File: lxc-alpine.in

package info (click to toggle)
lxc 1%3A1.0.6-6
  • links: PTS, VCS
  • area: main
  • in suites: jessie-kfreebsd
  • size: 4,800 kB
  • sloc: ansic: 33,735; sh: 11,868; python: 1,223; makefile: 734
file content (387 lines) | stat: -rw-r--r-- 10,786 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
#!/bin/sh

# Detect use under userns (unsupported)
for arg in "$@"; do
    [ "$arg" = "--" ] && break
    if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1
    fi
done

# Make sure the usual locations are in PATH
PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
export PATH

key_sha256sums="9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4  alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab  alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub
ebf31683b56410ecc4c00acd9f6e2839e237a3b62b5ae7ef686705c7ba0396a9  alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
1bb2a846c0ea4ca9d0e7862f970863857fc33c32f5506098c636a62a726a847b  alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub
12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c  alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub"


get_static_apk () {
    wget="wget -q -O -"
    pkglist=alpine-keys:apk-tools-static
    auto_repo_dir=

    if [ -z "$repository" ]; then
        url=http://wiki.alpinelinux.org/cgi-bin/dl.cgi
        if [ -z "$release" ]; then
            echo -n "Determining the latest release... "
            release=$($wget $url/.latest.$apk_arch.txt | \
                cut -d " " -f 3 | cut -d / -f 1 | uniq)
            if [ -z "$release" ]; then
                echo failed
                return 1
            fi
            echo $release
        fi
        auto_repo_dir=$release/main
        repository=$url/$auto_repo_dir
        pkglist=$pkglist:alpine-mirrors
    fi

    rootfs="$1"
    echo "Using static apk from $repository/$apk_arch"
    wget="$wget $repository/$apk_arch"

    # parse APKINDEX to find the current versions
    static_pkgs=$($wget/APKINDEX.tar.gz | \
        tar -Oxz APKINDEX | \
        awk -F: -v pkglist=$pkglist '
            BEGIN { split(pkglist,pkg) }
            $0 != "" { f[$1] = $2 }
            $0 == "" { for (i in pkg)
                           if (pkg[i] == f["P"])
                               print(f["P"] "-" f["V"] ".apk") }')
    [ "$static_pkgs" ] || return 1

    mkdir -p "$rootfs" || return 1
    for pkg in $static_pkgs; do
        echo "Downloading $pkg"
        $wget/$pkg | tar -xz -C "$rootfs"
    done

    # clean up .apk meta files
    rm -f "$rootfs"/.[A-Z]*

    # verify checksum of the key
    keyname=$(echo $rootfs/sbin/apk.static.*.pub | sed 's/.*\.SIGN\.RSA\.//')
    checksum=$(echo "$key_sha256sums" |  grep -w "$keyname")
    if [ -z "$checksum" ]; then
        echo "ERROR: checksum is missing for $keyname"
        return 1
    fi
    (cd $rootfs/etc/apk/keys && echo "$checksum" | sha256sum -c -) || return 1

    # verify the static apk binary signature
    APK=$rootfs/sbin/apk.static
    openssl dgst -verify $rootfs/etc/apk/keys/$keyname \
        -signature "$APK.SIGN.RSA.$keyname" "$APK" || return 1

    if [ "$auto_repo_dir" ]; then
        mirror_list=$rootfs/usr/share/alpine-mirrors/MIRRORS.txt
        mirror_count=$(wc -l $mirror_list | cut -d " " -f 1)
        random=$(hexdump -n 2 -e '/2 "%u"' /dev/urandom)
        repository=$(sed $(expr $random % $mirror_count + 1)\!d \
            $mirror_list)$auto_repo_dir
        echo "Selecting mirror $repository"
    fi
}

