CentOS scripts
This commit is contained in:
parent
81bf2e6090
commit
a814d9424a
8 changed files with 167 additions and 10 deletions
17
Makefile
17
Makefile
|
@ -1,5 +1,6 @@
|
||||||
UBUNTU_BOXES= precise quantal raring saucy trusty
|
UBUNTU_BOXES= precise quantal raring saucy trusty
|
||||||
DEBIAN_BOXES= squeeze wheezy sid jessie
|
DEBIAN_BOXES= squeeze wheezy sid jessie
|
||||||
|
CENTOS_BOXES= 6
|
||||||
TODAY=$(shell date -u +"%Y-%m-%d")
|
TODAY=$(shell date -u +"%Y-%m-%d")
|
||||||
|
|
||||||
# Replace i686 with i386 and x86_64 with amd64
|
# Replace i686 with i386 and x86_64 with amd64
|
||||||
|
@ -11,6 +12,7 @@ all: ubuntu debian
|
||||||
|
|
||||||
ubuntu: $(UBUNTU_BOXES)
|
ubuntu: $(UBUNTU_BOXES)
|
||||||
debian: $(DEBIAN_BOXES)
|
debian: $(DEBIAN_BOXES)
|
||||||
|
centos: $(CENTOS_BOXES)
|
||||||
|
|
||||||
# REFACTOR: Figure out how can we reduce duplicated code
|
# REFACTOR: Figure out how can we reduce duplicated code
|
||||||
$(UBUNTU_BOXES): CONTAINER = "vagrant-base-${@}-$(ARCH)"
|
$(UBUNTU_BOXES): CONTAINER = "vagrant-base-${@}-$(ARCH)"
|
||||||
|
@ -27,6 +29,13 @@ $(DEBIAN_BOXES):
|
||||||
@sudo -E ./mk-debian.sh debian $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
|
@sudo -E ./mk-debian.sh debian $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
|
||||||
@sudo chmod +rw $(PACKAGE)
|
@sudo chmod +rw $(PACKAGE)
|
||||||
@sudo chown ${USER}: $(PACKAGE)
|
@sudo chown ${USER}: $(PACKAGE)
|
||||||
|
$(CENTOS_BOXES): CONTAINER = "vagrant-base-centos-${@}-$(ARCH)"
|
||||||
|
$(CENTOS_BOXES): PACKAGE = "output/${TODAY}/vagrant-lxc-centos-${@}-$(ARCH).box"
|
||||||
|
$(CENTOS_BOXES):
|
||||||
|
@mkdir -p $$(dirname $(PACKAGE))
|
||||||
|
@sudo -E ./mk-centos.sh $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
|
||||||
|
@sudo chmod +rw $(PACKAGE)
|
||||||
|
@sudo chown ${USER}: $(PACKAGE)
|
||||||
|
|
||||||
acceptance: CONTAINER = "vagrant-base-acceptance-$(ARCH)"
|
acceptance: CONTAINER = "vagrant-base-acceptance-$(ARCH)"
|
||||||
acceptance: PACKAGE = "output/${TODAY}/vagrant-lxc-acceptance-$(ARCH).box"
|
acceptance: PACKAGE = "output/${TODAY}/vagrant-lxc-acceptance-$(ARCH).box"
|
||||||
|
@ -36,7 +45,13 @@ acceptance:
|
||||||
@sudo chmod +rw $(PACKAGE)
|
@sudo chmod +rw $(PACKAGE)
|
||||||
@sudo chown ${USER}: $(PACKAGE)
|
@sudo chown ${USER}: $(PACKAGE)
|
||||||
|
|
||||||
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} acceptance
|
release:
|
||||||
|
@test -z '$(version)' && echo 'version parameter not provided to `make`!' && exit 1 || return 0
|
||||||
|
gh release create -d -a output/${TODAY} $(version)
|
||||||
|
git tag $(version)
|
||||||
|
git push && git push --tags
|
||||||
|
|
||||||
|
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} ${CENTOS_BOXES} acceptance
|
||||||
clean:
|
clean:
|
||||||
@for r in $(ALL_BOXES); do \
|
@for r in $(ALL_BOXES); do \
|
||||||
sudo -E ./clean.sh $${r}\
|
sudo -E ./clean.sh $${r}\
|
||||||
|
|
16
centos/clean.sh
Executable file
16
centos/clean.sh
Executable file
|
@ -0,0 +1,16 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
source common/ui.sh
|
||||||
|
source common/utils.sh
|
||||||
|
|
||||||
|
debug 'Bringing container up'
|
||||||
|
utils.lxc.start
|
||||||
|
|
||||||
|
info "Cleaning up '${CONTAINER}'..."
|
||||||
|
|
||||||
|
log 'Removing temporary files...'
