Compare commits

..

No commits in common. "master" and "pr-readme" have entirely different histories.

28 changed files with 148 additions and 605 deletions

1
.gitignore vendored
View file

@ -1,3 +1,2 @@
/log
/output
*_packages

View file

@ -1,7 +1,6 @@
UBUNTU_BOXES= trusty xenial
DEBIAN_BOXES= jessie stretch sid
CENTOS_BOXES= 7
FEDORA_BOXES= 27
UBUNTU_BOXES= precise quantal raring saucy trusty
DEBIAN_BOXES= squeeze wheezy sid jessie
CENTOS_BOXES= 6
TODAY=$(shell date -u +"%Y-%m-%d")
# Replace i686 with i386 and x86_64 with amd64
@ -9,12 +8,11 @@ ARCH=$(shell uname -m | sed -e "s/68/38/" | sed -e "s/x86_64/amd64/")
default:
all: ubuntu debian fedora
all: ubuntu debian
ubuntu: $(UBUNTU_BOXES)
debian: $(DEBIAN_BOXES)
centos: $(CENTOS_BOXES)
fedora: $(FEDORA_BOXES)
# REFACTOR: Figure out how can we reduce duplicated code
$(UBUNTU_BOXES): CONTAINER = "vagrant-base-${@}-$(ARCH)"
@ -38,23 +36,12 @@ $(CENTOS_BOXES):
@sudo -E ./mk-centos.sh $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
$(FEDORA_BOXES): CONTAINER = "vagrant-base-fedora-${@}-$(ARCH)"
$(FEDORA_BOXES): PACKAGE = "output/${TODAY}/vagrant-lxc-fedora-${@}-$(ARCH).box"
$(FEDORA_BOXES):
@mkdir -p $$(dirname $(PACKAGE))
@sudo -E ./mk-fedora.sh $(@) $(ARCH) $(CONTAINER) $(PACKAGE)
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
.PHONY: gentoo
gentoo:
@sudo -E ./mk-gentoo.sh
acceptance: CONTAINER = "vagrant-base-acceptance-$(ARCH)"
acceptance: PACKAGE = "output/${TODAY}/vagrant-lxc-acceptance-$(ARCH).box"
acceptance:
@mkdir -p $$(dirname $(PACKAGE))
@PUPPET=1 CHEF=1 sudo -E ./mk-debian.sh ubuntu xenial $(ARCH) $(CONTAINER) $(PACKAGE)
@PUPPET=1 CHEF=1 sudo -E ./mk-debian.sh ubuntu precise $(ARCH) $(CONTAINER) $(PACKAGE)
@sudo chmod +rw $(PACKAGE)
@sudo chown ${USER}: $(PACKAGE)
@ -64,10 +51,10 @@ release:
git tag $(version)
git push && git push --tags
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} ${CENTOS_BOXES} ${FEDORA_BOXES} acceptance
clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} ${CENTOS_BOXES} acceptance
clean:
@for r in $(ALL_BOXES); do \
sudo -E ./clean.sh $${r}\
vagrant-base-$${r}-$(ARCH) \
output/${TODAY}/vagrant-lxc-$${r}-$(ARCH).box; \
done
vagrant-base-$${r}-$(ARCH) \
output/${TODAY}/vagrant-lxc-$${r}-$(ARCH).box; \
done

