lxc-fedora.in revision 8983aa6e1e831f690be9cf38ae434a0de8b5107d
0N/A# template script for generating fedora container for LXC 0N/A# lxc: linux Container library 0N/A# Daniel Lezcano <daniel.lezcano@free.fr> 0N/A# Ramez Hanna <rhanna@informatiq.org> 0N/A# This library is free software; you can redistribute it and/or 0N/A# modify it under the terms of the GNU Lesser General Public 0N/A# License as published by the Free Software Foundation; either 0N/A# version 2.1 of the License, or (at your option) any later version. 0N/A# This library is distributed in the hope that it will be useful, 0N/A# but WITHOUT ANY WARRANTY; without even the implied warranty of 0N/A # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 0N/A# Lesser General Public License for more details. 0N/A# You should have received a copy of the GNU Lesser General Public 0N/A# License along with this library; if not, write to the Free Software 0N/A# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 0N/A# Alow for weird remixes like the Raspberry Pi 0N/A# Use the Mitre standard CPE identifier for the release ID if possible... 0N/A# This is a shell friendly configuration file. We can just source it. 0N/A# What we're looking for in here is the ID, VERSION_ID and the CPE_NAME 0N/A if [
"${CPE_URI}" !=
"cpe:/o" ]
98N/A # Probably a better way to do this but sill remain posix 98N/A # compatible but this works, shrug... 98N/A # Must be nice and not introduce convenient bashisms here. 98N/Aif [
"${CPE_NAME}" !=
"" -a
"${ID}" =
"fedora" -a
"${VERSION_ID}" !=
"" ]
98N/A # Only if all other methods fail, try to parse the redhat-release file. 98N/A# Map a few architectures to their generic Fedora repository archs. 98N/A# The two ARM archs are a bit of a guesstimate for the v5 and v6 98N/A# archs. V6 should have hardware floating point (Rasberry Pi). 98N/A# The "arm" arch is safer (no hardware floating point). So 98N/A# there may be cases where we "get it wrong" for some v6 other 0N/A # disable selinux in fedora 0N/A # configure the network using the dhcp 0N/A cat <<EOF > ${rootfs_path}/etc/sysconfig/network-scripts/ifcfg-eth0 0N/A cat <<EOF > ${rootfs_path}/etc/sysconfig/network 0N/A # set hostname on systemd Fedora systems 0N/A cat <<EOF > $rootfs_path/etc/hosts 0N/A127.0.0.1 localhost.localdomain localhost $utsname 0N/A::1 localhost6.localdomain6 localhost6 58N/A # specifying this in the initial packages doesn't always work. 58N/A echo "installing fedora-release package" 58N/A # silence some needless startup errors 58N/A # don't mount devpts, for pete's sake 0N/A #dependency on a device unit fails it specially that we disabled udev 98N/A # Actually, the After=dev-%i.device line does not appear in the 97N/A # Fedora 17 or Fedora 18 systemd getty\@.service file. It may be left 98N/A # over from an earlier version and it's not doing any harm. We do need 97N/A # to disable the "ConditionalPathExists=/dev/tty0" line or no gettys are 98N/A # started on the ttys in the container. Lets do it in an override copy of 0N/A # the service so it can still pass rpm verifies and not be automatically 0N/A # updated by a new systemd version. -- mhw /\/\|=mhw=|\/\/ 0N/A sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \ 0N/A # Setup getty service on the 4 ttys we are going to allow in the 0N/A # check the mini fedora was not already downloaded 0N/A # download a mini fedora into a cache 0N/A echo "Downloading fedora minimal ..." 0N/A PKG_LIST="yum initscripts passwd rsyslog vim-minimal dhclient chkconfig rootfiles policycoreutils fedora-release" 0N/A # We're splitting the old loop into two loops plus a directory retrival. 0N/A # First loop... Try and retrive a mirror list with retries and a slight 0N/A # delay between attempts... 98N/A # This code is mildly "brittle" in that it assumes a certain 98N/A # page format and parsing HTML. I've done worse. :-P 98N/A # This will fall through if we didn't get any URLS above 98N/A # This code is mildly "brittle" in that it assumes a certain directory 98N/A # page format and parsing HTML. I've done worse. :-P 0N/A if [ $? -ne 0 -o "${RELEASE_RPM}" = "" ]; then 0N/A echo "Failed to identify fedora release rpm." 0N/A echo "Fetching fedora release rpm from ${RELEASE_URL}/${RELEASE_RPM}......" 