Class: Template

Inherits:

Object

• Object
• Template

Defined in:

lib/lxc_template.rb

Class Method Summary

• .lxc ⇒ Object

Class Method Details

.lxc ⇒ Object

# File 'lib/lxc_template.rb', line 3

def self.lxc
  "#!/bin/bash\n\n#\n# template script for generating ubuntu container for LXC\n#\n# This script consolidates and extends the existing lxc ubuntu scripts\n#\n\n# Copyright \xC2\xA9 2011 Serge Hallyn <serge.hallyn@canonical.com>\n# Copyright \xC2\xA9 2010 Wilhelm Meier\n# Author: Wilhelm Meier <wilhelm.meier@fh-kl.de>\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2, as\n# published by the Free Software Foundation.\n\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n# GNU General Public License for more details.\n\n# You should have received a copy of the GNU General Public License along\n# with this program; if not, write to the Free Software Foundation, Inc.,\n# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nset -e -x\n\nif [ -r /etc/default/lxc ]; then\n  . /etc/default/lxc\nfi\n\nconfigure_ubuntu()\n{\n  rootfs=$1\n  hostname=$2\n  release=$3\n\n # configure the network using the dhcp\n  cat <<EOF > $rootfs/etc/network/interfaces\n# This file describes the network interfaces available on your system\n# and how to activate them. For more information, see interfaces(5).\n\n# The loopback network interface\nauto lo\niface lo inet loopback\n\nauto eth0\niface eth0 inet dhcp\nEOF\n\n  # set the hostname\n  cat <<EOF > $rootfs/etc/hostname\n$hostname\nEOF\n  # set minimal hosts\n  cat <<EOF > $rootfs/etc/hosts\n127.0.0.1   localhost\n127.0.1.1   $hostname\n\n# The following lines are desirable for IPv6 capable hosts\n::1     ip6-localhost ip6-loopback\nfe00::0 ip6-localnet\nff00::0 ip6-mcastprefix\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\nEOF\n\n  if [ ! -f $rootfs/etc/init/container-detect.conf ]; then\n      # suppress log level output for udev\n      sed -i \"s/=\\\"err\\\"/=0/\" $rootfs/etc/udev/udev.conf\n\n      # remove jobs for consoles 5 and 6 since we only create 4 consoles in\n      # this template\n      rm -f $rootfs/etc/init/tty{5,6}.conf\n  fi\n\n  return 0\n}\n\n# finish setting up the user in the container by injecting ssh key\nfinalize_user()\n{\n  if [ -n \"$auth_key\" -a -f \"$auth_key\" ]; then\n      u_path=\"/root/.ssh\"\n      root_u_path=\"$rootfs/$u_path\"\n\n      mkdir -p $root_u_path\n      cp $auth_key \"$root_u_path/authorized_keys\"\n      chroot $rootfs chown -R root: \"$u_path\"\n\n      echo \"Inserted SSH public key from $auth_key into /root/.ssh/authorized_keys\"\n  fi\n  return 0\n}\n\nwrite_sourceslist()\n{\n  # $1 => path to the rootfs\n  # $2 => architecture we want to add\n  # $3 => whether to use the multi-arch syntax or not\n\n  case $2 in\n    amd64|i386)\n          MIRROR=${MIRROR:-http://mirrors.fastly.net/ubuntu}\n          SECURITY_MIRROR=${SECURITY_MIRROR:-http://mirrors.fastly.net/ubuntu}\n          ;;\n    *)\n          MIRROR=${MIRROR:-http://ports.ubuntu.com/ubuntu-ports}\n          SECURITY_MIRROR=${SECURITY_MIRROR:-http://ports.ubuntu.com/ubuntu-ports}\n          ;;\n  esac\n  if [ -n \"$3\" ]; then\n      cat >> \"$1/etc/apt/sources.list\" << EOF\ndeb [arch=$2] $MIRROR ${release} main restricted universe multiverse\ndeb [arch=$2] $MIRROR ${release}-updates main restricted universe multiverse\ndeb [arch=$2] $SECURITY_MIRROR ${release}-security main restricted universe multiverse\nEOF\n  else\n      cat >> \"$1/etc/apt/sources.list\" << EOF\ndeb $MIRROR ${release} main restricted