lxc/templates/lxc-alpine.in

	lxc-alpine.in revision 5845ac2bb83c2d509cbcb9a869d94b793f18cccc
#!/bin/sh
# vim: set ts=4:

# Exit on error and treat unset variables as an error.
set -eu

#
# LXC template for Alpine Linux 3+
#

# Note: Do not replace tabs with spaces, it would break heredocs!

# Authors:
# Jakub Jirutka <jakub@jirutka.cz>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA


#===========================  Constants  ============================#

# Make sure the usual locations are in PATH
export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin

readonly LOCAL_STATE_DIR='@LOCALSTATEDIR@'
readonly LXC_TEMPLATE_CONFIG='@LXCTEMPLATECONFIG@'
readonly LXC_CACHE_DIR="${LXC_CACHE_PATH:-"$LOCAL_STATE_DIR/cache/lxc"}/alpine"

# SHA256 checksums of GPG keys for APK.
readonly APK_KEYS_SHA256="\
9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4  alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab  alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub
ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9  alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b  alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub
12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c  alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub"

readonly APK_KEYS_URI='http://alpinelinux.org/keys'
readonly MIRRORS_LIST_URL='http://rsync.alpinelinux.org/alpine/MIRRORS.txt'

: ${APK_KEYS_DIR:=/etc/apk/keys}
if ! ls "$APK_KEYS_DIR"/alpine* >/dev/null 2>&1; then
    APK_KEYS_DIR="$LXC_CACHE_DIR/bootstrap/keys"
fi
readonly APK_KEYS_DIR

: ${APK:=$(command -v apk || true)}
if [ ! -x "$APK" ]; then
    APK="$LXC_CACHE_DIR/bootstrap/sbin/apk.static"
fi
readonly APK


#========================  Helper Functions  ========================#

usage() {
    cat <<-EOF
        Template specific options can be passed to lxc-create after a '--' like this:

           lxc-create --name=NAME [lxc-create-options] -- [template-options]

        Template options:
           -a ARCH, --arch=ARCH   The container architecture (e.g. x86, x86_64); defaults
                                  to the host arch.
           -d, --debug            Run this script in a debug mode (set -x and wget w/o -q).
           -F, --flush-cache      Remove cached files before build.
           -m URL --mirror=URL    The Alpine mirror to use; defaults to random mirror.
           -r VER, --release=VER  The Alpine release branch to install; default is the
                                  latest stable.

        Environment variables:
           APK             The apk-tools binary to use when building rootfs. If not set
                           or not executable and apk is not on PATH, then the script
                           will download the latest apk-tools-static.
           APK_KEYS_DIR    Path to directory with GPG keys for APK. If not set and
                           /etc/apk/keys does not contain alpine keys, then the script
                           will download the keys from ${APK_KEYS_URI}.
           LXC_CACHE_PATH  Path to the cache directory where to store cached rootfs.
    EOF
}

die() {
    local retval=$1; shift

    printf 'ERROR: %s\n' "$@" 1>&2
    exit $retval
}

einfo() {
    printf "\n==> $1\n"
}

fetch() {
    if [ "$DEBUG" = 'yes' ]; then
        wget -T 10 -O - $@
    else
        wget -T 10 -O - -q $@
    fi
}

latest_release_branch() {
    local arch="$1"
    local branch=$(fetch "$MIRROR_URL/latest-stable/releases/$arch/latest-releases.yaml" \
        | sed -En 's/^[ \t]*branch: (.*)$/\1/p' \
        | head -n 1)
    [ -n "$branch" ] && echo "$branch"
}

parse_arch() {
    case "$1" in
        x86 | i[3-6]86) echo 'x86';;
        x86_64 | amd64) echo 'x86_64';;
        arm*) echo 'armhf';;
        *) return 1;;
    esac
}

random_mirror_url() {
    local url=$(fetch "$MIRRORS_LIST_URL" | shuf -n 1)
    [ -n "$url" ] && echo "$url"
}

run_exclusively() {
    local lock_name="$1"
    local timeout=$2
    shift 2

    mkdir -p "$LOCAL_STATE_DIR/lock/subsys"

    local retval
    {
        echo -n "Obtaining an exclusive lock..."
        if ! flock -x 9; then
            echo ' failed.'
            return 1
        fi
        echo ' done'

        "$@"; retval=$?
    } 9> "$LOCAL_STATE_DIR/lock/subsys/lxc-alpine-$lock_name"

    return $retval
}


#============================  Bootstrap  ===========================#

bootstrap() {
    if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$LXC_CACHE_DIR/bootstrap" ]; then
        einfo 'Cleaning cached bootstrap files'
        rm -Rf "$LXC_CACHE_DIR/bootstrap"
    fi

    einfo 'Fetching and/or verifying APK keys'
    fetch_apk_keys "$APK_KEYS_DIR"

    if [ ! -x "$APK" ]; then
        einfo 'Fetching apk-tools static binary'

        local host_arch=$(parse_arch $(uname -m))
        fetch_apk_static "$LXC_CACHE_DIR/bootstrap" "$host_arch"
    fi
}