0N/A echo "Failed to download fedora release rpm ${RELEASE_RPM}." 0N/A echo "Failed to download the rootfs, aborting." 0N/A echo "Download complete." 0N/A # make a local copy of the minifedora 0N/A # i prefer rsync (no reason really) 0N/A echo "Cache repository is busy." 0N/A echo "Checking cache download in $cache/rootfs ... " 0N/A echo "Failed to download 'fedora base'" 0N/A echo "Cache found. Updating..." 0N/A echo "Failed to update 'fedora base', continuing with last known good cache" 97N/A echo "Update finished" 0N/A echo "Failed to copy rootfs" 0N/A cat <<EOF >> $config_path/config 0N/Alxc.utsname = $utsname 0N/Alxc.mount = $config_path/fstab 0N/Alxc.cap.drop = sys_module mac_admin mac_override sys_time 0N/Alxc.autodev = $auto_dev 0N/A# When using LXC with apparmor, uncomment the next line to run unconfined: 0N/A#lxc.aa_profile = unconfined 97N/Alxc.cgroup.devices.deny = a 0N/Alxc.cgroup.devices.allow = c 1:3 rwm 0N/Alxc.cgroup.devices.allow = c 1:5 rwm 0N/Alxc.cgroup.devices.allow = c 5:1 rwm 0N/Alxc.cgroup.devices.allow = c 5:0 rwm 0N/Alxc.cgroup.devices.allow = c 4:0 rwm 0N/Alxc.cgroup.devices.allow = c 4:1 rwm 0N/Alxc.cgroup.devices.allow = c 1:9 rwm 0N/Alxc.cgroup.devices.allow = c 1:8 rwm 0N/Alxc.cgroup.devices.allow = c 136:* rwm 0N/Alxc.cgroup.devices.allow = c 5:2 rwm 0N/Alxc.cgroup.devices.allow = c 254:0 rm 0N/A cat <<EOF > $config_path/fstab 0N/Aproc proc proc nodev,noexec,nosuid 0 0 0N/Asysfs sys sysfs defaults 0 0 58N/A echo "Failed to add configuration" 0N/A # lock, so we won't purge while someone is creating a repository 0N/A if [ $? != 0 ]; then 0N/A echo "Cache repository is busy." 66N/A echo -n "Purging the download cache for Fedora-$release..." $1 -n|--name=<container_name> [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>] [--fqdn=<network name of container>] [-A|--arch=<arch of the container>] -n,--name container name, used to as an identifier for that container from now on -p,--path path to where the container will be created, defaults to @LXCPATH@. The container config will go under @LXCPATH@ in that case --rootfs path for actual rootfs. -c,--clean clean the cache -R,--release Fedora release for the new container. if the host is Fedora, then it will default to the host's release. --fqdn fully qualified domain name (FQDN) for DNS and system naming -A,--arch NOT USED YET. Define what arch the container will be [i686,x86_64] -h,--help print this help if [ -z
"${utsname}" ];
then # This follows a standard "resolver" convention that an FQDN must have # at least two dots or it is considered a local relative host name. # If it doesn't, append the dns domain name of the host system. # This changes one significant behavior when running # "lxc_create -n Container_Name" without using the # utsname and hostname = Container_Name echo "Please install these using \"sudo yum install $needed_pkgs\"" echo "This is not a fedora host and release missing, defaulting to 18. use -R|--release to specify release" # Fedora 15 and above run systemd. We need autodev enabled to keep # systemd from causing problems. if [
"$(id -u)" !=
"0" ];
then echo "This script should be run as 'root'" # check for 'lxc.rootfs' passed in through default config by lxc-create echo "Interrupted, so cleaning up" # maybe was interrupted before copy config echo "failed write configuration file" echo "failed to install fedora" echo "failed to configure fedora for a container" # If the systemd configuration directory exists - set it up for what we need. # This configuration (rc.sysinit) is not inconsistent with the systemd stuff # above and may actually coexist on some upgraded systems. Let's just make # sure that, if it exists, we update this file, even if it's not used... echo "container rootfs and config created"