2
This is a new template to create containers based on Oracle Linux. A version
3
such as 5.8, 6.3, or 6.latest can be specified with -R in which case a rootfs
4
will be created from rpms downloaded from the Oracle public-yum repo.
5
Alternatively the path to an existing rootfs of Oracle 5 or 6 may be given to
6
the template with the -t option.
8
The architecture of the downloaded rpms installed in the container can be
9
specified with the -a template option.
11
Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
14
templates/Makefile.am | 1 +
15
templates/lxc-oracle.in | 496 +++++++++++++++++++++++++++++++++++++++++++++++
16
3 files changed, 498 insertions(+), 0 deletions(-)
17
create mode 100644 templates/lxc-oracle.in
19
diff --git a/configure.ac b/configure.ac
20
index 4bbfd9b..d0535f7 100644
23
@@ -197,6 +197,7 @@ AC_CONFIG_FILES([
24
templates/lxc-opensuse
27
+ templates/lxc-oracle
28
templates/lxc-altlinux
30
templates/lxc-archlinux
31
diff --git a/templates/Makefile.am b/templates/Makefile.am
32
index d6b3892..523498d 100644
33
--- a/templates/Makefile.am
34
+++ b/templates/Makefile.am
35
@@ -7,6 +7,7 @@ templates_SCRIPTS = \
43
diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
45
index 0000000..e13f13b
47
+++ b/templates/lxc-oracle.in
51
+# Template script for generating Oracle Enterprise Linux container for LXC
52
+# based on lxc-fedora, lxc-ubuntu
54
+# Copyright � 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
55
+# Copyright � 2012 Dwight Engen <dwight.engen@oracle.com>
57
+# Modified for Oracle Linux 5
58
+# Wim Coekaerts <wim.coekaerts@oracle.com>
60
+# Modified for Oracle Linux 6, combined OL5,6 into one template script
61
+# Dwight Engen <dwight.engen@oracle.com>
63
+# This library is free software; you can redistribute it and/or
64
+# modify it under the terms of the GNU Lesser General Public
65
+# License as published by the Free Software Foundation; either
66
+# version 2.1 of the License, or (at your option) any later version.
68
+# This library is distributed in the hope that it will be useful,
69
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
70
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
71
+# Lesser General Public License for more details.
73
+# You should have received a copy of the GNU Lesser General Public
74
+# License along with this library; if not, write to the Free Software
75
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
78
+# use virbr0 that is setup by default by libvirtd
79
+lxc_network_type=veth
80
+lxc_network_link=virbr0
90
+ if which btrfs >/dev/null 2>&1 && \
91
+ btrfs subvolume list "$1" >/dev/null 2>&1; then
97
+# fix up the container_rootfs
98
+container_rootfs_configure()
100
+ echo "Configuring container for Oracle Linux $container_release_major"
102
+ # "disable" selinux. init in OL 5 honors /etc/selinux/config. note that
103
+ # this doesnt actually disable it if it's enabled in the host, since
104
+ # libselinux::is_selinux_enabled() in the guest will check
105
+ # /proc/filesystems and see selinuxfs, thus reporting that it is on
106
+ # (ie. check the output of sestatus in the guest)
107
+ mkdir -p $container_rootfs/selinux
108
+ echo 0 > $container_rootfs/selinux/enforce
109
+ if [ -e $container_rootfs/etc/selinux/config ]; then
110
+ sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
112
+ echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
114
+ if [ $container_release_major = "5" ]; then
115
+ sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
116
+ sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
119
+ # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
120
+ # will report its name and be resolv'able by the hosts dnsmasq
121
+ touch $container_rootfs/etc/resolv.conf
122
+ cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
133
+ cat <<EOF > $container_rootfs/etc/sysconfig/network
139
+ # set minimal hosts
140
+ echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
143
+ echo "blacklist ipv6" >>$container_rootfs/etc/modprobe.d/blacklist.conf
144
+ echo "blacklist net-pf-10" >>$container_rootfs/etc/modprobe.d/blacklist.conf
145
+ rm $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
147
+ cat <<EOF > $container_rootfs/etc/fstab
148
+proc /proc proc nodev,noexec,nosuid 0 0
149
+devpts /dev/pts devpts defaults 0 0
150
+sysfs /sys sysfs defaults 0 0
153
+ # remove module stuff for iptables it just shows errors that are not
154
+ # relevant in a container
155
