lxc-debian

#!/bin/bash
#
# Creates a debian based container
#
# This script is based on the lxc-debian example script that ships with lxc.
#
# Copyright (C) 2010 Nigel McNie
#

CONFFILE="lxc.conf"
MNTFILE=
TMPMNTFILE=
UTSNAME=
MTU="1500"
DEBMIRROR=http://ftp.debian.org/debian
FQDN=$(hostname --fqdn)


################################################################################
#                    debian custom configuration files
################################################################################

# Disable selinux in the container
write_debian_selinux() {
    mkdir -p $ROOTFS/selinux
    echo 0 > $ROOTFS/selinux/enforce
}

# Write out a custom fstab
write_debian_fstab() {
cat <<EOF > $ROOTFS/etc/fstab
tmpfs  /dev/shm   tmpfs  defaults  0 0
EOF
}

# Write out a custom inittab
write_debian_inittab() {
cat <<EOF > $ROOTFS/etc/inittab
id:3:initdefault:
si::sysinit:/etc/init.d/rcS
l0:0:wait:/etc/init.d/rc 0
l1:1:wait:/etc/init.d/rc 1
l2:2:wait:/etc/init.d/rc 2
l3:3:wait:/etc/init.d/rc 3
l4:4:wait:/etc/init.d/rc 4
l5:5:wait:/etc/init.d/rc 5
l6:6:wait:/etc/init.d/rc 6
# Normally not reached, but fallthrough in case of emergency.
z6:6:respawn:/sbin/sulogin
1:2345:respawn:/sbin/getty 38400 console
c1:12345:respawn:/sbin/getty 38400 tty1 linux
c2:12345:respawn:/sbin/getty 38400 tty2 linux
c3:12345:respawn:/sbin/getty 38400 tty3 linux
c4:12345:respawn:/sbin/getty 38400 tty4 linux
EOF
}

# Write out network config (dhcp)
write_debian_network() {
cat <<EOF > $ROOTFS/etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
EOF
cat <<EOF >> $ROOTFS/etc/dhcp3/dhclient.conf
send host-name "$UTSNAME";
EOF
}

# Set the hostname for the container
write_debian_hostname() {
cat <<EOF > $ROOTFS/etc/hostname
$UTSNAME
EOF
cat <<EOF > $ROOTFS/etc/hosts
127.0.0.1   $UTSNAME localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
EOF
}

# Writes a custom ssh config that allows root logins
write_debian_sshd_config() {
cat <<EOF > $ROOTFS/etc/ssh/sshd_config
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords yes
ChallengeResponseAuthentication no
EOF
}

# Autoconfigures packages in the container so no debconf questions are asked
# when it's made
reconfigure_debian_packages() {
    default_environment_locale=$(debconf-show locales | grep default_environment_locale | cut -f 2 -d :)
    locales_to_be_generated=$(debconf-show locales | grep locales_to_be_generated | cut -f 2 -d :)
    tzdata_area=$(debconf-show tzdata | grep Areas | cut -f 2 -d :)
    tzdata_zone=$(debconf-show tzdata | grep Zones/${tzdata_area:1} | cut -f 2 -d :)

    cat <<EOF | chroot $ROOTFS sh
#!/bin/sh
export LANG=C
echo "locales locales/default_environment_locale select$default_environment_locale" > /debconf-selections
echo "locales locales/locales_to_be_generated multiselect$locales_to_be_generated" >> /debconf-selections
echo "tzdata tzdata/Areas select$tzdata_area" >> /debconf-selections
echo "tzdata tzdata/Zones/${tzdata_area:1} select$tzdata_zone" >> /debconf-selections
debconf-set-selections /debconf-selections

rm -f /etc/locale.gen
dpkg-reconfigure -u locales
echo ${tzdata_area:1}/${tzdata_zone:1} > /etc/timezone
cp /usr/share/zoneinfo/${tzdata_area:1}/${tzdata_zone:1} /etc/localtime
dpkg-reconfigure -u tzdata

rm -f /debconf-selections
EOF
}

# Disables services a container doesn't need
disable_debian_services() {
    chroot $ROOTFS /usr/sbin/update-rc.d -f umountfs remove
    chroot $ROOTFS /usr/sbin/update-rc.d -f hwclock.sh remove
    chroot $ROOTFS /usr/sbin/update-rc.d -f hwclockfirst.sh remove
}