universe multiverse\ndeb $MIRROR ${release}-updates main restricted universe multiverse\ndeb $SECURITY_MIRROR ${release}-security main restricted universe multiverse\nEOF\n  fi\n}\n\ncleanup()\n{\n  rm -rf $cache/partial-$arch\n  rm -rf $cache/rootfs-$arch\n}\n\ndownload_ubuntu()\n{\n  cache=$1\n  arch=$2\n  release=$3\n\n  packages=vim,ssh,curl,wget\n  echo \"installing packages: $packages\"\n\n  trap cleanup EXIT SIGHUP SIGINT SIGTERM\n  # check the mini ubuntu was not already downloaded\n  mkdir -p \"$cache/partial-$arch\"\n  if [ $? -ne 0 ]; then\n      echo \"Failed to create '$cache/partial-$arch' directory\"\n      return 1\n  fi\n\n  # download a mini ubuntu into a cache\n  MIRROR=${MIRROR:-http://mirrors.fastly.net/ubuntu}\n  echo \"Downloading ubuntu $release minimal from $MIRROR ...\"\n  if [ -n \"$(which qemu-debootstrap)\" ]; then\n      qemu-debootstrap --verbose --components=main,universe --arch=$arch --include=$packages $release $cache/partial-$arch $MIRROR\n  else\n      debootstrap --verbose --components=main,universe --arch=$arch --include=$packages $release $cache/partial-$arch $MIRROR\n  fi\n\n  if [ $? -ne 0 ]; then\n      echo \"Failed to download the rootfs, aborting.\"\n          return 1\n  fi\n\n  # Serge isn't sure whether we should avoid doing this when\n  # $release == `distro-info -d`\n  echo \"Installing updates\"\n  > $cache/partial-$arch/etc/apt/sources.list\n  write_sourceslist $cache/partial-$arch/ $arch\n\n  # precise: do not try to use i386 repos, we do not have them\n  if [ $release != \"lucid\" ]; then\n      rm -f \"$1/partial-${arch}/etc/dpkg/dpkg.cfg.d/multiarch\"\n  fi\n\n  chroot \"$1/partial-${arch}\" apt-get update\n  if [ $? -ne 0 ]; then\n      echo \"Failed to update the apt cache\"\n      return 1\n  fi\n  cat > \"$1/partial-${arch}\"/usr/sbin/policy-rc.d << EOF\n#!/bin/sh\nexit 101\nEOF\n  chmod +x \"$1/partial-${arch}\"/usr/sbin/policy-rc.d\n\n  lxc-unshare -s MOUNT -- chroot \"$1/partial-${arch}\" apt-get dist-upgrade -y\n  ret=$?\n  rm -f \"$1/partial-${arch}\"/usr/sbin/policy-rc.d\n\n  if [ $ret -ne 0 ]; then\n      echo \"Failed to upgrade the cache\"\n      return 1\n  fi\n\n  mv \"$1/partial-$arch\" \"$1/rootfs-$arch\"\n  trap EXIT\n  trap SIGINT\n  trap SIGTERM\n  trap SIGHUP\n  echo \"Download complete\"\n  return 0\n}\n\ncopy_ubuntu()\n{\n  cache=$1\n  arch=$2\n  rootfs=$3\n\n  # make a local copy of the miniubuntu\n  echo \"Copying rootfs to $rootfs ...\"\n  mkdir -p $rootfs\n  rsync -a $cache/rootfs-$arch/ $rootfs/ || return 1\n  return 0\n}\n\ninstall_ubuntu()\n{\n  rootfs=$1\n  release=$2\n  flushcache=$3\n  cache=\"/var/cache/lxc/$release\"\n  mkdir -p /var/lock/subsys/\n\n  (\n      flock -x 200\n      if [ $? -ne 0 ]; then\n          echo \"Cache repository is busy.\"\n          return 1\n      fi\n\n\n      if [ $flushcache -eq 1 ]; then\n          echo \"Flushing cache...\"\n          rm -rf \"$cache/partial-$arch\"\n          rm -rf \"$cache/rootfs-$arch\"\n      fi\n\n      echo \"Checking cache download in $cache/rootfs-$arch ... \"\n      if [ ! -e \"$cache/rootfs-$arch\" ]; then\n          download_ubuntu $cache $arch $release\n          if [ $? -ne 0 ]; then\n              echo \"Failed to download 'ubuntu $release base'\"\n              return 1\n          fi\n      fi\n\n      echo \"Copy $cache/rootfs-$arch to $rootfs ... \"\n      copy_ubuntu $cache $arch $rootfs\n      if [ $? -ne 0 ]; then\n          echo \"Failed to copy rootfs\"\n          return 1\n      fi\n\n      return 0\n\n  ) 200>/var/lock/subsys/lxc\n\n  return $?