lxc-ubuntu-cloud.in revision 9313e1e628160ca64f9e7fcec6500056c9a0725f
5e2a6a8992b4e9e77be3a94fc87af4dc14b0c8c4henning mueller# template script for generating ubuntu container for LXC based on released cloud
c273fbbb7863507673f695bc85709c0cb715011fTim Reddehase# Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com>
5ec1c6ff5da427d945d7fb708567ce3526c4c741Tim Reddehase# This program is free software; you can redistribute it and/or modify
5ec1c6ff5da427d945d7fb708567ce3526c4c741Tim Reddehase# it under the terms of the GNU General Public License version 2, as
98ba1c38b1cce99ecc61117259f2ae05ffe98469Tim Reddehase# published by the Free Software Foundation.
81a6387a4ab56a24194ecbabd6609c6bcca568b7Tim Reddehase# This program is distributed in the hope that it will be useful,
10be32b36246121321399ec3ab26d4d723d550e3Tim Reddehase# but WITHOUT ANY WARRANTY; without even the implied warranty of
10be32b36246121321399ec3ab26d4d723d550e3Tim Reddehase# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10be32b36246121321399ec3ab26d4d723d550e3Tim Reddehase# GNU General Public License for more details.
10be32b36246121321399ec3ab26d4d723d550e3Tim Reddehase# You should have received a copy of the GNU General Public License along
6f84d8dbc4edca35b7e69c8296a257ea17e3b74fTim Reddehase# with this program; if not, write to the Free Software Foundation, Inc.,
6f84d8dbc4edca35b7e69c8296a257ea17e3b74fTim Reddehase# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase # if there is exactly one veth network entry, make sure it has an
81a6387a4ab56a24194ecbabd6609c6bcca568b7Tim Reddehase nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase if [ $nics -eq 1 ]; then
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase grep -q "^lxc.network.hwaddr" $path/config || sed -i -e "/^lxc\.network\.type[ \t]*=[ \t]*veth/a lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" $path/config
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.mount = $path/fstab
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehaselxc.pivotdir = lxc_putold
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.devttydir =$ttydir
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.pts = 1024
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.utsname = $name
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.arch = $arch
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cap.drop = sys_module mac_admin mac_override sys_time
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase# When using LXC with apparmor, uncomment the next line to run unconfined:
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehase#lxc.aa_profile = unconfined
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase# To support container nesting on an Ubuntu host, uncomment next two lines:
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase#lxc.aa_profile = lxc-container-default-with-nesting
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.deny = a
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase# Allow any mknod (but not using the node)
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c *:* m
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = b *:* m
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase# /dev/null and zero
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 1:3 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 1:5 rwm
4949048bda09e116ee3627383e831455954cbe41Tim Reddehaselxc.cgroup.devices.allow = c 5:1 rwm
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehaselxc.cgroup.devices.allow = c 5:0 rwm
4949048bda09e116ee3627383e831455954cbe41Tim Reddehase# /dev/{,u}random
4949048bda09e116ee3627383e831455954cbe41Tim Reddehaselxc.cgroup.devices.allow = c 1:9 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 1:8 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 136:* rwm
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehaselxc.cgroup.devices.allow = c 5:2 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 254:0 rm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 10:229 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 10:200 rwm
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaselxc.cgroup.devices.allow = c 1:7 rwm
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksalxc.cgroup.devices.allow = c 10:228 rwm
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksalxc.cgroup.devices.allow = c 10:232 rwm
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksaproc proc proc nodev,noexec,nosuid 0 0
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksasysfs sys sysfs defaults 0 0
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa # rmdir /dev/shm for containers that have /run/shm
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa # get bind mounted to the host's /run/shm. So try to rmdir
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa # it, and in case that fails move it out of the way.
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then
9ade3006d75c25cfa77d51526e4a6cdd2370be5cEugen KuksaLXC Container configuration for Ubuntu Cloud images.