|
||||||
|
rm -rf ${ROOTFS}/tmp/*
|
||||||
|
|
||||||
|
log 'cleaning up dhcp leases'
|
||||||
|
rm -f ${ROOTFS}/var/lib/dhcp/*
|
18
centos/install-extras.sh
Executable file
18
centos/install-extras.sh
Executable file
|
@ -0,0 +1,18 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
source common/ui.sh
|
||||||
|
source common/utils.sh
|
||||||
|
|
||||||
|
info 'Installing extra packages and upgrading'
|
||||||
|
|
||||||
|
debug 'Bringing container up'
|
||||||
|
utils.lxc.start
|
||||||
|
|
||||||
|
# Sleep for a bit so that the container can get an IP
|
||||||
|
log 'Sleeping for 10 seconds...'
|
||||||
|
sleep 10
|
||||||
|
|
||||||
|
# TODO: Support for appending to this list from outside
|
||||||
|
PACKAGES=(vim curl wget man-db bash-completion python-software-properties ca-certificates sudo nfs-common)
|
||||||
|
utils.lxc.attach yum install install ${PACKAGES[*]} -y
|
|
@ -17,6 +17,11 @@ elif $(grep -q 'ubuntu' ${ROOTFS}/etc/shadow); then
|
||||||
chroot ${ROOTFS} groupmod -n vagrant ubuntu &>> ${LOG}
|
chroot ${ROOTFS} groupmod -n vagrant ubuntu &>> ${LOG}
|
||||||
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
|
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
|
||||||
log 'Renamed ubuntu user to vagrant and changed password.'
|
log 'Renamed ubuntu user to vagrant and changed password.'
|
||||||
|
elif [ ${DISTRIBUTION} = 'centos' ]; then
|
||||||
|
debug 'Creating vagrant user...'
|
||||||
|
chroot ${ROOTFS} useradd --create-home -s /bin/bash -u 1000 vagrant &>> ${LOG}
|
||||||
|
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
|
||||||
|
sed -i 's/^Defaults\s\+requiretty/# Defaults requiretty/' $ROOTFS/etc/sudoers
|
||||||
else
|
else
|
||||||
debug 'Creating vagrant user...'
|
debug 'Creating vagrant user...'
|
||||||
chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant &>> ${LOG}
|
chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant &>> ${LOG}
|
||||||
|
|
21
common/ui.sh
21
common/ui.sh
|
@ -6,21 +6,25 @@ export ERROR_COLOR='\033[31;01m'
|
||||||
export WARN_COLOR='\033[33;01m'
|
export WARN_COLOR='\033[33;01m'
|
||||||
|
|
||||||
log() {
|
log() {
|
||||||
echo " [${RELEASE}] ${1}" >>${LOG}
|
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
|
||||||
echo " [${RELEASE}] ${1}" >&2
|
echo " [${LOG_PREFIX}] ${1}" >>${LOG}
|
||||||
|
echo " [${LOG_PREFIX}] ${1}" >&2
|
||||||
}
|
}
|
||||||
|
|
||||||
warn() {
|
warn() {
|
||||||
echo "==> [${RELEASE}] [WARN] ${1}" >>${LOG}
|
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
|
||||||
echo -e "${WARN_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}"
|
echo "==> [${LOG_PREFIX}] [WARN] ${1}" >>${LOG}
|
||||||
|
echo -e "${WARN_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
|
||||||
}
|
}
|
||||||
|
|
||||||
info() {
|
info() {
|
||||||
echo "==> [${RELEASE}] [INFO] ${1}" >>${LOG}
|
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
|
||||||
echo -e "${OK_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}"
|
echo "==> [${LOG_PREFIX}] [INFO] ${1}" >>${LOG}
|
||||||
|
echo -e "${OK_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
|
||||||
}
|
}
|
||||||
|
|
||||||
confirm() {
|
confirm() {
|
||||||
|
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
|
||||||
question=${1}
|
question=${1}
|
||||||
default=${2}
|
default=${2}
|
||||||
default_prompt=
|
default_prompt=
|
||||||
|
@ -33,7 +37,7 @@ confirm() {
|
||||||
default='Yes'
|
default='Yes'
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo -e -n "${WARN_COLOR}==> [${RELEASE}] ${question} [${default_prompt}] ${NO_COLOR}" >&2
|
echo -e -n "${WARN_COLOR}==> [${LOG_PREFIX}] ${question} [${default_prompt}] ${NO_COLOR}" >&2
