[lxc-devel] [PATCH v2] Add Oracle Linux template
Serge Hallyn
serge.hallyn at canonical.com
Mon Oct 1 17:27:16 UTC 2012
Quoting Dwight Engen (dwight.engen at oracle.com):
>
> This is a new template to create containers based on an Oracle Linux
> rootfs image. The path to the rootfs must be given to the template,
> and if it resides on a btrfs will be snapshoted rather than copied.
>
> Signed-off-by: Dwight Engen <dwight.engen at oracle.com>
Hi,
maybe it's in here and I'm missing it, but where is the $template_rootfs
to come from? Is there a repository online where they can be fetched?
If so, can auto-wget'ing be added to the template?
-serge
> ---
> configure.ac | 1 +
> templates/Makefile.am | 1 +
> templates/lxc-oracle.in | 382 +++++++++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 384 insertions(+), 0 deletions(-)
> create mode 100644 templates/lxc-oracle.in
>
> diff --git a/configure.ac b/configure.ac
> index 4bbfd9b..d0535f7 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -197,6 +197,7 @@ AC_CONFIG_FILES([
> templates/lxc-opensuse
> templates/lxc-busybox
> templates/lxc-fedora
> + templates/lxc-oracle
> templates/lxc-altlinux
> templates/lxc-sshd
> templates/lxc-archlinux
> diff --git a/templates/Makefile.am b/templates/Makefile.am
> index d6b3892..523498d 100644
> --- a/templates/Makefile.am
> +++ b/templates/Makefile.am
> @@ -7,6 +7,7 @@ templates_SCRIPTS = \
> lxc-ubuntu-cloud \
> lxc-opensuse \
> lxc-fedora \
> + lxc-oracle \
> lxc-altlinux \
> lxc-busybox \
> lxc-sshd \
> diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
> new file mode 100644
> index 0000000..e8cfc6a
> --- /dev/null
> +++ b/templates/lxc-oracle.in
> @@ -0,0 +1,382 @@
> +#!/bin/bash
> +#
> +# Template script for generating Oracle Enterprise Linux container for LXC
> +# based on lxc-fedora, lxc-ubuntu
> +#
> +# Copyright © 2011 Wim Coekaerts <wim.coekaerts at oracle.com>
> +# Copyright © 2012 Dwight Engen <dwight.engen at oracle.com>
> +#
> +# Modified for Oracle Linux 5
> +# Wim Coekaerts <wim.coekaerts at oracle.com>
> +#
> +# Modified for Oracle Linux 6, combined OL5,6 into one template script
> +# Dwight Engen <dwight.engen at oracle.com>
> +#
> +# This library is free software; you can redistribute it and/or
> +# modify it under the terms of the GNU Lesser General Public
> +# License as published by the Free Software Foundation; either
> +# version 2.1 of the License, or (at your option) any later version.
> +#
> +# This library is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> +# Lesser General Public License for more details.
