beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Template script for generating Linux for SPARC for LXC
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# based on lxc-fedora, lxc-ubuntu
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Copyright © 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Copyright © 2012 Dwight Engen <dwight.engen@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Copyright � 2015 Wim Coekaerts <wim.coekaerts@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Modified for Oracle Linux 5
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Wim Coekaerts <wim.coekaerts@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Modified for Oracle Linux 6,7 combined OL4,5,6 into one template script
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Dwight Engen <dwight.engen@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Modified for Linux for SPARC 1.0
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Wim Coekaerts <wim.coekaerts@oracle.com>
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# This library is free software; you can redistribute it and/or
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# modify it under the terms of the GNU Lesser General Public
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# License as published by the Free Software Foundation; either
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# version 2.1 of the License, or (at your option) any later version.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# This library is distributed in the hope that it will be useful,
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# but WITHOUT ANY WARRANTY; without even the implied warranty of
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Lesser General Public License for more details.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# You should have received a copy of the GNU Lesser General Public
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# License along with this library; if not, write to the Free Software
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Detect use under userns (unsupported)
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "This template can't be used for unprivileged containers." 1>&2
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "You may want to try the \"download\" template instead." 1>&2
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Make sure the usual locations are in PATH
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsexport PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if which btrfs >/dev/null 2>&1 && \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts btrfs subvolume list "$1" >/dev/null 2>&1; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if which chcon >/dev/null 2>&1; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# fix up the container_rootfs
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Patching container rootfs $container_rootfs for Linux for SPARC $container_release_major.$container_release_minor"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # copy ourself into the container to be used to --patch the rootfs when
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # yum update on certain packages is done. we do this here instead of in
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # container_rootfs_configure() in case the patching done in this function
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # is updated in the future, we can inject the updated version of ourself
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cp -f `readlink -f $0` $container_rootfs/usr/bin/lxc-patch
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts mkdir -p $container_rootfs/usr/share/yum-plugins
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cp @DATADIR@/lxc/lxc-patch.py $container_rootfs/usr/share/yum-plugins
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts mkdir -p $container_rootfs/etc/yum/pluginconf.d
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF > $container_rootfs/etc/yum/pluginconf.d/lxc-patch.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertspackages=dbus,initscripts,iptables,openssh-server,setup,selinux-policy,readahead,udev,util-linux,util-linux-ng
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # "disable" selinux in the guest. The policy in the container isn't
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # likely to match the hosts (unless host == guest exactly) and the
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -e $container_rootfs/etc/selinux/config ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/sshd
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/sshd
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # setting /proc/$$/loginuid doesn't work under user namespace, which
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/sshd
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|session[ \t]*required[ \t]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/login
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -f $container_rootfs/usr/sbin/selinuxenabled ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts mv $container_rootfs/usr/sbin/selinuxenabled $container_rootfs/usr/sbin/selinuxenabled.lxcorig
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts ln -s /bin/false $container_rootfs/usr/sbin/selinuxenabled
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # ensure /dev/ptmx refers to the newinstance devpts of the container, or
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # remove module stuff for iptables it just shows errors that are not
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $container_release_major = "1" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/init/readahead-collector.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/init/readahead-disable-services.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/init/plymouth-shutdown.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/init/quit-plymouth.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rm -f $container_rootfs/etc/init/splash-manager.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|\[ -f /proc/swaps \]|# LXC [ -f /proc/swaps ]|' $container_rootfs/etc/init.d/halt
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm \&\& mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mkdir -p /dev/shm \&\& mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # there might be other services that are useless but the below set is a good start
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # some of these might not exist in the image, so we silence chkconfig complaining
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts lm_sensors lvm2-monitor mdmonitor microcode_ctl \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chroot $container_rootfs chkconfig 2>/dev/null $service off
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chroot $container_rootfs chkconfig 2>/dev/null $service on
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Configuring container for Linux for SPARC $container_release_major.$container_release_minor"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # will report its name and be resolv'able by the hosts dnsmasq
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsBOOTPROTO=dhcp
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsHOSTNAME=$name
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsDHCP_HOSTNAME=\`hostname\`
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsNM_CONTROLLED=no
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF > $container_rootfs/etc/sysconfig/network
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsNETWORKING=yes
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsNETWORKING_IPV6=no
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsHOSTNAME=$name
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # this file has to exist for libvirt/Virtual machine monitor to boot the container
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # setup console and tty[1-4] for login. note that /dev/console and
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # lxc will maintain these links and bind mount ptys over /dev/lxc/*
