lxc-cirros.in revision 8ec981fc8b0105da5f071e40811e0c2472a6c3c9
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber#!/bin/bash
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# template script for generating ubuntu container for LXC
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber#
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# This script consolidates and extends the existing lxc ubuntu scripts
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber#
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# Copyright © 2013 Canonical Ltd.
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# Author: Scott Moser <scott.moser@canonical.com>
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber#
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# This program is free software; you can redistribute it and/or modify
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# it under the terms of the GNU General Public License version 2, as
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# published by the Free Software Foundation.
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# This program is distributed in the hope that it will be useful,
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# but WITHOUT ANY WARRANTY; without even the implied warranty of
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# GNU General Public License for more details.
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# You should have received a copy of the GNU General Public License along
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# with this program; if not, write to the Free Software Foundation, Inc.,
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# Detect use under userns (unsupported)
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberfor arg in $*; do
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber if [ "$arg" == "--mapped-uid" ]; then
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber echo "This template can't be used for unprivileged containers." 1>&2
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber echo "You may want to try the \"download\" template instead." 1>&2
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber exit 1
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber fi
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberdone
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberVERBOSITY=0
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberDOWNLOAD_URL="http://download.cirros-cloud.net/"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberCACHE_D="@LOCALSTATEDIR@/cache/lxc/cirros"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberUNAME_M=$(uname -m)
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberARCHES=( i386 x86_64 amd64 arm )
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberSTREAMS=( released devel )
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberSOURCES=( nocloud none )
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberBUILD="standard"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberDEF_VERSION="released"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberDEF_SOURCE="nocloud"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Grabercase "${UNAME_M}" in
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber i?86) DEF_ARCH="i386";;
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber x86_64) DEF_ARCH="x86_64";;
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber arm*) DEF_ARCH="arm";;
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber *) DEF_ARCH="i386";;
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberesac
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Grabererror() { echo "$@" 1>&2; }
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberinargs() {
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber local needle="$1" x=""
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber shift
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber for x in "$@"; do
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber [ "$needle" = "$x" ] && return 0
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber done
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber return 1
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberUsage() {
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber cat <<EOF
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber${0##*/} [options]
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -a | --arch A architecture to use [${ARCHES[*]}]
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber default: ${DEF_ARCH}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -h | --help this usage
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -v | --verbose increase verbosity
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -S | --auth-key K insert auth key 'K'
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -v | --version V version [${STREAMS[*]}]
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber default: ${DEF_VERSION}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber -u | --userdata U user-data file
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber --tarball T read from tarball 'T' rather than downloading
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber or using cache.
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber --source S insert userdata/metadata via source S
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber [${SOURCES[*]}]
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane GraberEOF
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberbad_Usage() { Usage 1>&2; [ $# -eq 0 ] || error "$@"; return 1; }
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberdebug() {
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber local level=${1}; shift;
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber [ "${level}" -gt "${VERBOSITY}" ] && return
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber error "${@}"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberjsondict() {
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber local k="" v="" ret="{"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber for arg in "$@"; do
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber k="${arg%%=*}"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber v="${arg#*=}"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber ret="${ret} \"${k}\": \"$v\","