View file

@ -1,28 +1,30 @@
# vagrant-lxc base boxes
This repository contains a set of scripts for creating base boxes for usage with
[vagrant-lxc](https://github.com/fgrehm/vagrant-lxc) 1.4+.
[vagrant-lxc](https://github.com/fgrehm/vagrant-lxc) 1.0+.
## :warning: Deprecated :warning:
[I've stepped down as a maintainer of the plugin](https://github.com/fgrehm/vagrant-lxc/issues/375) and I'm no longer maintaining this repo. Feel free to use it as a starting point for your own boxes and if you need any help with that just LMK! :beers:
This fork is still maintained:
[https://github.com/obnoxxx/vagrant-lxc-base-boxes](https://github.com/obnoxxx/vagrant-lxc-base-boxes)
## What distros / versions can I build with this?
* Ubuntu
- Xenial 16.04 x86_64
- Precise 12.04 x86_64
- Quantal 12.10 x86_64
- Raring 13.04 x86_64
- Saucy 13.10 x86_64
- Trusty 14.04 x86_64
* Debian
- Stretch x86_64
- Squeeze x86_64
- Wheezy x86_64
- Jessie x86_64
- Sid x86_64
* Fedora
- 23 x86_64
- rawhide x86_64
* CentOS
- 7 x86_64
## Status
This is a fork of `obnoxxx/vagrant-lxc-base-boxes` which itself was a fork for
`fgrehm/vagrant-lxc-base-boxes`. The goal is to make LXC box generation work for LXC 3.0+. The
repo is not in top shape, but it works `make stretch` (which is what I use myself).
It should be easy enough for you to add support for distros you use (PR welcome).
- 6 x86_64
## Building the boxes
@ -32,43 +34,44 @@ create one based on [this](https://github.com/lxc/lxc/blob/master/templates/lxc-
and drop it on your lxc templates path (usually `/usr/share/lxc/templates`)._
```sh
git clone https://github.com/hsoft/vagrant-lxc-base-boxes.git
git clone https://github.com/fgrehm/vagrant-lxc-base-boxes.git
cd vagrant-lxc-base-boxes
make stretch
make precise
```
By default no provisioning tools will be included but you can pick the ones
you want by providing some environmental variables. For example:
```sh
ANSIBLE=1 PUPPET=1 CHEF=1 \
make stretch
PUPPET=1 CHEF=1 SALT=1 BABUSHKA=1 \
make precise
```
Will build a Debian Stretch x86_64 box with latest Ansible, Puppet and Chef pre-installed.
Will build a Ubuntu Precise x86_64 box with latest Puppet, Chef, Salt and
Babushka pre-installed.
When using ANSIBLE=1, an optional ANSIBLE_VERSION parameter may be passed that
will specify which version of ansible to install. By default it will install
the latest Ansible.
Additional packages to be installed can be specified with the ADDPACKAGES variable:
```sh
ADDPACKAGES="aptitude htop" \
make xenial
```
Will build a Ubuntu Xenial x86_64 box with aptitude and htop as additional
packages pre-installed. You can also specify the packages in a file
xenial_packages.
Note: ADDPACKAGES is currently only implemented for flavors of debian.
## Pre built base boxes
There are no pre-built base boxes for this repo. You have to build them yourself.
_**NOTE:** None of the base boxes below have a provisioner pre-installed_
| Distribution | VagrantCloud box |
| ------------ | ---------------- |
| Ubuntu Precise 12.04 x86_64 | [fgrehm/precise64-lxc](https://vagrantcloud.com/fgrehm/precise64-lxc) |
| Ubuntu Trusty 14.04 x86_64 | [fgrehm/trusty64-lxc](https://vagrantcloud.com/fgrehm/trusty64-lxc) |
| Debian Wheezy 7 x86_64 | [fgrehm/wheezy64-lxc](https://vagrantcloud.com/fgrehm/wheezy64-lxc) |
| Debian Jessie 8 x86_64 | [glenux/jessie64-lxc](https://atlas.hashicorp.com/glenux/boxes/jessie64-lxc) |
| CentOS 6 x86_64 | [fgrehm/centos-6-64-lxc](https://vagrantcloud.com/fgrehm/centos-6-64-lxc) |
## What makes up for a vagrant-lxc base box?
See [vagrant-lxc/BOXES.md](https://github.com/fgrehm/vagrant-lxc/blob/master/BOXES.md)
## Known issues
* We can't get the NFS client to be installed on the containers used for building
Ubuntu 13.04 / 13.10 / 14.04 base boxes.
* Puppet can't be installed on Debian Sid
* Salt can't be installed on Ubuntu 13.04

View file

@ -10,21 +10,11 @@ debug 'Bringing container up'
utils.lxc.start
# Sleep for a bit so that the container can get an IP
SECS=20
log "Sleeping for $SECS seconds..."
sleep $SECS
# install the fedora epel repo?
EPEL=${EPEL:-0}
# TODO: Support for appending to this list from outside
PACKAGES=(vim curl wget man ca-certificates sudo openssh-server)
if [ $EPEL = 1 ]; then
utils.lxc.attach yum update -y
utils.lxc.attach yum install epel-release -y
PACKAGES+=' bash-completion'
fi
log 'Sleeping for 10 seconds...'
sleep 10
utils.lxc.attach yum update -y
# TODO: Support for appending to this list from outside
PACKAGES=(vim curl wget man-db bash-completion python-software-properties ca-certificates sudo nfs-common)
utils.lxc.attach yum install ${PACKAGES[*]} -y

View file

@ -26,28 +26,18 @@ fi
# If we got to this point, we need to create the container
log "Creating container..."
if [ $RELEASE = 'raring' ]; then
utils.lxc.create -t ubuntu -- \
--release ${RELEASE} \
--arch ${ARCH}
elif [ $RELEASE = 'squeeze' ] || [ $RELEASE = 'wheezy' ]; then
utils.lxc.create -t debian -- \
--release ${RELEASE} \
--arch ${ARCH}
else
utils.lxc.create -t download -- \
--dist ${DISTRIBUTION} \
--release ${RELEASE} \
--arch ${ARCH}
if [ ${DISTRIBUTION} = 'fedora' ] ||\
[ ${DISTRIBUTION} = 'ubuntu' ] ||\
[ ${DISTRIBUTION} = 'debian' ]
then
# Improve systemd support:
# - The fedora template does it but the fedora images from the download
# template apparently don't.
# - The debian template does it but the debian image from the download
# template apparently not.
utils.lxc.stop
echo >> /var/lib/lxc/${CONTAINER}/config
echo "# settings for systemd with PID 1:" >> /var/lib/lxc/${CONTAINER}/config
echo "lxc.autodev = 1" >> /var/lib/lxc/${CONTAINER}/config
utils.lxc.start
utils.lxc.attach rm -f /dev/kmsg
utils.lxc.stop
fi
log "Container created!"