> +#
> +# You should have received a copy of the GNU Lesser General Public
> +# License along with this library; if not, write to the Free Software
> +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
> +#
> +
> +# use virbr0 that is setup by default by libvirtd
> +lxc_network_type=veth
> +lxc_network_link=virbr0
> +
> +die()
> +{
> + echo "failed: $1"
> + cleanup
> +}
> +
> +cleanup()
> +{
> + echo "Cleaning up"
> + lxc-destroy -n $name
> +
> + # normally lxc-destroy will delete the btrfs subvolume, but if we're
> + # interrupted before the config is setup it might not, so we will
> + # try to cleanup ourselves
> + container_rootfs_delete()
> +
> + # take care to not nuke / in case $cfg_dir isn't set
> + if [ $cfg_dir != "/" -a -d $cfg_dir ]; then
> + rm -rf $cfg_dir
> + fi
> + exit 1
> +}
> +
> +container_rootfs_create()
> +{
> + if [ -n $btrfs_subvolume ]; then
> + btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
> + else
> + cp -ax $template_rootfs $container_rootfs || die "copy template"
> + fi
> +}
> +
> +container_rootfs_delete()
> +{
> + if [ -n $btrfs_subvolume ]; then
> + btrfs subvolume delete $container_rootfs >/dev/null 2>&1
> + else
> + rm -rf $container_rootfs
> + fi
> +}
> +
> +# fix up the container_rootfs
> +container_rootfs_configure()
> +{
> + echo "Configuring container for OEL major version $container_release_major"
> +
> + # "disable" selinux. init in OEL 5 honors /etc/selinux/config. note that
> + # this doesnt actually disable it if it's enabled in the host, since
> + # libselinux::is_selinux_enabled() in the guest will check
> + # /proc/filesystems and see selinuxfs, thus reporting that it is on
> + # (ie. check the output of sestatus in the guest)
> + mkdir -p $container_rootfs/selinux
> + echo 0 > $container_rootfs/selinux/enforce
> + sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
> + if [ $container_release_major = "5" ]; then
> + sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
> + sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
> + fi
> +
> + # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
> + # will report its name and be resolv'able by the hosts dnsmasq
> + cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
> +DEVICE=eth0
> +BOOTPROTO=dhcp
> +ONBOOT=yes
> +HOSTNAME=$name
> +DHCP_HOSTNAME=$name
> +NM_CONTROLLED=no
> +TYPE=Ethernet
> +EOF
> +
> + # set the hostname
> + cat <<EOF > $container_rootfs/etc/sysconfig/network
> +NETWORKING=yes
> +NETWORKING_IPV6=no
> +HOSTNAME=$name
> +EOF
> +
> + # set minimal hosts
> + echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
> +
> + # disable ipv6
> + echo "blacklist ipv6" >>$container_rootfs/etc/modprobe.d/blacklist.conf
> + echo "blacklist net-pf-10" >>$container_rootfs/etc/modprobe.d/blacklist.conf
> + rm $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
> +
> + cat <<EOF > $container_rootfs/etc/fstab
> +proc /proc proc nodev,noexec,nosuid 0 0
> +devpts /dev/pts devpts defaults 0 0
> +sysfs /sys sysfs defaults 0 0
> +EOF
> +
> + # remove module stuff for iptables it just shows errors that are not
> + # relevant in a container
> + if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
> + sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
> + sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
> + fi
> +
> + # disable readahead in the container
> + if [ $container_release_major = "6" ]; then
> + rm -f $container_root/etc/init/readahead-collector.conf
> + rm -f $container_root/etc/init/readahead-disable-services.conf
> + sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
> + fi
> +
> + # disable udev in the container
> + sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
> + sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
> +
> + # disable nash raidautorun in the container since no /dev/md*
> + if [ $container_release_major = "5" ]; then
> + sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
> + sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
> + fi
> +
> + # prevent rc.sysinit from attempting to loadkeys
> + if [ $container_release_major = "5" ]; then
> + rm $container_rootfs/etc/sysconfig/keyboard
> + fi
> +
> + # dont start lvm
> + sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
> + sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
> +
> + # fix assumptions that plymouth is available
> + sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
> + sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
> + rm -f $container_root/etc/init/plymouth-shutdown.conf
> + rm -f $container_root/etc/init/quit-plymouth.conf
> + rm -f $container_root/etc/init/splash-manager.conf
> +
> + # setup console and tty[1-4] for login. note that /dev/console and
> + # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
> + # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
> + # lxc will maintain these links and bind mount ptys over /dev/lxc/*
> + # since lxc.devttydir is specified in the config.
