lxc-opensuse.in revision f4936bf19c56a688eec182e1916c8b660e3a0058
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# template script for generating suse container for LXC
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# lxc: linux Container library
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Daniel Lezcano <daniel.lezcano@free.fr>
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Frederic Crozat <fcrozat@suse.com>
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# This library is free software; you can redistribute it and/or
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# modify it under the terms of the GNU Lesser General Public
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# License as published by the Free Software Foundation; either
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# version 2.1 of the License, or (at your option) any later version.
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# This library is distributed in the hope that it will be useful,
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# but WITHOUT ANY WARRANTY; without even the implied warranty of
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Lesser General Public License for more details.
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# You should have received a copy of the GNU Lesser General Public
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# License along with this library; if not, write to the Free Software
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # set network as static, but everything is done by LXC outside the container
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat cat <<EOF > $rootfs/etc/sysconfig/network/ifcfg-eth0
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSTARTMODE='auto'
ba4c42597399c72fbb0b8f99e6ded79f738a6ac3Frederic CrozatBOOTPROTO='none'
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # do not use hostname from HOSTNAME variable
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatunset HOSTNAME
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat127.0.0.1 localhost $hostname
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat cat <<EOF > $rootfs/etc/sysconfig/bootloader
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatLOADER_TYPE=none
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatLOADER_LOCATION=none
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# disable root fsck
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatROOTFS_FSCK="0"
c840b37de865195a8742e219b4374d961a21d4d9Frederic CrozatROOTFS_BLKDEV="/dev/null"
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/proc-sys-fs-binfmt_misc.automount
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/console-shell.service
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /dev/null $rootfs/etc/systemd/system/systemd-vconsole-setup.service
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s /lib/systemd/system/getty@.service $rootfs/etc/systemd/system/getty.target.wants/getty@console.service
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat if [ ! -x /usr/bin/build ]; then
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat echo "you need to install \"build\" package"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # check the mini opensuse was not already downloaded
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Failed to create '$cache/partial-$arch' directory"
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive ar http://download.opensuse.org/distribution/$DISTRO/repo/oss/ repo-oss || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive ar http://download.opensuse.org/update/$DISTRO/ update || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --quiet --root $cache/partial-$arch-packages --non-interactive --gpg-auto-import-keys update || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby zypper --root $cache/partial-$arch-packages --non-interactive in --auto-agree-with-licenses --download-only zypper lxc patterns-openSUSE-base bash iputils sed tar || return 1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat cat > $cache/partial-$arch-packages/opensuse.conf << EOF
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatPreinstall: aaa_base bash coreutils diffutils
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: filesystem fillup glibc grep insserv
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: libbz2-1 libgcc47 libncurses5 pam
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatPreinstall: permissions libreadline6 rpm sed tar zlib libselinux1
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: liblzma5 libcap2 libacl1 libattr1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatPreinstall: libpopt0 libelf1 liblua5_1
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatPreinstall: libpcre1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatRunScripts: aaa_base
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatSupport: zypper
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic CrozatSupport: patterns-openSUSE-base
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: ncurses-utils
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: iputils
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: netcfg
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: dhcpcd hwinfo insserv module-init-tools openSUSE-release openssh
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatSupport: pwdutils rpcbind sysconfig rsyslog
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatIgnore: rpm:suse-build-key,build-key
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic CrozatIgnore: systemd:systemd-presets-branding
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat mkdir -p $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i686/
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat for i in "$cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i586/*" ; do
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s $i $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/i686/
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat mkdir -p $cache/partial-$arch-packages/var/cache/zypp/packages/update/i686
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat for i in "$cache/partial-$arch-packages/var/cache/zypp/packages/update/i586/*" ; do
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat ln -s $i $cache/partial-$arch-packages/var/cache/zypp/packages/update/i686/
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby CLEAN_BUILD=1 BUILD_ARCH="$arch" BUILD_ROOT="$cache/partial-$arch" BUILD_DIST="$cache/partial-$arch-packages/opensuse.conf" PATH="$PATH:/usr/lib/build" /usr/lib/build/init_buildsystem --clean --configdir /usr/lib/build/configs --cachedir $cache/partial-$arch-cache --repository $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/$arch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/repo-oss/suse/noarch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/update/$arch --repository $cache/partial-$arch-packages/var/cache/zypp/packages/update/noarch || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby chroot $cache/partial-$arch /usr/bin/zypper --quiet --non-interactive ar http://download.opensuse.org/distribution/$DISTRO/repo/oss repo-oss || return 1
f4936bf19c56a688eec182e1916c8b660e3a0058Jiri Slaby chroot $cache/partial-$arch /usr/bin/zypper --quiet --non-interactive ar http://download.opensuse.org/update/$DISTRO/ update || return 1
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# really clean the image
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat rm -fr $cache/partial-$arch/{.build,.guessed_dist,.srcfiles*,installed-pkg}
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# make sure we have a minimal /dev
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat mknod -m 666 $cache/partial-$arch/dev/null c 1 3
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat mknod -m 666 $cache/partial-$arch/dev/zero c 1 5
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat# create mtab symlink
44ee8a102e3d8052631fbb119f58a55ce678d039Frederic Crozat ln -sf /proc/self/mounts $cache/partial-$arch/etc/mtab
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozat# ensure /var/run and /run are symlinked
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozat ln -s -f ../run $cache/partial-$arch/var/run
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Failed to download the rootfs, aborting."