+ if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
156
+ sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
157
+ sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
160
+ # disable readahead in the container
161
+ if [ $container_release_major = "6" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
162
+ rm -f $container_root/etc/init/readahead-collector.conf
163
+ rm -f $container_root/etc/init/readahead-disable-services.conf
164
+ sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
167
+ # disable udev in the container
168
+ sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
169
+ sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
171
+ # disable nash raidautorun in the container since no /dev/md*
172
+ if [ $container_release_major = "5" ]; then
173
+ sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
174
+ sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
177
+ # prevent rc.sysinit from attempting to loadkeys
178
+ if [ $container_release_major = "5" -a -e $container_rootfs/etc/sysconfig/keyboard ]; then
179
+ rm $container_rootfs/etc/sysconfig/keyboard
182
+ # dont try to sync the hwclock at shutdown
183
+ sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
186
+ sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
187
+ sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
189
+ # fix assumptions that plymouth is available
190
+ sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
191
+ sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
192
+ rm -f $container_root/etc/init/plymouth-shutdown.conf
193
+ rm -f $container_root/etc/init/quit-plymouth.conf
194
+ rm -f $container_root/etc/init/splash-manager.conf
196
+ # setup console and tty[1-4] for login. note that /dev/console and
197
+ # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
198
+ # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
199
+ # lxc will maintain these links and bind mount ptys over /dev/lxc/*
200
+ # since lxc.devttydir is specified in the config.
202
+ # allow root login on console and tty[1-4]
203
+ echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
204
+ echo "lxc/console" >>$container_rootfs/etc/securetty
205
+ echo "lxc/tty1" >>$container_rootfs/etc/securetty
206
+ echo "lxc/tty2" >>$container_rootfs/etc/securetty
207
+ echo "lxc/tty3" >>$container_rootfs/etc/securetty
208
+ echo "lxc/tty4" >>$container_rootfs/etc/securetty
210
+ # dont try to unmount /dev/lxc devices
211
+ sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
213
+ # start a getty on /dev/console, /dev/tty[1-4]
214
+ if [ $container_release_major = "5" ]; then
215
+ sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty console' $container_rootfs/etc/inittab
216
+ sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
217
+ sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
220
+ if [ $container_release_major = "6" ]; then
221
+ cat <<EOF > $container_rootfs/etc/init/console.conf
224
+# This service maintains a getty on the console from the point the system is
225
+# started until it is shut down again.
227
+start on stopped rc RUNLEVEL=[2345]
228
+stop on runlevel [!2345]
231
+exec /sbin/mingetty /dev/console
235
+ # there might be other services that are useless but the below set is a good start
236
+ # some of these might not exist in the image, so we silence chkconfig complaining
237
+ # about the service file not being found
239
+ acpid auditd autofs cpuspeed dund gpm haldaemon hidd \
240
+ ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
241
+ lm_sensors lvm2-monitor mdmonitor microcode_ctl \
242
+ ntpd postfix sendmail udev-post ;
244
+ chroot $container_rootfs chkconfig 2>/dev/null $service off
247
+ for service in rsyslog ;
249
+ chroot $container_rootfs chkconfig 2>/dev/null $service on
252
+ # create required devices
253
+ # take care to not nuke /dev in case $container_rootfs isn't set
254
+ dev_path="$container_rootfs/dev"
255
+ if [ $container_rootfs != "/" -a -d $dev_path ]; then
259
+ mknod -m 666 $dev_path/null c 1 3
260
+ mknod -m 666 $dev_path/zero c 1 5
261
+ mknod -m 666 $dev_path/random c 1 8
262
+ mknod -m 666 $dev_path/urandom c 1 9
263
+ mkdir -m 755 $dev_path/pts
264
+ mkdir -m 1777 $dev_path/shm
265
+ mknod -m 666 $dev_path/tty c 5 0
266
+ mknod -m 666 $dev_path/tty0 c 4 0
267
+ mknod -m 666 $dev_path/tty1 c 4 1
268
+ mknod -m 666 $dev_path/tty2 c 4 2
269
+ mknod -m 666 $dev_path/tty3 c 4 3
270
+ mknod -m 666 $dev_path/tty4 c 4 4
271
+ mknod -m 600 $dev_path/console c 5 1