\n}\n\ncopy_configuration()\n{\n  path=$1\n  rootfs=$2\n  name=$3\n  arch=$4\n  release=$5\n\n  if [ $arch = \"i386\" ]; then\n      arch=\"i686\"\n  fi\n\n  ttydir=\"\"\n  if [ -f $rootfs/etc/init/container-detect.conf ]; then\n      ttydir=\" lxc\"\n  fi\n\n  # if there is exactly one veth network entry, make sure it has an\n  # associated hwaddr.\n  nics=`grep -e '^lxc\\.network\\.type[ \\t]*=[ \\t]*veth' $path/config | wc -l`\n  if [ $nics -eq 1 ]; then\n      grep -q \"^lxc.network.hwaddr\" $path/config || cat <<EOF >> $path/config\nlxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\\(..\\)/\\1:/g; s/.$//')\nEOF\n  fi\n\n  cat <<EOF >> $path/config\nlxc.utsname = $name\n\nlxc.devttydir =$ttydir\nlxc.tty = 4\nlxc.pts = 1024\nlxc.rootfs = $rootfs\nlxc.mount  = $path/fstab\nlxc.arch = $arch\nlxc.cap.drop = sys_module mac_admin\nlxc.pivotdir = lxc_putold\n\n# uncomment the next line to run the container unconfined:\n#lxc.aa_profile = unconfined\n\nlxc.cgroup.devices.deny = a\n# Allow any mknod (but not using the node)\nlxc.cgroup.devices.allow = c *:* m\nlxc.cgroup.devices.allow = b *:* m\n# /dev/null and zero\nlxc.cgroup.devices.allow = c 1:3 rwm\nlxc.cgroup.devices.allow = c 1:5 rwm\n# consoles\nlxc.cgroup.devices.allow = c 5:1 rwm\nlxc.cgroup.devices.allow = c 5:0 rwm\n#lxc.cgroup.devices.allow = c 4:0 rwm\n#lxc.cgroup.devices.allow = c 4:1 rwm\n# /dev/{,u}random\nlxc.cgroup.devices.allow = c 1:9 rwm\nlxc.cgroup.devices.allow = c 1:8 rwm\nlxc.cgroup.devices.allow = c 136:* rwm\nlxc.cgroup.devices.allow = c 5:2 rwm\n# rtc\nlxc.cgroup.devices.allow = c 254:0 rwm\n#fuse\nlxc.cgroup.devices.allow = c 10:229 rwm\n#tun\nlxc.cgroup.devices.allow = c 10:200 rwm\n#full\nlxc.cgroup.devices.allow = c 1:7 rwm\n#hpet\nlxc.cgroup.devices.allow = c 10:228 rwm\n#kvm\nlxc.cgroup.devices.allow = c 10:232 rwm\nEOF\n\n  cat <<EOF > $path/fstab\nproc            proc         proc    nodev,noexec,nosuid 0 0\nsysfs           sys          sysfs defaults  0 0\nEOF\n\n  if [ $? -ne 0 ]; then\n      echo \"Failed to add configuration\"\n      return 1\n  fi\n\n  return 0\n}\n\ntrim()\n{\n  rootfs=$1\n  release=$2\n\n  # provide the lxc service\n  cat <<EOF > $rootfs/etc/init/lxc.conf\n# fake some events needed for correct startup other services\n\ndescription     \"Container Upstart\"\n\nstart on startup\n\nscript\n      rm -rf /var/run/*.pid\n      rm -rf /var/run/network/*\n      /sbin/initctl emit stopped JOB=udevtrigger --no-wait\n      /sbin/initctl emit started JOB=udev --no-wait\nend script\nEOF\n\n  # fix buggus runlevel with sshd\n  cat <<EOF > $rootfs/etc/init/ssh.conf\n# ssh - OpenBSD Secure Shell server\n#\n# The OpenSSH server provides secure shell access to the system.\n\ndescription \"OpenSSH server\"\n\nstart on filesystem\nstop on runlevel [!2345]\n\nexpect fork\nrespawn\nrespawn limit 10 5\numask 022\n# replaces SSHD_OOM_ADJUST in /etc/default/ssh\noom never\n\npre-start script\n  test -x /usr/sbin/sshd || { stop; exit 0; }\n  test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; }\n  test -c /dev/null || { stop; exit 0; }\n\n  mkdir -p -m0755 /var/run/sshd\nend script\n\n# if you used to set SSHD_OPTS in /etc/default/ssh, you can change the\n# 'exec' line here instead\nexec /usr/sbin/sshd\nEOF\n\n  cat <<EOF > $rootfs/etc/init/console.conf\n# console - getty\n#\n# This service maintains a console on tty1 from the point the system is\n# started until it is shut down again.