do not set insecure passwords Signed-off-by: Evgeni Golov <evgeni@debian.org>

lxc-opensuse: fix default value for release code Signed-off-by: Maxime Besson <maxime.besson@smile.fr>

lxc-opensuse: rm poweroff.target -> sigpwr.target copy Given commit 330ae3d350e060e5702a0e5ef5d0faeeeea8df6e: lxccontainer: detect if we should send SIGRTMIN+3 This is required by systemd to cleanly shutdown. Other init systems should not have SIGRTMIN+3 in the blocked signals set. we should stop poking around with sigpwr.target for systemd. Signed-off-by: Evgeni Golov <evgeni@debian.org>

don't try to get stuff from /usr/lib/systemd on the host it might not even be there… Signed-off-by: Evgeni Golov <evgeni@debian.org>

Remove libgcc_s1 from openSUSE template Removed libgcc_s1 because it breaks container building for openSUSE. Related: openSUSE/obs-build#188 Signed-off-by: Terzeus S. Dominguez <tsdmgz@gmail.com>

Set openSUSE to be unconfined by AppArmor Uncommented lxc.aa_profile = unconfined. Otherwise, container fails to start up. Signed-off-by: Terzeus S. Dominguez <tsdmgz@gmail.com>

Change openSUSE default release to Leap 42.2 Signed-off-by: Terzeus S. Dominguez <tsdmgz@gmail.com>

Update openSUSE template for Leap 42.2 Aside from adding a 42.2 option, $DISTRO comparisons for Leap have been changed [ exp ] => [[ exp ]] to accomodate pattern matching for future releases. Signed-off-by: Terzeus S. Dominguez <tsdmgz@gmail.com>

find OpenSUSE's build also as obs-build this is how it is shipped in Debian and Ubuntu Signed-off-by: Evgeni Golov <evgeni@debian.org>

Fix zypper repo for Leap Leap repos are moved one level deeper. Included oss repo only. Signed-off-by: Terzeus S. Dominguez <zeus@dmgznet.com>

Add iproute2 and net-tools to Leap install Added missing network utilities to base install for Leap. Included check to do it for Leap 42.1 only. Signed-off-by: Terzeus S. Dominguez <zeus@dmgznet.com>

Fix typo Signed-off-by: Terzeus S. Dominguez <zeus@dmgznet.com>

Add openSUSE Leap release in opensuse template Signed-off-by: Terzeus S. Dominguez <zeus@dmgznet.com>

templates: lxc-opensuse, use rpm to determine build version zypper info's output is not usable for several reasons: * it is localized -- there is no "Version: " in my output * it shows results both from the repo and local system So use plain rpm to determine whether build is installed and if proper version is in place. Signed-off-by: Jiri Slaby <jslaby@suse.cz>

Added container-cache option to templates This change adds in the container-cache option within the mainline default lxc templates. The pupose here is to allow a template to pull from a location that may not be `@LOCALSTATEDIR@/cache/lxc` Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

Use consistent /proc, /sys and /sys/fs/cgroup (v2) - Implements mixed mode for /sys where it's mounted read-only but with /sys/devices/virtual/net/ writable. - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all templates. - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup. - Get rid of the fstab file by default, using lxc.mount.entry instead. - Set sys:mixed as the default for "sys". sys:mixed is slightly more permissive than sys:ro so this shouldn't be a problem. The read-only bind mount of /sys on top of itself is there so that mountall and other init systems don't attempt to remount /sys read-write. v2 changes: - Fix the mount list, don't specify a source for the remount. - Update the documentation. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: protect possibly unset variable with quotes in -z check Signed-off-by: Michael Adam <obnox@samba.org> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: fix parsing of option "--clean": it takes no argument Signed-off-by: Michael Adam <obnox@samba.org> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: fix tab/whitespace mixup in usage text. Signed-off-by: Michael Adam <obnox@samba.org> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: Disable building openSUSE containers on 13.2/Tumbleweed only if wrong version of build package is installed Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: default release changed to 13.1, as 12.3 reaches end-of-life soon Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: Disabling builds on openSUSE Tumbleweed, detection improved. Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: Disable on 13.2 Disabled building openSUSE containers on openSUSE 13.2 and openSUSE Tumbleweed due to faulty behaviour with newer versions of init_buildsystem. Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: Check if given argument is a valid release Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: Added explanation on how to use the template Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: template now understands release arguments Signed-off-by: Johannes Kastl <git@ojkastl.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Updated lxc-opensuse for common configuration changes. Updated the lxc-opensuse template for the changes for the common configuration used by the download template. Changed the default network mode in the container to dhcp. Signed-off-by: Michael H. Warfield <mhw@WittsEnd.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: Fix syntax error Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

templates: Fix bashisms in common code Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

templates: Make sure usual locations are in PATH Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

templates: improve refusing to run unprivileged For all templates except lxc-ubuntu-cloud and lxc-download, detect not only --mapped-uid but also --mapped-gid and error out. Detecting will not be done after -- parameter because of non-option parameters. Also, change the mode of lxc-archlinux.in 100755 to 100644. Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

templates: Refuse to run unprivileged Only the download and ubuntu-cloud templates work with unprivileged containers, for all others, detect --mapped-uid and error out as early as possible, recommending the use of the download template. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>

handle simple bashisms: - [[ ]] -> [ ] - == -> = - source -> . - redirect of fd 200 is error in mksh, use fd 9 - &> /dev/null -> > /dev/null 2>&1 - useless function keyword - echo -e -> printf still left bash shebang which did not validate with checkbashism, mostly due 'type' being reported as bashism Signed-Off-By: Elan Ruusamäe <glen@delfi.ee> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-opensuse: add perl-base to prerequisities It is needed by insserv-compat. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Tab/spaces consistency for templates Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

