templates: add squashfs support to lxc-ubuntu-cloud.in Add squashfs format file support for lxc-ubuntu-cloud.in Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

Update Ubuntu release name: add zesty and remove wily Add zesty to KNOWN_RELEASES Remove EOL wily from KNOWN_RELEASES Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

tests: fix image download for s390x Make release selection more flexible. Update the KNOWN_RELEAES list, add yakkety and remove vivid. Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

ubuntu-cloud: Various fixes - Update list of supported releases - Make the fallback release trusty - Don't specify the compression algorithm (use auto-detection) so that people passing tarballs to the template don't see regressions. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu-cloud: Never exit 0 when no container is created Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

ubuntu-cloud: Replace .tar.gz by .tar.xz and don't auto-generate missing tarballs Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu-cloud: support passing vendor-data vendor-data is supported in Ubuntu cloud images in trusty and later. This allows the user to pass it in on create or clone. Signed-off-by: Scott Moser <smoser@ubuntu.com>

Added container-cache option to templates This change adds in the container-cache option within the mainline default lxc templates. The pupose here is to allow a template to pull from a location that may not be `@LOCALSTATEDIR@/cache/lxc` Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

ubuntu: Drop lucid support and refresh releaess list Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Use consistent /proc, /sys and /sys/fs/cgroup (v2) - Implements mixed mode for /sys where it's mounted read-only but with /sys/devices/virtual/net/ writable. - Sets lxc.mount.auto to "cgroup:mixed proc:mixed sys:mixed" for all templates. - Drop any template-specific mount for /proc, /sys or /sys/fs/cgroup. - Get rid of the fstab file by default, using lxc.mount.entry instead. - Set sys:mixed as the default for "sys". sys:mixed is slightly more permissive than sys:ro so this shouldn't be a problem. The read-only bind mount of /sys on top of itself is there so that mountall and other init systems don't attempt to remount /sys read-write. v2 changes: - Fix the mount list, don't specify a source for the remount. - Update the documentation. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

ubuntu templates: don't check for $rootfs/run/shm /dev/shm must be turned from a directory into a symlink to /run/shm. The templates do this only if they find -d $rootfs/run/shm. Since /run will be a tmpfs, checking for it in the rootfs is silly. It also is currently broken as ubuntu cloud images have an empty /run. (this should fix https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1353734) Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

templates: Make sure usual locations are in PATH Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

create: pass --mapped-gid to templates next to --mapped-uid That way templates can fix group ownership alongside uid ownership. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: Update arm* cross | host arch | arm64 | armhf | armel | ------------------------------------- | arm64 | X | X | X | | armhf | | X | X | | armel | | X | X | ------------------------------------- Although optional, all existing arm64 silicon supports 32bit instructions. armel/armhf is only a userspace change, so they are interchangeable. However armhf isn't supported on all armel platforms (e.g. armv6) but all those we support have hard-float. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: various small changes * ppc64el images now exist and generally function. Instead of failing because an arch isnt in the list, let that check happen by ability to download something. * update the hard coded ubuntu releases to know about 'trusty' and drop no longer supported releases (consistent with behavior when distro-info is available) * shorten the logic that decides if host and container arch are supported. * support skipping "invalid arch" check entirely via undocumented variable UCTEMPLATE_SKIP_ARCH_CHECK. * update usage to reference 'tryreleased' as the default 'stream' * give good error message if user tries 'released' and there is no released version available. Signed-off-by: Scott Moser <smoser@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu/ubuntu-cloud: Add support for arm64 and ppc64el Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu-cloud: Default to trying released channel This adds a fallback to the daily channel if an image couldn't be found in the released one. Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: Fix cache and lock location Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

handle simple bashisms: - [[ ]] -> [ ] - == -> = - source -> . - redirect of fd 200 is error in mksh, use fd 9 - &> /dev/null -> > /dev/null 2>&1 - useless function keyword - echo -e -> printf still left bash shebang which did not validate with checkbashism, mostly due 'type' being reported as bashism Signed-Off-By: Elan Ruusamäe <glen@delfi.ee> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Fix some typos Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

