src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::INotify;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::Tools;
  11
  12 use base qw(PVE::AbstractConfig);
  13
  14 my $nodename = PVE::INotify::nodename();
  15 my $lock_handles =  {};
  16 my $lockdir = "/run/lock/lxc";
  17 mkdir $lockdir;
  18 mkdir "/etc/pve/nodes/$nodename/lxc";
  19 my $MAX_MOUNT_POINTS = 10;
  20 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  21
  22 # BEGIN implemented abstract methods from PVE::AbstractConfig
  23
  24 sub guest_type {
  25     return "CT";
  26 }
  27
  28 sub __config_max_unused_disks {
  29     my ($class) = @_;
  30
  31     return $MAX_UNUSED_DISKS;
  32 }
  33
  34 sub config_file_lock {
  35     my ($class, $vmid) = @_;
  36
  37     return "$lockdir/pve-config-${vmid}.lock";
  38 }
  39
  40 sub cfs_config_path {
  41     my ($class, $vmid, $node) = @_;
  42
  43     $node = $nodename if !$node;
  44     return "nodes/$node/lxc/$vmid.conf";
  45 }
  46
  47 sub mountpoint_backup_enabled {
  48     my ($class, $mp_key, $mountpoint) = @_;
  49
  50     return 1 if $mp_key eq 'rootfs';
  51
  52     return 0 if $mountpoint->{type} ne 'volume';
  53
  54     return 1 if $mountpoint->{backup};
  55
  56     return 0;
  57 }
  58
  59 sub has_feature {
  60     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  61     my $err;
  62
  63     $class->foreach_mountpoint($conf, sub {
  64         my ($ms, $mountpoint) = @_;
  65
  66         return if $err; # skip further test
  67         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  68
  69         $err = 1
  70             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  71                                                  $mountpoint->{volume},
  72                                                  $snapname, $running);
  73     });
  74
  75     return $err ? 0 : 1;
  76 }
  77
  78 sub __snapshot_save_vmstate {
  79     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  80     die "implement me - snapshot_save_vmstate\n";
  81 }
  82
  83 sub __snapshot_check_running {
  84     my ($class, $vmid) = @_;
  85     return PVE::LXC::check_running($vmid);
  86 }
  87
  88 sub __snapshot_check_freeze_needed {
  89     my ($class, $vmid, $config, $save_vmstate) = @_;
  90
  91     my $ret = $class->__snapshot_check_running($vmid);
  92     return ($ret, $ret);
  93 }
  94
  95 sub __snapshot_freeze {
  96     my ($class, $vmid, $unfreeze) = @_;
  97
  98     if ($unfreeze) {
  99         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 100         warn $@ if $@;
 101     } else {
 102         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 103         PVE::LXC::sync_container_namespace($vmid);
 104     }
 105 }
 106
 107 sub __snapshot_create_vol_snapshot {
 108     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 109
 110     my $storecfg = PVE::Storage::config();
 111
 112     return if $snapname eq 'vzdump' &&
 113         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 114
 115     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 116 }
 117
 118 sub __snapshot_delete_remove_drive {
 119     my ($class, $snap, $remove_drive) = @_;
 120
 121     if ($remove_drive eq 'vmstate') {
 122         die "implement me - saving vmstate\n";
 123     } else {
 124         my $value = $snap->{$remove_drive};
 125         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 126         delete $snap->{$remove_drive};
 127
 128         $class->add_unused_volume($snap, $mountpoint->{volume})
 129             if ($mountpoint->{type} eq 'volume');
 130     }
 131 }
 132
 133 sub __snapshot_delete_vmstate_file {
 134     my ($class, $snap, $force) = @_;
 135
 136     die "implement me - saving vmstate\n";
 137 }
 138
 139 sub __snapshot_delete_vol_snapshot {
 140     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 141
 142     return if $snapname eq 'vzdump' &&
 143         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 144
 145     my $storecfg = PVE::Storage::config();
 146     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 147     push @$unused, $mountpoint->{volume};
 148 }
 149
 150 sub __snapshot_rollback_vol_possible {
 151     my ($class, $mountpoint, $snapname) = @_;
 152
 153     my $storecfg = PVE::Storage::config();
 154     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 155 }
 156
 157 sub __snapshot_rollback_vol_rollback {
 158     my ($class, $mountpoint, $snapname) = @_;
 159
 160     my $storecfg = PVE::Storage::config();
 161     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 162 }
 163
 164 sub __snapshot_rollback_vm_stop {
 165     my ($class, $vmid) = @_;
 166
 167     PVE::Tools::run_command(['/usr/bin/lxc-stop', '-n', $vmid, '--kill'])
 168         if $class->__snapshot_check_running($vmid);
 169 }
 170
 171 sub __snapshot_rollback_vm_start {
 172     my ($class, $vmid, $vmstate, $forcemachine);
 173
 174     die "implement me - save vmstate\n";
 175 }
 176
 177 sub __snapshot_rollback_get_unused {
 178     my ($class, $conf, $snap) = @_;
 179
 180     my $unused = [];
 181
 182     $class->__snapshot_foreach_volume($conf, sub {
 183         my ($vs, $volume) = @_;
 184
 185         return if $volume->{type} ne 'volume';
 186
 187         my $found = 0;
 188         my $volid = $volume->{volume};
 189
 190         $class->__snapshot_foreach_volume($snap, sub {
 191             my ($ms, $mountpoint) = @_;
 192
 193             return if $found;
 194             return if ($mountpoint->{type} ne 'volume');
 195
 196             $found = 1
