lxct-create

#!/bin/bash
# ================================================================================
# LXC-tools: Appliance and LXC container builder for Debian GNU/Linux (and derivatives)
#
# Copyright © 2010 Jesús Lara Giménez (phenobarbital) <jesuslarag@gmail.com>
# Version: 0.5  
#
#    Developed by Jesus Lara (phenobarbital) <jesuslara@phenobarbital.info>
#    https://github.com/phenobarbital/lxc-tools
#    
#    This script is based on the lxc-debian example script that ships with lxc.
#    Copyright (C) 2010 Nigel McNie
#
#    License: GNU GPL version 3  <http://gnu.org/licenses/gpl.html>.
#    This is free software: you are free to change and redistribute it.
#    There is NO WARRANTY, to the extent permitted by law.
# ================================================================================

###
# lxct_create
# create a lxc container
##

# get configuration
if [ -e /etc/lxc-tools/lxc-tools.conf ]; then
    . /etc/lxc-tools/lxc-tools.conf
else
    . ./etc/lxc-tools.conf
fi

#
#  all common functions (for all templates)
#
if [ -e /usr/lib/lxc-tools/lxct_common.sh ]; then
    . /usr/lib/lxc-tools/lxct_common.sh
else
    . ./lib/lxct_common.sh
fi

### functions

# get template
get_template() 
{
	templatedir
	if [ -z "$TEMPLATE" ]; then
		# creating a container from host-based
		DIST=`get_distribution`
		case "$DIST" in
			"debian"|"Debian"|"DEBIAN")
				debug "- using lxc-debian as template"
				TEMPLATE="$TEMPLATEDIR/lxc-debian"
				;;
			"ubuntu"|"Ubuntu"|"UBUNTU")
				debug "- using lxc-ubuntu as template"
				TEMPLATE="$TEMPLATEDIR/lxc-ubuntu"
				;;				
			"centos"|"Centos"|"CENTOS"|"CentOS")
				debug "- using lxc-centos as template"
				TEMPLATE="$TEMPLATEDIR/lxc-centos"
				;;			
			*)
				error "Unknown distribution: $DIST"
				exit 1
				;;
		esac
	elif [ -f "$TEMPLATEDIR/lxc-$TEMPLATE" ]; then
		debug "- using lxc-$TEMPLATE as template"
		TEMPLATE="$TEMPLATEDIR/lxc-$TEMPLATE"
	else
		error "$(basename $0) template $TEMPLATE not exists, aborted"
		exit 1
	fi
}

# run all roles defined in --role option
execute_roles()
{
	roledir
	if [ ! -z "$ROLENAME" ]; then
	IFS=',' read -a roles <<< "$ROLENAME"
	for role in "${roles[@]}"
	do
		role_file="$ROLEDIR/$role"
		# existe este rol?
		if [ -f "$role_file" ]; then
			#verifico esta permisologia
			if [ ! -x "$role_file" ]; then
				error "error: role '$role' is not executable, try chmod o+x $role_file"
				return 1
			else
				info " = Executing role $role = "
				. $role_file "$ROOTFS"	
			fi
		else
			error "error: role '$role' not exists in $ROLEDIR"
			return 1
		fi
	done
	else
		return 0
	fi
}

function create_lxc_config() {
	if [ -z "$SECURE" ]; then
		CAPABILITIES='sys_admin sys_module sys_time sys_nice mac_admin mac_override'
	else
		CAPABILITIES='sys_admin audit_control audit_write fsetid ipc_lock ipc_owner lease linux_immutable mac_admin mac_override mknod setfcap setpcap sys_module sys_nice sys_pacct sys_ptrace sys_rawio sys_tty_config sys_time'
	fi
cat <<EOF > $CONFIGFILE
# $CONFIGFILE

## Container
lxc.utsname                             = $NAME
lxc.arch                                = $ARCH
# lxc.console                             = /var/log/lxc/$NAME.console
lxc.tty                                 = 2
lxc.pts                                 = 1024

## network
lxc.network.type                        = $NET_TYPE
$NET_OPTIONS

## Capabilities
lxc.cap.drop                            = $CAPABILITIES

## Devices
# Allow all devices
#lxc.cgroup.devices.allow               = a
# Deny all devices
lxc.cgroup.devices.deny                 = a
# Allow to mknod all devices (but not using them)
lxc.cgroup.devices.allow                = c *:* m
lxc.cgroup.devices.allow                = b *:* m
# /dev/console
lxc.cgroup.devices.allow                = c 5:1 rwm
# /dev/fuse
lxc.cgroup.devices.allow                = c 10:229 rwm
# /dev/null
lxc.cgroup.devices.allow                = c 1:3 rwm
# /dev/ptmx
lxc.cgroup.devices.allow                = c 5:2 rwm
# /dev/pts/*
lxc.cgroup.devices.allow                = c 136:* rwm
# /dev/random
lxc.cgroup.devices.allow                = c 1:8 rwm
# /dev/rtc
lxc.cgroup.devices.allow                = c 254:0 rwm
# /dev/tty
lxc.cgroup.devices.allow                = c 5:0 rwm
# /dev/urandom
lxc.cgroup.devices.allow                = c 1:9 rwm
# /dev/zero
lxc.cgroup.devices.allow                = c 1:5 rwm