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # since lxc.devttydir is specified in the config.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # allow root login on console, tty[1-4], and pts/0 for libvirt
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "lxc/console" >>$container_rootfs/etc/securetty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts for i in 1 2 3 4; do
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "lxc/tty$i" >>$container_rootfs/etc/securetty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "# For libvirt/Virtual Machine Monitor" >>$container_rootfs/etc/securetty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts for i in 0 1 2 3 4; do
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "pts/$i" >>$container_rootfs/etc/securetty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # prevent mingetty from calling vhangup(2) since it fails with userns
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -f $container_rootfs/etc/init/tty.conf ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i 's|mingetty|mingetty --nohangup|' $container_rootfs/etc/init/tty.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # create maygetty which only spawns a getty on the console when running
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # under lxc, not libvirt-lxc which symlinks /dev/console to the same pty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ "\$container" = "lxc" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts exec /sbin/mingetty \$@
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsexec sleep infinity
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF > $container_rootfs/etc/init/console.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# console - getty
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# This service maintains a getty on the console from the point the system is
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# started until it is shut down again.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsstart on stopped rc RUNLEVEL=[2345]
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsstop on runlevel [!2345]
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsexec /sbin/maygetty --nohangup --noclear /dev/console
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF > $container_rootfs/etc/init/power-status-changed.conf
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# power-status-changed - used to cleanly shut down the container
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# This task is run whenever init receives SIGPWR
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Used to shut down the machine.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsstart on power-status-changed
710a25539eebf98c0460b2d791e78b74d7e47935Thomas Tanaka if [ -f /etc/sysconfig/clock ]; then
710a25539eebf98c0460b2d791e78b74d7e47935Thomas Tanaka echo ZONE=$ZONE > $container_rootfs/etc/sysconfig/clock
710a25539eebf98c0460b2d791e78b74d7e47935Thomas Tanaka echo "Timezone in container is not configured. Adjust it manually."
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chroot $container_rootfs useradd -m -s /bin/bash oracle
ff7a7fdc31f43272c36b1cfbff5b6613f4198e17Evgeni Golov printf "Added container user:\033[1moracle\033[0m\n"
ff7a7fdc31f43272c36b1cfbff5b6613f4198e17Evgeni Golov printf "Added container user:\033[1mroot\033[0m\n"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# create the container's lxc config file
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Create configuration file $cfg_dir/config"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "# Common configuration" >> $cfg_dir/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -e "@LXCTEMPLATECONFIG@/sparclinux.common.conf" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "lxc.include = @LXCTEMPLATECONFIG@/sparclinux.common.conf" >> $cfg_dir/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# Container configuration for Linux for SPARC $container_release_major.$container_release_minor
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertslxc.arch = $arch
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertslxc.utsname = $name
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts grep -q "^lxc.rootfs" $cfg_dir/config 2>/dev/null || echo "lxc.rootfs = $container_rootfs" >> $cfg_dir/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "lxc.cap.drop = setfcap setpcap" >>$cfg_dir/config
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka # see if the default network settings were already specified
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka echo "lxc.network.type = veth" >>$cfg_dir/config
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka lxc_network_link=`grep '^lxc.network.link' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka echo "lxc.network.link = lxcbr0" >>$cfg_dir/config
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka lxc_network_hwaddr=`grep '^lxc.network.hwaddr' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka local hwaddr="00:16:3e:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka echo "lxc.network.hwaddr = $hwaddr" >>$cfg_dir/config
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka lxc_network_flags=`grep '^lxc.network.flags' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
2a385c0d8ebe9619072a66476cd8624f781178a0Thomas Tanaka echo "lxc.network.flags = up" >>$cfg_dir/config
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertslxc.network.name = eth0
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertslxc.network.mtu = 1500
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # lxc-create already made $container_rootfs a btrfs subvolume, but
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # in this case we want to snapshot the original subvolume so we we
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts cp -axT $template_rootfs $container_rootfs || die "copy template"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "name=Linux for SPARC $container_release_major.$container_release_minor ($basearch)" >>$1
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "gpgkey=$yum_url/RPM-GPG-KEY-oracle-ol$container_release_major" >>$1
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # create required devices. note that /dev/console will be created by lxc
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # or libvirt itself to be a symlink to the right pty.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # take care to not nuke /dev in case $container_rootfs isn't set
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $container_rootfs != "/" -a -d $dev_path ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # ensure symlinks created in /dev have the right context
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts for node in null zero random urandom pts shm \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chcon --reference /dev/$node $dev_path/$node 2>/dev/null
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chcon --reference / $container_rootfs 2>/dev/null
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts die "The $cmd command is required, please install it"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Yum installing release $container_release_major.$container_release_minor for $basearch"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts $container_rootfs/etc/yum.repos.d/lxc-install.repo $repo $baseurl
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts die "Unsupported release $container_release_major"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts wget -q $yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts die "Unable to download repo file $yum_url/$repofile, release unavailable"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # yum will take $basearch from host, so force the arch we want
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i "s|baseurl=http://yum.oracle.com/|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i "s|gpgkey=http://yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # disable all repos, then enable the repo for the version we are installing.