install_alpine() {
    rootfs="$1"
    shift
    mkdir -p "$rootfs"/etc/apk || return 1
    : ${keys_dir:=/etc/apk/keys}
    if ! [ -d "$rootfs"/etc/apk/keys ] && [ -d "$keys_dir" ]; then
        cp -r "$keys_dir" "$rootfs"/etc/apk/keys
    fi
    if [ -n "$repository" ]; then
        echo "$repository" > "$rootfs"/etc/apk/repositories
    else
        cp /etc/apk/repositories "$rootfs"/etc/apk/repositories || return 1
        if [ -n "$release" ]; then
            sed -i -e "s:/[^/]\+/\([^/]\+\)$:/$release/\1:" \
                "$rootfs"/etc/apk/repositories
        fi
    fi
    opt_arch=
    if [ -n "$apk_arch" ]; then
        opt_arch="--arch $apk_arch"
    fi
    $APK add -U --initdb --root $rootfs $opt_arch "$@" alpine-base
}

configure_alpine() {
    rootfs="$1"
    echo "Setting up /etc/inittab"
    cat >"$rootfs"/etc/inittab<<EOF
::sysinit:/sbin/rc sysinit
::wait:/sbin/rc default
tty1:12345:respawn:/sbin/getty 38400 tty1
tty2:12345:respawn:/sbin/getty 38400 tty2
tty3:12345:respawn:/sbin/getty 38400 tty3
tty4:12345:respawn:/sbin/getty 38400 tty4
::ctrlaltdel:/sbin/reboot
::shutdown:/sbin/rc shutdown
EOF
    # set up timezone
    if [ -f /etc/TZ ]; then
        cp /etc/TZ "$rootfs/etc/TZ"
    fi

    # set up nameserver
    grep nameserver /etc/resolv.conf > "$rootfs/etc/resolv.conf"

    # configure the network using the dhcp
    cat <<EOF > $rootfs/etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
EOF

    # set the hostname
    echo $hostname > $rootfs/etc/hostname

    # missing device nodes
    echo "Setting up device nodes"
    mkdir -p -m 755 "$rootfs/dev/pts"
    mkdir -p -m 1777 "$rootfs/dev/shm"
    mknod -m 666 "$rootfs/dev/zero" c 1 5
    mknod -m 666 "$rootfs/dev/full" c 1 7
    mknod -m 666 "$rootfs/dev/random" c 1 8
    mknod -m 666 "$rootfs/dev/urandom" c 1 9
    mknod -m 666 "$rootfs/dev/tty0" c 4 0
    mknod -m 666 "$rootfs/dev/tty1" c 4 1
    mknod -m 666 "$rootfs/dev/tty2" c 4 2
    mknod -m 666 "$rootfs/dev/tty3" c 4 3
    mknod -m 666 "$rootfs/dev/tty4" c 4 4
#    mknod -m 600 "$rootfs/dev/initctl" p
    mknod -m 666 "$rootfs/dev/tty" c 5 0
    mknod -m 666 "$rootfs/dev/console" c 5 1
    mknod -m 666 "$rootfs/dev/ptmx" c 5 2

    # start services
    ln -s /etc/init.d/bootmisc "$rootfs"/etc/runlevels/boot/bootmisc
    ln -s /etc/init.d/syslog "$rootfs"/etc/runlevels/boot/syslog

    return 0
}

copy_configuration() {
    path=$1
    rootfs=$2
    hostname=$3

    grep -q "^lxc.rootfs" $path/config 2>/dev/null \
        || echo "lxc.rootfs = $rootfs" >> $path/config
    if [ -n "$lxc_arch" ]; then
        echo "lxc.arch = $lxc_arch" >> $path/config
    fi

    lxc_network_link_line="# lxc.network.link = br0"
    for br in lxcbr0 virbr0 br0; do
        if [ -d /sys/class/net/$br/bridge ]; then
            lxc_network_link_line="lxc.network.link = $br"
            break
        fi
    done

    if ! grep -q "^lxc.network.type" $path/config 2>/dev/null; then
        cat <<EOF >> $path/config
lxc.network.type = veth
$lxc_network_link_line
lxc.network.flags = up
EOF
    fi