View file

@ -3,13 +3,6 @@ set -e
source common/ui.sh
ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
WORKING_DIR="/tmp/${CONTAINER}"
debug "Creating ${WORKING_DIR}"
mkdir -p ${WORKING_DIR}
mkdir -p $(dirname ${PACKAGE})
# TODO: Create file with build date / time on container
info "Packaging '${CONTAINER}' to '${PACKAGE}'..."
@ -23,18 +16,14 @@ if [ -f ${WORKING_DIR}/rootfs.tar.gz ]; then
fi
log "Compressing container's rootfs"
pushd $(dirname ${ROOTFS})
pushd $(dirname ${ROOTFS}) &>>${LOG}
tar --numeric-owner --anchored --exclude=./rootfs/dev/log -czf \
${WORKING_DIR}/rootfs.tar.gz ./rootfs/*
popd
popd &>>${LOG}
# Prepare package contents
log 'Preparing box package contents'
if [ -f conf/${DISTRIBUTION}-${RELEASE} ]; then
cp conf/${DISTRIBUTION}-${RELEASE} ${WORKING_DIR}/lxc-config
else
cp conf/${DISTRIBUTION} ${WORKING_DIR}/lxc-config
fi
cp conf/${DISTRIBUTION} ${WORKING_DIR}/lxc-config
cp conf/metadata.json ${WORKING_DIR}
sed -i "s/<TODAY>/${NOW}/" ${WORKING_DIR}/metadata.json
@ -42,6 +31,3 @@ sed -i "s/<TODAY>/${NOW}/" ${WORKING_DIR}/metadata.json
log 'Packaging box'
TARBALL=$(readlink -f ${PACKAGE})
(cd ${WORKING_DIR} && tar -czf $TARBALL ./*)
chmod +rw ${PACKAGE}
chown ${USER}: ${PACKAGE}

View file

@ -3,8 +3,7 @@ set -e
source common/ui.sh
ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
VAGRANT_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key"
export VAGRANT_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key"
info "Preparing vagrant user..."
@ -14,29 +13,24 @@ if $(grep -q 'vagrant' ${ROOTFS}/etc/shadow); then
elif $(grep -q 'ubuntu' ${ROOTFS}/etc/shadow); then
debug 'vagrant user does not exist, renaming ubuntu user...'
mv ${ROOTFS}/home/{ubuntu,vagrant}
chroot ${ROOTFS} usermod -l vagrant -d /home/vagrant ubuntu
chroot ${ROOTFS} groupmod -n vagrant ubuntu
chroot ${ROOTFS} usermod -l vagrant -d /home/vagrant ubuntu &>> ${LOG}
chroot ${ROOTFS} groupmod -n vagrant ubuntu &>> ${LOG}
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
log 'Renamed ubuntu user to vagrant and changed password.'
elif [ ${DISTRIBUTION} = 'centos' -o ${DISTRIBUTION} = 'fedora' ]; then
elif [ ${DISTRIBUTION} = 'centos' ]; then
debug 'Creating vagrant user...'
chroot ${ROOTFS} useradd --create-home -s /bin/bash -u 1000 vagrant
chroot ${ROOTFS} useradd --create-home -s /bin/bash -u 1000 vagrant &>> ${LOG}
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
sed -i 's/^Defaults\s\+requiretty/# Defaults requiretty/' $ROOTFS/etc/sudoers
if [ ${RELEASE} -eq 6 ]; then
info 'Disabling password aging for root...'
# disable password aging (required on Centos 6)
# pretend that password was changed today (won't fail during provisioning)
chroot ${ROOTFS} chage -I -1 -m 0 -M 99999 -E -1 -d `date +%Y-%m-%d` root
fi
else
debug 'Creating vagrant user...'
chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant
chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant &>> ${LOG}
chroot ${ROOTFS} adduser vagrant sudo &>> ${LOG}
echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd
fi
# Configure SSH access
if [ -d ${ROOTFS}/home/vagrant/.ssh/authorized_keys ]; then
if [ -d ${ROOTFS}/home/vagrant/.ssh ]; then
log 'Skipping vagrant SSH credentials configuration'
else
debug 'SSH key has not been set'

View file

@ -7,16 +7,19 @@ export WARN_COLOR='\033[33;01m'
log() {
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo " [${LOG_PREFIX}] ${1}"
echo " [${LOG_PREFIX}] ${1}" >>${LOG}
echo " [${LOG_PREFIX}] ${1}" >&2
}
warn() {
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo "==> [${LOG_PREFIX}] [WARN] ${1}" >>${LOG}
echo -e "${WARN_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
}
info() {
LOG_PREFIX="${DISTRIBUTION}-${RELEASE}"
echo "==> [${LOG_PREFIX}] [INFO] ${1}" >>${LOG}
echo -e "${OK_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}"
}