272
+ mknod -m 666 $dev_path/full c 1 7
273
+ mknod -m 600 $dev_path/initctl p
275
+ # ensure /dev/ptmx refers to the newinstance devpts of the container, or
276
+ # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
277
+ rm -f $container_rootfs/dev/ptmx
278
+ ln -s pts/ptmx $container_rootfs/dev/ptmx
280
+ # start with a clean /var/log/messages
281
+ rm -f $container_rootfs/var/log/messages
283
+ # add oracle user, set root password
284
+ chroot $container_rootfs useradd --create-home -s /bin/bash oracle
285
+ echo "oracle:oracle" | chroot $container_rootfs chpasswd
286
+ echo "root:root" | chroot $container_rootfs chpasswd
287
+ echo -e "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m"
288
+ echo -e "Added container user:\033[1mroot\033[0m password:\033[1mroot\033[0m"
291
+# create the container's lxc config file
292
+container_config_create()
294
+ echo "Create configuration file $cfg_dir/config"
295
+ # generate a hwaddr for the container with a high mac address
296
+ # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
297
+ local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
298
+ head -1 |awk '{print $2}' | cut -c1-10 |\
299
+ sed 's/\(..\)/\1:/g; s/.$//'`"
300
+ mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
301
+ rm -f $cfg_dir/config
302
+ cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
303
+# Container configuration for Oracle Linux $release_major.$release_minor
309
+lxc.rootfs = $container_rootfs
310
+lxc.mount = $cfg_dir/fstab
312
+lxc.network.type = $lxc_network_type
313
+lxc.network.flags = up
314
+lxc.network.link = $lxc_network_link
315
+lxc.network.name = eth0
316
+lxc.network.mtu = 1500
317
+lxc.network.hwaddr = $hwaddr
318
+# Control Group devices: all denied except those whitelisted
319
+lxc.cgroup.devices.deny = a
320
+lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
321
+lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
322
+lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
323
+lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
324
+lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
325
+lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
326
+lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
327
+lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
328
+lxc.cgroup.devices.allow = c 254:0 rwm # /dev/rtc0
331
+ cat <<EOF > $cfg_dir/fstab || die "unable to create $cfg_dir/fstab"
332
+proc $container_rootfs/proc proc nodev,noexec,nosuid 0 0
333
+devpts $container_rootfs/dev/pts devpts defaults 0 0
334
+sysfs $container_rootfs/sys sysfs defaults 0 0
338
+container_rootfs_clone()
340
+ if is_btrfs_subvolume $template_rootfs; then
341
+ # lxc-create already made $container_rootfs a btrfs subvolume, but
342
+ # in this case we want to snapshot the original subvolume so we we
343
+ # have to delete the one that lxc-create made
344
+ btrfs subvolume delete $container_rootfs
345
+ btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
347
+ cp -ax $template_rootfs $container_rootfs || die "copy template"
351
+container_rootfs_create()
353
+ cmds="rpm wget yum"
354
+ if [ $release_major = "5" ]; then
355
+ cmds="$cmds db_dump db43_load"
357
+ for cmd in $cmds; do
358
+ which $cmd >/dev/null 2>&1
359
+ if [ $? -ne 0 ]; then
360
+ die "The $cmd command is required, please install it"
364
+ mkdir -p /var/lock/subsys/
367
+ if [ $? -ne 0 ]; then
368
+ die "The template is busy."
371
+ echo "Downloading release $release_major.$release_minor for $basearch"
373
+ # get yum repo file
374
+ public_yum_url=http://public-yum.oracle.com
375
+ if [ $release_major = "5" ]; then
376
+ repofile=public-yum-el5.repo
377
+ elif [ $release_major = "6" ]; then
378
+ repofile=public-yum-ol6.repo
380
+ die "Unsupported release $release_major"
382
+ mkdir -p $container_rootfs/etc/yum.repos.d
383
+ wget -q $public_yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
384
+ if [ $? -ne 0 ]; then
385
+ die "Failed to download repo file $public_yum_url/$repofile"
388
+ # yum will take $basearch from host, so force the arch we want
389
+ sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
391
+ # replace url if they specified one
392
+ if [ -n "$repourl" ]; then
393
+ sed -i "s|baseurl=http://public-yum.oracle.com/repo|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
394
+ sed -i "s|gpgkey=http://public-yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
397
+ # disable all repos, then enable the repo for the version we are installing.