> +
> + # allow root login on console and tty[1-4]
> + echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
> + echo "lxc/console" >>$container_rootfs/etc/securetty
> + echo "lxc/tty1" >>$container_rootfs/etc/securetty
> + echo "lxc/tty2" >>$container_rootfs/etc/securetty
> + echo "lxc/tty3" >>$container_rootfs/etc/securetty
> + echo "lxc/tty4" >>$container_rootfs/etc/securetty
> +
> + # dont try to unmount /dev/lxc devices
> + sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
> +
> + # start a getty on /dev/console, /dev/tty[1-4]
> + if [ $container_release_major = "5" ]; then
> + sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty console' $container_rootfs/etc/inittab
> + sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
> + sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
> + fi
> +
> + if [ $container_release_major = "6" ]; then
> + cat <<EOF > $container_rootfs/etc/init/console.conf
> +# console - getty
> +#
> +# This service maintains a getty on the console from the point the system is
> +# started until it is shut down again.
> +
> +start on stopped rc RUNLEVEL=[2345]
> +stop on runlevel [!2345]
> +
> +respawn
> +exec /sbin/mingetty /dev/console
> +EOF
> + fi
> +
> + # there might be other services that are useless but the below set is a good start
> + # some of these might not exist in the image, so we silence chkconfig complaining
> + # about the service file not being found
> + for service in \
> + acpid auditd autofs cpuspeed dund gpm haldaemon hidd \
> + ip6tables irqbalance iscsi iscsid isdn kdump kudzu \
> + lm_sensors lvm2-monitor mdmonitor microcode_ctl \
> + ntpd postfix sendmail udev-post ;
> + do
> + chroot $container_rootfs chkconfig 2>/dev/null $service off
> + done
> +
> + # create required devices
> + # take care to not nuke /dev in case $container_rootfs isn't set
> + dev_path="$container_rootfs/dev"
> + if [ $container_rootfs != "/" -a -d $dev_path ]; then
> + rm -rf $dev_path
> + mkdir -p $dev_path
> + fi
> + mknod -m 666 $dev_path/null c 1 3
> + mknod -m 666 $dev_path/zero c 1 5
> + mknod -m 666 $dev_path/random c 1 8
> + mknod -m 666 $dev_path/urandom c 1 9
> + mkdir -m 755 $dev_path/pts
> + mkdir -m 1777 $dev_path/shm
> + mknod -m 666 $dev_path/tty c 5 0
> + mknod -m 666 $dev_path/tty0 c 4 0
> + mknod -m 666 $dev_path/tty1 c 4 1
> + mknod -m 666 $dev_path/tty2 c 4 2
> + mknod -m 666 $dev_path/tty3 c 4 3
> + mknod -m 666 $dev_path/tty4 c 4 4
> + mknod -m 600 $dev_path/console c 5 1
> + mknod -m 666 $dev_path/full c 1 7
> + mknod -m 600 $dev_path/initctl p
> +
> + # ensure /dev/ptmx refers to the newinstance devpts of the container, or
> + # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
> + rm -f $container_rootfs/dev/ptmx
> + ln -s pts/ptmx $container_rootfs/dev/ptmx
> +
> + # start with a clean /var/log/messages
> + rm $container_rootfs/var/log/messages
> +
> + # add oracle user, set root password
> + chroot $container_rootfs useradd --create-home -s /bin/bash oracle
> + echo "oracle:oracle" | chroot $container_rootfs chpasswd
> + echo "root:toor" | chroot $container_rootfs chpasswd
> + echo -e "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m"
> + echo -e "Added container user:\033[1mroot\033[0m password:\033[1mtoor\033[0m"
> +}
> +
> +# create the container's lxc config file
> +container_config_create()
> +{
> + echo "Create configuration file $cfg_dir/config"
> + # generate a hwaddr for the container with a high mac address
> + # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
> + local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
> + head -1 |awk '{print $2}' | cut -c1-10 |\
> + sed 's/\(..\)/\1:/g; s/.$//'`"
> + mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
> + rm -f $cfg_dir/config
> + cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
> +# Container configuration for $container_release_full
> +lxc.utsname = $name
> +lxc.devttydir = lxc