View file

@ -3,31 +3,21 @@
utils.lxc.attach() {
cmd="$@"
log "Running [${cmd}] inside '${CONTAINER}' container..."
lxc-attach -n ${CONTAINER} -- $cmd
}
utils.lxc.pipetofile() {
lxc-attach -n ${CONTAINER} -- /bin/bash -c "tee $1 > /dev/null"
}
utils.lxc.runscript() {
log "Running $1 inside '${CONTAINER}'..."
cat $1 | utils.lxc.pipetofile /script.sh
utils.lxc.attach /bin/bash /script.sh
(lxc-attach -n ${CONTAINER} -- $cmd) & >> ${LOG}
}
utils.lxc.start() {
lxc-start -d -n ${CONTAINER} || true
lxc-start -d -n ${CONTAINER} & >> ${LOG} || true
}
utils.lxc.stop() {
lxc-stop -n ${CONTAINER} || true
lxc-stop -n ${CONTAINER} & >> ${LOG} || true
}
utils.lxc.destroy() {
lxc-destroy -n ${CONTAINER}
lxc-destroy -n ${CONTAINER} & >> ${LOG}
}
utils.lxc.create() {
lxc-create -n ${CONTAINER} "$@"
lxc-create -n ${CONTAINER} "$@" & >> ${LOG}
}

View file

@ -1,9 +1,9 @@
# Taken from the oracle.common.conf.in
# Console settings
lxc.tty.dir = lxc
lxc.tty.max = 4
lxc.pty.max = 1024
lxc.devttydir = lxc
lxc.tty = 4
lxc.pts = 1024
# Mount entries
lxc.mount.auto = proc:mixed sys:ro
@ -54,4 +54,4 @@ lxc.cgroup.devices.allow = c 10:200 rwm # /dev/net/tun
# Blacklist some syscalls which are not safe in privileged
# containers
lxc.seccomp.profile = /usr/share/lxc/config/common.seccomp
lxc.seccomp = /usr/share/lxc/config/common.seccomp

View file

@ -1,34 +1,36 @@
# Default pivot location
lxc.pivotdir = lxc_putold
# Default mount entries
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry = sysfs sys sysfs defaults 0 0
# Default console settings
lxc.tty.max = 4
lxc.pty.max = 1024
lxc.tty = 4
lxc.pts = 1024
# Default capabilities
lxc.cap.drop = sys_module mac_admin mac_override sys_time
# Prevent systemd-journald from burning 100% of CPU
# See https://wiki.debian.org/LXC#Incompatibility_with_systemd
lxc.kmsg = 0
lxc.autodev = 1
# When using LXC with apparmor, the container will be confined by default.
# If you wish for it to instead run unconfined, copy the following line
# (uncommented) to the container's configuration file.
#lxc.apparmor.profile = unconfined
#lxc.aa_profile = unconfined
# To support container nesting on an Ubuntu host while retaining most of
# apparmor's added security, use the following two lines instead.
#lxc.apparmor.profile = lxc-container-default-with-nesting
#lxc.aa_profile = lxc-container-default-with-nesting
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
# If you wish to allow mounting block filesystems, then use the following
# line instead, and make sure to grant access to the block device and/or loop
# devices below in lxc.cgroup.devices.allow.
#lxc.apparmor.profile = lxc-container-default-with-mounting
#lxc.aa_profile = lxc-container-default-with-mounting
# Default cgroup limits
lxc.cgroup.devices.deny = a

View file

@ -1,63 +0,0 @@
# support systemd as PID 1
lxc.autodev = 1
# Default pivot location
# Default mount entries
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
# Default console settings
lxc.tty.max = 4
lxc.pty.max = 1024
# Default capabilities
lxc.cap.drop = sys_module mac_admin mac_override sys_time sys_rawio
# When using LXC with apparmor, the container will be confined by default.
# If you wish for it to instead run unconfined, copy the following line
# (uncommented) to the container's configuration file.
#lxc.apparmor.profile = unconfined
# To support container nesting on an Ubuntu host while retaining most of
# apparmor's added security, use the following two lines instead.
#lxc.apparmor.profile = lxc-container-default-with-nesting
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
# If you wish to allow mounting block filesystems, then use the following
# line instead, and make sure to grant access to the block device and/or loop
# devices below in lxc.cgroup.devices.allow.
#lxc.apparmor.profile = lxc-container-default-with-mounting
# Default cgroup limits
lxc.cgroup.devices.deny = a
## Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
## /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
## consoles
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 5:1 rwm
## /dev/{,u}random
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 1:9 rwm
## /dev/pts/*
lxc.cgroup.devices.allow = c 5:2 rwm
lxc.cgroup.devices.allow = c 136:* rwm
## rtc
lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun
lxc.cgroup.devices.allow = c 10:200 rwm
## full
lxc.cgroup.devices.allow = c 1:7 rwm
## hpet
lxc.cgroup.devices.allow = c 10:228 rwm
## kvm
lxc.cgroup.devices.allow = c 10:232 rwm
## To use loop devices, copy the following line to the container's
## configuration file (uncommented).
#lxc.cgroup.devices.allow = b 7:* rwm