################################################################################
#                        lxc configuration files
################################################################################

write_lxc_configuration() {
cat <<EOF > $CONFFILE
lxc.utsname = $UTSNAME
lxc.tty = 4
lxc.pts = 1024
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.name = eth0
lxc.network.mtu = $MTU
lxc.mount = $TMPMNTFILE
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
EOF
}

write_lxc_mounts() {

    TMPMNTFILE=$(mktemp lxc.XXXXXXXXXX)

    if [ ! -z "$MNTFILE" ]; then
    cp $MNTFILE $TMPMNTFILE
    fi
}


collect_information() {

    # choose a hostname, default is the container name
    echo -n "What hostname do you wish for this container ? [$NAME] "
    read _UTSNAME_

    if [ ! -z "$_UTSNAME_" ]; then
        UTSNAME=$_UTSNAME_
    else
        UTSNAME=$NAME
    fi

    echo -n "Specify the location for an extra fstab file [(none)] "
    read _MNTFILE_

    if [ ! -z "$_MNTFILE_" ]; then
        MNTFILE=$_MNTFILE_
    fi
}

install_debian()
{
    ARCH=$(dpkg --print-architecture)
    case $ARCH in
        amd64) ARCH=amd64 ;;
        i386 ) ARCH=i386 ;;
        *    ) echo "Unsupported architecture $ARCH!"; exit 1; ;;
    esac

    echo "Choose the architecture for the container (choices as for deboostrap, e.g.: amd64, i386"
    echo -n "Choice ? [$ARCH] "
    read _ARCH_

    if [ ! -z "$_ARCH_" ]; then
        ARCH=$_ARCH_
    fi

    # choose a mirror
    echo -n "Specify the debian mirror to use to download the rootfs [$DEBMIRROR] "
    read _DEBMIRROR_

    if [ ! -z "$_DEBMIRROR_" ]; then
        DEBMIRROR=$_DEBMIRROR_
    fi

    # download a mini debian into a cache
    echo "Downloading debian minimal ..."
    debootstrap --verbose --variant=minbase --arch=$ARCH \
        --include ifupdown,locales,libui-dialog-perl,dialog,netbase,net-tools,iproute,openssh-server,dhcp3-client \
        lenny $ROOTFS $DEBMIRROR

    RESULT=$?
    if [ "$RESULT" != "0" ]; then
        echo "Failed to download the rootfs, aborting."
        exit 1
    fi

}

run_pre_create_hook() {
    # source a hook that's run before the container is created
    # sourced so it has access to our variables, like $NAME
    test -x /etc/lxc-debian/host-pre-create && . /etc/lxc-debian/host-pre-create
}

run_post_create_hooks() {
    # source host and guest hooks for after the container is created
    test -x /etc/lxc-debian/host-post-create && . /etc/lxc-debian/host-post-create

    if [ -x /etc/lxc-debian/guest-post-create ]; then
        cp /etc/lxc-debian/guest-post-create $ROOTFS/guest-post-create
        chroot $ROOTFS /bin/bash /guest-post-create
        chroot $ROOTFS /bin/rm /guest-post-create
    fi
}

create() {

    collect_information
    write_lxc_mounts
    write_lxc_configuration

    /usr/bin/lxc-create -n $NAME -f $CONFFILE
    RES=$?

    # remove the configuration files
    rm -f $CONFFILE
    rm -f $TMPMNTFILE

    if [ "$RES" != "0" ]; then
        echo "Failed to create '$NAME'"
        exit 1
    fi


    install_debian
    write_debian_inittab
    write_debian_hostname
    write_debian_fstab
    write_debian_network
    write_debian_sshd_config
    write_debian_selinux
    reconfigure_debian_packages
    disable_debian_services
    run_pre_create_hook
    run_post_create_hooks

    echo "Done."
    echo -e "\nYou can run your container with the 'lxc-start -n $NAME'\n"
}

destroy() {

    echo -n "This will PERMANENTLY DESTROY the container $NAME. Are you sure? [y/N] ? "
    read
    if [ "$REPLY" != "y" ]; then
        echo "Abort."
        exit
    fi

    halt=$(which lxc-halt)
    if lxc-info -n $NAME | grep RUNNING > /dev/null; then
        if [ -n "$halt" ]; then
            lxc-halt -n $NAME
        else
            lxc-stop -n $NAME
        fi
    fi
    sleep .5

    rm -rf $ROOTFS
    /usr/bin/lxc-destroy -n $NAME
    RETVAL=$?
    if [ ! $RETVAL -eq 0 ]; then
        echo "Failed to destroyed '$NAME'"
        return $RETVAL
    fi

    return 0
}

help() {
    cat <<EOF

This script is a helper to create debian system containers.

The script will create the container configuration file following
the informations submitted interactively with 'lxc-debian create'

Have fun :)

EOF
}

usage() {
    echo "Usage: $(readlink -f $0) {create|destroy} -n NAME"
    exit 0
}



# Main program

if [ $# = 0 ]; then
    usage
fi

case "$1" in
    -h|-help|--help) help;;
esac

if [ "$(id -u)" != "0" ]; then
    echo "This script should be run as 'root'"
    exit 1
fi

NAME=""
COMMAND=$1
shift
while getopts "n:" flag
do
    case $flag in
        n) NAME="$OPTARG" ;;
        *)
            echo "Unknown argument: $flag"
            exit 1
            ;;
    esac
done

if [ -z "$NAME" ]; then
    echo "lxc-debian: missing container name, use -n option"
    exit 1
fi

ROOTFS="/var/lib/lxc/$NAME/rootfs"

case "$COMMAND" in
    create)   create;;
    destroy)  destroy;;
    *)        usage;;
esac