fetch_apk_keys() {
    local dest="$1"
    local line keyname

    mkdir -p "$dest"
    cd "$dest"

    echo "$APK_KEYS_SHA256" | while read -r line; do
        keyname="${line##* }"
        if [ ! -f "$keyname" ]; then
            fetch "$APK_KEYS_URI/$keyname" > "$keyname"
        fi
        echo "$line" | sha256sum -c -
    done || exit 2

    cd - >/dev/null
}

fetch_apk_static() {
    local dest="$1"
    local arch="$2"
    local pkg_name='apk-tools-static'

    mkdir -p "$dest"

    local pkg_ver=$(fetch "$MIRROR_URL/latest-stable/main/$arch/APKINDEX.tar.gz" \
        | tar -xzO APKINDEX \
        | sed -n "/P:${pkg_name}/,/^$/ s/V:\(.*\)$/\1/p")

    [ -n "$pkg_ver" ] || die 2 "Cannot find a version of $pkg_name in APKINDEX"

    fetch "$MIRROR_URL/latest-stable/main/$arch/${pkg_name}-${pkg_ver}.apk" \
        | tar -xz -C "$dest" sbin/  # --extract --gzip --directory

    [ -f "$dest/sbin/apk.static" ] || die 2 'apk.static not found'

    local keyname=$(echo "$dest"/sbin/apk.static.*.pub | sed 's/.*\.SIGN\.RSA\.//')
    openssl dgst -sha1 \
        -verify "$APK_KEYS_DIR/$keyname" \
        -signature "$dest/sbin/apk.static.SIGN.RSA.$keyname" \
        "$dest/sbin/apk.static" \
        || die 2 'Signature verification for apk.static failed'

    # Note: apk doesn't return 0 for --version
    local out="$("$dest"/sbin/apk.static --version)"
    echo "$out"

    [ "${out%% *}" = 'apk-tools' ] || die 3 'apk.static --version failed'
}


#============================  Install  ============================#

install() {
    local rootfs="$1"
    local arch="$2"
    local branch="$3"
    local cache_dir="$LXC_CACHE_DIR/rootfs-$branch-$arch"

    if [ "$FLUSH_CACHE" = 'yes' ] && [ -d "$cache_dir" ]; then
        einfo "Cleaning cached rootfs of Alpine $branch $arch"
        rm -Rf "$cache_dir"
    fi

    if [ ! -d "$cache_dir/rootfs" ]; then
        einfo "Building Alpine rootfs in $cache_dir/rootfs"
        build_alpine "$cache_dir/rootfs" "$arch" "$branch"
    fi

    einfo "Copying cached rootfs to $rootfs"
    mkdir -p "$rootfs"
    cp -a "$cache_dir"/rootfs/* "$rootfs"/
}

build_alpine() {
    local dest="$1"
    local arch="$2"
    local branch="$3"
    local repo_url="$MIRROR_URL/$branch/main"

    rm -Rf "$dest.part" 2>/dev/null
    mkdir -p "$dest.part"

    cd "$dest.part"

    $APK --update-cache --initdb --arch="$arch" \
        --root=. --keys-dir="$APK_KEYS_DIR" --repository="$repo_url" \
        add alpine-base

    echo "$repo_url" > etc/apk/repositories

    make_dev_nodes
    setup_inittab
    setup_hosts
    setup_network
    setup_services

    chroot . /bin/true \
        || die 3 'Failed to execute /bin/true in chroot, the builded rootfs is broken!'

    cd - >/dev/null

    rm -Rf "$dest"
    mv "$dest.part" "$dest"
}

make_dev_nodes() {
    mkdir -p -m 755 dev/pts
    mkdir -p -m 1777 dev/shm

    mknod -m 666 dev/zero c 1 5
    mknod -m 666 dev/full c 1 7
    mknod -m 666 dev/random c 1 8
    mknod -m 666 dev/urandom c 1 9

    local i; for i in $(seq 0 4); do
        mknod -m 620 dev/tty$i c 4 $i
        chown 0:5 dev/tty$i  # root:tty
    done

    mknod -m 666 dev/tty c 5 0
    chown 0:5 dev/tty  # root:tty
    mknod -m 620 dev/console c 5 1
    mknod -m 666 dev/ptmx c 5 2
    chown 0:5 dev/ptmx  # root:tty
}

setup_inittab() {
    # Remove unwanted ttys.
    sed -i '/^tty[5-9]\:\:.*$/d' etc/inittab

    cat <<-EOF >> etc/inittab
        # Main LXC console console
        ::respawn:/sbin/getty 38400 console
    EOF
}

setup_hosts() {
    # This runscript injects localhost entries with the current hostname
    # into /etc/hosts.
    cat <<'EOF' > etc/init.d/hosts
#!/sbin/openrc-run

start() {
    local start_tag='# begin generated'
    local end_tag='# end generated'

    local content=$(
        cat <<-EOF
            $start_tag by /etc/init.d/hosts
            127.0.0.1  $(hostname).local $(hostname) localhost
            ::1        $(hostname).local $(hostname) localhost
            $end_tag
        EOF
    )

    if grep -q "^${start_tag}" /etc/hosts; then
        # escape \n, busybox sed doesn't like them
        content=${content//$'\n'/\\$'\n'}

        sed -ni "/^${start_tag}/ {
                a\\${content}
                # read and discard next line and repeat until $end_tag or EOF
                :a; n; /^${end_tag}/!ba; n
            }; p" /etc/hosts
    else
        printf "$content" >> /etc/hosts
    fi
}
EOF
    chmod +x etc/init.d/hosts

