Since we use a post-stop hook to unmount all file systems at
container shutdown rather than a stop hook (because at this
point there are still multiple mount namespaces around), we
need to wait for the lxc-start/monitor process to exit to be
sure all the unmounting has succeeded, because it will put
the container into a STOPPED state before executing the
post-stop hook, making lxc-wait and lxc-stop signal success
too early when waiting for the container to stop.
Introduce a vm_stop() helper which calls lxc-stop and then
waits for the command socket to close. Note that lxc-stop
already has the "hard-stop-after-timeout" mechanic built in,
so the 'forceStop' code path of the vm_stop api call removed
here was not actually necessary.
Technically we could pass --nokill for the behavior assumed
there, but for now this patch should not be causing any
actual behavior changes.
We changed this to read values from the container's inner
cgroup, but didn't take into account that unprivileged
containers don't have one.
Add a parameter to specify whether it is an unprivileged
container.
Fixes: 41ef9833bf00 ("include ns/ dir in read_cgroup_value") Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
we want our unit to only start when manually invoked (by our code), and
stop on shutdown via pve-guests or pve-ha-lrm. lxc@ units are stopped by
systemd on shutdown, because of transitive dependencies.
since all instances of template service units are by default assigned to
a new slice with DefaultDependencies=yes, we also need to introduce our
own custom slice with DefaultDependencies=no.
With 2.1 a bunch of keys were renamed for consistency, and
network interface configuration is now done with explicit
indices.
Since we allow various custom "lxc.*" keys in our container
configuration we need to deal with this change and we now
inform the user about this with a warning.
API/clone: do not overwrite global signal handlers
perls 'local' must be either used in front of each $SIG{...}
assignments or they must be put in a list, else it affects only the
first variable and the rest are *not* in local context.
This may cause weird behaviour where daemons seemingly do not get
terminating signals delivered correctly and thus may not shutdown
gracefully anymore.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Philip Abernethy [Wed, 23 Aug 2017 15:04:37 +0000 (17:04 +0200)]
close #1478: add check for unsupported config
Adds a check if an unprivileged container is configured to use
quota on any of its mountpoints. If so an understandable error
message is given. Ideally I'd like to catch those
configurations on the GUI, too, to avoid users just running
into it.
SLES 12 shares its base with opensuse leap, so we shouldn't get into
much trouble here.
I copied the os-release file from a SLES installation.
I didn't found official SLES CT/rootfs images, people with access to
the repos should be able to create them.
Fixes: #1464 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
setup/suse: check early if setting up the ct getty service is needed
Explixitly set if we need to call setup_container_getty_service(), as
its more expressive, especially with suse version jumping in mind.
Also next patches will add support for other opensuse based releases
(tumbleweed, sles).
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
setup/suse: use new os_release_var to simplify version detection
Not only simplify but also correct version detection.
Until now we checked the files 'SuSE-release' and 'SuSE-brand' for
version parsing. 'SuSE-release' is marked as obsolete and replaced by
the newer standarised 'os-release', and the fallback is plain wrong
and not guaranteed to exist or match the actual version.
'SuSE-brand' does not get supplied by the 'openSUSE-release' package
but by another package, i.e. 'branding-openSUSE' this isn't
guaranteed to be installed, at least on CT creation, and may have
another version as the actual template provides. E.g. on tumbleweed I
get version 13.3 there, while the release package tells me "20170729".
As "os-release" is available at least sine openSUSE 12.2, and we
support 13.X and newer currently, just use it instead.
Adapt the regex as the non-rolling releases have always a X.Y format.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This should exist everywhere, its content look like shell
assignments but are limited enough to not require a shell to
parse (see os-release(5) or its parts pasted as a comment to
the parse function).
Further motivation for this is the fact that in suse the
/etc/SuSE-release file is declared deprecated in favor of
/etc/os-release.
Note that we have to read the file in a protected_call to
avoid symlink issues.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 10 May 2017 13:03:46 +0000 (15:03 +0200)]
use Syscall module instead of raw syscall numbers
Raw syscall numbers were not platform independent, so replace them
with the new PVE::Syscall module which gets the syscall numbers from
syscall.ph, which provides the platform local values.
we cannot directly use syscall.ph as it is no normal perl module and
so it's usage requires special handling
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
The commit changes the configuration before the VM is actually
migrated, so it is possible to have a wrong configuration when
migration fails for some reason. Also, I am quite unsure if
this automatic target change is really wanted. The patch also
contains wrong refereces to $self->{opts}->{node}.
Since the STOPPED state is set before cgroup cleanup we need
a better way to restart a container: We now install an
ExecStopPost snippet into the lxc@.service which when
encountering a reboot trigger file
(/var/lib/lxc/$vmid/reboot) performs a systemctl restart.
projects / pve-container.git / log