View file

@ -1,63 +0,0 @@
# support systemd as PID 1
lxc.autodev = 1
# Default pivot location
# Default mount entries
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0
# Default console settings
lxc.tty.max = 4
lxc.pty.max = 1024
# Default capabilities
lxc.cap.drop = sys_module mac_admin mac_override sys_time sys_rawio
# When using LXC with apparmor, the container will be confined by default.
# If you wish for it to instead run unconfined, copy the following line
# (uncommented) to the container's configuration file.
#lxc.apparmor.profile = unconfined
# To support container nesting on an Ubuntu host while retaining most of
# apparmor's added security, use the following two lines instead.
#lxc.apparmor.profile = lxc-container-default-with-nesting
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
# If you wish to allow mounting block filesystems, then use the following
# line instead, and make sure to grant access to the block device and/or loop
# devices below in lxc.cgroup.devices.allow.
#lxc.apparmor.profile = lxc-container-default-with-mounting
# Default cgroup limits
lxc.cgroup.devices.deny = a
## Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
## /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
## consoles
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 5:1 rwm
## /dev/{,u}random
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 1:9 rwm
## /dev/pts/*
lxc.cgroup.devices.allow = c 5:2 rwm
lxc.cgroup.devices.allow = c 136:* rwm
## rtc
lxc.cgroup.devices.allow = c 254:0 rm
## fuse
lxc.cgroup.devices.allow = c 10:229 rwm
## tun
lxc.cgroup.devices.allow = c 10:200 rwm
## full
lxc.cgroup.devices.allow = c 1:7 rwm
## hpet
lxc.cgroup.devices.allow = c 10:228 rwm
## kvm
lxc.cgroup.devices.allow = c 10:232 rwm
## To use loop devices, copy the following line to the container's
## configuration file (uncommented).
#lxc.cgroup.devices.allow = b 7:* rwm

View file

@ -1,68 +0,0 @@
# work better with systemd:
lxc.autodev = 1
# Taken from the oracle.common.conf.in
# Console settings
lxc.tty.dir = lxc
lxc.tty.max = 4
lxc.pty.max = 1024
# Mount entries
lxc.mount.auto = proc:mixed sys:ro
# Ensure hostname is changed on clone
lxc.hook.clone = /usr/share/lxc/hooks/clonehostname
# Capabilities
# Uncomment these if you don't run anything that needs the capability, and
# would like the container to run with less privilege.
#
# Dropping sys_admin disables container root from doing a lot of things
# that could be bad like re-mounting lxc fstab entries rw for example,
# but also disables some useful things like being able to nfs mount, and
# things that are already namespaced with ns_capable() kernel checks, like
# hostname(1).
# lxc.cap.drop = sys_admin
# lxc.cap.drop = net_raw # breaks dhcp/ping
# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
# lxc.cap.drop = setuid # breaks sshd,nfs statd
# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
# lxc.cap.drop = audit_write
# big big login delays in Fedora 20 systemd:
#lxc.cap.drop = setpcap
#
lxc.cap.drop = mac_admin mac_override
# needed for httpd
#lxc.cap.drop = setfcap
lxc.cap.drop = sys_module sys_pacct
# sys_nice: needed to run CTDB
#lxc.cap.drop = sys_nice sys_pacct
lxc.cap.drop = sys_rawio sys_time
# Control Group devices: all denied except those whitelisted
lxc.cgroup.devices.deny = a
# Allow any mknod (but not reading/writing the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
## /dev/null
lxc.cgroup.devices.allow = c 1:3 rwm
## /dev/zero
lxc.cgroup.devices.allow = c 1:5 rwm
## /dev/full
lxc.cgroup.devices.allow = c 1:7 rwm
## /dev/tty
lxc.cgroup.devices.allow = c 5:0 rwm
## /dev/random
lxc.cgroup.devices.allow = c 1:8 rwm
## /dev/urandom
lxc.cgroup.devices.allow = c 1:9 rwm
## /dev/tty[1-4] ptys and lxc console
lxc.cgroup.devices.allow = c 136:* rwm
## /dev/ptmx pty master
lxc.cgroup.devices.allow = c 5:2 rwm
# Blacklist some syscalls which are not safe in privileged
# containers
lxc.seccomp.profile = /usr/share/lxc/config/common.seccomp

View file

@ -1,5 +0,0 @@
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
# Default console settings
lxc.tty.max = 4
lxc.pty.max = 1024