typo fix: create $rootfs/dev/pts Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Move some common Ubuntu config This introduces a new /usr/share/lxc/config directory containing common configuration snippets. The two Ubuntu templates are then simplified to just include the relevant entries avoiding a whole lot of hardcoded cgroup, capabilities and mount points configuration. An extra comment is also added at the top of all generated configuration files telling the user to look at lxc.conf(5) for more information. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Some tweak on previous change (timezone) This adds the same code to the Debian-based templates (Ubuntu and Ubuntu Cloud) and also avoids a needless fork. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu: Actually attempt to remove /dev/shm Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Tab/spaces consistency for templates Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

use awk, instead of 'grep | awk' Signed-off-by: Elan Ruusamäe <glen@delfi.ee> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu*: Mark non-essential mounts optional Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

create_run_template: tell the template what caller's uid was mapped to conf.c/conf.h: have replaced bool hostid_is_mapped() with int mapped_hostid() which returns the mapped uid for the caller's uid on the host, or -1 if none create_run_template: pass caller's uid into template. lxc-ubuntu-cloud: 1. accept --mapped-uid argument 2. don't write to devices cgroup - not allowed. 3. if running in userns, use $HOME/.cache 4. chown cached files to the uid to which our caller was mapped 5. ignore /dev when extracting rootfs in a userns Changelog: nov 5: remove debugging INFO line. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: Cope with spaces in paths Reported-by: Scott Moser <smoser@ubuntu.com> Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-ubuntu-cloud: pass --numeric-owner and -p to untar Just following up here, Serge raised the question of whether or not the other two invocations of 'tar' in this script need '--numeric-owner'. They probably should have it, although its of little concern because the 'build_root_tgz' path is only taken if there is no '-root.tar.gz' file for download, and the only supported ubuntu release without the -root.tar.gz download is 10.04 at this point. Anyway, below is a more complete diff, also including a fix as '--numeric-uid' is not a valid option to tar. The name is '--numeric-owner'. Signed-off-by: Scott Moser <smoser@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu templates: make pstore fstab entry optional Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

add pstore to container fstab Otherwise user-namespace containers will hang on mountall. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

fix license text in ubuntu and ubuntu-cloud templates Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Fix some typos Signed-off-by: Dmitry Shachnev <mitya57@ubuntu.com> Reported-by: Vincent Ladeuil Acked-by: Stéphane Graber <stgraber@ubuntu.com>

add a clone hook for ubuntu-cloud images This allows ability to now specify '--userdata' arguments to 'create' or to 'clone'. So now, the following means very fast start of instances with different user-data. $ sudo lxc-create -t ubuntu-cloud -n precise -- \ -r precise --arch amd64 $ sudo lxc-clone -B overlayfs -o precise -s -n ephem1 \ --userdata="my.userdata1" $ sudo lxc-clone -B overlayfs -o precise -s -n ephem2 \ --userdata="my.userdata2" Also present here is * an improvement to the static list of Ubuntu releases. It uses ubuntu-distro-info if available degrades back to a static list on failure. * moving of the replacement variables to the top of the create template This is just to make it more obvious what is being replaced and put them in a single location. Signed-off-by: Scott Moser <smoser@ubuntu.com>

ubuntu-cloud: remove debugging echo Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

