lxc-opensuse.in revision 207bf0e475f1dc6e9a2dac2cee3a209b56427855
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# template script for generating suse container for LXC
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# lxc: linux Container library
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Daniel Lezcano <daniel.lezcano@free.fr>
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Frederic Crozat <fcrozat@suse.com>
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# This library is free software; you can redistribute it and/or
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# modify it under the terms of the GNU Lesser General Public
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# License as published by the Free Software Foundation; either
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# version 2.1 of the License, or (at your option) any later version.
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# This library is distributed in the hope that it will be useful,
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# but WITHOUT ANY WARRANTY; without even the implied warranty of
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Lesser General Public License for more details.
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# You should have received a copy of the GNU Lesser General Public
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# License along with this library; if not, write to the Free Software
250b1eec71b074acdff1c5f6b5a1f0d7d2c20b77Stéphane Graber# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
8ec981fc8b0105da5f071e40811e0c2472a6c3c9Stéphane Graber# Detect use under userns (unsupported)
c63c04fcaf1c3a78c70500eae253d72fa9c8358aTAMUKI Shoichi if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
8ec981fc8b0105da5f071e40811e0c2472a6c3c9Stéphane Graber echo "This template can't be used for unprivileged containers." 1>&2
8ec981fc8b0105da5f071e40811e0c2472a6c3c9Stéphane Graber echo "You may want to try the \"download\" template instead." 1>&2
207bf0e475f1dc6e9a2dac2cee3a209b56427855Stéphane Graber# Make sure the usual locations are in PATH
207bf0e475f1dc6e9a2dac2cee3a209b56427855Stéphane Graberexport PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # set network as static, but everything is done by LXC outside the container
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat cat <<EOF > $rootfs/etc/sysconfig/network/ifcfg-eth0
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSTARTMODE='auto'
ba4c42597399c72fbb0b8f99e6ded79f738a6ac3Frederic CrozatBOOTPROTO='none'
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # do not use hostname from HOSTNAME variable
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatunset HOSTNAME
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat127.0.0.1 localhost $hostname
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat cat <<EOF > $rootfs/etc/sysconfig/bootloader
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatLOADER_TYPE=none
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatLOADER_LOCATION=none
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# disable root fsck
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatROOTFS_FSCK="0"
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatROOTFS_BLKDEV="/dev/null"
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/proc-sys-fs-binfmt_misc.automount
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/console-shell.service
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/systemd-vconsole-setup.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn sed -e 's/ConditionPathExists=.*//' /usr/lib/systemd/system/getty@.service > $rootfs/etc/systemd/system/getty@.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s getty@.service $rootfs/etc/systemd/system/getty@tty1.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s ../getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@console.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s -f ../getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@tty1.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s ../getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@tty2.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s ../getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@tty3.service
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn ln -s ../getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@tty4.service
98f5f7e2c54fc003f81b2164adf3c7bd8a104556Cedric Bosdonnat # copy host poweroff target as sigpwr target to make shutdown work
98f5f7e2c54fc003f81b2164adf3c7bd8a104556Cedric Bosdonnat # see https://wiki.archlinux.org/index.php/Linux_Containers#Container_cannot_be_shutdown_if_using_systemd
98f5f7e2c54fc003f81b2164adf3c7bd8a104556Cedric Bosdonnat cp /usr/lib/systemd/system/poweroff.target $rootfs/usr/lib/systemd/system/sigpwr.target
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat if [ ! -x /usr/bin/build ]; then
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat echo "you need to install \"build\" package"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # check the mini opensuse was not already downloaded
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Failed to create '$cache/partial-$arch' directory"
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive ar http://download.opensuse.org/distribution/$DISTRO/repo/oss/ repo-oss || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive ar http://download.opensuse.org/update/$DISTRO/ update || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive --gpg-auto-import-keys update || return 1
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge Hallyn zypper --root $cache/partial-$arch-packages --non-interactive in --auto-agree-with-licenses --download-only zypper lxc patterns-openSUSE-base bash iputils sed tar rsyslog || return 1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat cat > $cache/partial-$arch-packages/opensuse.conf << EOF
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatPreinstall: aaa_base bash coreutils diffutils
cc33e055dd047af7b4cc8a226bb54b3b9c450152Jiri SlabyPreinstall: filesystem fillup glibc grep insserv-compat perl-base
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge HallynPreinstall: libbz2-1 libgcc_s1 libncurses5 pam
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge HallynPreinstall: permissions libreadline6 rpm sed tar libz1 libselinux1
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: liblzma5 libcap2 libacl1 libattr1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatPreinstall: libpopt0 libelf1 liblua5_1
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: libpcre1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatRunScripts: aaa_base
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatSupport: zypper
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatSupport: patterns-openSUSE-base
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: ncurses-utils
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: iputils
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: netcfg
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge HallynSupport: dhcpcd hwinfo insserv-compat module-init-tools openSUSE-release openssh
36368228d286cd5c1492ae7aab92b4d78dbfb616Serge HallynSupport: pwdutils rpcbind sysconfig
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatIgnore: rpm:suse-build-key,build-key
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatIgnore: systemd:systemd-presets-branding
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat mkdir -p $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i686/
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat for i in "$cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i586/*" ; do
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s $i $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i686/
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat mkdir -p $cache/partial-$arch-packages/var/cache/zypp/packages/update/i686
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat for i in "$cache/partial-$arch-packages/var/cache/zypp/packages/update/i586/*" ; do
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s $i $cache/partial-$arch-packages/var/cache/zypp/packages/update/i686/
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby CLEAN_BUILD=1 BUILD_ARCH="$arch" BUILD_ROOT="$cache/partial-$arch" BUILD_DIST="$cache/partial-$arch-packages/opensuse.conf" PATH="$PATH:/usr/lib/build" /usr/lib/build/init_buildsystem --clean --configdir /usr/lib/build/configs --cachedir $cache/partial-$arch-cache --repository $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/$arch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/noarch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/update/$arch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/update/noarch || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby chroot $cache/partial-$arch /usr/bin/zypper --quiet --non-interactive ar http://download.opensuse.org/distribution/$DISTRO/repo/oss repo-oss || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby chroot $cache/partial-$arch /usr/bin/zypper --quiet --non-interactive ar http://download.opensuse.org/update/$DISTRO/ update || return 1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# really clean the image
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat rm -fr $cache/partial-$arch/{.build,.guessed_dist,.srcfiles*,installed-pkg}
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# make sure we have a minimal /dev
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat mknod -m 666 $cache/partial-$arch/dev/null c 1 3
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat mknod -m 666 $cache/partial-$arch/dev/zero c 1 5
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# create mtab symlink
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat ln -sf /proc/self/mounts $cache/partial-$arch/etc/mtab
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozat# ensure /var/run and /run are symlinked
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozat ln -s -f ../run $cache/partial-$arch/var/run
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Failed to download the rootfs, aborting."
