glenux-archive/vagrant-lxc-base-boxes
glenux-archive/vagrant-lxc-base-boxes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

CentOS scripts

Browse source
This commit is contained in:
Fabio Rehm 2014-09-24 12:16:20 -03:00
parent 81bf2e6090
commit a814d9424a
8 changed files with 167 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
Makefile
View file

@ -1,5 +1,6 @@
UBUNTU_BOXES= precise quantal raring saucy trusty
DEBIAN_BOXES= squeeze wheezy sid jessie
CENTOS_BOXES= 6
TODAY=$(shell date -u +"%Y-%m-%d")
# Replace i686 with i386 and x86_64 with amd64
@ -11,6 +12,7 @@ all: ubuntu debian
ubuntu: $(UBUNTU_BOXES)
debian: $(DEBIAN_BOXES)
centos: $(CENTOS_BOXES)
# REFACTOR: Figure out how can we reduce duplicated code
$(UBUNTU_BOXES): CONTAINER = "vagrant-base-${@}-$(ARCH)"
@ -27,6 +29,13 @@ $(DEBIAN_BOXES):
@sudo -E ./mk-debian.sh debian $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
$(CENTOS_BOXES): CONTAINER = "vagrant-base-centos-${@}-$(ARCH)"
$(CENTOS_BOXES): PACKAGE = "output/${TODAY}/vagrant-lxc-centos-${@}-$(ARCH).box"
$(CENTOS_BOXES):
@mkdir -p $$(dirname $(PACKAGE))
@sudo -E ./mk-centos.sh $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
acceptance: CONTAINER = "vagrant-base-acceptance-$(ARCH)"
acceptance: PACKAGE = "output/${TODAY}/vagrant-lxc-acceptance-$(ARCH).box"
@ -36,7 +45,13 @@ acceptance:
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} acceptance
release:
@test -z '$(version)' && echo 'version parameter not provided to `make`!' && exit 1 || return 0
gh release create -d -a output/${TODAY} $(version)
git tag $(version)
git push && git push --tags
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} ${CENTOS_BOXES} acceptance
clean:
@for r in $(ALL_BOXES); do \
sudo -E ./clean.sh $${r}\

16
centos/clean.sh Executable file
View file

@ -0,0 +1,16 @@
#!/bin/bash
set -e
source common/ui.sh
source common/utils.sh
debug 'Bringing container up'
utils.lxc.start
info "Cleaning up '${CONTAINER}'..."
log 'Removing temporary files...'
rm -rf ${ROOTFS}/tmp/*
log 'cleaning up dhcp leases'
rm -f ${ROOTFS}/var/lib/dhcp/*

18
centos/install-extras.sh Executable file
View file

@ -0,0 +1,18 @@
#!/bin/bash
set -e
source common/ui.sh
source common/utils.sh
info 'Installing extra packages and upgrading'
debug 'Bringing container up'
utils.lxc.start
# Sleep for a bit so that the container can get an IP
log 'Sleeping for 10 seconds...'
sleep 10
# TODO: Support for appending to this list from outside
PACKAGES=(vim curl wget man-db bash-completion python-software-properties ca-certificates sudo nfs-common)
utils.lxc.attach yum install install ${PACKAGES[*]} -y

5
common/prepare-vagrant-user.sh
View file

@ -17,6 +17,11 @@ elif $(grep -q 'ubuntu' ${ROOTFS}/etc/shadow); then
chroot ${ROOTFS} groupmod -n vagrant ubuntu &>> ${LOG}
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
log 'Renamed ubuntu user to vagrant and changed password.'
elif [ ${DISTRIBUTION} = 'centos' ]; then
debug 'Creating vagrant user...'
chroot ${ROOTFS} useradd --create-home -s /bin/bash -u 1000 vagrant &>> ${LOG}
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
sed -i 's/^Defaults\s\+requiretty/# Defaults requiretty/' $ROOTFS/etc/sudoers
else
debug 'Creating vagrant user...'
chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant &>> ${LOG}