ubuntu-cloud: changes to support unprivileged use don't try to lock if using a specified tarball The lock/subsys/lxc-ubuntu-cloud lock is to protect the tarballs managed under /var/cache/lxc/cloud-$release. Don't lock if we've been handed a tarball. fake device creation Unprivileged users can't create devices, so bind mount null, tty, urandom and console from the host. Changelog: Jul 22: as Stéphane points out, remove a left-over debug line Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu templates: add some kernel filesystems to container fstab The debugfs, fusectl, and securityfs may not be mounted inside a non-init userns. But mountall hangs waiting for them to be mounted. So just pre-mount them using $lxcpath/$name/fstab as bind mounts, which will prevent mountall from trying to mount them. If the kernel doesn't provide them, then the bind mount failure will be ignored, and mountall in the container will proceed without the mount since it is 'optional'. But without these bind mounts, starting a container inside a user namespace hangs. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu-cloud template: accept --rootfs argument Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

ubuntu: Tweak layout of the config Just add an extra white line to both templates. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Move container creation fully into the api 1. implement bdev->create: python and lua: send NULL for bdevtype and bdevspecs. They'll want to be updated to pass those in in a way that makes sense, but I can't think about that right now. 2. templates: pass --rootfs If the container is backed by a device which must be mounted (i.e. lvm) then pass the actual rootfs mount destination to the templates. Note that the lxc.rootfs can be a mounted block device. The template should actually be installing the rootfs under the path where the lxc.rootfs is *mounted*. Still, some people like to run templates by hand and assume purely directory backed containers, so continue to support that use case (i.e. if no --rootfs is listed). Make sure the templates don't re-write lxc.rootfs if it is already in the config. (Most were already checking for that) 3. Replace lxc-create script with lxc_create.c program. Changelog: May 24: when creating a container, create $lxcpath/$name/partial, and flock it. When done, close that file and unlink it. In lxc_container_new() and lxcapi_start(), check for this file. If it is locked, create is ongoing. If it exists but is not locked, create() was killed - remove the container. May 24: dont disk-lock during lxcapi_create. The partial lock is sufficient. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

ubuntu templates: add comments to show how to enable nesting Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

templates: deny writes to host's clock (v2) Don't allow write to /dev/rtc0, and remove sys_time. Thanks, Christoph. v2: drop sys_time, sys_module, mac_admin and mac_override in all templates. Reported-by: Christoph Mitasch <cmitasch@thomas-krenn.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

ubuntu: Various fixes - Drop disabled entries from allowed devices list - Improve generated config layout a bit - Drop redundant uname call - Re-generate the SSH host keys on container creation Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Use "uname -m" instead of "arch" According to "arch"'s manpage, it's identical to "uname -m". Some distros ship uname but don't ship arch, however all distros ship uname, therefore it makes sense to use "uname -m" whenever possible. Signed-off-by: Christian Bühler <christian@cbuehler.de> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu: Tweak architecture support This updates the various checks to match the grid below: == lxc-ubuntu support per architecture == amd64: amd64, i386, armel, armhf, powerpc i386: i386, armel, armhf, powerpc armel: armel, armhf armhf: armhf, armel powerpc: powerpc == lxc-ubuntu-cloud support per architecture == amd64: amd64, i386 i386: i386 armel: armel, armhf armhf: armhf, armel Note that most of the foreign architectures on x86 are supported through the use of qemu-user-static. This one however isn't yet support for cloud images (I'll send a patch for 1.0). Also, qemu-user-static is technically able to emulate amd64 on i386 but qemu-debootstrap doesn't appear to know that and fails quite miserably. We may also want to add a test for amd64 kernel but i386 userspace, which is a valid combination that allows running an amd64 container on an i386 host without requiring emulation, but that's for another patch. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu{-cloud}: Config layout tweaking This commit tweaks the layout of the config file for the Ubuntu templates. With this, we now get a clear network config group, then a path related group, then a bunch of random config options and the end of the config is apparmor, capabilities and cgroups. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>

templates: Consistent use of locking Move to per-template lock (except for oracle that's per-container). Also ensure that the path used for the lock is relative to LOCALSTATEDIR. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

templates: Make generated config consistent This updates all the templates and the configuration files to consistently use "key = value" everywhere. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Use LXCPATH and LOCALSTATEDIR instead of hardcoded /var Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

