CentOS scripts
Fabio Rehm
9 years ago
parent
81bf2e6090
commit
a814d9424a
@ -0,0 +1,16 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
source common/ui.sh
|
||||
source common/utils.sh
|
||||
|
||||
debug 'Bringing container up'
|
||||
utils.lxc.start
|
||||
|
||||
info "Cleaning up '${CONTAINER}'..."
|
||||
|
||||
log 'Removing temporary files...'
|
||||
rm -rf ${ROOTFS}/tmp/*
|
||||
|
||||
log 'cleaning up dhcp leases'
|
||||
rm -f ${ROOTFS}/var/lib/dhcp/*
|
||||
@ -0,0 +1,18 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
source common/ui.sh
|
||||
source common/utils.sh
|
||||
|
||||
info 'Installing extra packages and upgrading'
|
||||
|
||||
debug 'Bringing container up'
|
||||
utils.lxc.start
|
||||
|
||||
# Sleep for a bit so that the container can get an IP
|
||||
log 'Sleeping for 10 seconds...'
|
||||
sleep 10
|
||||
|
||||
# TODO: Support for appending to this list from outside
|
||||
PACKAGES=(vim curl wget man-db bash-completion python-software-properties ca-certificates sudo nfs-common)
|
||||
utils.lxc.attach yum install install ${PACKAGES[*]} -y
|
||||
@ -0,0 +1,51 @@
|
||||
# Taken from the oracle.common.conf.in
|
||||
# Console settings
|
||||
|
||||
lxc.devttydir = lxc
|
||||
lxc.tty = 4
|
||||
lxc.pts = 1024
|
||||
|
||||
# Mount entries
|
||||
lxc.mount.auto = proc:mixed sys:ro
|
||||
|
||||
# Ensure hostname is changed on clone
|
||||
lxc.hook.clone = /usr/share/lxc/hooks/clonehostname
|
||||
|
||||
# Capabilities
|
||||
# Uncomment these if you don't run anything that needs the capability, and
|
||||
# would like the container to run with less privilege.
|
||||
#
|
||||
# Dropping sys_admin disables container root from doing a lot of things
|
||||
# that could be bad like re-mounting lxc fstab entries rw for example,
|
||||
# but also disables some useful things like being able to nfs mount, and
|
||||
# things that are already namespaced with ns_capable() kernel checks, like
|
||||
# hostname(1).
|
||||
# lxc.cap.drop = sys_admin
|
||||
# lxc.cap.drop = net_raw # breaks dhcp/ping
|
||||
# lxc.cap.drop = setgid # breaks login (initgroups/setgroups)
|
||||
# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd)
|
||||
# lxc.cap.drop = setuid # breaks sshd,nfs statd
|
||||
# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed)
|
||||
# lxc.cap.drop = audit_write
|
||||
#
|
||||
lxc.cap.drop = mac_admin mac_override setfcap setpcap
|
||||
lxc.cap.drop = sys_module sys_nice sys_pacct
|
||||
lxc.cap.drop = sys_rawio sys_time
|
||||
|
||||
# Control Group devices: all denied except those whitelisted
|
||||
lxc.cgroup.devices.deny = a
|
||||
# Allow any mknod (but not reading/writing the node)
|
||||
lxc.cgroup.devices.allow = c *:* m
|
||||
lxc.cgroup.devices.allow = b *:* m
|
||||
lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null
|
||||
lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero
|
||||
lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full
|
||||
lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty
|
||||
lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random
|
||||
lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom
|
||||
lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console
|
||||
lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master
|
||||
|
||||
# Blacklist some syscalls which are not safe in privileged
|
||||
# containers
|
||||
lxc.seccomp = /usr/share/lxc/config/common.seccomp
|
||||
@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
source common/ui.sh
|
||||
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
echo "You should run this script as root (sudo)."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export DISTRIBUTION='centos'
|
||||
export RELEASE=$1
|
||||
export ARCH=$2
|
||||
export CONTAINER=$3
|
||||
export PACKAGE=$4
|
||||
export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs"
|
||||
export WORKING_DIR="/tmp/${CONTAINER}"
|
||||
export NOW=$(date -u)
|
||||
export LOG=$(readlink -f .)/log/${CONTAINER}.log
|
||||
|
||||
mkdir -p $(dirname $LOG)
|
||||
echo '############################################' > ${LOG}
|
||||
echo "# Beginning build at $(date)" >> ${LOG}
|
||||
touch ${LOG}
|
||||
chmod +rw ${LOG}
|
||||
|
||||
if [ -f ${PACKAGE} ]; then
|
||||
warn "The box '${PACKAGE}' already exists, skipping..."
|
||||
echo
|
||||
exit
|
||||
fi
|
||||
|
||||
debug "Creating ${WORKING_DIR}"
|
||||
mkdir -p ${WORKING_DIR}
|
||||
|
||||
info "Building box to '${PACKAGE}'..."
|
||||
|
||||
./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||
# ./centos/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER}
|
||||
./centos/install-extras.sh ${CONTAINER}
|
||||
./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER}
|
||||
./centos/clean.sh ${CONTAINER}
|
||||
./common/package.sh ${CONTAINER} ${PACKAGE}
|
||||
|
||||
info "Finished building '${PACKAGE}'!"
|
||||
log "Run \`sudo lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way"
|
||||
echo
|
||||
Loading…
Reference in New Issue