View file

@ -1,13 +1,14 @@
# Default pivot location
lxc.pivotdir = lxc_putold
# Default mount entries
lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
lxc.mount.entry = sysfs sys sysfs defaults 0 0
# Default console settings
lxc.tty.dir = lxc
lxc.tty.max = 4
lxc.pty.max = 1024
lxc.devttydir = lxc
lxc.tty = 4
lxc.pts = 1024
# Default capabilities
lxc.cap.drop = sys_module mac_admin mac_override sys_time
@ -15,11 +16,11 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, the container will be confined by default.
# If you wish for it to instead run unconfined, copy the following line
# (uncommented) to the container's configuration file.
#lxc.apparmor.profile = unconfined
#lxc.aa_profile = unconfined
# To support container nesting on an Ubuntu host while retaining most of
# apparmor's added security, use the following two lines instead.
#lxc.apparmor.profile = lxc-container-default-with-nesting
#lxc.aa_profile = lxc-container-default-with-nesting
#lxc.hook.mount = /usr/share/lxc/hooks/mountcgroups
# Uncomment the following line to autodetect squid-deb-proxy configuration on the
@ -29,7 +30,7 @@ lxc.cap.drop = sys_module mac_admin mac_override sys_time
# If you wish to allow mounting block filesystems, then use the following
# line instead, and make sure to grant access to the block device and/or loop
# devices below in lxc.cgroup.devices.allow.
#lxc.apparmor.profile = lxc-container-default-with-mounting
#lxc.aa_profile = lxc-container-default-with-mounting
# Default cgroup limits
lxc.cgroup.devices.deny = a

View file

@ -1,9 +0,0 @@
# Template used to create this container: /usr/share/lxc/templates/lxc-ubuntu
# Parameters passed to the template: --release wily --arch amd64
# For additional config options, please look at lxc.container.conf(5)
# Common configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
# settings for systemd with PID 1:
lxc.autodev = 1

View file

@ -1,12 +0,0 @@
# Template used to create this container: /usr/share/lxc/templates/lxc-ubuntu
# Parameters passed to the template: --release wily --arch amd64
# For additional config options, please look at lxc.container.conf(5)
# Common configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
# settings for systemd with PID 1:
lxc.autodev = 1
# allow unconfined and incomplete
lxc.apparmor.profile = unconfined
lxc.apparmor.allow_incomplete = 1

View file

@ -1,7 +0,0 @@
#!/bin/bash
ANSIBLE_VERSION=${ANSIBLE_VERSION:-latest}
apt-get install -y build-essential python-setuptools python-jinja2 python-yaml python-paramiko python-httplib2 python-crypto sshpass
wget https://releases.ansible.com/ansible/ansible-$ANSIBLE_VERSION.tar.gz -O /tmp//ansible.tar.gz
tar -zxvf /tmp/ansible.tar.gz -C /tmp/ && rm -r /tmp/ansible.tar.gz
cd /tmp/ansible-* && make && make install

