3
# template script for generating ubuntu container for LXC based on released cloud
6
# Copyright © 2012 Serge Hallyn <serge.hallyn@canonical.com>
8
# This program is free software; you can redistribute it and/or modify
9
# it under the terms of the GNU General Public License version 2, as
10
# published by the Free Software Foundation.
12
# This program is distributed in the hope that it will be useful,
13
# but WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
17
# You should have received a copy of the GNU General Public License along
18
# with this program; if not, write to the Free Software Foundation, Inc.,
19
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24
if [ -r /etc/default/lxc ]; then
35
if [ $arch = "i386" ]; then
39
# if there is exactly one veth network entry, make sure it has an
41
nics=`grep -e '^lxc\.network\.type[ \t]*=[ \t]*veth' $path/config | wc -l`
42
if [ $nics -eq 1 ]; then
43
grep -q "^lxc.network.hwaddr" $path/config || cat <<EOF >> $path/config
44
lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')
48
cat <<EOF >> $path/config
54
lxc.mount = $path/fstab
56
lxc.cap.drop = sys_module mac_admin
57
# uncomment the next line to run the container unconfined:
58
#lxc.aa_profile = unconfined
60
lxc.cgroup.devices.deny = a
61
# Allow any mknod (but not using the node)
62
lxc.cgroup.devices.allow = c *:* m
63
lxc.cgroup.devices.allow = b *:* m
65
lxc.cgroup.devices.allow = c 1:3 rwm
66
lxc.cgroup.devices.allow = c 1:5 rwm
68
lxc.cgroup.devices.allow = c 5:1 rwm
69
lxc.cgroup.devices.allow = c 5:0 rwm
70
#lxc.cgroup.devices.allow = c 4:0 rwm
71
#lxc.cgroup.devices.allow = c 4:1 rwm
73
lxc.cgroup.devices.allow = c 1:9 rwm
74
lxc.cgroup.devices.allow = c 1:8 rwm
75
lxc.cgroup.devices.allow = c 136:* rwm
76
lxc.cgroup.devices.allow = c 5:2 rwm
78
lxc.cgroup.devices.allow = c 254:0 rwm
80
lxc.cgroup.devices.allow = c 10:229 rwm
82
lxc.cgroup.devices.allow = c 10:200 rwm
84
lxc.cgroup.devices.allow = c 1:7 rwm
86
lxc.cgroup.devices.allow = c 10:228 rwm
88
lxc.cgroup.devices.allow = c 10:232 rwm
91
cat <<EOF > $path/fstab
92
proc proc proc nodev,noexec,nosuid 0 0
93
sysfs sys sysfs defaults 0 0
102
LXC Container configuration for Ubuntu Cloud images.
105
[ -r | --release <release> ]: Release name of container, defaults to host
106
[ -a | --arch ]: Arhcitecture of container, defaults to host arcitecture
107
[ -C | --cloud ]: Configure container for use with meta-data service, defaults to no
108
[ -T | --tarball ]: Location of tarball
109
[ -d | --debug ]: Run with 'set -x' to debug errors
110
[ -s | --stream]: Use specified stream rather than 'released'
112
Options, mutually exclusive of "-C" and "--cloud":
113
[ -i | --hostid ]: HostID for cloud-init, defaults to random string
114
[ -u | --userdata ]: Cloud-init user-data file to configure container on start
115
[ -S | --auth-key ]: SSH Public key file to inject into container
116
[ -L | --nolocales ]: Do not copy host's locales into container
122
options=$(getopt -o a:hp:r:n:Fi:CLS:T:ds: -l arch:,help,path:,release:,name:,flush-cache,hostid:,auth-key:,cloud,no_locales,tarball:,debug,stream:,userdata: -- "$@")
123
if [ $? -ne 0 ]; then
127
eval set -- "$options"
130
if [ -f /etc/lsb-release ]; then
132
case "$DISTRIB_CODENAME" in
133
lucid|maverick|natty|oneiric|precise)
134
release=$DISTRIB_CODENAME
141
# Code taken from debootstrap
142
if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg --print-architecture >/dev/null 2>&1; then
143
arch=`/usr/bin/dpkg --print-architecture`
144
elif type udpkg >/dev/null 2>&1 && udpkg --print-architecture >/dev/null 2>&1; then