    # Wipe it, will be generated by the above runscript.
    echo -n > etc/hosts
}

setup_network() {
    # Note: loopback is automatically started by LXC.
    cat <<-EOF > etc/network/interfaces
        auto eth0
        iface eth0 inet dhcp
    EOF
}

setup_services() {
    local svc_name

    # Specify the LXC subsystem.
    sed -i 's/^#*rc_sys=.*/rc_sys="lxc"/' etc/rc.conf

    # boot runlevel
    for svc_name in bootmisc hosts syslog; do
        ln -s /etc/init.d/$svc_name etc/runlevels/boot/$svc_name
    done

    # default runlevel
    for svc_name in networking cron; do
        ln -s /etc/init.d/$svc_name etc/runlevels/default/$svc_name
    done
}


#===========================  Configure  ===========================#

configure_container() {
    local config="$1"
    local hostname="$2"
    local arch="$3"

    cat <<-EOF >> "$config"

        # Specify container architecture.
        lxc.arch = $arch

        # Set hostname.
        lxc.utsname = $hostname

        # If something doesn't work, try to comment this out.
        # Dropping sys_admin disables container root from doing a lot of things
        # that could be bad like re-mounting lxc fstab entries rw for example,
        # but also disables some useful things like being able to nfs mount, and
        # things that are already namespaced with ns_capable() kernel checks, like
        # hostname(1).
        lxc.cap.drop = sys_admin

        # Include common configuration.
        lxc.include = $LXC_TEMPLATE_CONFIG/alpine.common.conf
    EOF
}


#=============================  Main  ==============================#

if [ "$(id -u)" != "0" ]; then
    die 1 "This script must be run as 'root'"
fi

# Parse command options.
options=$(getopt -o a:dFm:n:p:r:h -l arch:,debug,flush-cache,mirror:,name:,\
path:,release:,rootfs:,help,mapped-uid:,mapped-gid: -- "$@")
eval set -- "$options"

# Clean variables and set defaults.
arch="$(uname -m)"
debug='no'
flush_cache='no'
mirror_url=
name=
path=
release=
rootfs=

# Process command options.
while [ $# -gt 0 ]; do
    case $1 in
        -a | --arch)
            arch=$2; shift 2
        ;;
        -d | --debug)
            debug='yes'; shift 1
        ;;
        -F | --flush-cache)
            flush_cache='yes'; shift 1
        ;;
        -m | --mirror)
            mirror_url=$2; shift 2
        ;;
        -n | --name)
            name=$2; shift 2
        ;;
        -p | --path)
            path=$2; shift 2
        ;;
        -r | --release)
            release=$2; shift 2
        ;;
        --rootfs)
            rootfs=$2; shift 2
        ;;
        -h | --help)
            usage; exit 0
        ;;
        --)
            shift; break
        ;;
        --mapped-[ug]id)
            die 1 "This template can't be used for unprivileged containers." \
                'You may want to try the "download" template instead.'
        ;;
        *)
            echo "Unknown option: $1" 1>&2
            usage; exit 1
        ;;
    esac
done

[ "$debug" = 'yes' ] && set -x

# Set global variables.
readonly DEBUG="$debug"
readonly FLUSH_CACHE="$flush_cache"
readonly MIRROR_URL="${mirror_url:-$(random_mirror_url)}"

# Validate options.
[ -n "$name" ] || die 1 'Missing required option --name'
[ -n "$path" ] || die 1 'Missing required option --path'

if [ -z "$rootfs" ] && [ -f "$path/config" ]; then
    rootfs="$(sed -nE 's/^lxc.rootfs\s*=\s*(.*)$/\1/p' "$path/config")"
fi
if [ -z "$rootfs" ]; then
    rootfs="$path/rootfs"
fi

arch=$(parse_arch "$arch") \
    || die 1 "Unsupported architecture: $arch"

if [ -z "$release" ]; then
    release=$(latest_release_branch "$arch") \
        || die 2 'Failed to resolve Alpine last release branch'
fi

# Here we go!
run_exclusively 'bootstrap' 10 bootstrap
run_exclusively "$release-$arch" 30 install "$rootfs" "$arch" "$release"
configure_container "$path/config" "$name" "$arch"

einfo "Container's rootfs and config have been created"
cat <<-EOF
    Edit the config file $path/config to check/enable networking setup.
    The installed system is preconfigured for a loopback and single network
    interface configured via DHCP.

    To start the container, run "lxc-start -n $name".
    The root password is not set; to enter the container run "lxc-attach -n $name".
EOF