View file

@ -10,29 +10,21 @@ debug 'Bringing container up'
utils.lxc.start
# Sleep for a bit so that the container can get an IP
SECS=15
log "Sleeping for $SECS seconds..."
sleep $SECS
PACKAGES=(vim curl wget man-db openssh-server bash-completion ca-certificates sudo)
log "Installing additional packages: ${ADDPACKAGES}"
PACKAGES+=" ${ADDPACKAGES}"
log 'Sleeping for 5 seconds...'
sleep 5
# TODO: Support for appending to this list from outside
PACKAGES=(vim curl wget man-db openssh-server bash-completion python-software-properties ca-certificates sudo)
if [ $DISTRIBUTION = 'ubuntu' ]; then
PACKAGES+=' software-properties-common'
fi
if [ $RELEASE != 'raring' ] && [ $RELEASE != 'saucy' ] && [ $RELEASE != 'trusty' ] && [ $RELEASE != 'wily' ] ; then
if [ $RELEASE != 'raring' ] && [ $RELEASE != 'saucy' ] && [ $RELEASE != 'trusty' ] ; then
PACKAGES+=' nfs-common'
fi
if [ $RELEASE != 'stretch' ] ; then
PACKAGES+=' python-software-properties'
fi
utils.lxc.attach apt-get update
utils.lxc.attach apt-get install ${PACKAGES[*]} -y --force-yes
utils.lxc.attach apt-get upgrade -y --force-yes
ANSIBLE=${ANSIBLE:-0}
CHEF=${CHEF:-0}
PUPPET=${PUPPET:-0}
SALT=${SALT:-0}
@ -44,18 +36,6 @@ if [ $DISTRIBUTION = 'debian' ]; then
-i ${ROOTFS}/etc/bash.bashrc
fi
if [ $ANSIBLE = 1 ]; then
if $(lxc-attach -n ${CONTAINER} -- which ansible &>/dev/null); then
log "Ansible has been installed on container, skipping"
else
info "Installing Ansible"
cp debian/install-ansible.sh ${ROOTFS}/tmp/ && chmod +x ${ROOTFS}/tmp/install-ansible.sh
utils.lxc.attach /tmp/install-ansible.sh
fi
else
log "Skipping Ansible installation"
fi
if [ $CHEF = 1 ]; then
if $(lxc-attach -n ${CONTAINER} -- which chef-solo &>/dev/null); then
log "Chef has been installed on container, skipping"
@ -79,6 +59,8 @@ if [ $PUPPET = 1 ]; then
warn "Puppet can't be installed on Debian sid, skipping"
else
log "Installing Puppet"
wget http://apt.puppetlabs.com/puppetlabs-release-stable.deb -O "${ROOTFS}/tmp/puppetlabs-release-stable.deb" &>>${LOG}
utils.lxc.attach dpkg -i "/tmp/puppetlabs-release-stable.deb"
utils.lxc.attach apt-get update
utils.lxc.attach apt-get install puppet -y --force-yes
fi
@ -89,10 +71,47 @@ fi
if [ $SALT = 1 ]; then
if $(lxc-attach -n ${CONTAINER} -- which salt-minion &>/dev/null); then
log "Salt has been installed on container, skipping"
elif [ ${RELEASE} = 'raring' ]; then
warn "Salt can't be installed on Ubuntu Raring 13.04, skipping"
else
if [ $DISTRIBUTION = 'ubuntu' ]; then
utils.lxc.attach add-apt-repository -y ppa:saltstack/salt
else # DEBIAN
if [ $RELEASE == "squeeze" ]; then
SALT_SOURCE_1="deb http://debian.saltstack.com/debian squeeze-saltstack main"
SALT_SOURCE_2="deb http://backports.debian.org/debian-backports squeeze-backports main contrib non-free"
elif [ $RELEASE == "wheezy" ]; then
SALT_SOURCE_1="deb http://debian.saltstack.com/debian wheezy-saltstack main"
else
SALT_SOURCE_1="deb http://debian.saltstack.com/debian unstable main"
fi
echo $SALT_SOURCE_1 > ${ROOTFS}/etc/apt/sources.list.d/saltstack.list
echo $SALT_SOURCE_2 >> ${ROOTFS}/etc/apt/sources.list.d/saltstack.list
utils.lxc.attach wget -q -O /tmp/salt.key "http://debian.saltstack.com/debian-salt-team-joehealy.gpg.key"
utils.lxc.attach apt-key add /tmp/salt.key
fi
utils.lxc.attach apt-get update
utils.lxc.attach apt-get install salt-minion -y --force-yes
fi
else
log "Skipping Salt installation"
fi
if [ $BABUSHKA = 1 ]; then
if $(lxc-attach -n ${CONTAINER} -- which babushka &>/dev/null); then
log "Babushka has been installed on container, skipping"
elif [ ${RELEASE} = 'trusty' ]; then
warn "Babushka can't be installed on Ubuntu Trusty 14.04, skipping"
else
log "Installing Babushka"
cat > $ROOTFS/tmp/install-babushka.sh << EOF
#!/bin/sh
curl https://babushka.me/up | sudo bash
EOF
chmod +x $ROOTFS/tmp/install-babushka.sh
utils.lxc.attach /tmp/install-babushka.sh
fi
else
log "Skipping Babushka installation"
fi

View file

@ -30,7 +30,7 @@ if [ ${DISTRIBUTION} = 'debian' ]; then
# Fixes for jessie, following the guide from
# https://wiki.debian.org/LXC#Incompatibility_with_systemd
if [ "$RELEASE" = 'jessie' ] || [ "$RELEASE" = 'stretch' ]; then
if [ "$RELEASE" = 'jessie' ]; then
# Reconfigure the LXC
utils.lxc.attach /bin/cp \
/lib/systemd/system/getty@.service \
@ -48,5 +48,5 @@ utils.lxc.attach /usr/sbin/locale-gen ${LANG}
utils.lxc.attach update-locale LANG=${LANG}
# Fix to allow bindfs
utils.lxc.attach ln -sf /bin/true /sbin/modprobe
utils.lxc.attach ln -s /bin/true /sbin/modprobe
utils.lxc.attach mknod -m 666 /dev/fuse c 10 229

View file

@ -1,16 +0,0 @@
#!/bin/bash
set -e
source common/ui.sh
source common/utils.sh
debug 'Bringing container up'
utils.lxc.start
info "Cleaning up '${CONTAINER}'..."
log 'Removing temporary files...'
rm -rf ${ROOTFS}/tmp/*
log 'cleaning up dhcp leases'
rm -f ${ROOTFS}/var/lib/dhcp/*