44d397891e691ab994a69766cc72e57265b62da1Serge Hallyn rsync -Ha $cache/rootfs-$arch/ $rootfs/ || return 1
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Checking cache download in $cache/rootfs-$arch ... "
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Copy $cache/rootfs-$arch to $rootfs ... "
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat if grep -q "^lxc.network.type" $path/config; then
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber TYPE=$(sed '/^#/d; /lxc.network.type/!d; s/.*=[ \t]*//' $path/config)
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber if [ ! grep -q "^lxc.network.*.gateway" $path/config ]; then
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber [ $IPV4_NOT_CONFIGURED -eq 0 ] && IPV4=$(sed '/^#/d; /lxc.network.ipv4/!d; /gateway/d; s/.*=[ \t]*//; s/\([[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\).*/\1/' $path/config)
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber if [ "$TYPE" = "veth" -o "$TYPE" = "macvlan" ]; then
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber if [ $IPV4_NOT_CONFIGURED -eq 0 -a "$IPV4" != "0.0.0.0" ]; then
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber IP=$(/sbin/ip route | awk '/default/ { print $3 }')
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber echo "lxc.network.ipv4.gateway = $IP " >> $path/config
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber sed -i -e 's/BOOTPROTO=.*/BOOTPROTO=dhcp/' $rootfs/etc/sysconfig/network/ifcfg-eth0
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber echo "#remove next line if host DNS configuration should not be available to container" >> $path/config
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber echo "lxc.mount.entry = /etc/resolv.conf etc/resolv.conf none bind,ro 0 0" >> $path/config
c01c25fcdd1e0cacad8075bcfcef4c8e8d4b8cb6Stéphane Graber echo 'lxc.network.type = empty' >> $path/config
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallyn grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.utsname = $name
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.pts = 1024
eba7df9ee0a1963984ef212e7ddfc0e0835af288Stéphane Graberlxc.mount = $path/fstab
eee3ba81c88e64b8a732694fc4843a39d5bde491Serge Hallynlxc.cap.drop = sys_module mac_admin mac_override mknod sys_time
f02ce27d4b1a9d01b88d0ffaf626e5bafa671bf0Stéphane Graber# When using LXC with apparmor, uncomment the next line to run unconfined:
f02ce27d4b1a9d01b88d0ffaf626e5bafa671bf0Stéphane Graber#lxc.aa_profile = unconfined
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.deny = a
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# /dev/null and zero
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:3 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:5 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:1 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:0 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 4:0 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 4:1 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# /dev/{,u}random
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:9 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:8 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 136:* rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:2 rwm
eee3ba81c88e64b8a732694fc4843a39d5bde491Serge Hallynlxc.cgroup.devices.allow = c 254:0 rm
80a881b232b8955b85b360d4def99e6e680ff61bSerge Hallynproc proc proc nodev,noexec,nosuid 0 0
80a881b232b8955b85b360d4def99e6e680ff61bSerge Hallynsysfs sys sysfs defaults 0 0
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozattmpfs run tmpfs mode=0755,nodev,nosuid 0 0
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ ! -e $cache ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # lock, so we won't purge while someone is creating a repository
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? != 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat$1 -h|--help -p|--path=<path> --clean
1897e3bcd36af9f3fe6d3649910a9adb93e5e988Serge Hallynoptions=$(getopt -o hp:n:c -l help,rootfs:,path:,name:,clean -- "$@")
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber --) shift 1; break ;;
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "'zypper' command is missing"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatif [ -z "$path" ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "'path' parameter is required"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "This script should be run as 'root'"
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallyn# detect rootfs
1897e3bcd36af9f3fe6d3649910a9adb93e5e988Serge Hallynif [ -z "$rootfs" ]; then
1897e3bcd36af9f3fe6d3649910a9adb93e5e988Serge Hallyn if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
853d58fdf5af0960b7b6edc9dea0fadddb8535f1Elan Ruusamäe rootfs=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $config)
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed to install opensuse"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed to configure opensuse for a container"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed write configuration file"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatif [ ! -z $clean ]; then