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $container_release_minor = "latest" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts die "Unsupported release $container_release_major.$container_release_minor"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # don't put devpts,proc, nor sysfs in here, it will already be mounted for us by lxc/libvirt
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # create rpm db, download and yum install minimal packages
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts yum_args="--installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils sparclinux-release"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # we unshare the mount namespace because yum installing the ol4
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # packages causes $rootfs/proc to be mounted on
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts lxc-unshare -s MOUNT yum -- $yum_args install $min_pkgs $user_pkgs
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts die "Failed to download and install the rootfs, aborting."
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # rsyslog and pam depend on coreutils for some common commands in
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # their POSTIN scriptlets, but coreutils wasn't installed yet. now
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # that coreutils is installed, reinstall the packages so their POSTIN
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # runs right. similarly, libutempter depends on libselinux.so.1 when
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # it runs /usr/sbin/groupadd, so reinstall it too
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts rpm --root $container_rootfs --nodeps -e $redo_pkgs
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts lxc-unshare -s MOUNT yum -- $yum_args install $redo_pkgs
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # these distributions put the rpm database in a place the guest is
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $host_distribution = "Ubuntu" -o $host_distribution = "Debian" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts mv $container_rootfs/$HOME/.rpmdb/* $container_rootfs/var/lib/rpm
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # if the native rpm created the db with Hash version 9, we need to
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # downgrade it to Hash version 8 for use with OL5.x
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts db_version=`file $container_rootfs/var/lib/rpm/Packages | \
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts # the host rpm may not be the same as the guest, rebuild the db with
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts chroot $container_rootfs rpm --rebuilddb >/dev/null 2>&1
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts ) 9>@LOCALSTATEDIR@/lock/subsys/lxc-sparclinux-$name
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $? -ne 0 ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ -f $1/etc/sparclinux-release ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_version=`cat $1/etc/sparclinux-release |awk '/^Linux/ {print $5}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Unable to determine container release version"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -a|--arch=<arch> architecture (sparc64)
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -R|--release=<release> release to download for the new container
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts --rootfs=<path> rootfs path
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -r|--rpms=<rpm name> additional rpms to install into container
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -u|--url=<url> replace yum repo url (ie. Oracle public-yum mirror)
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts --baseurl=<url> use package repository (ie. file:///mnt)
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts arch and release must also be specified
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -t|--templatefs=<path> copy/clone rootfs at path instead of downloading
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -P|--patch=<path> only patch the rootfs at path for use as a container
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsRelease is of the format "major.minor", for example "1.0" or "1.latest"
beabd0a28f97372f3842746888082237c070ded1Wim CoekaertsThis template supports Linux for SPARC release 1.0
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsoptions=$(getopt -o hp:n:a:R:r:u:t: -l help,rootfs:,path:,name:,arch:,release:,rpms:,url:,templatefs:,patch:,baseurl: -- "$@")
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -R|--release) container_release_version=$2; shift 2;;
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts -t|--templatefs) template_rootfs=$2; shift 2;;
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts --) shift 1; break ;;
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts# make sure mandatory args are given and valid
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "This script should be run as 'root'"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -n "$baseurl" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ "$arch" = "" -o "$container_release_version" = "" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "The --arch and --release must be specified when using --baseurl"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -n "$patch_rootfs" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -z $name ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Container name must be given"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -z $cfg_dir ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Configuration directory must be given, check lxc-create"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Bad architecture given, check lxc-create"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts host_release_version=`cat /etc/sparclinux-release |awk '{print $5}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "Unable to determine host distribution"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsecho "Host is $host_distribution $host_release_version"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -z "$container_rootfs" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -n "$template_rootfs" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts if [ $host_distribution = "SPARCLinux" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_version=$host_release_version
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts echo "No release specified with -R, defaulting to 1.latest"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaerts container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsif [ -n "$template_rootfs" ]; then
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsecho "Container : $container_rootfs"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsecho "Config : $cfg_dir/config"
beabd0a28f97372f3842746888082237c070ded1Wim Coekaertsecho "Network : eth0 ($lxc_network_type) on $lxc_network_link"