_;
1097
1098     my @names = ('rootfs');
1099
1100     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1101         push @names, "mp$i";
1102     }
1103
1104     return $reverse ? reverse @names : @names;
1105 }
1106
1107 sub foreach_mountpoint_full {
1108     my ($class, $conf, $reverse, $func) = @_;
1109
1110     foreach my $key ($class->mountpoint_names($reverse)) {
1111         my $value = $conf->{$key};
1112         next if !defined($value);
1113         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1114         next if !defined($mountpoint);
1115
1116         &$func($key, $mountpoint);
1117     }
1118 }
1119
1120 sub foreach_mountpoint {
1121     my ($class, $conf, $func) = @_;
1122
1123     $class->foreach_mountpoint_full($conf, 0, $func);
1124 }
1125
1126 sub foreach_mountpoint_reverse {
1127     my ($class, $conf, $func) = @_;
1128
1129     $class->foreach_mountpoint_full($conf, 1, $func);
1130 }
1131
1132 sub get_vm_volumes {
1133     my ($class, $conf, $excludes) = @_;
1134
1135     my $vollist = [];
1136
1137     $class->foreach_mountpoint($conf, sub {
1138         my ($ms, $mountpoint) = @_;
1139
1140         return if $excludes && $ms eq $excludes;
1141
1142         my $volid = $mountpoint->{volume};
1143         return if !$volid || $mountpoint->{type} ne 'volume';
1144
1145         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1146         return if !$sid;
1147
1148         push @$vollist, $volid;
1149     });
1150
1151     return $vollist;
1152 }
1153
1154 return 1;