> +lxc.tty = 4
> +lxc.pts = 1024
> +lxc.rootfs = $container_rootfs
> +lxc.mount = $cfg_dir/fstab
> +# Networking
> +lxc.network.type = $lxc_network_type
> +lxc.network.flags = up
> +lxc.network.link = $lxc_network_link
> +lxc.network.name = eth0
> +lxc.network.mtu = 1500
> +lxc.network.hwaddr = $hwaddr
> +# Control Group devices: all denied except those whitelisted
> +lxc.cgroup.devices.deny = a
> +lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
> +lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
> +lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
> +lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
> +lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
> +lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
> +lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
> +lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
> +lxc.cgroup.devices.allow = c 254:0 rwm # /dev/rtc0
> +EOF
> +
> + cat <<EOF > $cfg_dir/fstab || die "unable to create $cfg_dir/fstab"
> +proc $container_rootfs/proc proc nodev,noexec,nosuid 0 0
> +devpts $container_rootfs/dev/pts devpts defaults 0 0
> +sysfs $container_rootfs/sys sysfs defaults 0 0
> +EOF
> +}
> +
> +usage()
> +{
> + cat <<EOF
> + -t|--templatefs=<path> (mandatory: path to template rootfs)
> + -r|--rootfs=<path> (container rootfs path, defaults to templatefs dir)
> + -h|--help
> +EOF
> + return 0
> +}
> +
> +options=$(getopt -o hp:n:t:r: -l help,path:,name:,template:,rootfs: -- "$@")
> +if [ $? -ne 0 ]; then
> + usage $(basename $0)
> + exit 1
> +fi
> +
> +eval set -- "$options"
> +while true
> +do
> + case "$1" in
> + -p|--path) cfg_dir=$2; shift 2;;
> + -n|--name) name=$2; shift 2;;
> + -t|--templatefs) template_rootfs=$2; shift 2;;
> + -r|--rootfs) container_rootfs=$2; shift 2;;
> + -h|--help) usage $0 && exit 0;;
> + --) shift 1; break ;;
> + *) break ;;
> + esac
> +done
> +
> +# make sure mandatory args are given and valid
> +if [ "$(id -u)" != "0" ]; then
> + echo "This script should be run as 'root'"
> + exit 1
> +fi
> +
> +if [ -z $name ]; then
> + echo "Container name must be given"
> + usage
> + exit 1
> +fi
> +
> +if [ -z $cfg_dir ]; then
> + echo "Cofiguration directory must be given, check lxc-create"
> + usage
> + exit 1
> +fi
> +
> +if [ -z $template_rootfs ]; then
> + echo "Template filesystem rootfs must be specified"
> + usage
> + exit 1
> +fi
> +
> +if [ ! -d $template_rootfs ]; then
> + echo "Template filesystem $template_rootfs does not exist, set up a container template first."
> + exit 1
> +fi
> +
> +if which btrfs >/dev/null 2>&1 && btrfs subvolume list $template_rootfs >/dev/null 2>&1; then
> + btrfs_subvolume=1
> +fi
> +
> +trap cleanup SIGHUP SIGINT SIGTERM
> +
> +if [ -z $container_rootfs ]; then
> + container_rootfs=`dirname $template_rootfs`/$name
> +fi
> +container_release_full=`cat $template_rootfs/etc/oracle-release`
> +container_release_version=`cat $template_rootfs/etc/oracle-release |awk '/^Oracle/ {print $5}'`
> +container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
> +container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
> +
> +container_config_create
> +container_rootfs_create
> +container_rootfs_configure
> +
> +echo "Container : $container_rootfs"
> +echo "Template : $template_rootfs"
> +echo "Config : $cfg_dir/config"
> +echo "Network : eth0 ($lxc_network_type) on $lxc_network_link"
> --
> 1.7.1
>
>
>
>
> ------------------------------------------------------------------------------
> Got visibility?
> Most devs has no idea what their production app looks like.
> Find out how fast your code is with AppDynamics Lite.
> http://ad.doubleclick.net/clk;262219671;13503038;y?
> http://info.appdynamics.com/FreeJavaPerformanceDownload.html
> _______________________________________________
> Lxc-devel mailing list
> Lxc-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/lxc-devel
More information about the lxc-devel
mailing list