Rhonda D'Vine [Wed, 30 Jan 2019 13:41:33 +0000 (14:41 +0100)]
Fix #1924: add snapshot parameter
The pct CLI command offer the config function. The output of that may
vary with respect to a given snapshot. This adds a switch that shows the
corresponding snapshot's config.
The code needs a newer libpve-guest-common-perl, thus bumping the
dependency.
Thomas Lamprecht [Mon, 28 Jan 2019 07:06:48 +0000 (08:06 +0100)]
fix #889: api create: reserver config with create lock early
allows to remove some checks as we can be sure the config belongs to
us once we have it resered, either for restore or new creation.
This is similar to the qemu-server approach[0][1], adapted to the
LXC code. We need to cleanup a bit less if something fails, as the
LXC code path always removed the config and all created volumes in
this case, which means the 'create' reserve lock is gone too.
The early reserve on API entry, instead of doing it after forked
worker entry, allows to workaround the issues reported in #889 as
successful return from the API call means that the VMID is locked.
Thomas Lamprecht [Mon, 28 Jan 2019 07:06:47 +0000 (08:06 +0100)]
destroy_config: die if unlink fails
We use this in two places, in the cleanup path of the create/restore
API path and indirectly through PVE::LXC::destroy_lxc_container, once
again in the restore code path of the create API call, to cleanup a
CT before overwriting it with a backup if the force flag ist set. The
second time in the destroy CT API call, both times a hard error in a
erroneous cleanup is wanted.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
close #1785: whitelist namespaced lxc.sysfs.* entries
According do namespaces(7) these should be namespaced (iow.
changing these values on the host they are not propagated to
running containers), so it makes sense to whitelist them.
Note that these only work when also using
'lxc.mount.auto: proc:rw'
That should be enough for snapd on unprivileged containers.
For privileged containers we'd also need a way to not drop
the mac_admin capability - not sure we'd want that.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Tim Marx [Tue, 9 Oct 2018 11:34:14 +0000 (13:34 +0200)]
close #1940: pct console: added ability to specify escape sequence
added clarification about behavior when passing -1 to escapechar
restored former behavior in other uses of get_console_command
added meaningful tag to commit message
Currently the autodev hook only adds device nodes, but in
order for the container to use them we also need to add
entries to the devices cgroup to both the limiting and the
namespaced devices cgroup directory.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
we use perl modules from pve-firewall and some build steps fail if
isn't installed, e.g., happening on bootstrapping.
pve-firewall includes some modules from us but does so in a way which
can cope with a not-installed pve-container (or qemu-server for that
matter).
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Our checks for .pve-ignore.* files happen at write time so
we mostly don't have to think about them within the
functions dealing with them. /etc/hosts is one of the files
we need nowhere except when updating it, and there are some
tools managing it and producing files too large for our
default file_get_contents() size limit, so here we want to
skip early to avoid an error at read time.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Upstream's templates seem to have switched to systemd-networkd for
fedora > 25. Since then various workarounds have been suggested (starting
the legacy network.service in /etc/rc.local). This patch tries to accomodate
both network-configuration options for the affected and available templates
(25, 26, 27), by configuring both services.
Wolfgang Link [Wed, 6 Jun 2018 13:21:45 +0000 (15:21 +0200)]
fix #1778: check if storage support templates
LXC can only create templates on storages which support linked clones.
To prevent this, we will check before we convert to a template if the
storage support this.
Wolfgang Link [Tue, 5 Jun 2018 10:58:47 +0000 (12:58 +0200)]
fix #1792: Do not assign vars in conditional statement
If a variable is defined and assigned in a conditional statement,
it is not defined behavior in Perl.
For more inforamtion about this behavior see
https://perldoc.perl.org/perlsyn.html#Statement-Modifiers
"NOTE: The behaviour of a my, state, or our modified with a statement
modifier conditional or loop construct (for example, my $x if ... )
is undefined.
The value of the my variable may be undef, any previously assigned
value, or possibly anything else.
Don't rely on it. Future versions of perl might do something different
from the version of perl you try it out on. Here be dragons."
we only handled the special rootfs mount so creating a template
from a container with additional mountpoint did not work correctly.
Use foreach_mountpoint to create a base vdisk for all mount points
after checking if the storage supports it
otherwise the size information gets lost when detaching and reattaching
a mountpoint volume, which is less than ideal since mountpoints without
size information require manual information when restoring.
This finishes the work started with 07084526aa4a ("create:
open templates as real root"), which opened templates as
real root, but passed it to tar via /proc/*/fd, which does
not actually bypass the check. (Curiously tar did manage to
figure out the file extension from it).
In order to actually extract templates the unprivileged user
cannot access by themselves, we need to pass it to tar via
stdin, however, this means tar cannot auto-detect the
compression (or more accurately, it can and does, but tells
you which option to pass it rather than just extracting
it...)
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
systemd-networkd keeps trying to use keyctl() and if it
refuses to work it is apparently a fatal error, so let's
make it think keyctl() support doesn't actually exist by
letting it always fail with ENOSYS.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
projects / pve-container.git / log