lxc-ubuntu

#!/bin/bash
#
# Creates a ubuntu based container
#
# This script is based on the lxc-ubuntu example script that ships with lxc.
#
# Copyright (C) 2010 Nigel McNie
# Modified for Ubuntu 2010 phbaer
# Modified some more 2011 David Schoen
#

################################################################################
#                                  change log
################################################################################

# 2011-08-02 - 2011-08-03
#   - simplified argument parsing and usage/help messages for future refactoring
#   - adjusted all variables to not be UPPER case to ensure no risk of ENV variable overlap
#   - consolidated config variable initialisation
#   - added defaults so that just running './lxc-ubuntu' is sufficient
#   - set a default root password to 'lxc'
#   - add --arch, --mirror, --device and --yes cli args
#   - broke backwards compatibility a little, run with: './lxc-ubuntu ... --device auto' to preserve old behavior

################################################################################
#                    ubuntu custom configuration files
################################################################################

# Disable selinux in the container
write_ubuntu_selinux() {
    mkdir -p $rootfs/selinux
    echo 0 > $rootfs/selinux/enforce
}

# Write out a custom fstab
write_ubuntu_fstab() {
cat <<EOF > $rootfs/etc/fstab
tmpfs  /dev/shm   tmpfs  defaults  0 0
EOF
}

# Write out network config (dhcp)
write_ubuntu_network() {
    cat <<EOF > $rootfs/etc/network/interfaces
auto lo
iface lo inet loopback

EOF
    if [ -z "$static_ip4" ] ; then
	## no static address set: enable DHCP
	cat <<EOF > $rootfs/etc/network/interfaces
auto eth0
iface eth0 inet dhcp
EOF
cat <<EOF >> $rootfs/etc/dhcp/dhclient.conf
send host-name "$utsname";
EOF
    else
	## fixed address
	cat <<EOF >> $rootfs/etc/network/interfaces
auto eth0
iface eth0 inet static
	address $address
	netmask $netmask
	gateway $gateway

EOF
	## resolver config
	if [ -n "$nameserver" ] ; then
		cat <<EOF >> $rootfs/etc/resolv.conf
nameserver $nameserver
EOF
	fi
    fi
}

# Set the hostname for the container
write_ubuntu_hostname() {
cat <<EOF > $rootfs/etc/hostname
$utsname
EOF
cat <<EOF > $rootfs/etc/hosts
127.0.0.1   $utsname localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
EOF
}

# Writes a custom ssh config that allows root logins
write_ubuntu_sshd_config() {
cat <<EOF > $rootfs/etc/ssh/sshd_config
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords yes
ChallengeResponseAuthentication no
EOF
}

# Autoconfigures packages in the container so no debconf questions are asked
# when it's made
reconfigure_ubuntu_packages() {
    default_environment_locale=$(debconf-show locales | grep default_environment_locale | cut -f 2 -d :)
    locales_to_be_generated=$(debconf-show locales | grep locales_to_be_generated | cut -f 2 -d :)
    tzdata_area=$(debconf-show tzdata | grep Areas | cut -f 2 -d :)
    tzdata_zone=$(debconf-show tzdata | grep Zones/${tzdata_area:1} | cut -f 2 -d :)

    cat <<EOF | chroot $rootfs sh
#!/bin/sh
apt-get install --force-yes -y language-pack-en
update-locale LANG="en_GB.UTF-8" LANGUAGE="en_GB.UTF-8" LC_ALL="en_GB.UTF-8"
EOF
}

# set root's password to 'lxc'
reset_root_password() {
    sed -i 's%^root:.*%root:$6$EEGUnn6e$DkpHEGpLyyFW/QePxZjsTvix9E7c8YPdH6RF4BYx8yagQMySPYkmjKMPLyrE7ZpNxUh0huqMCfSLcIct7/puH/:15248:0:99999:7:::%' $rootfs/etc/shadow
}