\n\nstart on stopped rc RUNLEVEL=[2345]\nstop on runlevel [!2345]\n\nrespawn\nexec /sbin/getty -8 38400 /dev/console\nEOF\n\n  cat <<EOF > $rootfs/lib/init/fstab\n# /lib/init/fstab: cleared out for bare-bones lxc\nEOF\n\n  # reconfigure some services\n  if [ -z \"$LANG\" ]; then\n      chroot $rootfs locale-gen en_US.UTF-8\n      chroot $rootfs update-locale LANG=en_US.UTF-8\n  else\n      chroot $rootfs locale-gen $LANG\n      chroot $rootfs update-locale LANG=$LANG\n  fi\n\n  # remove pointless services in a container\n  chroot $rootfs /usr/sbin/update-rc.d -f ondemand remove\n\n  chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls u*.conf); do mv $f $f.orig; done'\n  chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls tty[2-9].conf); do mv $f $f.orig; done'\n  chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls plymouth*.conf); do mv $f $f.orig; done'\n  chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls hwclock*.conf); do mv $f $f.orig; done'\n  chroot $rootfs /bin/bash -c 'cd /etc/init; for f in $(ls module*.conf); do mv $f $f.orig; done'\n\n  # if this isn't lucid, then we need to twiddle the network upstart bits :(\n  if [ $release != \"lucid\" ]; then\n      sed -i 's/^.*emission handled.*$/echo Emitting lo/' $rootfs/etc/network/if-up.d/upstart\n  fi\n}\n\npost_process()\n{\n  rootfs=$1\n  release=$2\n  trim_container=$3\n\n  if [ $trim_container -eq 1 ]; then\n      trim $rootfs $release\n  elif [ ! -f $rootfs/etc/init/container-detect.conf ]; then\n      # Make sure we have a working resolv.conf\n      cresolvonf=\"${rootfs}/etc/resolv.conf\"\n      mv $cresolvonf ${cresolvonf}.lxcbak\n      cat /etc/resolv.conf > ${cresolvonf}\n\n      # for lucid, if not trimming, then add the ubuntu-virt\n      # ppa and install lxcguest\n      if [ $release = \"lucid\" ]; then\n          chroot $rootfs apt-get install --force-yes -y python-software-properties\n          chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa\n      fi\n\n      chroot $rootfs apt-get update\n      chroot $rootfs apt-get install --force-yes -y lxcguest\n\n      # Restore old resolv.conf\n      rm -f ${cresolvonf}\n      mv ${cresolvonf}.lxcbak ${cresolvonf}\n  fi\n\n  # If the container isn't running a native architecture, setup multiarch\n  if [ -x \"$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)\" ]; then\n      dpkg_version=$(chroot $rootfs dpkg-query -W -f='${Version}' dpkg)\n      if chroot $rootfs dpkg --compare-versions $dpkg_version ge \"1.16.2\"; then\n          chroot $rootfs dpkg --add-architecture ${hostarch}\n      else\n          mkdir -p ${rootfs}/etc/dpkg/dpkg.cfg.d\n          echo \"foreign-architecture ${hostarch}\" > ${rootfs}/etc/dpkg/dpkg.cfg.d/lxc-multiarch\n      fi\n\n      # Save existing value of MIRROR and SECURITY_MIRROR\n      DEFAULT_MIRROR=$MIRROR\n      DEFAULT_SECURITY_MIRROR=$SECURITY_MIRROR\n\n      # Write a new sources.list containing both native and multiarch entries\n      > ${rootfs}/etc/apt/sources.list\n      write_sourceslist $rootfs $arch \"native\"\n\n      MIRROR=$DEFAULT_MIRROR\n      SECURITY_MIRROR=$DEFAULT_SECURITY_MIRROR\n      write_sourceslist $rootfs $hostarch \"multiarch\"\n\n      # precise: do not try to use i386 repos, we do not have them\n      if [ $release != \"lucid\" ]; then\n          rm -f ${rootfs}/etc/dpkg/dpkg.cfg.d/multiarch\n      fi\n\n      # Finally update the lists and install upstart using the host architecture\n      chroot $rootfs apt-get update\n      chroot $rootfs apt-get install --force-yes -y --no-install-recommends upstart:${hostarch} mountall:${hostarch} iproute:${hostarch} isc-dhcp-client:${hostarch}\n  fi\n\n  # rmdir /dev/shm for containers that have /run/shm\n  # I'm afraid of doing rm -rf $rootfs/dev/shm, in case it did\n  # get bind mounted to the host's /run/shm.  