|
||||||
read answer
|
read answer
|
||||||
|
|
||||||
if [ -z $answer ]; then
|
if [ -z $answer ]; then
|
||||||
|
@ -49,5 +53,6 @@ confirm() {
|
||||||
}
|
}
|
||||||
|
|
||||||
debug() {
|
debug() {
|
||||||
[ ! $DEBUG ] || echo " [${RELEASE}] [DEBUG] ${1}" >&2
|
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
|
||||||
|
[ ! $DEBUG ] || echo " [${LOG_PREFIX}] [DEBUG] ${1}" >&2
|
||||||
}
|
}
|
||||||
|
|
51
conf/centos
Normal file
51
conf/centos
Normal file
|
@ -0,0 +1,51 @@
|
||||||
|
# Taken from the oracle.common.conf.in
|
||||||
|
# Console settings
|
||||||
|
|
||||||
|
lxc.devttydir = lxc
|
||||||
|
lxc.tty = 4
|
||||||
|
lxc.pts = 1024
|
||||||
|
|
||||||
|
# Mount entries
|
||||||
|
lxc.mount.auto = proc:mixed sys:ro
|
||||||
|
|
||||||
|
# Ensure hostname is changed on clone
|
||||||
|
lxc.hook.clone = /usr/share/lxc/hooks/clonehostname
|
||||||
|
|
||||||
|
# Capabilities
|
||||||
|
# Uncomment these if you don't run anything that needs the capability, and
|
||||||
|
# would like the container to run with less privilege.
|
||||||
|
#
|
||||||
|
# Dropping sys_admin disables container root from doing a lot of things
|
||||||
|
# that could be bad like re-mounting lxc fstab entries rw for example,
|
||||||
|
# but also disables some useful things like being able to nfs mount, and
|
||||||
|
# things that are already namespaced with ns_capable() kernel checks, like
|
||||||
|
# hostname(1).
|
||||||
|
# lxc.cap.drop = sys_admin
|
||||||
|
# lxc.cap.drop = net_raw # breaks dhcp/ping
|
||||||
|
# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
|
||||||
|
# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
|
||||||
|
# lxc.cap.drop = setuid # breaks sshd,nfs statd
|
||||||
|
# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
|
||||||
|
# lxc.cap.drop = audit_write
|
||||||
|
#
|
||||||
|
lxc.cap.drop = mac_admin mac_override setfcap setpcap
|
||||||
|
lxc.cap.drop = sys_module sys_nice sys_pacct
|
||||||
|
lxc.cap.drop = sys_rawio sys_time
|
||||||
|
|
||||||
|
# Control Group devices: all denied except those whitelisted
|
||||||
|
lxc.cgroup.devices.deny = a
|
||||||
|
# Allow any mknod (but not reading/writing the node)
|
||||||
|
lxc.cgroup.devices.allow = c *:* m
|
||||||
|
lxc.cgroup.devices.allow = b *:* m
|
||||||
|
lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
|
||||||
|
lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
|
||||||
|
lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
|
||||||
|
lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
|
||||||
|
lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
|
||||||
|
lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
|
||||||
|
lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
|
||||||
|
lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
|
||||||
|
|
||||||
|
# Blacklist some syscalls which are not safe in privileged
|
||||||
|
# containers
|
||||||
|
lxc.seccomp = /usr/share/lxc/config/common.seccomp
|
47
mk-centos.sh
Executable file
47
mk-centos.sh
Executable file
|
@ -0,0 +1,47 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
source common/ui.sh
|
||||||
|
|
||||||
|
if [ "$(id -u)" != "0" ]; then
|
||||||
|
echo "You should run this script as root (sudo)."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
export DISTRIBUTION='centos'
|
||||||
|
export RELEASE=$1
|
||||||
|
export ARCH=$2
|
||||||
|
export CONTAINER=$3
|
||||||
|
export PACKAGE=$4
|
||||||
|
export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
|
||||||
|
export WORKING_DIR="/tmp/${CONTAINER}"
|
||||||
|
export NOW=$(date -u)
|
||||||
|
export LOG=$(readlink -f .)/log/${CONTAINER}.log
|
||||||
|
|
||||||
|
mkdir -p $(dirname $LOG)
|
||||||
|
echo '############################################' > ${LOG}
|
||||||
|
echo "# Beginning build at $(date)" >> ${LOG}
|
||||||
|
touch ${LOG}
|
||||||
|
chmod +rw ${LOG}
|
||||||
|
|
||||||
|
if [ -f ${PACKAGE} ]; then
|
||||||
|
warn "The box '${PACKAGE}' already exists, skipping..."
|
||||||
|
echo
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
debug "Creating ${WORKING_DIR}"
|
||||||
|
mkdir -p ${WORKING_DIR}
|
||||||
|
|
||||||
|
info "Building box to '${PACKAGE}'..."
|
||||||
|
|
||||||
|
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||||
|
# ./centos/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||||
|
./centos/install-extras.sh ${CONTAINER}
|
||||||
|
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
|
||||||
|
./centos/clean.sh ${CONTAINER}
|
||||||
|
./common/package.sh ${CONTAINER} ${PACKAGE}
|
||||||
|
|
||||||
|
info "Finished building '${PACKAGE}'!"
|
||||||
|
log "Run \`sudo lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way"
|
||||||
|
echo
|
|
@ -38,7 +38,7 @@ info "Building box to '${PACKAGE}'..."
|
||||||
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||||
./debian/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
./debian/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||||
./debian/install-extras.sh ${CONTAINER}
|
./debian/install-extras.sh ${CONTAINER}
|
||||||
./common/prepare-vagrant-user.sh ${CONTAINER}
|
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
|
||||||
./debian/clean.sh ${CONTAINER}
|
./debian/clean.sh ${CONTAINER}
|
||||||
./common/package.sh ${CONTAINER} ${PACKAGE}
|
./common/package.sh ${CONTAINER} ${PACKAGE}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue