Merge remote-tracking branch 'origin/master'

doc/source/best-practices.rst

@@ -65,10 +65,3 @@ This section provides some generic guidelines and tips for working with
 
   Remove unnecessary snapshots, especially from jails where data is
   constantly changing!
-
-**Use** :command:`iocage chroot`
-
-  When accessing or modifying files in a template or stopped jail, use
-  :command:`iocage chroot [UUID | NAME] [Command ...]`. This
-  way you don't need to spin up the jail or convert the template.
-

doc/source/templates.rst

@@ -42,12 +42,50 @@ Done!
 
 **Customizing a template:**
 
-To make further customizations or just patch the template, there are two
-options:
-
-* Convert the template back to a jail with
-  :command:`iocage set template=no [UUID | NAME]`, then start the jail
-  with :command:`iocage start [UUID | NAME]`.
-* If network access is unnecessary to make the changes, use
-  :command:`iocage chroot [UUID | NAME] [Command ...]` to run the
-  needed commands inside the template.
+To make changes to the template, you will need to know whether any existing
+jails are based on the template. Since modifying the template will require
+converting it back into a jail, it cannot be the base for any jails.
+
+*** No jails based on the template ***
+
+1. Convert the template back into a jail:
+
+   :command:`iocage set template=no [UUID | NAME]`.
+
+2. Start the jail:
+
+   :command:`iocage start [UUID | NAME]`.
+
+3. Use any method you wish to connect to the jail and modify its contents.
+
+4. Stop the jail:
+
+   :command:`iocage stop [UUID | NAME]`.
+
+5. Convert the jail back into a template:
+
+   :command:`iocage set template=yes [UUID | NAME]`.
+
+*** Jails based on the template ***
+
+This process will create a new template, leaving the existing template
+and jails unaffected.
+
+1. Create a 'thick' jail from the template, so that it will be independent
+   from the template:
+
+   :command:`iocage create -T -t [UUID | NAME] -n newtemplate`.
+
+2. Start the jail:
+
+   :command:`iocage start newtemplate`.
+
+3. Use any method you wish to connect to the jail and modify its contents.
+
+4. Stop the jail:
+
+   :command:`iocage stop newtemplate`.
+
+5. Convert the jail into a template:
+
+   :command:`iocage set template=yes newtemplate`.

iocage_lib/ioc_json.py

@@ -673,7 +673,7 @@ def __init__(self, location, checking_datasets, silent, callback):
     @staticmethod
     def get_version():
         """Sets the iocage configuration version."""
-        version = '19'
+        version = '20'
 
         return version
 
@@ -1014,6 +1014,10 @@ def check_config(self, conf, default=False):
             {k: 'off' for k in IOCRCTL.types if not conf.get(k)}
         )
 
+        # Version 20 keys
+        if not conf.get('exec_created'):
+            conf['exec_created'] = '/usr/bin/true'
+
         if not default:
             conf.update(jail_conf)
 
@@ -1238,6 +1242,7 @@ def check_default_config(self):
             'exec_poststart': '/usr/bin/true',
             'exec_prestop': '/usr/bin/true',
             'exec_poststop': '/usr/bin/true',
+            'exec_created': '/usr/bin/true',
             'exec_clean': 1,
             'exec_timeout': '60',
             'stop_timeout': '30',
@@ -2157,6 +2162,7 @@ def json_check_prop(self, key, value, conf):
             "exec_prestop": ("string", ),
             "exec_poststop": ("string", ),
             "exec_clean": truth_variations,
+            "exec_created": ("string", ),
             "exec_timeout": ("string", ),
             "stop_timeout": ("string", ),
             "exec_jail_user": ("string", ),

iocage_lib/ioc_start.py

@@ -138,6 +138,7 @@ def __start_jail__(self):
         exec_prestart = self.conf["exec_prestart"]
         exec_poststart = self.conf["exec_poststart"]
         exec_clean = self.conf["exec_clean"]
+        exec_created = self.conf["exec_created"]
         exec_timeout = self.conf["exec_timeout"]
         stop_timeout = self.conf["stop_timeout"]
         mount_devfs = self.conf["mount_devfs"]
@@ -269,13 +270,15 @@ def __start_jail__(self):
         # FreeBSD before 12.0 does not support this.
 
         if userland_version < 12.0:
-            _allow_mlock = ""
-            _allow_mount_fusefs = ""
-            _allow_vmm = ""
+            _allow_mlock = ''
+            _allow_mount_fusefs = ''
+            _allow_vmm = ''
+            _exec_created = ''
         else:
             _allow_mlock = f"allow.mlock={allow_mlock}"
             _allow_mount_fusefs = f"allow.mount.fusefs={allow_mount_fusefs}"
             _allow_vmm = f"allow.vmm={allow_vmm}"
+            _exec_created = f'exec.created={exec_created}'
 
         if not self.conf['vnet']:
             ip4_addr = self.conf['ip4_addr']
@@ -379,6 +382,7 @@ def __start_jail__(self):
                 _sysvmsg,
                 _sysvsem,
                 _sysvshm,
+                _exec_created,
                 f'host.domainname={host_domainname}',
                 f'host.hostname={host_hostname}',
                 f'path={self.path}/root',