So try to rmdir\n  # it, and in case that fails move it out of the way.\n  if [ ! -L $rootfs/dev/shm ] && [ -d $rootfs/run/shm ] && [ -e $rootfs/dev/shm ]; then\n      mv $rootfs/dev/shm $rootfs/dev/shm.bak\n      ln -s /run/shm $rootfs/dev/shm\n  fi\n}\n\nusage()\n{\n  cat <<EOF\n$1 -h|--help [-a|--arch] [--trim] [-d|--debug]\n [-F | --flush-cache] [-r|--release <release>] [ -S | --auth-key <keyfile>]\nrelease: the ubuntu release (e.g. precise): defaults to host release on ubuntu, otherwise uses latest LTS\ntrim: make a minimal (faster, but not upgrade-safe) container\narch: the container architecture (e.g. amd64): defaults to host arch\nauth-key: SSH Public key file to inject into container\nEOF\n  return 0\n}\n\noptions=$(getopt -o a:b:hp:r:xn:FS:d -l arch:,help,path:,release:,trim,name:,flush-cache,auth-key:,debug,rootfs: -- \"$@\")\nif [ $? -ne 0 ]; then\n  usage $(basename $0)\n  exit 1\nfi\neval set -- \"$options\"\n\nrelease=precise # Default to the last Ubuntu LTS release for non-Ubuntu systems\nif [ -f /etc/lsb-release ]; then\n  . /etc/lsb-release\n  if [ \"$DISTRIB_ID\" = \"Ubuntu\" ]; then\n      release=$DISTRIB_CODENAME\n  fi\nfi\n\nbindhome=\narch=$(arch)\n\n# Code taken from debootstrap\nif [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then\n  arch=`/usr/bin/dpkg --print-architecture`\nelif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then\n  arch=`/usr/bin/udpkg --print-architecture`\nelse\n  arch=$(arch)\n  if [ \"$arch\" = \"i686\" ]; then\n      arch=\"i386\"\n  elif [ \"$arch\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n  elif [ \"$arch\" = \"armv7l\" ]; then\n      arch=\"armel\"\n  fi\nfi\n\ndebug=0\ntrim_container=0\nhostarch=$arch\nflushcache=0\n\nwhile true\ndo\n  case \"$1\" in\n  -h|--help)      usage $0 && exit 0;;\n  -p|--path)      path=$2; shift 2;;\n  -n|--name)      name=$2; shift 2;;\n  -F|--flush-cache) flushcache=1; shift 1;;\n  -r|--release)   release=$2; shift 2;;\n  -a|--arch)      arch=$2; shift 2;;\n  -x|--trim)      trim_container=1; shift 1;;\n  -S|--auth-key)  auth_key=$2; shift 2;;\n  -d|--debug)     debug=1; shift 1;;\n  --rootfs)       shift 2;;\n  --)             shift 1; break ;;\n  \"\")             break ;;\n  *)              echo \"Got unexpected parameter: $1\" ; exit 1 ;;\n  esac\ndone\n\nif [ $debug -eq 1 ]; then\n  set -x\nfi\n\nif [ \"$arch\" == \"i686\" ]; then\n  arch=i386\nfi\n\nif [ $hostarch = \"i386\" -a $arch = \"amd64\" ]; then\n  echo \"can't create amd64 container on i386\"\n  exit 1\nfi\n\ntype debootstrap\nif [ $? -ne 0 ]; then\n  echo \"'debootstrap' command is missing\"\n  exit 1\nfi\n\nif [ -z \"$path\" ]; then\n  echo \"'path' parameter is required\"\n  exit 1\nfi\n\nif [ \"$(id -u)\" != \"0\" ]; then\n  echo \"This script should be run as 'root'\"\n  exit 1\nfi\n\nrootfs=$path/rootfs\n\ninstall_ubuntu $rootfs $release $flushcache\nif [ $? -ne 0 ]; then\n  echo \"failed to install ubuntu $release\"\n  exit 1\nfi\n\nconfigure_ubuntu $rootfs $name $release\nif [ $? -ne 0 ]; then\n  echo \"failed to configure ubuntu $release for a container\"\n  exit 1\nfi\n\ncopy_configuration $path $rootfs $name $arch $release\nif [ $? -ne 0 ]; then\n  echo \"failed write configuration file\"\n  exit 1\nfi\n\npost_process $rootfs $release $trim_container\n\nfinalize_user\n\n"
end