## Limits
lxc.cgroup.cpu.shares                  = 1024
lxc.cgroup.cpuset.cpus                 = 1
lxc.cgroup.memory.limit_in_bytes       = $MEMORY

## Filesystem
EOF
if [ "$BACKEND_METHOD" == 'lvm' ]; then
cat <<EOF >> $CONFIGFILE
lxc.rootfs                             = $LVROOTFS
EOF
else
cat <<EOF >> $CONFIGFILE
lxc.rootfs                             = $ROOTFS
lxc.mount.entry                        = proc $ROOTFS/proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry                        = sysfs $ROOTFS/sys sysfs defaults,ro 0 0
lxc.mount.entry                        = devpts $ROOTFS/dev/pts devpts gid=5,mode=620,newinstance,ptmxmode=0666 0 0
EOF
fi

if [ "$DIST" == 'gentoo' ]; then
cat <<EOF >> $CONFIGFILE
lxc.mount.entry                        = portagetmp $ROOTFS/var/portage/tmp tmpfs rw,nosuid,nodev 0 0
lxc.mount.entry                        = run $ROOTFS/run tmpfs rw,nosuid,nodev,relatime,mode=755 0 0
EOF
fi
if [ "$DIST" == 'fedora' ]; then
cat <<EOF >> $CONFIGFILE
lxc.mount.entry                        = devtmpfs $ROOTFS/dev devtmpfs defaults 0 0
EOF
fi
    if [ $? -ne 0 ]; then
        error "Failed to add configuration"
        return 1
    fi
    return 0
}

# get volume and create lvm volume
function create_lvm_volume() {
	if [ "$BACKEND_METHOD" = 'lvm' ]; then
cat <<EOF
  Volume Group: $LVM
  LVM Name : $NAME
  Size : $SIZE
EOF
		LVCREATE=`which lvcreate`
		if [ ! -f "$LVCREATE" ]; then
			error "'lvcreate' command is missing, run 'apt-get install lvm2'"
			exit 1
		fi
		LVROOTFS="/dev/$LVM/$NAME"
		lvdisplay $LVROOTFS > /dev/null 2>&1
		if [ $? -eq 0 ]; then
			error "error: $LVROOTFS already exists in vggroup $LVM" >&2
			exit 1
		fi
		$LVCREATE -n $NAME --size $SIZE $LVM 2>&1
		if [ $? -ne 0 ]; then
			error "error creating $LVROOTFS in vggroup $LVM, aborted" >&2
			exit 1
		fi
		# volume format
		/sbin/mkfs.$FS -L $NAME $LVROOTFS
		if [ $? -ne 0 ]; then
				error "error formatting $LVROOTFS with $FS filesystem, aborted" >&2
				exit 1
		fi
		debug " - mounting $LVROOTFS in $ROOTFS"
		mount $LVROOTFS $ROOTFS
  fi
  return 0
}

umount_lvm()
{
	if [ "$BACKEND_METHOD" = 'lvm' ]; then
		#umount 
		debug " - unmounting $LVROOTFS"
		umount -f $LVROOTFS
	fi
}

create_btrfs_volume() {
	#TODO
	if [ "$BACKEND_METHOD" = 'btrfs' ]; then
		# btrfs is installed?
		if [ ! -f `which btrfs` ]; then
			error "'btrfs' command is missing, run 'apt-get install btrfs-tools'"
			exit 1
		fi
		# is directory a BTRFS volume?
		result=`btrfs filesystem df $DIR`
		if [ $? -ne 0 ]; then
			error "$DIR is not a BTRFS volume, use DIR to define a BTRFS mount point"
			exit 1
		fi
		# test if sub-volume not exists
		id=`btrfs subvolume list $DIR | grep $NAME | grep ID | awk '{print $2}'`
		if [ ! -z "$id" ]; then
			error "error: sub-volume $NAME already exists in $DIR with ID $id, aborted" >&2
			exit 1
		fi
		debug " - creating BTRFS sub-volume $NAME in $DIR"
		# crear un sub-volumen
		btrfs subvolume create $DIR/$NAME > /dev/null 2>&1
		if [ $? -ne 0 ]; then
			error "error creating btrfs sub-volume in volume $DIR, aborted" >&2
			exit 1
		fi
	fi
}