# create root's SSH authorized_keys file
write_root_authkey() {
   mkdir -p $rootfs/root/.ssh
   local f=$rootfs/root/.ssh/authorized_keys
   cp "$1" "$f"
   chmod 644 "$f"
   chown root:root "$f"
}

disable_upstart_mounts() {
    cat <<EOF > $rootfs/lib/init/fstab
#
# These are the filesystems that are always mounted on boot, you can
# override any of these by copying the appropriate line from this file into
# /etc/fstab and tweaking it as you see fit.  See fstab(5).
#
# <file system> <mount point>             <type>          <options>                    <dump> <pass>
/dev/root       /                         rootfs          defaults                          0 1
#none            /proc                     proc            nodev,noexec,nosuid               0 0
none            /proc/sys/fs/binfmt_misc  binfmt_misc     nodev,noexec,nosuid,optional      0 0
#none            /sys                      sysfs           nodev,noexec,nosuid               0 0
none            /sys/fs/fuse/connections  fusectl         optional                          0 0
none            /sys/kernel/debug         debugfs         optional                          0 0
none            /sys/kernel/security      securityfs      optional                          0 0
none            /spu                      spufs           gid=spu,optional                  0 0
#none            /dev                      devtmpfs,tmpfs  mode=0755                         0 0
none            /dev/pts                  devpts          noexec,nosuid,gid=tty,mode=0620   0 0
none            /dev/shm                  tmpfs           nosuid,nodev                      0 0
none            /tmp                      none            defaults                          0 0
none            /var/run                  tmpfs           mode=0755,nosuid,showthrough      0 0
none            /var/lock                 tmpfs           nodev,noexec,nosuid,showthrough   0 0
none            /lib/init/rw              tmpfs           mode=0755,nosuid,optional         0 0
EOF
}

modify_upstart_sysinit() {
    sed -i 's/start on filesystem and net-device-up IFACE=lo/start on filesystem #and net-device-up IFACE=lo/' $rootfs/etc/init/rc-sysinit.conf
}

write_upstart_lxc() {
    cat <<EOF > $rootfs/etc/init/lxc.conf
# LXC – Fix init sequence to have LXC containers boot with upstart

# description “Fix LXC container”

start on startup

task
pre-start script
mount -t proc proc /proc
mount -t devpts devpts /dev/pts
mount -t sysfs sys /sys
mount -t tmpfs varrun /var/run
mount -t tmpfs varlock /var/lock
mkdir -p /var/run/network
touch /var/run/utmp
chmod 664 /var/run/utmp
chown root.utmp /var/run/utmp
if [ "$(find /etc/network/ -name upstart -type f)" ]; then
chmod -x /etc/network/*/upstart || true
fi
end script

script
start networking
initctl emit filesystem --no-wait
initctl emit local-filesystems --no-wait
initctl emit virtual-filesystems --no-wait
init 2
end script
EOF
mkdir -p $rootfs/var/run/network
touch $rootfs/var/run/network/ifstate
mkdir -p $rootfs/var/run/sshd
}

# Disables services a container doesn't need
disable_ubuntu_services() {
    chroot $rootfs /usr/sbin/update-rc.d -f umountfs remove
    chroot $rootfs /usr/sbin/update-rc.d -f hwclock.sh remove
    chroot $rootfs /usr/sbin/update-rc.d -f hwclockfirst.sh remove
}


################################################################################
#                        lxc configuration files
################################################################################

write_lxc_configuration() {
cat <<EOF > $conffile
lxc.utsname = $utsname
lxc.tty = 6
lxc.pts = 1024
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = $bridge
lxc.network.name = eth0
lxc.network.mtu = $mtu
lxc.rootfs = $rootfs
#lxc.mount = $tmpmntfile
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
EOF
}

write_lxc_mounts() {

    tmpmntfile=$(mktemp lxc.XXXXXXXXXX)

    if [ ! -z "$mntfile" ]; then
    cp $mntfile $tmpmntfile
    fi
}


collect_information() {

    [[ $interactive = yes ]] || return

    # choose a hostname, default is the container name
    echo -n "What hostname do you wish for this container ? [$utsname] "
    read _utsname_