    # if there is exactly one veth or macvlan network entry, make sure
    # it has an associated mac address.
    nics=$(awk -F '[ \t]*=[ \t]*' \
        '$1=="lxc.network.type" && ($2=="veth" || $2=="macvlan") {print $2}' \
        $path/config | wc -l)
    if [ "$nics" -eq 1 ] && ! grep -q "^lxc.network.hwaddr" $path/config; then
        # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
        hwaddr="fe:$(dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
                      head -n 1 |awk '{print $2}' | cut -c1-10 |\
                      sed 's/\(..\)/\1:/g; s/.$//')"
        echo "lxc.network.hwaddr = $hwaddr" >> $path/config
    fi

    cat <<EOF >> $path/config

lxc.tty = 4
lxc.pts = 1024
lxc.utsname = $hostname
lxc.cap.drop = sys_module mac_admin mac_override sys_time sys_admin

# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined

# devices
lxc.cgroup.devices.deny = a
# /dev/null, zero and full
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
lxc.cgroup.devices.allow = c 1:7 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rm

# mounts point
lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry=run run tmpfs nodev,noexec,nosuid,relatime,size=1m,mode=0755 0 0
lxc.mount.entry=none dev/pts devpts gid=5,mode=620 0 0
lxc.mount.entry=shm dev/shm tmpfs nodev,nosuid,noexec 0 0

EOF

    return 0
}

die() {
    echo "$@" >&2
    exit 1
}

usage() {
    cat >&2 <<EOF
Usage: $(basename $0) [-h|--help] [-r|--repository <url>]
                   [-R|--release <release>] [-a|--arch <arch>]
                   [--rootfs <rootfs>] -p|--path <path> -n|--name <name>
                   [PKG...]
EOF
}

usage_err() {
    usage
    exit 1
}

optarg_check() {
    if [ -z "$2" ]; then
        usage_err "option '$1' requires an argument"
    fi
}

default_path=@LXCPATH@
release=
arch=$(uname -m)

# template mknods, requires root
if [ $(id -u) -ne 0 ]; then
   echo "$(basename $0): must be run as root" >&2
   exit 1
fi

while [ $# -gt 0 ]; do
    opt="$1"
    shift
    case "$opt" in
    -h|--help)
        usage
        exit 0
        ;;
    -n|--name)
        optarg_check $opt "$1"
        name=$1
        shift
        ;;
    --rootfs)
        optarg_check $opt "$1"
        rootfs=$1
        shift
        ;;
    -p|--path)
        optarg_check $opt "$1"
        path=$1
        shift
        ;;
    -r|--repository)
        optarg_check $opt "$1"
        repository=$1
        shift
	;;
    -R|--release)
        optarg_check $opt "$1"
        release=$1
        shift
        ;;
    -a|--arch)
        optarg_check $opt "$1"
        arch=$1
        shift
        ;;
    --)
        break;;
    --*=*)
        # split --myopt=foo=bar into --myopt foo=bar
        set -- ${opt%=*} ${opt#*=} "$@"
        ;;
    -?)
        usage_err "unknown option '$opt'"
        ;;
    -*)
        # split opts -abc into -a -b -c
        set -- $(echo "${opt#-}" | sed 's/\(.\)/ -\1/g') "$@"
        ;;
    esac
done


[ -z "$name" ] && usage_err

if [ -z "${path}" ]; then
    path="${default_path}/${name}"
fi

if [ -z "$rootfs" ]; then
    rootfs=`awk -F= '$1 ~ /^lxc.rootfs/ { print $2 }' "$path/config" 2>/dev/null`
    if [ -z "$rootfs" ]; then
        rootfs="${path}/rootfs"
    fi
fi

lxc_arch=$arch
apk_arch=$arch

case "$arch" in
    i[3-6]86)
        apk_arch=x86
        lxc_arch=x86
        ;;
    x86)
        lxc_arch=i686
        ;;
    x86_64|"")
        ;;
    arm*)
        apk_arch=armhf
        ;;
    *)
        die "unsupported architecture: $arch"
        ;;
esac

: ${APK:=apk}
if ! which $APK >/dev/null; then
    get_static_apk "$rootfs" || die "Failed to download a valid static apk"
fi

install_alpine "$rootfs" "$@" || die "Failed to install rootfs for $name"
configure_alpine "$rootfs" "$name" || die "Failed to configure $name"
copy_configuration "$path" "$rootfs" "$name"