44d397891e691ab994a69766cc72e57265b62da1Serge Hallyn rsync -Ha $cache/rootfs-$arch/ $rootfs/ || return 1
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Checking cache download in $cache/rootfs-$arch ... "
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber echo "Copy $cache/rootfs-$arch to $rootfs ... "
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? -ne 0 ]; then
fe253caa8b98854445aaf6ee253545ee1f13beb1Stéphane Graber ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-opensuse
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat if grep -q "^lxc.network.type" $path/config; then
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat TYPE=$(sed '/^#/d; /lxc.network.type/!d; s/.*=[ \t]*//' $path/config)
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat if [ ! grep -q "^lxc.network.*.gateway" $path/config ]; then
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat [ $IPV4_NOT_CONFIGURED -eq 0 ] && IPV4=$(sed '/^#/d; /lxc.network.ipv4/!d; /gateway/d; s/.*=[ \t]*//; s/\([[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\).*/\1/' $path/config)
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat if [ "$TYPE" = "veth" -o "$TYPE" = "macvlan" ]; then
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat if [ $IPV4_NOT_CONFIGURED -eq 0 -a "$IPV4" != "0.0.0.0" ]; then
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat IP=$(/sbin/ip route | awk '/default/ { print $3 }')
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat echo "lxc.network.ipv4.gateway = $IP " >> $path/config
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat sed -i -e 's/BOOTPROTO=.*/BOOTPROTO=dhcp/' $rootfs/etc/sysconfig/network/ifcfg-eth0
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat echo "#remove next line if host DNS configuration should not be available to container" >> $path/config
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat echo "lxc.mount.entry = /etc/resolv.conf etc/resolv.conf none bind,ro 0 0" >> $path/config
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozat echo 'lxc.network.type = empty' >> $path/config
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallyn grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.utsname = $name
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.pts = 1024
eba7df9ee0a1963984ef212e7ddfc0e0835af288Stéphane Graberlxc.mount = $path/fstab
a7273db9f87f59815d36c3eca4d4501304ae84b2Frederic Crozatlxc.cap.drop = sys_module mac_admin mac_override mknod
f02ce27d4b1a9d01b88d0ffaf626e5bafa671bf0Stéphane Graber# When using LXC with apparmor, uncomment the next line to run unconfined:
f02ce27d4b1a9d01b88d0ffaf626e5bafa671bf0Stéphane Graber#lxc.aa_profile = unconfined
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.deny = a
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# /dev/null and zero
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:3 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:5 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:1 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:0 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 4:0 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 4:1 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat# /dev/{,u}random
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:9 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 1:8 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 136:* rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 5:2 rwm
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatlxc.cgroup.devices.allow = c 254:0 rwm
80a881b232b8955b85b360d4def99e6e680ff61bSerge Hallynproc proc proc nodev,noexec,nosuid 0 0
80a881b232b8955b85b360d4def99e6e680ff61bSerge Hallynsysfs sys sysfs defaults 0 0
d696d21c2a7d5d15b3a456edd8ba742a5970d40aFrederic Crozattmpfs run tmpfs mode=0755,nodev,nosuid 0 0
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ $? -ne 0 ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat if [ ! -e $cache ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat # lock, so we won't purge while someone is creating a repository
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber if [ $? != 0 ]; then
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
fe253caa8b98854445aaf6ee253545ee1f13beb1Stéphane Graber ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-opensuse
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat$1 -h|--help -p|--path=<path> --clean
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatoptions=$(getopt -o hp:n:c -l help,path:,name:,clean -- "$@")
14d9c0f09d1a55d124ef210a4b4e205c9fe7596cStéphane Graber --) shift 1; break ;;
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "'zypper' command is missing"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatif [ -z "$path" ]; then
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "'path' parameter is required"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "This script should be run as 'root'"
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallyn# detect rootfs
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallynif grep -q '^lxc.rootfs' $config 2>/dev/null ; then
1881820ae4ff9004beef1bf7f04553580840441dSerge Hallyn rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed to install opensuse"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed to configure opensuse for a container"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozat echo "failed write configuration file"
c840b37de865195a8742e219b4374d961a21d4d9Frederic Crozatif [ ! -z $clean ]; then