    if [ ! -z "$_utsname_" ]; then
        utsname=$_utsname_
    fi

    echo -n "Specify the location for an extra fstab file [(none)] "
    read _mntfile_

    if [ ! -z "$_mntfile_" ]; then
        mntfile=$_mntfile_
    fi

    echo "Choose the architecture for the container (choices as for deboostrap, e.g.: amd64, i386"
    echo -n "Choice ? [$arch] "
    read _arch_

    if [ ! -z "$_arch_" ]; then
        arch=$_arch_
    fi

    # choose a mirror
    echo -n "Specify the ubuntu mirror to use to download the rootfs [$debmirror] "
    read _debmirror_

    if [ ! -z "$_debmirror_" ]; then
        debmirror=$_debmirror_
    fi
}

install_ubuntu()
{
    case $arch in
        amd64|i386) ;;
        *) echo "Unsupported architecture $arch!"; exit 1;;
    esac

    # download a mini ubuntu into a cache
    echo "Downloading ubuntu minimal ..."
    debootstrap --verbose --variant=minbase --arch=$arch \
        --include ifupdown,locales,netbase,net-tools,iproute,openssh-server,isc-dhcp-client,gpgv,adduser,apt-utils,vim,openssh-blacklist,openssh-blacklist-extra,console-setup,sudo,iputils-ping,aptitude,ubuntu-minimal \
        $release $rootfs $debmirror

    resULT=$?
    if [ "$resULT" != "0" ]; then
        echo "Failed to download the rootfs, aborting."
        exit 1
    fi

}

run_pre_create_hook() {
    # source a hook that's run before the container is created
    # sourced so it has access to our variables, like $utsname
    test -x /etc/lxc-ubuntu/host-pre-create && . /etc/lxc-ubuntu/host-pre-create
}

run_post_create_hooks() {
    # source host and guest hooks for after the container is created
    test -x /etc/lxc-ubuntu/host-post-create && . /etc/lxc-ubuntu/host-post-create

    if [ -x /etc/lxc-ubuntu/guest-post-create ]; then
        cp /etc/lxc-ubuntu/guest-post-create $rootfs/guest-post-create
        chroot $rootfs /bin/bash /guest-post-create
        chroot $rootfs /bin/rm /guest-post-create
    fi
}

create() {

    collect_information
    write_lxc_mounts
    write_lxc_configuration

    /usr/bin/lxc-create -n $utsname -f $conffile
    res=$?

    # remove the configuration files
    rm -f $conffile
    rm -f $tmpmntfile

    if [ "$res" != "0" ]; then
        echo "Failed to create '$utsname'"
        exit 1
    fi

    mkdir -p $rootfs

    if [[ ! -z $device ]]; then
        if ! mount "$device" "$rootfs"; then
            echo "Failed to mount $device"
            lxc-destroy -n "$utsname"
            exit 1
        fi
    fi

    install_ubuntu
    write_ubuntu_hostname
    write_ubuntu_fstab
    write_ubuntu_network
    write_ubuntu_selinux
    reconfigure_ubuntu_packages
    disable_ubuntu_services
    run_pre_create_hook
    run_post_create_hooks
    disable_upstart_mounts
    modify_upstart_sysinit
    write_upstart_lxc
    if [ -z "$root_authkey" ] ; then
	write_ubuntu_sshd_config
    	reset_root_password
    else
	write_root_authkey "$root_authkey"
    fi

    echo "Done."
    echo -e "\nYou can run your container with the 'lxc-start -n $utsname'\n"
    if [ -z "$root_authkey" ] ; then
      echo -e "\nYou can login to your container over SSH as root with password 'lxc'\n"
    else
      echo -e "\nYou can login to your container over SSH as root with the authkey you have provided\n"
    fi
}

destroy() {

    echo -n "This will PERMANENTLY DESTROY the container $utsname. Are you sure? [y/N] ? "
    read reply
    if [ "$reply" != "y" ]; then
        echo "Abort."
        exit
    fi