21
common/ui.sh
View file

@ -6,21 +6,25 @@ export ERROR_COLOR='\033[31;01m'
export WARN_COLOR='\033[33;01m'
log() {
echo " [${RELEASE}] ${1}" >>${LOG}
echo " [${RELEASE}] ${1}" >&2
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo " [${LOG_PREFIX}] ${1}" >>${LOG}
echo " [${LOG_PREFIX}] ${1}" >&2
}
warn() {
echo "==> [${RELEASE}] [WARN] ${1}" >>${LOG}
echo -e "${WARN_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}"
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo "==> [${LOG_PREFIX}] [WARN] ${1}" >>${LOG}
echo -e "${WARN_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
}
info() {
echo "==> [${RELEASE}] [INFO] ${1}" >>${LOG}
echo -e "${OK_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}"
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo "==> [${LOG_PREFIX}] [INFO] ${1}" >>${LOG}
echo -e "${OK_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
}
confirm() {
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
question=${1}
default=${2}
default_prompt=
@ -33,7 +37,7 @@ confirm() {
default='Yes'
fi
echo -e -n "${WARN_COLOR}==> [${RELEASE}] ${question} [${default_prompt}] ${NO_COLOR}" >&2
echo -e -n "${WARN_COLOR}==> [${LOG_PREFIX}] ${question} [${default_prompt}] ${NO_COLOR}" >&2
read answer
if [ -z $answer ]; then
@ -49,5 +53,6 @@ confirm() {
}
debug() {
[ ! $DEBUG ] || echo " [${RELEASE}] [DEBUG] ${1}" >&2
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
[ ! $DEBUG ] || echo " [${LOG_PREFIX}] [DEBUG] ${1}" >&2
}

51
conf/centos Normal file
View file

@ -0,0 +1,51 @@
# Taken from the oracle.common.conf.in
# Console settings
lxc.devttydir = lxc
lxc.tty = 4
lxc.pts = 1024
# Mount entries
lxc.mount.auto = proc:mixed sys:ro
# Ensure hostname is changed on clone
lxc.hook.clone = /usr/share/lxc/hooks/clonehostname
# Capabilities
# Uncomment these if you don't run anything that needs the capability, and
# would like the container to run with less privilege.
#
# Dropping sys_admin disables container root from doing a lot of things
# that could be bad like re-mounting lxc fstab entries rw for example,
# but also disables some useful things like being able to nfs mount, and
# things that are already namespaced with ns_capable() kernel checks, like
# hostname(1).
# lxc.cap.drop = sys_admin
# lxc.cap.drop = net_raw # breaks dhcp/ping
# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
# lxc.cap.drop = setuid # breaks sshd,nfs statd
# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
# lxc.cap.drop = audit_write
#
lxc.cap.drop = mac_admin mac_override setfcap setpcap
lxc.cap.drop = sys_module sys_nice sys_pacct
lxc.cap.drop = sys_rawio sys_time
# Control Group devices: all denied except those whitelisted
lxc.cgroup.devices.deny = a
# Allow any mknod (but not reading/writing the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
# Blacklist some syscalls which are not safe in privileged
# containers
lxc.seccomp = /usr/share/lxc/config/common.seccomp

47
mk-centos.sh Executable file
View file

@ -0,0 +1,47 @@
#!/bin/bash
set -e
source common/ui.sh
if [ "$(id -u)" != "0" ]; then
echo "You should run this script as root (sudo)."
exit 1
fi
export DISTRIBUTION='centos'
export RELEASE=$1
export ARCH=$2
export CONTAINER=$3
export PACKAGE=$4
export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
export WORKING_DIR="/tmp/${CONTAINER}"
export NOW=$(date -u)
export LOG=$(readlink -f .)/log/${CONTAINER}.log
mkdir -p $(dirname $LOG)
echo '############################################' > ${LOG}
echo "# Beginning build at $(date)" >> ${LOG}
touch ${LOG}
chmod +rw ${LOG}
if [ -f ${PACKAGE} ]; then
warn "The box '${PACKAGE}' already exists, skipping..."
echo
exit
fi
debug "Creating ${WORKING_DIR}"
mkdir -p ${WORKING_DIR}
info "Building box to '${PACKAGE}'..."
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
# ./centos/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
./centos/install-extras.sh ${CONTAINER}
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
./centos/clean.sh ${CONTAINER}
./common/package.sh ${CONTAINER} ${PACKAGE}
info "Finished building '${PACKAGE}'!"
log "Run \`sudo lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way"
echo

2
mk-debian.sh
View file

@ -38,7 +38,7 @@ info "Building box to '${PACKAGE}'..."
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
./debian/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
./debian/install-extras.sh ${CONTAINER}
./common/prepare-vagrant-user.sh ${CONTAINER}
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
./debian/clean.sh ${CONTAINER}
./common/package.sh ${CONTAINER} ${PACKAGE}