 197                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 198         });
 199
 200         push @$unused, $volid if !$found;
 201     });
 202
 203     return $unused;
 204 }
 205
 206 sub __snapshot_foreach_volume {
 207     my ($class, $conf, $func) = @_;
 208
 209     $class->foreach_mountpoint($conf, $func);
 210 }
 211
 212 # END implemented abstract methods from PVE::AbstractConfig
 213
 214 # BEGIN JSON config code
 215
 216 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 217
 218 my $rootfs_desc = {
 219     volume => {
 220         type => 'string',
 221         default_key => 1,
 222         format => 'pve-lxc-mp-string',
 223         format_description => 'volume',
 224         description => 'Volume, device or directory to mount into the container.',
 225     },
 226     size => {
 227         type => 'string',
 228         format => 'disk-size',
 229         format_description => 'DiskSize',
 230         description => 'Volume size (read only value).',
 231         optional => 1,
 232     },
 233     acl => {
 234         type => 'boolean',
 235         description => 'Explicitly enable or disable ACL support.',
 236         optional => 1,
 237     },
 238     ro => {
 239         type => 'boolean',
 240         description => 'Read-only mount point',
 241         optional => 1,
 242     },
 243     quota => {
 244         type => 'boolean',
 245         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 246         optional => 1,
 247     },
 248     replicate => {
 249         type => 'boolean',
 250         description => 'Will include this volume to a storage replica job.',
 251         optional => 1,
 252         default => 1,
 253     },
 254     shared => {
 255         type => 'boolean',
 256         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 257         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 258         optional => 1,
 259         default => 0,
 260     },
 261 };
 262
 263 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 264     type => 'string', format => $rootfs_desc,
 265     description => "Use volume as container root.",
 266     optional => 1,
 267 });
 268
 269 PVE::JSONSchema::register_standard_option('pve-lxc-snapshot-name', {
 270     description => "The name of the snapshot.",
 271     type => 'string', format => 'pve-configid',
 272     maxLength => 40,
 273 });
 274
 275 my $confdesc = {
 276     lock => {
 277         optional => 1,
 278         type => 'string',
 279         description => "Lock/unlock the VM.",
 280         enum => [qw(migrate backup snapshot rollback)],
 281     },
 282     onboot => {
 283         optional => 1,
 284         type => 'boolean',
 285         description => "Specifies whether a VM will be started during system bootup.",
 286         default => 0,
 287     },
 288     startup => get_standard_option('pve-startup-order'),
 289     template => {
 290         optional => 1,
 291         type => 'boolean',
 292         description => "Enable/disable Template.",
 293         default => 0,
 294     },
 295     arch => {
 296         optional => 1,
 297         type => 'string',
 298         enum => ['amd64', 'i386'],
 299         description => "OS architecture type.",
 300         default => 'amd64',
 301     },
 302     ostype => {
 303         optional => 1,
 304         type => 'string',
 305         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 306         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 307     },
 308     console => {
 309         optional => 1,
 310         type => 'boolean',
 311         description => "Attach a console device (/dev/console) to the container.",
 312         default => 1,
 313     },
 314     tty => {
 315         optional => 1,
 316         type => 'integer',
 317         description => "Specify the number of tty available to the container",
 318         minimum => 0,
 319         maximum => 6,
 320         default => 2,
 321     },
 322     cores => {
 323         optional => 1,
 324         type => 'integer',
 325         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 326         minimum => 1,
 327         maximum => 128,
 328     },
 329     cpulimit => {
 330         optional => 1,
 331         type => 'number',
 332         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 333         minimum => 0,
 334         maximum => 128,
 335         default => 0,
 336     },
 337     cpuunits => {
 338         optional => 1,
 339         type => 'integer',
 340         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 341         minimum => 0,
 342         maximum => 500000,
 343         default => 1024,
 344     },
 345     memory => {
 346         optional => 1,
 347         type => 'integer',
 348         description => "Amount of RAM for the VM in MB.",
 349         minimum => 16,
 350         default => 512,
 351     },
 352     swap => {
 353         optional => 1,
 354         type => 'integer',
 355         description => "Amount of SWAP for the VM in MB.",
 356         minimum => 0,
 357         default => 512,
 358     },
 359     hostname => {
 360         optional => 1,
 361         description => "Set a host name for the container.",
 362         type => 'string', format => 'dns-name',
 363         maxLength => 255,
 364     },
 365     description => {
 366         optional => 1,
 367         type => 'string',
 368         description => "Container description. Only used on the configuration web interface.",
 369     },
 370     searchdomain => {
 371         optional => 1,
 372         type => 'string', format => 'dns-name-list',