145
arch=`/usr/bin/udpkg --print-architecture`
148
if [ "$arch" = "i686" ]; then
150
elif [ "$arch" = "x86_64" ]; then
152
elif [ "$arch" = "armv7l" ]; then
153
# note: arm images don't exist before oneiric; are called armhf in
154
# precise; and are not supported by the query, so we don't actually
155
# support them yet (see check later on). When Query2 is available,
156
# we'll use that to enable arm images.
170
-h|--help) usage $0 && exit 0;;
171
-p|--path) path=$2; shift 2;;
172
-n|--name) name=$2; shift 2;;
173
-F|--flush-cache) flushcache=1; shift 1;;
174
-r|--release) release=$2; shift 2;;
175
-a|--arch) arch=$2; shift 2;;
176
-i|--hostid) host_id=$2; shift 2;;
177
-u|--userdata) userdata=$2; shift 2;;
178
-C|--cloud) cloud=1; shift 1;;
179
-S|--auth-key) auth_key=$2; shift 2;;
180
-L|--no_locales) locales=0; shift 2;;
181
-T|--tarball) tarball=$2; shift 2;;
182
-d|--debug) debug=1; shift 1;;
183
-s|--stream) stream=$2; shift 2;;
184
--) shift 1; break ;;
189
if [ $debug -eq 1 ]; then
193
if [ "$arch" == "i686" ]; then
197
if [ $hostarch = "i386" -a $arch = "amd64" ]; then
198
echo "can't create amd64 container on i386"
202
if [ $arch != "i386" -a $arch != "amd64" ]; then
203
echo "Only i386 and amd64 are supported by the ubuntu cloud template."
207
if [ "$stream" != "daily" -a "$stream" != "released" ]; then
208
echo "Only 'daily' and 'released' streams are supported"
212
if [ -n "$userdata" -a ! -f "$userdata" ]; then
213
echo "Userdata does not exist"
217
if [ -z "$path" ]; then
218
echo "'path' parameter is required"
222
if [ "$(id -u)" != "0" ]; then
223
echo "This script should be run as 'root'"
229
type ubuntu-cloudimg-query
232
# determine the url, tarball, and directory names
234
cache="/var/cache/lxc/cloud-$release"
238
if [ -n "$tarball" ]; then
241
url1=`ubuntu-cloudimg-query $release $stream $arch --format "%{url}\n"`
242
url2=`echo $url1 | sed -e 's/.tar.gz/-root\0/'`
245
filename=`basename $url2`
250
umount -l $cache/$xdir || true
254
# if the release doesn't have a *-rootfs.tar.gz, then create one from the
255
# cloudimg.tar.gz by extracting the .img, mounting it loopback, and creating
256
# a tarball from the mounted image.
262
xdir=`mktemp -d -p .`
263
tarname=`basename $url`
264
imgname="`basename $tarname .tar.gz`.img"
265
trap buildcleanup EXIT
266
if [ $flushcache -eq 1 -o ! -f $cache/$tarname ]; then
268
echo "Downloading cloud image from $url"
269
wget $url || { echo "Couldn't find cloud image $url."; exit 1; }
271
echo "Creating new cached cloud image rootfs"
272
tar zxf $tarname $imgname
273
mount -o loop $imgname $xdir
274
(cd $xdir; tar zcf ../$filename .)
276
rm -f $tarname $imgname
278
echo "New cloud image cache created"
282
mkdir -p /var/lock/subsys/
287
if [ $flushcache -eq 1 ]; then
288
echo "Clearing the cached images"
292
if [ ! -f $filename ]; then
293
wget $url2 || build_root_tgz $url1 $filename
296
echo "Extracting container rootfs"
299
tar -zxf $cache/$filename
302
if [ $cloud -eq 0 ]; then
303
echo "Configuring for running outside of a cloud environment"
304
echo "If you want to configure for a cloud evironment, please use '-- -C' to create the container"
306
seed_d=$rootfs/var/lib/cloud/seed/nocloud-net
307
rhostid=$(uuidgen | cut -c -8)
308
host_id=${hostid:-$rhostid}
311
cat > "$seed_d/meta-data" <<EOF
312
instance_id: lxc-$host_id
315
rm $rootfs/etc/hostname
317
if [ $locales -eq 1 ]; then
318
cp /usr/lib/locale/locale-archive $rootfs/usr/lib/locale/locale-archive
322
if [ -n "$auth_key" -a -f "$auth_key" ]; then
323
u_path="/home/ubuntu/.ssh"
324
root_u_path="$rootfs/$u_path"
325
mkdir -p $root_u_path
326
cp $auth_key "$root_u_path/authorized_keys"
327
chroot $rootfs chown -R ubuntu: "$u_path"
329
echo "Inserted SSH public key from $auth_key into /home/ubuntu/.ssh/authorized_keys"
332
if [ -f "$userdata" ]; then
333
echo "Using custom user-data"
334
cp $userdata $seed_d/user-data
337
if [ -z "$MIRROR" ]; then
338
MIRROR="http://archive.ubuntu.com/ubuntu"
341
cat > "$seed_d/user-data" <<EOF
343
output: {all: '| tee -a /var/log/cloud-init-output.log'}
345
manage_etc_hosts: localhost
346
locale: $(/usr/bin/locale | awk -F= '/LANG=/ {print$NF}')
350
chroot $rootfs /usr/sbin/usermod -U ubuntu
351
echo "ubuntu:ubuntu" | chroot $rootfs chpasswd
352
echo "Please login as user ubuntu with password ubuntu."
356
echo "Configured for running in a cloud environment."
357
echo "If you do not have a meta-data service, this container will likely be useless."
361
) 200>/var/lock/subsys/lxc-ubucloud
363
copy_configuration $path $rootfs $name $arch
365
echo "Container $name created."