# crear la carpeta para el rootfs
make_rootfs() {
	# create directory
    if [ ! -f "$ROOTFS" ]; then
		mkdir -p $ROOTFS
		if [ $? -ne 0 ]; then
			error "error creating $ROOTFS folder" >&2
			exit 1
		fi		
		debug "- created rootfs folder $ROOTFS -"
    fi
}

touch_config() {
	if [ -d "$CONFIG" ]; then
		debug "- created config file in $CONFIG -"
		touch $CONFIGFILE
	fi
}

####================= Main execution ==========================####

# variables
NAME=''
SIZE=''
IP=''
IFACE=''
NET_OPTIONS=''
VLAN_ID=''
DIST=''
TEMPLATE=''
ROLE=''
HOSTNAME=''
LAN_INTERFACE='eth0'
CLEAN_CACHE=0
FORCE=0

usage() {
	echo "Usage: $(basename $0) [-n|--name=<container_name>] [-t|--template=<template-name>]
        [-r|--role=<role-name>] [-A|--arch=<arch of the container>][--packages=<comma-separated package list>]
        [-B|--backend=<dir|lvm|btrfs>] [--dhcp|--ip=<ip>] [-D|--domain=DOMAIN] [--clean] [--debug] [-h|--help]"  
    return 1
}

help() {
	usage
cat <<EOF

This script is a helper to create lxc system containers

The script will create the container configuration file following
the informations submitted interactively with 'lxct-create'

Options:
  -n, --name                 specify the name of the lxc container
  -t, --template             create container from a template script (debian, ubuntu, canaima, etc)
  -r, --role                 role-based script for running in container after creation
  -c, --clean                create a clean version of cache container
  -B, --backend              define backend for container storage (default: dir, LVM or btrfs) 
  -s, --size                 if LVM or btrfs, volume size
  -f, --fs                   if LVM, set filesystem format (ext4, xfs, btrfs)
  -l, --lvm                  set the LVM volume group name for container creation
  -D, --domain               define Domain Name
  --net                      specify network option (veth, macvlan, vlan, empty)
  -i, --iface                if macvlan or vlan option, define interface name (ex: eth0)
  -v, --vlan                 if vlan is enabled, define vlan-id
  -A, --arch                 Hardware Architecture of Container (i386, i686, x86_64)
  --packages                 Extra comma-separated list of packages
  --debug                    Enable debugging information
  --dhcp                     Container interface is in dhcp mode
  --ip                       IP Address of container
  --force                    Destroy LXC before creation
  Help options:
      --help     give this help list
      --usage	 Display brief usage message
      --version  print program version
EOF
	get_version
	exit 1
}

### main execution program ###

if [ "$(id -u)" != "0" ]; then
   error "$(basename $0): must be run as root" >&2
   exit 1
fi

# basic checkin

check_backend()
{
	if [[ "$1" = "lvm" || "$1" = "dir" || "$1" = "btrfs" ]]; then
		return 0
	else
		usage_err "option '$1' invalid backend"
	fi
}

check_net()
{
	if [[ "$1" = "veth" ]] || [[ "$1" = "empty" ]] || [[ "$1" = "macvlan" ]] || [[ "$1" = "vlan" ]] || [[ "$1" = "phys" ]]; then
		# TODO: check network options
		return 0
	else
		usage_err "option '$1' invalid network option"
	fi
}

check_name()
{
	if [[ "${#1}" -gt 20 ]] || [[ "${#1}" -lt 2 ]]; then
		usage_err "container name '$1' is an invalid name"
	fi
}

check_directory()
{
	if [ ! -d "$1" ]; then
		usage_err "Directory '$1' doesn't exist."
	fi
}

check_template()
{
	case "$1" in
	"debian")
		DIST='Debian'
		TEMPLATE='debian'
		SUITE=`get_suite`
		;;
	"ubuntu")
		DIST='Ubuntu'
		TEMPLATE='ubuntu'
		SUITE='precise'
		MIRROR='http://archive.ubuntu.com/ubuntu'
		;;	
	"canaima")
		DIST='Canaima'
		TEMPLATE='canaima'
		SUITE='kerepakupai'
		;;
	"gentoo")
		DIST='Gentoo'
		TEMPLATE='gentoo'
		;;
	"archlinux")
		DIST='Archlinux'
		TEMPLATE='archlinux'
		;;
	"centos")
		DIST='CentOS'
		TEMPLATE='centos'
		SUITE='6'
		;;
	"fedora")
		DIST='Fedora'
		TEMPLATE='fedora'
		SUITE='18'
		;;							
	*)
		usage_err "option '$1' invalid template option"
		exit 1
	esac
}