 373         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 374     },
 375     nameserver => {
 376         optional => 1,
 377         type => 'string', format => 'address-list',
 378         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 379     },
 380     rootfs => get_standard_option('pve-ct-rootfs'),
 381     parent => {
 382         optional => 1,
 383         type => 'string', format => 'pve-configid',
 384         maxLength => 40,
 385         description => "Parent snapshot name. This is used internally, and should not be modified.",
 386     },
 387     snaptime => {
 388         optional => 1,
 389         description => "Timestamp for snapshots.",
 390         type => 'integer',
 391         minimum => 0,
 392     },
 393     replicate => get_standard_option('pve-replicate'),
 394     cmode => {
 395         optional => 1,
 396         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 397         type => 'string',
 398         enum => ['shell', 'console', 'tty'],
 399         default => 'tty',
 400     },
 401     protection => {
 402         optional => 1,
 403         type => 'boolean',
 404         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 405         default => 0,
 406     },
 407     unprivileged => {
 408         optional => 1,
 409         type => 'boolean',
 410         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 411         default => 0,
 412     },
 413 };
 414
 415 my $valid_lxc_conf_keys = {
 416     'lxc.include' => 1,
 417     'lxc.arch' => 1,
 418     'lxc.utsname' => 1,
 419     'lxc.haltsignal' => 1,
 420     'lxc.rebootsignal' => 1,
 421     'lxc.stopsignal' => 1,
 422     'lxc.init_cmd' => 1,
 423     'lxc.network.type' => 1,
 424     'lxc.network.flags' => 1,
 425     'lxc.network.link' => 1,
 426     'lxc.network.mtu' => 1,
 427     'lxc.network.name' => 1,
 428     'lxc.network.hwaddr' => 1,
 429     'lxc.network.ipv4' => 1,
 430     'lxc.network.ipv4.gateway' => 1,
 431     'lxc.network.ipv6' => 1,
 432     'lxc.network.ipv6.gateway' => 1,
 433     'lxc.network.script.up' => 1,
 434     'lxc.network.script.down' => 1,
 435     'lxc.pts' => 1,
 436     'lxc.console.logfile' => 1,
 437     'lxc.console' => 1,
 438     'lxc.tty' => 1,
 439     'lxc.devttydir' => 1,
 440     'lxc.hook.autodev' => 1,
 441     'lxc.autodev' => 1,
 442     'lxc.kmsg' => 1,
 443     'lxc.mount' => 1,
 444     'lxc.mount.entry' => 1,
 445     'lxc.mount.auto' => 1,
 446     'lxc.rootfs' => 'lxc.rootfs is auto generated from rootfs',
 447     'lxc.rootfs.mount' => 1,
 448     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 449                             ', please use mount point options in the "rootfs" key',
 450     # lxc.cgroup.*
 451     # lxc.limit.*
 452     'lxc.cap.drop' => 1,
 453     'lxc.cap.keep' => 1,
 454     'lxc.aa_profile' => 1,
 455     'lxc.aa_allow_incomplete' => 1,
 456     'lxc.se_context' => 1,
 457     'lxc.seccomp' => 1,
 458     'lxc.id_map' => 1,
 459     'lxc.hook.pre-start' => 1,
 460     'lxc.hook.pre-mount' => 1,
 461     'lxc.hook.mount' => 1,
 462     'lxc.hook.start' => 1,
 463     'lxc.hook.stop' => 1,
 464     'lxc.hook.post-stop' => 1,
 465     'lxc.hook.clone' => 1,
 466     'lxc.hook.destroy' => 1,
 467     'lxc.loglevel' => 1,
 468     'lxc.logfile' => 1,
 469     'lxc.start.auto' => 1,
 470     'lxc.start.delay' => 1,
 471     'lxc.start.order' => 1,
 472     'lxc.group' => 1,
 473     'lxc.environment' => 1,
 474 };
 475
 476 our $netconf_desc = {
 477     type => {
 478         type => 'string',
 479         optional => 1,
 480         description => "Network interface type.",
 481         enum => [qw(veth)],
 482     },
 483     name => {
 484         type => 'string',
 485         format_description => 'string',
 486         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 487         pattern => '[-_.\w\d]+',
 488     },
 489     bridge => {
 490         type => 'string',
 491         format_description => 'bridge',
 492         description => 'Bridge to attach the network device to.',
 493         pattern => '[-_.\w\d]+',
 494         optional => 1,
 495     },
 496     hwaddr => {
 497         type => 'string',
 498         format_description => "XX:XX:XX:XX:XX:XX",
 499         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 500         pattern => qr/(?:[a-f0-9]{2}:){5}[a-f0-9]{2}/i,
 501         optional => 1,
 502     },
 503     mtu => {
 504         type => 'integer',
 505         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 506         minimum => 64, # minimum ethernet frame is 64 bytes
 507         optional => 1,
 508     },
 509     ip => {
 510         type => 'string',
 511         format => 'pve-ipv4-config',
 512         format_description => 'IPv4Format/CIDR',
 513         description => 'IPv4 address in CIDR format.',
 514         optional => 1,
 515     },
 516     gw => {
 517         type => 'string',
 518         format => 'ipv4',
 519         format_description => 'GatewayIPv4',
 520         description => 'Default gateway for IPv4 traffic.',
 521         optional => 1,
 522     },
 523     ip6 => {
 524         type => 'string',
 525         format => 'pve-ipv6-config',
 526         format_description => 'IPv6Format/CIDR',
 527         description => 'IPv6 address in CIDR format.',
 528         optional => 1,
 529     },
 530     gw6 => {
 531         type => 'string',
 532         format => 'ipv6',
 533         format_description => 'GatewayIPv6',
 534         description => 'Default gateway for IPv6 traffic.',
 535         optional => 1,
 536     },
 537     firewall => {
 538         type => 'boolean',
 539         description => "Controls whether this interface's firewall rules should be used.",
 540         optional => 1,
 541     },
 542     tag => {
 543         type => 'integer',
 544         minimum => 1,
 545         maximum => 4094,
 546         description => "VLAN tag for this interface.",
 547         optional => 1,
 548     },
 549     trunks => {
 550         type => 'string',
 551         pattern => qr/\d+(?:;\d+)*/,
 552         format_description => 'vlanid[;vlanid...]',
 553         description => "VLAN ids to pass through the interface",
 554         optional => 1,
 555     },
 556     rate => {
 557         type => 'number',
 558         format_description => 'mbps',
 559         description => "Apply rate limiting to the interface",
 560         optional => 1,
 561     },
 562 };
 563 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 564
 565 my $MAX_LXC_NETWORKS = 10;
 566 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 567     $confdesc->{"net$i"} = {
 568         optional => 1,
 569         type => 'string', format => $netconf_desc,
 570         description => "Specifies network interfaces for the container.",
 571     };
 572 }
 573
 574 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 575 sub verify_lxc_mp_string {
 576     my ($mp, $noerr) = @_;
 577
 578     # do not allow:
 579     # /./ or /../
 580     # /. or /.. at the end
 581     # ../ at the beginning
 582
 583     if($mp =~ m@/\.\.?/@ ||
 584        $mp =~ m@/\.\.?$@ ||
 585        $mp =~ m@^\.\./@) {
 586         return undef if $noerr;
 587         die "$mp contains illegal character sequences\n";
 588     }
 589     return $mp;
 590 }
 591
 592 my $mp_desc = {
 593     %$rootfs_desc,
 594     backup => {
 595         type => 'boolean',
 596         description => 'Whether to include the mount point in backups.',
 597         verbose_description => 'Whether to include the mount point in backups '.
 598                                '(only used for volume mount points).',
 599         optional => 1,
 600     },
 601     mp => {
 602         type => 'string',
 603         format => 'pve-lxc-mp-string',
 604         format_description => 'Path',
 605         description => 'Path to the mount point as seen from inside the container '.
 606                        '(must not contain symlinks).',
 607         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 608                                "NOTE: Must not contain any symlinks for security reasons."
 609     },
 610 };
 611 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 612
 613 my $unuseddesc = {
 614     optional => 1,
 615     type => 'string', format => 'pve-volume-id',
 616     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 617 };
 618
 619 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 620     $confdesc->{"mp$i"} = {
 621         optional => 1,
 622         type => 'string', format => $mp_desc,
 623         description => "Use volume as container mount point.",
 624         optional => 1,
 625     };
 626 }
 627
 628 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 629     $confdesc->{"unused$i"} = $unuseddesc;
 630 }
 631
 632 sub parse_pct_config {
 633     my ($filename, $raw) = @_;
 634
 635     return undef if !defined($raw);
 636
 637     my $res = {
 638         digest => Digest::SHA::sha1_hex($raw),
 639         snapshots => {},
 640     };
 641
 642     $filename =~ m|/lxc/(\d+).conf$|
 643         || die "got strange filename '$filename'";
 644
 645     my $vmid = $1;
 646
 647     my $conf = $res;
 648     my $descr = '';
 649     my $section = '';
 650
 651     my @lines = split(/\n/, $raw);
 652     foreach my $line (@lines) {
 653         next if $line =~ m/^\s*$/;
 654
 655         if ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 656             $section = $1;
 657             $conf->{description} = $descr if $descr;
 658             $descr = '';
 659             $conf = $res->{snapshots}->{$section} = {};
 660             next;
 661         }
 662
 663         if ($line =~ m/^\#(.*)\s*$/) {
 664             $descr .= PVE::Tools::decode_text($1) . "\n";
 665             next;
 666         }
 667
 668         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 669             my $key = $1;
 670             my $value = $3;
 671             my $validity = $valid_lxc_conf_keys->{$key} || 0;
 672             if ($validity eq 1 || $key =~ m/^lxc\.(?:cgroup|limit)\./) {
 673                 push @{$conf->{lxc}}, [$key, $value];
 674             } elsif (my $errmsg = $validity) {
 675                 warn "vm $vmid - $key: $errmsg\n";
 676             } else {
 677                 warn "vm $vmid - unable to parse config: $line\n";
 678             }
 679         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 680             $descr .= PVE::Tools::decode_text($2);
 681         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 682             $conf->{snapstate} = $1;
 683         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 684             my $key = $1;
 685             my $value = $2;
 686             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 687             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 688             $conf->{$key} = $value;
 689         } else {
 690             warn "vm $vmid - unable to parse config: $line\n";
 691         }
 692     }
 693
 694     $conf->{description} = $descr if $descr;
 695
 696     delete $res->{snapstate}; # just to be sure
 697
 698     return $res;
 699 }
 700
 701 sub write_pct_config {