View file

@ -1,29 +0,0 @@
#!/bin/bash
set -e
source common/ui.sh
source common/utils.sh
info 'Installing extra packages and upgrading'
debug 'Bringing container up'
utils.lxc.start
# Sleep for a bit so that the container can get an IP
SECS=20
log "Sleeping for $SECS seconds..."
sleep $SECS
# TODO: Support for appending to this list from outside
PACKAGES=(vim-enhanced curl wget man-db bash-completion ca-certificates sudo openssh-server strace python-dnf dnf-plugins-core e2fsprogs net-tools bind-utils)
utils.lxc.attach dnf update -y
utils.lxc.attach dnf install ${PACKAGES[*]} -y
MASK_TMP=${MASK_TMP:-0}
if [ $MASK_TMP -eq 1 ]; then
# don't overmount /tmp with tmpfs: important for lxc-cachier
utils.lxc.attach systemctl mask tmp.mount
fi

View file

@ -1,14 +0,0 @@
#!/bin/bash
set -e
source /etc/profile
echo "Cleaning up"
rm /script.sh
echo 'Removing temporary files...'
rm -rf /tmp/*
echo 'cleaning up distfiles'
rm -f /usr/portage/distfiles/*

View file

@ -1,41 +0,0 @@
#!/bin/bash
set -e
source /etc/profile
echo 'Installing packages and upgrading'
PACKAGES=(net-misc/curl wget man-db openssh ca-certificates sudo)
echo "Installing additional packages: ${ADDPACKAGES}"
PACKAGES+=" ${ADDPACKAGES}"
ANSIBLE=${ANSIBLE:-0}
if [[ $ANSIBLE = 1 ]]; then
PACKAGES+=' ansible'
fi
CHEF=${CHEF:-0}
if [[ $CHEF = 1 ]]; then
echo "Chef installation isn't supported on Gentoo"
exit 1
fi
PUPPET=${PUPPET:-0}
if [[ $PUPPET = 1 ]]; then
PACKAGES+=' puppet eix'
fi
SALT=${SALT:-0}
if [[ $SALT = 1 ]]; then
PACKAGES+=' salt'
fi
# trying to set capabilities on an unprivileged container fails.
echo "*/* -filecaps" > /etc/portage/package.use/vagrant_overrides
emerge --sync
emerge --noreplace ${PACKAGES[*]}
emerge -uND @world
rc-config add sshd default

View file

@ -13,7 +13,6 @@ export RELEASE=$2
export ARCH=$3
export CONTAINER=$4
export PACKAGE=$5
export ADDPACKAGES=${ADDPACKAGES-$(cat ${RELEASE}_packages | tr "\n" " ")}
export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
export WORKING_DIR="/tmp/${CONTAINER}"
export NOW=$(date -u)

View file

@ -1,46 +0,0 @@
#!/bin/bash
set -e
source common/ui.sh
if [ "$(id -u)" != "0" ]; then
echo "You should run this script as root (sudo)."
exit 1
fi
export DISTRIBUTION='fedora'
export RELEASE=$1
export ARCH=$2
export CONTAINER=$3
export PACKAGE=$4
export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
export WORKING_DIR="/tmp/${CONTAINER}"
export NOW=$(date -u)
export LOG=$(readlink -f .)/log/${CONTAINER}.log
mkdir -p $(dirname $LOG)
echo '############################################' > ${LOG}
echo "# Beginning build at $(date)" >> ${LOG}
touch ${LOG}
chmod +rw ${LOG}
if [ -f ${PACKAGE} ]; then
warn "The box '${PACKAGE}' already exists, skipping..."
echo
exit
fi
debug "Creating ${WORKING_DIR}"
mkdir -p ${WORKING_DIR}
info "Building box to '${PACKAGE}'..."
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
./fedora/install-extras.sh ${CONTAINER}
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
./fedora/clean.sh ${CONTAINER}
./common/package.sh ${CONTAINER} ${PACKAGE}
info "Finished building '${PACKAGE}'!"
log "Run \`sudo lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way"
echo

View file

@ -1,47 +0,0 @@
#!/bin/bash
set -e
source common/ui.sh
source common/utils.sh
if [ "$(id -u)" != "0" ]; then
echo "You should run this script as root (sudo)."
exit 1
fi
TODAY=$(date -u +"%Y-%m-%d")
export DISTRIBUTION=gentoo
export RELEASE=current
export ARCH=$(uname -m | sed -e "s/68/38/" | sed -e "s/x86_64/amd64/")
export CONTAINER="vagrant-base-${DISTRIBUTION}-${ARCH}"
export PACKAGE="output/${TODAY}/${CONTAINER}.box"
export NOW=$(date -u)
echo '############################################'
echo "# Beginning build at $(date)"
if [ -f ${PACKAGE} ]; then
warn "The box '${PACKAGE}' already exists, skipping..."
echo
exit
fi
info "Building box to '${PACKAGE}'..."
./common/download.sh
utils.lxc.start
SECS=15
log "Sleeping for $SECS seconds..."
sleep $SECS
utils.lxc.runscript gentoo/install-packages.sh
./common/prepare-vagrant-user.sh
utils.lxc.runscript gentoo/clean.sh
utils.lxc.stop
./common/package.sh
info "Finished building '${PACKAGE}'!"
log "Run \`lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way"
echo