# processing arguments
ARGS=`getopt -n$0 -u -a -o r:n:t:A:B:d:D:l:i:vf:s:h --longoptions packages:,net::,dhcp,ip::,dist::,suite::,debug,verbose,clean,version,help,size::,fs::,vlan::,iface::,lvm::,domain::,dir::,directory::,backend::,arch::,template::,role::,name:: -- "$@"`
eval set -- "$ARGS"

while [ $# -gt 0 ]; do
	case "$1" in
        -n|--name)
            check_name "$2"
            NAME=$2
            shift
            ;;
        -d|--dir|--directory)
            optarg_check $1 $2
            check_directory $2
            DIR=$2
            shift
            ;;
        -t|--template)
            check_template "$2"
            shift
            ;;
        -r|--role)
            optarg_check $1 "$2"
            ROLENAME=$2
            shift
            ;;
        -D|--domain)
            optarg_check $1 $2
            DOMAIN=$2
            shift
            ;;
        -A|--arch)
            optarg_check $1 "$2"
            ARCH=$2
            shift
            ;;         
        -B|--backend)
            check_backend "$2"
            BACKEND_METHOD=$2
            shift
            ;;
        -l|--lvm)
            optarg_check $1 "$2"
            LVM=$2
            shift
            ;;
        -i|--iface)
            optarg_check $1 "$2"
            IFACE=$2
            shift
            ;;            
        -v|--vlan)
            optarg_check $1 "$2"
            VLAN_ID=$2
            shift
            ;;
        -f|--fs)
            optarg_check $1 "$2"
            FS=$2
            shift
            ;;
        -s|--size)
            optarg_check $1 "$2"
            SIZE=$2
            shift
            ;;
        --packages)
			PACKAGES="$2"
			shift
			;;
        --net)
			check_net "$2"
			NET_TYPE=$2
			shift
			;;
        --dhcp)
            DHCP='y'
            IP=''
            ;;
        --ip)
			optarg_check $1 "$2"
			DHCP='n'
			IP=$2
			shift
			;;
        --dist)
			optarg_check $1 "$2"
            DIST=$2
            shift
            ;;
        --suite)
			optarg_check $1 "$2"
            SUITE=$2
            shift
            ;;
        --secure)
			# creating a more secure container
            SECURE='true'
            ;;            
        --debug)
            VERBOSE='true'
            ;;
        --verbose)
            VERBOSE='true'
            ;;            
        --clean)
            CLEAN_CACHE=1
            ;;
        --force)
            FORCE=1
            ;;      
        --version)
			get_version
			exit 0;;
        -h|--help)
            help
            exit 1
            ;;
        --)
            break;;
        -?)
            usage_err "unknown option '$1'"
            exit 1
            ;;
        *)
			info "$1"
            usage
            exit 1
            ;;
	esac
    shift
done

#
#  fill all "auto" variables and check configuration
#
if [ -e /usr/lib/lxc-tools/lxct_config.sh ]; then
    . /usr/lib/lxc-tools/lxct_config.sh
else
    . ./lib/lxct_config.sh
fi

### main execution program ###

main()
{
	# si no pasamos ningun parametro
	if [ $# = 0 ]; then
		# descubrir el dominio
		get_domain
		# descubrir el nombre del equipo
		get_hostname
	fi
	# define logging facility
	logging_file $NAME
	
	CONFIG="$DIR/$NAME"
    ROOTFS="$CONFIG/rootfs"
    CONFIGFILE="$CONFIG/config"
    
	# network configuration
	get_network_info
	
	# summary of changes
	show_summary

	# TODO, ¿pedir confirmación para proceder luego del sumario?
	if [ "$VERBOSE" == 'true' ]; then
		read -p "Continue (y/n)?" WORK
		if [ "$WORK" != "y" ]; then
			exit 0
		fi
	fi
	
	case "$BACKEND_METHOD" in
	"btrfs")
		#TODO: no options yet
		create_btrfs_volume
		make_rootfs
		touch_config
		;;
	"dir")
		make_rootfs
		# create config-file
		touch_config
		;;
	"lvm")
		# mount LVM volume
		make_rootfs
		create_lvm_volume
		touch_config
		;;
	"*")
		# invalid option
		error "invalid method $BACKEND_METHOD" >&2
		exit 1;;
	esac

	# create config file
    create_lxc_config
    #
    ## creating vm from template
    get_template
    set_suite_repository
    
    debug "creating container from template $TEMPLATE"
    . $TEMPLATE
    create_container
    if [ "$?" -ne "0" ]; then
    	error "failed to create Container, aborted"
    	exit 1
    fi
    # running any role defined into chroot
	execute_roles
	# cleanup container
	cleanup_container
	message "Creation of Container finished."
	umount_lvm
	# create container
	lxc-create -n $NAME -f $CONFIGFILE
    install_summary
    info "You can run your container with the 'lxc-start -n $NAME -d'"    
}

# = end = #
main

exit 0