fix lxc-ubuntu-cloud option parsing bugs The -u shortopt matching --userdata was not specified, and when -L is found shift should have been by 1 not 2 since there is no optarg. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-create: Make location of container rootfs configurable Make 'dir' an explicit backing store type, which accepts '--dir rootfs' as an option to specify a custom location for the container rootfs. Also update lxc-destroy to now remove the rootfs separately, as removing @LXCPATH@/$name may not hit it. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

revert devtmpfs in ubuntu templates devtmpfs is shared between host and containers, and it messes up lucid containers too. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu{-cloud}: Fix missing "fi" in new devtmpfs code The "if" statement to add devtmpfs was missing a matching "fi" causing parsing error when using the template. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

templates: mount devtmpfs in ubuntu containers That way /dev/disk/ exists, and update-grub can succeed. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1060404

ubuntu-cloud template cleanups Fix for quantal images which do not have the user 'ubuntu' present. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1045955 Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-ubuntu-cloud: get full pathname to userdata file When passing '--userdata somefile' to the ubuntu-cloud template, a user may pass a relative pathname. The template uses the filename after changing current directory, so store the full pathname for the userdata file instead of a potential relative pathname. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

Add lxc.aa_profile example to all templates LXC has optional apparmor support, default profile is lxc-container-default. This change adds a commented "lxc.aa_profile = default" line to all templates, uncommenting this will bypass apparmor for the container. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Use lxc_putold as the pivot_root put dir in the ubuntu templates By default we use mnt, but that means that lxc fstab entries do not work when placed under the container's /mnt/. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

Fix lxc-ubuntu and lxc-ubuntu-cloud to properly deal with /dev/shm. Now that initscripts in Debian and Ubuntu has been updated to no longer do silly things with /dev/shm and /run/shm on installation/update, the check needs updating to detect any remaining broken case and fix it. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

ubuntu and debian templates: Clean up cache if cache build is interrupted Otherwise the next lxc-create may rsync a bad cache. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

templates: don't fail on busy flock Just wait until the lock is available. That is a nicer behavior for concurrent lxc-creates. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

ubuntu templates: remove maverick as it is end-of-life Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Update Ubuntu templates for quantal Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

lxc-ubuntu-cloud: extract the right filenames from tarball Signed-off-by: Ben Howard <ben.howard@canonical.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

lxc-ubuntu*: in precise, make /dev/shm a symbolic link to /run/shm This would be done (though done wrongly) by mounted-dev.conf, but that doesn't run because we don't mount /dev. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Description: Fix handling of user-data in ubuntu-cloud template Signed-off-by: Ben Howard <ben.howard@canonical.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Minor lxc config template layout fix Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

templates: use relative paths when creating containers At the same time, allow lxc.mount.entry to specify an absolute target path relative to /var/lib/lxc/CN/rootfs, even if rootfs is a blockdev. Otherwise all such entries are ignored for blockdev-backed containers. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

lxc-ubuntu-cloud.in: re-enable use of daily cloud images There are two types of cloud images - released and daily ones. We were always using daily ones, instead of using released by default with an option for daily. Fix that. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Description: fix handling of non-precise cloud image format Also includes a fix for broken check for $debug Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

ubuntu templates cleanups 1. fix inconsistent use of '--auth-key' (not --auth_key) which broke their usage 2. add --debug option to lxc-ubuntu (which does set -x to show what broke) (idea from Idea from lifeless and benji) 3. fix incorrect assumption about group with -b option. User's default group may not be the same as username. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

update ubuntu templates to provide macaddr and more Add a macaddr if precisely one veth is specified but no hwaddr. Allow specifying ssh authkeys. In cloud template, copy locales by default and allow a tarball to be specified. Signed-off-by: Ben Howard <ben.howard@canonical.com> Signed-off-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

Add ubuntu-cloud template This is a new template to create containers based on the ubuntu cloud images, rather than using debootstrap. Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>