use awk, instead of 'grep | awk' Signed-off-by: Elan Ruusamäe <glen@delfi.ee> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Fixed opensuse template to make lxc-shutdown work. The fix is described by: https://wiki.archlinux.org/index.php/Linux_Containers#Container_cannot_be_shutdown_if_using_systemd Signed-off-by: Cedric Bosdonnat <cbosdonnat@suse.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

licensing: Add missing headers and FSF address Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Move container creation fully into the api 1. implement bdev->create: python and lua: send NULL for bdevtype and bdevspecs. They'll want to be updated to pass those in in a way that makes sense, but I can't think about that right now. 2. templates: pass --rootfs If the container is backed by a device which must be mounted (i.e. lvm) then pass the actual rootfs mount destination to the templates. Note that the lxc.rootfs can be a mounted block device. The template should actually be installing the rootfs under the path where the lxc.rootfs is *mounted*. Still, some people like to run templates by hand and assume purely directory backed containers, so continue to support that use case (i.e. if no --rootfs is listed). Make sure the templates don't re-write lxc.rootfs if it is already in the config. (Most were already checking for that) 3. Replace lxc-create script with lxc_create.c program. Changelog: May 24: when creating a container, create $lxcpath/$name/partial, and flock it. When done, close that file and unlink it. In lxc_container_new() and lxcapi_start(), check for this file. If it is locked, create is ongoing. If it exists but is not locked, create() was killed - remove the container. May 24: dont disk-lock during lxcapi_create. The partial lock is sufficient. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

templates: deny writes to host's clock (v2) Don't allow write to /dev/rtc0, and remove sys_time. Thanks, Christoph. v2: drop sys_time, sys_module, mac_admin and mac_override in all templates. Reported-by: Christoph Mitasch <cmitasch@thomas-krenn.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Use "uname -m" instead of "arch" According to "arch"'s manpage, it's identical to "uname -m". Some distros ship uname but don't ship arch, however all distros ship uname, therefore it makes sense to use "uname -m" whenever possible. Signed-off-by: Christian Bühler <christian@cbuehler.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

templates: update for openSUSE 12.3 Update template to install openSUSE 12.3 Signed-off-by: Frederic Crozat <fcrozat@suse.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: print \n from one echo Otherwise the output looks like: Copying rootfs to /var/lib/lxc/tomcat/rootfs ...Please change root-password ! Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: proper failure Fail if something goes wrong. We used to continue and show one failure after another. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: extend base Base no longer provides bash, sed and tar, but we need those. So add them. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-opensuse: update for 12.2 This adaptation of systemd. We also add network configuration support. Jiri Slaby: cleanups, rebase Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

shutdown fixes for openSUSE container - mount /run on tmpfs outside container - replace /var/run bind mount on /run by a symlink Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

various fixes for openSUSE template for lxc-clone usage - create /etc/hostname as symlink to /etc/HOSTNAME - fix inadequate space in lxc.mount config, preventing lxc-clone to work Jiri Slaby: some cleanups Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

templates: Consistent use of locking Move to per-template lock (except for oracle that's per-container). Also ensure that the path used for the lock is relative to LOCALSTATEDIR. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Update for consistent indent This commit updates all scripts using mixed indent to a consistent 4 spaces indent. In the past quite a few of those scripts used tabs to instead of 8 spaces or instead of 4 spaces, sometimes mixing those in the same line and sometimes changing the tab width within the same file. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

templates: Make generated config consistent This updates all the templates and the configuration files to consistently use "key = value" everywhere. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Use LXCPATH and LOCALSTATEDIR instead of hardcoded /var Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

templates: use hardlink detection in rsync I'm not sure whether we want this: is -H ubiquitous? Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Michael H. Warfield <mhw@WittsEnd.com> Acked-by: Dwight Engen <dwight.engen@oracle.com>

lxc-create: Make location of container rootfs configurable Make 'dir' an explicit backing store type, which accepts '--dir rootfs' as an option to specify a custom location for the container rootfs. Also update lxc-destroy to now remove the rootfs separately, as removing @LXCPATH@/$name may not hit it. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add lxc.aa_profile example to all templates LXC has optional apparmor support, default profile is lxc-container-default. This change adds a commented "lxc.aa_profile = default" line to all templates, uncommenting this will bypass apparmor for the container. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

templates: don't fail on busy flock Just wait until the lock is available. That is a nicer behavior for concurrent lxc-creates. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

templates: use relative paths when creating containers At the same time, allow lxc.mount.entry to specify an absolute target path relative to /var/lib/lxc/CN/rootfs, even if rootfs is a blockdev. Otherwise all such entries are ignored for blockdev-backed containers. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

add lvm support to lxc-create 1. Some templates copy the cached pristine rootfs using 'cp a b' where b is $lxc_path/$name/rootfs. That doesn't do the right thing if rootfs already exists, as it will when it is an lvm or other mount. So switch to 'rsync a/ b/'. (cp can be made to work too of course). 2. Update lxc-create to support backing stores. For now only lvm is implemented. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

templates: update openSUSE template for openSUSE 12.1 rely on "build" package, to ensure chroot can be created with distribution older than 12.1 Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

templates: add openSUSE template. The good news is, starting with next openSUSE release (and next SLES 11 Service Pack), patching /etc/init.d/boot won't be needed anymore for LXC, we integrated detection of LXC (through container variable set to lxc) in /etc/init.d/boot and /dev is no longer mounted automatically by initscript. Signed-off-by: Frederic Crozat <fcrozat@suse.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>