lxc-download.in revision 71d3a6590fe665421d7a0026d699b0654ddfc7f6
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Client script for LXC container images.
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Copyright © 2014 Stéphane Graber <stgraber@ubuntu.com>
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# This library is free software; you can redistribute it and/or
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# modify it under the terms of the GNU Lesser General Public
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# License as published by the Free Software Foundation; either
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# version 2.1 of the License, or (at your option) any later version.
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# This library is distributed in the hope that it will be useful,
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# but WITHOUT ANY WARRANTY; without even the implied warranty of
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Lesser General Public License for more details.
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# You should have received a copy of the GNU Lesser General Public
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# License along with this library; if not, write to the Free Software
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Some useful functions
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if ! wget -q https://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if ! wget -q http://${DOWNLOAD_SERVER}/$1 -O $2 >/dev/null 2>&1; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi elif [ "$DOWNLOAD_SHOW_HTTP_WARNING" = "true" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "WARNING: Failed to download the file over HTTPs." 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo -n " The file was instead download over HTTP. " 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "A server replay attack may be possible!" 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi --recv-keys ${DOWNLOAD_KEYID} >/dev/null 2>&1; then
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi echo "ERROR: Unable to fetch GPG key from keyserver."
70bb1a9ca75543597766cfd644b53db5cc772d3fLars Wikberg if [ "$DOWNLOAD_SHOW_GPG_WARNING" = "true" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "WARNING: Running without gpg validation!" 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if ! gpg --verify $1 >/dev/zero 2>&1; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi [ -e /proc/self/uid_map ] || { echo no; return; }
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || \
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi [ "$line" = "0 0 4294967295" ] && { echo no; return; }
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ -e "${FILE_PATH}-${DOWNLOAD_MODE}" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ -e "$FILE_PATH.${DOWNLOAD_COMPAT_LEVEL}" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi FILE_PATH="${FILE_PATH}.${DOWNLOAD_COMPAT_LEVEL}"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH YasufumiLXC container image downloader
57da8c32f85c0255efa61ee32e260068afdaa565KATOH YasufumiRequired arguments:
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ -d | --dist <distribution> ]: The name of the distribution
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ -r | --release <release> ]: Release name/version
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi[ -a | --arch <architecture> ]: Architecture of the container
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ -h | --help ]: This help message
57da8c32f85c0255efa61ee32e260068afdaa565KATOH YasufumiOptional arguments:
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --variant <variant> ]: Variant of the image (default: "default")
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --server <server> ]: Image server (default: "images.linuxcontainers.org")
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --keyid <keyid> ]: GPG keyid (default: 0x...)
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --keyserver <keyserver> ]: GPG keyserver to use
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --no-validate ]: Disable GPG validation (not recommended)
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --flush-cache ]: Flush the local copy (if present)
57da8c32f85c0255efa61ee32e260068afdaa565KATOH YasufumiLXC internal arguments (do not pass manually!):
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --name <name> ]: The container name
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --path <path> ]: The path to the container
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --rootfs <rootfs> ]: The path to the container's rootfs
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi[ --mapped-uid <map> ]: A uid/gid map (user namespaces)
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumioptions=$(getopt -o d:r:a:h -l dist:,release:,arch:,help,variant:,server:,\
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumikeyid:,no-validate,flush-cache,name:,path:,rootfs:,mapped-uid: -- "$@")
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi --no-validate) DOWNLOAD_VALIDATE="false"; shift 1;;
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi --flush-cache) DOWNLOAD_FLUSH_CACHE="true"; shift 1;;
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Check for required binaries
3726cda21aade3dce418315e7f3dd2e15b69f735KATOH Yasufumi echo "ERROR: Missing required tool: $bin" 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Check for GPG
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "ERROR: Missing recommended tool: gpg" 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "You can workaround this by using --no-validate." 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Check that we have all variables we need
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -z "$LXC_NAME" ] || [ -z "$LXC_PATH" ] || [ -z "$LXC_ROOTFS" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ -z "$LXC_MAPPED_UID" ] || [ "$LXC_MAPPED_UID" = "-1" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "ERROR: In a user namespace without a map." 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -z "$DOWNLOAD_DIST" ] || [ -z "$DOWNLOAD_RELEASE" ] || \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Trap all exit signals
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Setup the cache
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi LXC_CACHE_PATH="$LOCALSTATEDIR/cache/lxc/download/$DOWNLOAD_DIST"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi LXC_CACHE_PATH="$HOME/.cache/lxc/download/$DOWNLOAD_DIST"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi LXC_CACHE_PATH="$LXC_CACHE_PATH/$DOWNLOAD_RELEASE/$DOWNLOAD_ARCH"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -d "$LXC_CACHE_PATH" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ "$DOWNLOAD_FLUSH_CACHE" = "true" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "Flushing the cache..."