    halt=$(which lxc-halt-container)
    if lxc-info -n $utsname | grep RUNNING > /dev/null; then
        if [ -n "$halt" ]; then
            lxc-halt-container -n $utsname
        else
            lxc-stop -n $utsname
        fi
    fi
    sleep .5

    rm -rf $rootfs
    /usr/bin/lxc-destroy -n $utsname
    RETVAL=$?
    if [ ! $RETVAL -eq 0 ]; then
        echo "Failed to destroy '$utsname'"
        return $RETVAL
    fi

    return 0
}

usage() {
    echo "Usage: $0 [command] [options]"
    echo
    echo "Example: $0 create -n ubuntu"
    echo 
    echo "This script is a helper to create ubuntu system containers."
    echo 
    echo "The script will create the container configuration file following"
    echo "the information submitted interactively with 'lxc-ubuntu create'"
    echo "or as options outlined below."
    echo
    echo "Command: default is 'create'"
    echo "  create: Create a new lxc"
    echo "  destroy: Destroy an existing lxc" 
    echo
    echo "Options:"
    echo "  -n|--name <name>: name of lxc, default is 'ubuntu'"
    echo "  -h|-help|--help: display this helpful message"
    echo "  --mirror <deb mirror>: defaults to http://archive.ubuntu.com/ubuntu"
    echo "  --arch <i386|amd64>: dpkg arch type"
    echo "  --release <hardy|intrepid|jaunty|karmic|lucid|oneiric> : debian release"
    echo "  --root-authkey <file>: use publickey-based authentication for root, no password authetication for root"
    echo "  -y|--yes: assume defaults are correct for all questions, do not ask interactive questions"
    echo "  --device </dev/foo>: specify some device to mount as the rootfs of the lxc, 'auto' will use /dev/vg0/lxc-<name>"
    echo " --bridge IFNAME"
    echo " --static-ip4 IPADDR NETMASK GATEWAY DNSSERVER"
    echo 
    echo "Have fun :)"
}

# Main program

if [ "$(id -u)" != "0" ]; then
    echo "This script should be run as 'root'"
    exit 1
fi

bridge=br0
static_ip4=""

# parse cli args
while true; do
    [[ -z $1 ]] && break

    case "$1" in
        -h|-help|--help) 
            usage
            exit 0
            ;;
        -n|--name)
            utsname="$2"
            shift # remove name from remaining arguments
            ;;
        create|destroy)
            command="$1"
            ;;
        --mirror)
            debmirror="$2"
            shift
            ;;
	--release)
	    release="$2"
            shift
            ;;
        --arch)
            arch="$2"
            shift
            ;;
        --device)
            device="$2"
            shift
            ;;
	--root-authkey)
	    root_authkey="$2"
	    shift
	    ;;
	--bridge)
	    bridge="$2"
	    shift
	    ;;
	--static-ip4)
	    if [ $# -lt 5 ] ; then usage; exit; fi
	    address="$2"
	    shift
	    netmask="$2"
	    shift
	    gateway="$2"
	    shift
	    nameserver="$2"
	    shift
	    static_ip4=yes
	    ;;
        -y|--yes)
            interactive=no
            ;;
        *)
            echo "ERROR: Unknown argument $1"
            echo
            usage
            exit 1
            ;;
    esac

    shift
done

utsname="${utsname:-ubuntu}" # default lxc name of "ubuntu"
command="${command:-create}" # default command is to "create"
interactive="${interactive:-yes}"
mntfile=
tmpmntfile=
mtu="1500"
debmirror="${debmirror:-http://archive.ubuntu.com/ubuntu}"
fqdn=$(hostname --fqdn)
conffile="/var/lib/lxc/$utsname.conf"
rootfs="/var/lib/lxc/$utsname/rootfs"
arch="${arch:-$(dpkg --print-architecture)}"
release="${release:-$(lsb_release -s -c)}"
device="${device:-}"
[[ $device = auto ]] && device="/dev/vg0/lxc-$utsname"

$command

# vim: et sw=4 ts=4