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber done
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber ret="${ret%,} }"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber echo "$ret"
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber}
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Grabercopy_configuration()
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber{
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber local path=$1 rootfs=$2 name=$3 arch=$4 release=$5
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Grabercat >> "$path/config" <<EOF
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber# Template used to create this container: cirros
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graber
0306de4f280adc0cd5faa3cd365c584d61c9e383Stéphane Graberlxc.rootfs = $rootfs
#lxc.mount = $path/fstab
lxc.pivotdir = lxc_putold
lxc.tty = 4
lxc.pts = 1024
lxc.utsname = $name
lxc.arch = $arch
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
# To support container nesting on an Ubuntu host, uncomment next two lines:
#lxc.aa_profile = lxc-container-default-with-nesting
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
lxc.cgroup.devices.deny = a
# Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
# fuse
lxc.cgroup.devices.allow = c 10:229 rwm
# tun
lxc.cgroup.devices.allow = c 10:200 rwm
# full
lxc.cgroup.devices.allow = c 1:7 rwm
# hpet
lxc.cgroup.devices.allow = c 10:228 rwm
# kvm
lxc.cgroup.devices.allow = c 10:232 rwm
EOF
}
insert_ds_nocloud() {
local root_d="$1" authkey="$2" udfile="$3"
local sdir="$root_d/var/lib/cloud/seed/nocloud"
mkdir -p "$sdir" ||
{ error "failed to make datasource dir $sdir"; return 1; }
rm -f "$sdir/meta-data" "$sdir/user-data" ||
{ error "failed to clean old data from $sdir"; return 1; }
iid="iid-local01"
jsondict "instance-id=$iid" \
${authkeys:+"public-keys=${authkeys}"} > "$sdir/meta-data" ||
{ error "failed to write metadata to $sdir/meta-data"; return 1; }
if [ -n "$udfile" ]; then
cat "$udfile" > "$sdir/user-data" ||
{ error "failed to write user-data to $sdir"; return 1; }
else
rm -f "$sdir/user-data"
fi
}
insert_ds() {
local dstype="$1" root_d="$2" authkey="$3" udfile="$4"
case "$dstype" in
nocloud) insert_ds_nocloud "$root_d" "$authkey" "$udfile"
esac
}
extract_rootfs() {
local tarball="$1" rootfs_d="$2"
mkdir -p "${rootfs_d}" ||
{ error "failed to make rootfs dir ${rootfs_d}"; return 1; }
tar -C "${rootfs_d}" -Sxzf "${tarball}" ||
{ error "failed to populate ${rootfs_d}"; return 1; }
return 0
}
download_tarball() {
local arch="$1" ver="$2" cached="$3" baseurl="$4"
local out="" outd="" file="" dlpath=""
file="cirros-$ver-$arch-lxc.tar.gz"
dlpath="$ver/$file"
outd="${cached}/${dlpath%/*}"
if [ -f "$cached/$dlpath" ]; then
_RET="$cached/$dlpath"
return 0
fi
mkdir -p "${outd}" ||
{ error "failed to create ${outd}"; return 1; }
debug 1 "downloading ${baseurl%/}/$dlpath" to "${cached}/$dlpath"
wget "${baseurl%/}/$dlpath" -O "$cached/${dlpath}.$$" &&
mv "$cached/$dlpath.$$" "$cached/$dlpath" || {
rm -f "$cached/$dlpath.$$";
error "failed to download $dlpath";
return 1;
}
_RET="$cached/$dlpath"
}
create_main() {
local short_opts="a:hn:p:S:uvV"
local long_opts="arch:,auth-key:,name:,path:,tarball:,userdata:,verbose,version:,rootfs:"
local getopt_out=""
getopt_out=$(getopt --name "${0##*/}" \
--options "${short_opts}" --long "${long_opts}" -- "$@") &&
eval set -- "${getopt_out}" ||
{ bad_Usage; return; }
local arch="${DEF_ARCH}" dsource="${DEF_SOURCE}" version="${DEF_VERSION}"
local authkey_f="" authkeys="" userdata_f="" path="" tarball=""
local cur="" next=""
local rootfs_d=""
while [ $# -ne 0 ]; do
cur=$1; next=$2;
case "$cur" in
-a|--arch) arch="$next"; shift;;
-h|--help) Usage ; return 0;;
-n|--name) name="$next"; shift;;
-v|--verbose) VERBOSITY=$((${VERBOSITY}+1));;
-S|--auth-key) authkey_f="$next"; shift;;
-p|--path) path=$next; shift;;
-v|--version) version=$next; shift;;
-u|--userdata) userdata_f="$next"; shift;;
--tarball) tarball="$next"; shift;;
--source) dsource="$next"; shift;;
--rootfs) rootfs_d="$next"; shift;;
--) shift; break;;
esac
shift;
done
[ -n "$rootfs_d" ] || rootfs_d="$path/rootfs"
[ $# -eq 0 ] || { bad_Usage "unexpected arguments: $*"; return; }
[ -n "$path" ] || { error "'path' parameter is required"; return 1; }
if [ "$(id -u)" != "0" ]; then
{ error "must be run as root"; return 1; }
fi
case "$arch" in
i?86) arch="i386";;
amd64) arch="x86_64";;
esac
inargs "$arch" "${ARCHES[@]}" ||
{ error "bad arch '$arch'. allowed: ${ARCHES[*]}"; return 1; }
inargs "$dsource" "${SOURCES[@]}" ||
{ error "bad source '$dsource'. allowed: ${SOURCES[*]}"; return 1; }
if [ "$dsource" = "none" ] && [ -n "$userdata_f" -o -n "$authkey_f" ]; then
error "userdata and authkey are incompatible with --source=none";
return 1;
fi
if [ -n "$authkey_f" ]; then
if [ ! -f "$authkey_f" ]; then
error "--auth-key=${authkey_f} must reference a file"
return 1
fi
authkeys=$(cat "$authkey_f") ||
{ error "failed to read ${authkey_f}"; return 1; }
fi
if [ -n "$userdata_f" -a ! -f "${userdata_f}" ]; then
error "${userdata_f}: --userdata arg not a file"
return 1
fi
if [ -z "$tarball" ]; then
if inargs "$version" "${STREAMS[@]}"; then
out=$(wget -O - -q "${DOWNLOAD_URL%/}/version/$version") ||
{ error "failed to convert 'version=$version'"; return 1; }
version="$out"
fi
download_tarball "$arch" "$version" "${CACHE_D}" "${DOWNLOAD_URL}" ||
return
tarball="$_RET"
fi
extract_rootfs "${tarball}" "${rootfs_d}" || return
# cirros 0.3.1 was broken for /dev/random and /dev/urandom
if [ -b "$rootfs_d/dev/random" ]; then
rm -f "$rootfs_d/dev/random" &&
mknod --mode=666 "$rootfs_d/dev/random" c 1 8 ||
{ error "failed to fix /dev/random"; return 1; }
fi
if [ -b "$rootfs_d/dev/urandom" ]; then
rm -f "$rootfs_d/dev/urandom" &&
mknod --mode=666 "$rootfs_d/dev/urandom" c 1 9 ||
{ error "failed to fix /dev/urandom"; return 1; }
fi
if [ "$version" = "0.3.2~pre1" ]; then
debug 1 "fixing console for lxc and '$version'"
sed -i 's,^\(#console.* 115200 \)# /dev/console,\1 console,g' \
"$rootfs_d/etc/inittab" ||
{ error "failed to fix console entry for $version"; return 1; }
fi
if [ "$dsource" != "none" ]; then
insert_ds "$dsource" "$path/rootfs" "$authkeys" "$userdata_f" || {
error "failed to insert userdata to $path/rootfs"
return 1
}
fi
copy_configuration "$path" "$path/rootfs" "$name" "$arch" "$release"
return
}
create_main "$@"
# vi: ts=4 expandtab