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi if [ "$(cat $(relevant_file expiry))" -lt $(date +%s) ]; then
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi echo "The cached copy has expired, re-downloading..."
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Download what's needed
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi # Initialize GPG
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi # Grab the index
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi DOWNLOAD_INDEX_PATH=/meta/1.0/index-${DOWNLOAD_MODE}
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "Downloading the image index"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL} \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi ! download_file ${DOWNLOAD_INDEX_PATH}.${DOWNLOAD_COMPAT_LEVEL}.asc \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi download_file ${DOWNLOAD_INDEX_PATH} ${DOWNLOAD_TEMP}/index normal
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi while read line; do
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi # Basic CSV parser
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi [ -z "$6" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ -z "$DOWNLOAD_URL" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "ERROR: Couldn't find a matching image." 1>&1
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi # Download the actual files
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "Downloading the rootfs"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi download_file $DOWNLOAD_URL/rootfs.tar.xz.asc \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi gpg_validate ${DOWNLOAD_TEMP}/rootfs.tar.xz.asc
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "Downloading the metadata"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi download_file $DOWNLOAD_URL/meta.tar.xz.asc \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi gpg_validate ${DOWNLOAD_TEMP}/meta.tar.xz.asc
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi mv ${DOWNLOAD_TEMP}/rootfs.tar.xz $LXC_CACHE_PATH
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if ! tar Jxf ${DOWNLOAD_TEMP}/meta.tar.xz -C $LXC_CACHE_PATH; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi chown $LXC_MAPPED_UID -Rf $LXC_CACHE_BASE >/dev/null 2>&1 || true
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "The image cache is now ready"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "Using image from local cache"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Unpack the rootfs
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiecho "Unpacking the rootfs"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi tar --numeric-owner -xpJf ${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi tar --anchored --exclude="./dev/*" --numeric-owner -xpJf \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi ${LXC_CACHE_PATH}/rootfs.tar.xz -C ${LXC_ROOTFS}
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Setup the configuration
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ ! -e $configfile ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "ERROR: meta tarball is missing the configuration file" 1>&2
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi## Extract all the network config entries
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumised -i -e "/lxc.network/{w ${LXC_PATH}/config-network" -e "d}" \
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi## Extract any other config entry
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumised -i -e "/lxc./{w ${LXC_PATH}/config-auto" -e "d}" ${LXC_PATH}/config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi## Append the defaults
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiecho "# Distribution configuration" >> ${LXC_PATH}/config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi## Add the container-specific config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiecho "# Container specific configuration" >> ${LXC_PATH}/config
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumiif [ -e "${LXC_PATH}/config-auto" ]; then
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi cat ${LXC_PATH}/config-auto >> ${LXC_PATH}/config
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumiif [ -e "$fstab" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "lxc.mount = ${LXC_PATH}/fstab" >> ${LXC_PATH}/config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiecho "lxc.utsname = ${LXC_NAME}" >> ${LXC_PATH}/config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi## Re-add the previously removed network config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -e "${LXC_PATH}/config-network" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi echo "# Network configuration" >> ${LXC_PATH}/config
dc421f3aac1f0e516c763dd156629a8ed2a7b4caKATOH Yasufumi cat ${LXC_PATH}/config-network >> ${LXC_PATH}/config
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Setup the fstab
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -e $fstab ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi TEMPLATE_FILES="$TEMPLATE_FILES ${LXC_PATH}/fstab"
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Look for extra templates
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi while read line; do
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi [ ! -e "$fullpath" ] && continue
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi# Replace variables in all templates
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi [ ! -e "$file" ] && continue
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi sed -i "s#LXC_TEMPLATE_CONFIG#$LXC_TEMPLATE_CONFIG#g" $file
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi sed -i "s#LXC_HOOK_DIR#$LXC_HOOK_DIR#g" $file
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumi chown $LXC_MAPPED_UID -f $LXC_PATH/config $LXC_PATH/fstab || true
57da8c32f85c0255efa61ee32e260068afdaa565KATOH Yasufumiif [ -e "$(relevant_file create-message)" ]; then