9ade3006d75c25cfa77d51526e4a6cdd2370be5cEugen KuksaGeneric Options
9ade3006d75c25cfa77d51526e4a6cdd2370be5cEugen Kuksa[ -r | --release <release> ]: Release name of container, defaults to host
9ade3006d75c25cfa77d51526e4a6cdd2370be5cEugen Kuksa[ --rootfs <path> ]: Path in which rootfs will be placed
9ade3006d75c25cfa77d51526e4a6cdd2370be5cEugen Kuksa[ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa[ -C | --cloud ]: Configure container for use with meta-data service, defaults to no
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa[ -T | --tarball ]: Location of tarball
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa[ -d | --debug ]: Run with 'set -x' to debug errors
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa[ -s | --stream]: Use specified stream rather than 'released'
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen KuksaOptions, mutually exclusive of "-C" and "--cloud":
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa [ -i | --hostid ]: HostID for cloud-init, defaults to random string
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa [ -u | --userdata ]: Cloud-init user-data file to configure container on start
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa [ -S | --auth-key ]: SSH Public key file to inject into container
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa [ -L | --nolocales ]: Do not copy host's locales into container
81a6387a4ab56a24194ecbabd6609c6bcca568b7Tim Reddehaseoptions=$(getopt -o a:hp:r:n:Fi:CLS:T:ds:u: -l arch:,help,rootfs:,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata: -- "$@")
7c0f71e3e6e26af2cc91112fdbe3905879bfd893Tim Reddehase# Code taken from debootstrap
7c0f71e3e6e26af2cc91112fdbe3905879bfd893Tim Reddehaseif [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseelif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
503ccb65bd740225668eb51be966d60fb4ae29e1Tim Reddehase # note: arm images don't exist before oneiric; are called armhf in
503ccb65bd740225668eb51be966d60fb4ae29e1Tim Reddehase # precise and later; and are not supported by the query, so we don't actually
503ccb65bd740225668eb51be966d60fb4ae29e1Tim Reddehase # support them yet (see check later on). When Query2 is available,
503ccb65bd740225668eb51be966d60fb4ae29e1Tim Reddehase # we'll use that to enable arm images.
98ba1c38b1cce99ecc61117259f2ae05ffe98469Tim Reddehase --) shift 1; break ;;
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseif [ $arch != "i386" -a $arch != "amd64" -a $arch != "armhf" -a $arch != "armel" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase echo "Only i386, amd64, armel and armhf are supported by the ubuntu cloud template."
7dadc1a5aa3845c2ce19ad1daa2c63dfd7b59979Tim Reddehaseif [ $hostarch != "i386" -a $hostarch != "amd64" -a $hostarch != "armhf" -a $hostarch != "armel" ]; then
7dadc1a5aa3845c2ce19ad1daa2c63dfd7b59979Tim Reddehase echo "Only i386, amd64, armel and armhf are supported as host."
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseif [ $hostarch = "amd64" -a $arch != "amd64" -a $arch != "i386" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase echo "can't create $arch container on $hostarch"
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseif [ $hostarch = "i386" -a $arch != "i386" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase echo "can't create $arch container on $hostarch"
d51cee8257d50d1f2d7c0818d968b32096f6b795Tim Reddehaseif [ $hostarch = "armhf" -o $hostarch = "armel" ] && \
772288cf17d57e84a4799c56949263f7ff098773Tim Reddehase [ $arch != "armhf" -a $arch != "armel" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase echo "can't create $arch container on $hostarch"
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseif [ "$stream" != "daily" -a "$stream" != "released" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase echo "Only 'daily' and 'released' streams are supported"
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehaseif [ -n "$userdata" ]; then
23f0ab4a423943eb59109df37074ef0c330d07c0Tim Reddehase if [ ! -f "$userdata" ]; then
653f8d7c88abc38a2c42f12b80b3e3efd882e039Tim Reddehase echo "Userdata ($userdata) does not exist"