 702     my ($filename, $conf) = @_;
 703
 704     delete $conf->{snapstate}; # just to be sure
 705
 706     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 707     my $used_volids = {};
 708     foreach my $vid (@$volidlist) {
 709         $used_volids->{$vid} = 1;
 710     }
 711
 712     # remove 'unusedX' settings if the volume is still used
 713     foreach my $key (keys %$conf) {
 714         my $value = $conf->{$key};
 715         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 716             delete $conf->{$key};
 717         }
 718     }
 719
 720     my $generate_raw_config = sub {
 721         my ($conf) = @_;
 722
 723         my $raw = '';
 724
 725         # add description as comment to top of file
 726         my $descr = $conf->{description} || '';
 727         foreach my $cl (split(/\n/, $descr)) {
 728             $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 729         }
 730
 731         foreach my $key (sort keys %$conf) {
 732             next if $key eq 'digest' || $key eq 'description' ||
 733                     $key eq 'pending' || $key eq 'snapshots' ||
 734                     $key eq 'snapname' || $key eq 'lxc';
 735             my $value = $conf->{$key};
 736             die "detected invalid newline inside property '$key'\n"
 737                 if $value =~ m/\n/;
 738             $raw .= "$key: $value\n";
 739         }
 740
 741         if (my $lxcconf = $conf->{lxc}) {
 742             foreach my $entry (@$lxcconf) {
 743                 my ($k, $v) = @$entry;
 744                 $raw .= "$k: $v\n";
 745             }
 746         }
 747
 748         return $raw;
 749     };
 750
 751     my $raw = &$generate_raw_config($conf);
 752
 753     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 754         $raw .= "\n[$snapname]\n";
 755         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 756     }
 757
 758     return $raw;
 759 }
 760
 761 sub update_pct_config {
 762     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 763
 764     my @nohotplug;
 765
 766     my $new_disks = 0;
 767     my @deleted_volumes;
 768
 769     my $rootdir;
 770     if ($running) {
 771         my $pid = PVE::LXC::find_lxc_pid($vmid);
 772         $rootdir = "/proc/$pid/root";
 773     }
 774
 775     my $hotplug_error = sub {
 776         if ($running) {
 777             push @nohotplug, @_;
 778             return 1;
 779         } else {
 780             return 0;
 781         }
 782     };
 783
 784     if (defined($delete)) {
 785         foreach my $opt (@$delete) {
 786             if (!exists($conf->{$opt})) {
 787                 # silently ignore
 788                 next;
 789             }
 790
 791             if ($opt eq 'memory' || $opt eq 'rootfs') {
 792                 die "unable to delete required option '$opt'\n";
 793             } elsif ($opt eq 'hostname') {
 794                 delete $conf->{$opt};
 795             } elsif ($opt eq 'swap') {
 796                 delete $conf->{$opt};
 797                 PVE::LXC::write_cgroup_value("memory", $vmid,
 798                                              "memory.memsw.limit_in_bytes", -1);
 799             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup') {
 800                 delete $conf->{$opt};
 801             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 802                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 803                 next if $hotplug_error->($opt);
 804                 delete $conf->{$opt};
 805             } elsif ($opt eq 'cores') {
 806                 delete $conf->{$opt}; # rest is handled by pvestatd
 807             } elsif ($opt eq 'cpulimit') {
 808                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 809                 delete $conf->{$opt};
 810             } elsif ($opt eq 'cpuunits') {
 811                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 812                 delete $conf->{$opt};
 813             } elsif ($opt =~ m/^net(\d)$/) {
 814                 delete $conf->{$opt};
 815                 next if !$running;
 816                 my $netid = $1;
 817                 PVE::Network::veth_delete("veth${vmid}i$netid");
 818             } elsif ($opt eq 'protection') {
 819                 delete $conf->{$opt};
 820             } elsif ($opt =~ m/^unused(\d+)$/) {
 821                 next if $hotplug_error->($opt);
 822                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 823                 push @deleted_volumes, $conf->{$opt};
 824                 delete $conf->{$opt};
 825             } elsif ($opt =~ m/^mp(\d+)$/) {
 826                 next if $hotplug_error->($opt);
 827                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 828                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 829                 delete $conf->{$opt};
 830                 if ($mp->{type} eq 'volume') {
 831                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 832                 }
 833             } elsif ($opt eq 'unprivileged') {
 834                 die "unable to delete read-only option: '$opt'\n";
 835             }  elsif ($opt eq "replicate") {
 836                 delete $conf->{$opt};
 837             } else {
 838                 die "implement me (delete: $opt)"
 839             }
 840             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 841         }
 842     }
 843
 844     # There's no separate swap size to configure, there's memory and "total"
 845     # memory (iow. memory+swap). This means we have to change them together.