398
+ if [ $release_minor = "latest" ]; then
399
+ if [ $release_major = "5" ]; then
400
+ repo="el"$release_major"_"$release_minor
402
+ repo="ol"$release_major"_"$release_minor
404
+ elif [ $release_minor = "0" ]; then
405
+ repo="ol"$release_major"_ga_base"
407
+ repo="ol"$release_major"_u"$release_minor"_base"
409
+ sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
410
+ sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
412
+ # create rpm db, download and yum install minimal packages
413
+ mkdir -p $container_rootfs/var/lib/rpm
414
+ rpm --root $container_rootfs --initdb
415
+ yum_cmd="yum --installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
416
+ min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server dhclient chkconfig rootfiles policycoreutils oraclelinux-release"
418
+ $yum_cmd install $min_pkgs
419
+ if [ $? -ne 0 ]; then
420
+ die "Failed to download and install the rootfs, aborting."
423
+ # rsyslog and pam depend on coreutils for some common commands in
424
+ # their POSTIN scriptlets, but coreutils wasn't installed yet. now
425
+ # that coreutils is installed, reinstall the packages so their POSTIN
426
+ # runs right. similarly, libutempter depends on libselinux.so.1 when
427
+ # it runs /usr/sbin/groupadd, so reinstall it too
428
+ if [ $release_major = "5" ]; then
429
+ rpm --root $container_rootfs --nodeps -e rsyslog pam libutempter
430
+ $yum_cmd install rsyslog pam libutempter
431
+ if [ $? -ne 0 ]; then
432
+ die "Unable to reinstall packages"
436
+ # if we're on 6 and installing 5 we need to fix up the rpm database
437
+ # since 5 uses an older db format
438
+ if [ $release_major = "5" -a $host_release_major = "6" ]; then
439
+ echo "Fixing (downgrading) rpm database"
440
+ rm -f $container_rootfs/var/lib/rpm/__db*
441
+ for db in $container_rootfs/var/lib/rpm/* ; do
442
+ db_dump $db |db43_load $db.new
445
+ chroot $container_rootfs rpm --rebuilddb
448
+ ) 200>/var/lock/subsys/lxc-oracle-$name
454
+ -a|--arch=<arch> architecture (ie. i686, x86_64)
455
+ -R|--release=<release> release to download for the new container
456
+ -u|--url=<url> replace yum repo url (ie. local yum mirror)
457
+ -t|--templatefs=<path> copy/clone rootfs at path instead of downloading
460
+Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
465
+options=$(getopt -o hp:n:a:R:u:t: -l help,path:,name:,arch:,release:,url:,templatefs: -- "$@")
466
+if [ $? -ne 0 ]; then
467
+ usage $(basename $0)
472
+eval set -- "$options"
476
+ -h|--help) usage $0 && exit 0;;
477
+ -p|--path) cfg_dir=$2; shift 2;;
478
+ -n|--name) name=$2; shift 2;;
479
+ -a|--arch) arch=$2; shift 2;;
480
+ -R|--release) release_version=$2; shift 2;;
481
+ -u|--url) repourl=$2; shift;;
482
+ -t|--templatefs) template_rootfs=$2; shift 2;;
483
+ --) shift 1; break ;;
488
+# make sure mandatory args are given and valid
489
+if [ "$(id -u)" != "0" ]; then
490
+ echo "This script should be run as 'root'"
494
+if [ -z $name ]; then
495
+ echo "Container name must be given"
500
+if [ -z $cfg_dir ]; then
501
+ echo "Configuration directory must be given, check lxc-create"
507
+if [ "$arch" = "i686" ]; then
511
+container_rootfs="$cfg_dir/rootfs"
513
+if [ -n "$template_rootfs" ]; then
514
+ release_version=`cat $template_rootfs/etc/oracle-release |awk '/^Oracle/ {print $5}'`
516
+if [ -z "$release_version" ]; then
517
+ echo "No release specified with -R, defaulting to 6.3"
518
+ release_version="6.3"
520
+release_major=`echo $release_version |awk -F '.' '{print $1}'`
521
+release_minor=`echo $release_version |awk -F '.' '{print $2}'`
523
+host_release_version=`cat /etc/oracle-release |awk '/^Oracle/ {print $5}'`
524
+host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
525
+host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
527
+trap cleanup SIGHUP SIGINT SIGTERM
529
+container_config_create
530
+if [ -n "$template_rootfs" ]; then
531
+ container_rootfs_clone
533
+ container_rootfs_create
536
+container_release_version=`cat $container_rootfs/etc/oracle-release |awk '/^Oracle/ {print $5}'`
537
+container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
538
+container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
540
+container_rootfs_configure
542
+echo "Container : $container_rootfs"
543
+echo "Config : $cfg_dir/config"
544
+echo "Network : eth0 ($lxc_network_type) on $lxc_network_link"