a3bd54a5482d637ac89bbddbc27796d303544d4dEugen Kuksaif [ -n "$auth_key" ]; then
a3bd54a5482d637ac89bbddbc27796d303544d4dEugen Kuksa if [ ! -f "$auth_key" ]; then
a3bd54a5482d637ac89bbddbc27796d303544d4dEugen Kuksa echo "--auth-key=${auth_key} must reference a file"
a3bd54a5482d637ac89bbddbc27796d303544d4dEugen Kuksa { echo "failed to get full path for auth_key"; exit 1; }
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksaif [ -z "$path" ]; then
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksa echo "'path' parameter is required"
dfc7323cf206c044e128ffc866be9d3c777be8b7Eugen Kuksa echo "This script should be run as 'root'"
dfc7323cf206c044e128ffc866be9d3c777be8b7Eugen Kuksa# detect rootfs
dfc7323cf206c044e128ffc866be9d3c777be8b7Eugen Kuksaif [ -z "$rootfs" ]; then
dfc7323cf206c044e128ffc866be9d3c777be8b7Eugen Kuksa if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
dfc7323cf206c044e128ffc866be9d3c777be8b7Eugen Kuksa rootfs=`grep 'lxc.rootfs =' $config | awk -F= '{ print $2 }'`
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksa# determine the url, tarball, and directory names
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksa# download if needed
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksaif [ -n "$tarball" ]; then
c67b096189612bb816b4306ef88080b795b5cf41Eugen Kuksa url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
1d39ed6dd0248b5b0c969926bae5f6f66ff4d082Eugen Kuksa# if the release doesn't have a *-rootfs.tar.gz, then create one from the
1d39ed6dd0248b5b0c969926bae5f6f66ff4d082Eugen Kuksa# cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
1d39ed6dd0248b5b0c969926bae5f6f66ff4d082Eugen Kuksa# a tarball from the mounted image.
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
1f3a52128a4c9a5830936e25b071ce6a81fec1beEugen Kuksa wget $url || { echo "Couldn't find cloud image $url."; exit 1; }
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa if [ $flushcache -eq 1 ]; then
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa if [ ! -f $filename ]; then
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa if [ $cloud -eq 0 ]; then
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa echo "Configuring for running outside of a cloud environment"
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksa echo "If you want to configure for a cloud evironment, please use '-- -C' to create the container"
b7fe8f3179594e2ebccf6ee9f562e9c2e17aab96Eugen Kuksainstance-id: lxc-$host_id
41a28e74548dbac9c1ee8f936906904fb91dda0cEugen Kuksa sed -e '/^$/d' -e 's,^,- ,' "$auth_key" "$auth_key"
41a28e74548dbac9c1ee8f936906904fb91dda0cEugen Kuksa [ $? -eq 0 ] ||
41a28e74548dbac9c1ee8f936906904fb91dda0cEugen Kuksa { echo "failed to write public keys to metadata"; exit 1; }
41a28e74548dbac9c1ee8f936906904fb91dda0cEugen Kuksa if [ $locales -eq 1 ]; then
41a28e74548dbac9c1ee8f936906904fb91dda0cEugen Kuksa cp /usr/lib/locale/locale-archive $rootfs/usr/lib/locale/locale-archive
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksa#cloud-config
7dd850622b51de5132e9383683cd28370a7c4b1aEugen Kuksaoutput: {all: '| tee -a /var/log/cloud-init-output.log'}
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksaapt_mirror: $MIRROR
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksamanage_etc_hosts: localhost
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksalocale: $(/usr/bin/locale | awk -F= '/LANG=/ {print$NF}')
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksapassword: ubuntu
9f4ecaa71ceb2eec7be34a2687cb8c3cb3441b05Eugen Kuksachpasswd: { expire: False }
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehase echo "Configured for running in a cloud environment."
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehase echo "If you do not have a meta-data service, this container will likely be useless."
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehase) 200>@LOCALSTATEDIR@/lock/subsys/lxc-ubuntu-cloud
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehasecopy_configuration $path $rootfs $name $arch $release
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehaseecho "Container $name created."
db8aaeeeb3b24f487a5d02c60d18e96e55f6ba85Tim Reddehase# vi: ts=4 expandtab