 846     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 847     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 848     if (defined($wanted_memory) || defined($wanted_swap)) {
 849
 850         my $old_memory = ($conf->{memory} || 512);
 851         my $old_swap = ($conf->{swap} || 0);
 852
 853         $wanted_memory //= $old_memory;
 854         $wanted_swap //= $old_swap;
 855
 856         my $total = $wanted_memory + $wanted_swap;
 857         if ($running) {
 858             my $old_total = $old_memory + $old_swap;
 859             if ($total > $old_total) {
 860                 PVE::LXC::write_cgroup_value("memory", $vmid,
 861                                              "memory.memsw.limit_in_bytes",
 862                                              int($total*1024*1024));
 863                 PVE::LXC::write_cgroup_value("memory", $vmid,
 864                                              "memory.limit_in_bytes",
 865                                              int($wanted_memory*1024*1024));
 866             } else {
 867                 PVE::LXC::write_cgroup_value("memory", $vmid,
 868                                              "memory.limit_in_bytes",
 869                                              int($wanted_memory*1024*1024));
 870                 PVE::LXC::write_cgroup_value("memory", $vmid,
 871                                              "memory.memsw.limit_in_bytes",
 872                                              int($total*1024*1024));
 873             }
 874         }
 875         $conf->{memory} = $wanted_memory;
 876         $conf->{swap} = $wanted_swap;
 877
 878         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 879     }
 880
 881     my $storecfg = PVE::Storage::config();
 882
 883     my $used_volids = {};
 884     my $check_content_type = sub {
 885         my ($mp) = @_;
 886         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 887         my $storage_config = PVE::Storage::storage_config($storecfg, $sid);
 888         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 889             if !$storage_config->{content}->{rootdir};
 890     };
 891
 892     foreach my $opt (keys %$param) {
 893         my $value = $param->{$opt};
 894         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
 895         if ($opt eq 'hostname' || $opt eq 'arch') {
 896             $conf->{$opt} = $value;
 897         } elsif ($opt eq 'onboot') {
 898             $conf->{$opt} = $value ? 1 : 0;
 899         } elsif ($opt eq 'startup') {
 900             $conf->{$opt} = $value;
 901         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 902             next if $hotplug_error->($opt);
 903             $conf->{$opt} = $value;
 904         } elsif ($opt eq 'nameserver') {
 905             next if $hotplug_error->($opt);
 906             my $list = PVE::LXC::verify_nameserver_list($value);
 907             $conf->{$opt} = $list;
 908         } elsif ($opt eq 'searchdomain') {
 909             next if $hotplug_error->($opt);
 910             my $list = PVE::LXC::verify_searchdomain_list($value);
 911             $conf->{$opt} = $list;
 912         } elsif ($opt eq 'cores') {
 913             $conf->{$opt} = $value;# rest is handled by pvestatd
 914         } elsif ($opt eq 'cpulimit') {
 915             if ($value == 0) {
 916                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 917             } else {
 918                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
 919             }
 920             $conf->{$opt} = $value;
 921         } elsif ($opt eq 'cpuunits') {
 922             $conf->{$opt} = $value;
 923             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
 924         } elsif ($opt eq 'description') {
 925             $conf->{$opt} = PVE::Tools::encode_text($value);
 926         } elsif ($opt =~ m/^net(\d+)$/) {
 927             my $netid = $1;
 928             my $net = PVE::LXC::Config->parse_lxc_network($value);
 929             if (!$running) {
 930                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
 931             } else {
 932                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
 933             }
 934         } elsif ($opt eq 'protection') {
 935             $conf->{$opt} = $value ? 1 : 0;
 936         } elsif ($opt =~ m/^mp(\d+)$/) {
 937             next if $hotplug_error->($opt);
 938             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 939             my $old = $conf->{$opt};
 940             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
 941             if ($mp->{type} eq 'volume') {
 942                 &$check_content_type($mp);
 943                 $used_volids->{$mp->{volume}} = 1;
 944             }
 945             $conf->{$opt} = $value;
 946             if (defined($old)) {
 947                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
 948                 if ($mp->{type} eq 'volume') {
 949                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 950                 }
 951             }
 952             $new_disks = 1;
 953         } elsif ($opt eq 'rootfs') {
 954             next if $hotplug_error->($opt);
 955             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 956             my $old = $conf->{$opt};
 957             $conf->{$opt} = $value;
 958             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
 959             if ($mp->{type} eq 'volume') {
 960                 &$check_content_type($mp);
 961                 $used_volids->{$mp->{volume}} = 1;
 962             }
 963             if (defined($old)) {
 964                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
 965                 if ($mp->{type} eq 'volume') {
 966                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 967                 }
 968             }
 969             $new_disks = 1;
 970         } elsif ($opt eq 'unprivileged') {
 971             die "unable to modify read-only option: '$opt'\n";
 972         } elsif ($opt eq 'ostype') {
 973             next if $hotplug_error->($opt);
 974             $conf->{$opt} = $value;
 975         } elsif ($opt eq "replicate") {
 976             # check replicate feature on all mountpoints
 977             PVE::LXC::Config->get_replicatable_volumes($storecfg, $conf);
 978             my $repl = PVE::JSONSchema::check_format('pve-replicate', $value);
 979             PVE::Cluster::check_node_exists($repl->{target});
 980             $conf->{$opt} = $value;
 981         } else {
 982             die "implement me: $opt";
 983         }
 984         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 985     }
 986
 987     # Apply deletions and creations of new volumes
 988     if (@deleted_volumes) {
 989         my $storage_cfg = PVE::Storage::config();
 990         foreach my $volume (@deleted_volumes) {
 991             next if $used_volids->{$volume}; # could have been re-added, too
 992             # also check for references in snapshots
 993             next if $class->is_volume_in_use($conf, $volume, 1);
 994             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
 995         }
 996     }
 997
 998     if ($new_disks) {
 999         my $storage_cfg = PVE::Storage::config();
1000         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
1001     }
1002
1003     # This should be the last thing we do here
1004     if ($running && scalar(@nohotplug)) {
1005         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
1006     }
1007 }
1008
1009 sub check_type {
1010     my ($class, $key, $value) = @_;
1011
1012     die "unknown setting '$key'\n" if !$confdesc->{$key};
1013
1014     my $type = $confdesc->{$key}->{type};
1015
1016     if (!defined($value)) {
1017         die "got undefined value\n";
1018     }
1019
1020     if ($value =~ m/[\n\r]/) {
1021         die "property contains a line feed\n";
1022     }
1023
1024     if ($type eq 'boolean') {
1025         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1026         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1027         die "type check ('boolean') failed - got '$value'\n";
1028     } elsif ($type eq 'integer') {
1029         return int($1) if $value =~ m/^(\d+)$/;
1030         die "type check ('integer') failed - got '$value'\n";
1031     } elsif ($type eq 'number') {
1032         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1033         die "type check ('number') failed - got '$value'\n";
1034     } elsif ($type eq 'string') {
1035         if (my $fmt = $confdesc->{$key}->{format}) {
1036             PVE::JSONSchema::check_format($fmt, $value);
1037             return $value;
1038         }
1039         return $value;
1040     } else {
1041         die "internal error"
1042     }
1043 }
1044
1045
1046 # add JSON properties for create and set function
1047 sub json_config_properties {
1048     my ($class, $prop) = @_;
1049
1050     foreach my $opt (keys %$confdesc) {
1051         next if $opt eq 'parent' || $opt eq 'snaptime';
1052         next if $prop->{$opt};
1053         $prop->{$opt} = $confdesc->{$opt};
1054     }
1055
1056     return $prop;
1057 }
1058
1059 sub __parse_ct_mountpoint_full {
1060     my ($class, $desc, $data, $noerr) = @_;
1061
1062     $data //= '';
1063
1064     my $res;
1065     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1066     if ($@) {
1067         return undef if $noerr;
1068         die $@;
1069     }
1070
1071     if (defined(my $size = $res->{size})) {
1072         $size = PVE::JSONSchema::parse_size($size);
1073         if (!defined($size)) {
1074             return undef if $noerr;
1075             die "invalid size: $size\n";
1076         }
1077         $res->{size} = $size;
1078     }
1079
1080     $res->{type} = $class->classify_mountpoint($res->{volume});
1081
1082     return $res;
1083 };
1084
1085 sub parse_ct_rootfs {
1086     my ($class, $data, $noerr) = @_;
1087
1088     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1089
1090     $res->{mp} = '/' if defined($res);
1091
1092     return $res;
1093 }
1094
1095 sub parse_ct_mountpoint {
1096     my ($class, $data, $noerr) = @_;
1097
1098     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1099 }
1100
1101 sub print_ct_mountpoint {
1102     my ($class, $info, $nomp) = @_;
1103     my $skip = [ 'type' ];
1104     push @$skip, 'mp' if $nomp;
1105     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1106 }
1107
1108 sub print_lxc_network {
1109     my ($class, $net) = @_;
1110     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1111 }
1112
1113 sub parse_lxc_network {
1114     my ($class, $data) = @_;
1115
1116     my $res = {};
1117
1118     return $res if !$data;
1119
1120     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1121
1122     $res->{type} = 'veth';
1123     if (!$res->{hwaddr}) {
1124         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1125         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1126     }
1127
1128     return $res;
1129 }
1130
1131 sub option_exists {
1132     my ($class, $name) = @_;
1133
1134     return defined($confdesc->{$name});
1135 }
1136 # END JSON config code
1137
1138 sub classify_mountpoint {
1139     my ($class, $vol) = @_;
1140     if ($vol =~ m!^/!) {
1141         return 'device' if $vol =~ m!^/dev/!;
1142         return 'bind';
1143     }
1144     return 'volume';
1145 }
1146
1147 sub is_volume_in_use {
1148     my ($class, $config, $volid, $include_snapshots) = @_;
1149     my $used = 0;
1150
1151     $class->foreach_mountpoint($config, sub {
1152         my ($ms, $mountpoint) = @_;
1153         return if $used;
1154         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1155     });
1156
1157     my $snapshots = $config->{snapshots};
1158     if ($include_snapshots && $snapshots) {
1159         foreach my $snap (keys %$snapshots) {
1160             $used ||= $class->is_volume_in_use($snapshots->{$snap}, $volid);
1161         }
1162     }
1163
1164     return $used;
1165 }
1166
1167 sub has_dev_console {
1168     my ($class, $conf) = @_;
1169
1170     return !(defined($conf->{console}) && !$conf->{console});
1171 }
1172
1173 sub has_lxc_entry {
1174     my ($class, $conf, $keyname) = @_;
1175
1176     if (my $lxcconf = $conf->{lxc}) {
1177         foreach my $entry (@$lxcconf) {
1178             my ($key, undef) = @$entry;
1179             return 1 if $key eq $keyname;
1180         }
1181     }
1182
1183     return 0;
1184 }
1185
1186 sub get_tty_count {
1187     my ($class, $conf) = @_;
1188
1189     return $conf->{tty} // $confdesc->{tty}->{default};
1190 }
1191
1192 sub get_cmode {
1193     my ($class, $conf) = @_;
1194
1195     return $conf->{cmode} // $confdesc->{cmode}->{default};
1196 }
1197
1198 sub mountpoint_names {
1199     my ($class, $reverse) = @_;
1200
1201     my @names = ('rootfs');
1202
1203     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1204         push @names, "mp$i";
1205     }
1206
1207     return $reverse ? reverse @names : @names;
1208 }
1209
1210 sub foreach_mountpoint_full {
1211     my ($class, $conf, $reverse, $func, @param) = @_;
1212
1213     foreach my $key ($class->mountpoint_names($reverse)) {
1214         my $value = $conf->{$key};
1215         next if !defined($value);
1216         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1217         next if !defined($mountpoint);
1218
1219         &$func($key, $mountpoint, @param);
1220     }
1221 }
1222
1223 sub foreach_mountpoint {
1224     my ($class, $conf, $func, @param) = @_;
1225
1226     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1227 }
1228
1229 sub foreach_mountpoint_reverse {
1230     my ($class, $conf, $func, @param) = @_;
1231
1232     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1233 }
1234
1235 sub get_vm_volumes {
1236     my ($class, $conf, $excludes) = @_;
1237
1238     my $vollist = [];
1239
1240     $class->foreach_mountpoint($conf, sub {
1241         my ($ms, $mountpoint) = @_;
1242
1243         return if $excludes && $ms eq $excludes;
1244
1245         my $volid = $mountpoint->{volume};
1246         return if !$volid || $mountpoint->{type} ne 'volume';
1247
1248         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1249         return if !$sid;
1250
1251         push @$vollist, $volid;
1252     });
1253
1254     return $vollist;
1255 }
1256
1257 sub get_replicatable_volumes {
1258     my ($class, $storecfg, $conf, $noerr) = @_;
1259
1260     my $volhash = {};
1261
1262     my $test_volid = sub {
1263         my ($volid, $mountpoint) = @_;
1264
1265         return if !$volid;
1266
1267         return if defined($mountpoint->{replicate}) && !$mountpoint->{replicate};
1268
1269         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1270             return if $noerr;
1271             die "missing replicate feature on volume '$volid'\n";
1272         }
1273
1274         $volhash->{$volid} = 1;
1275     };
1276
1277     $class->foreach_mountpoint($conf, sub {
1278         my ($ms, $mountpoint) = @_;
1279         $test_volid->($mountpoint->{volume}, $mountpoint);
1280     });
1281
1282     foreach my $snapname (keys %{$conf->{snapshots}}) {
1283         my $snap = $conf->{snapshots}->{$snapname};
1284         $class->foreach_mountpoint($snap, sub {
1285             my ($ms, $mountpoint) = @_;
1286             $test_volid->($mountpoint->{volume}, $mountpoint);
1287         });
1288     }
1289
1290     return $volhash;
1291 }
1292
1293 1;