Compare commits

..

11 commits

Author SHA1 Message Date
aadfdb0229 Merge pull request #486 from boltronics/truncate_config_on_update 2021-05-05 00:59:01 +02:00
3421d7eb0f Merge pull request #401 from cangeli/multiple-private-networks 2021-05-05 00:46:12 +02:00
b6a7210ddc Bump vagrant-lxc version 2021-05-05 00:42:08 +02:00
4b826e5592 Merge pull request #483 from Aguay-val/patch-1
* Fix catchall regex to avoid privilege escalation.
* Ref: https://github.com/fgrehm/vagrant-lxc/pull/483
2021-05-05 00:29:19 +02:00
459c281b8e Merge branch 'contrib/fix-travis-ci-after-new-github-branch-naming' into develop 2021-05-05 00:23:23 +02:00
4777d58e0d chore: update ruby & bundler version for CI
* bundler 1.12.5 breaks with current version of dependencies
  (NoMethodError: undefined method `[]' for nil:NilClass)
* vagrant-2.2.17 requires ruby version ~> 2.5, < 2.8
2021-05-05 00:01:02 +02:00
4069ce8595 fix: gem vagrant* (dependencies) now use branch 'main' instead of 'master' 2021-05-05 00:01:02 +02:00
a9b0d34bb2 fix: resolve issues with cgroup2 and lxc4 2021-05-04 19:28:20 +02:00
Adam Bolte
ba8d6ac630
Truncate config on writes
Fix for #485.
2019-10-21 16:53:36 +11:00
Aguay-val
ebec6a80c0
Update sudoers.rb.erb
Fix catchall regex to avoid privilege escalation.

Related to issue : https://github.com/fgrehm/vagrant-lxc/issues/482
2019-04-17 15:21:26 +02:00
Christophe Angeli
16a555ceec add interface option for pipework script + iterate the networks 2016-01-16 18:49:22 +01:00
8 changed files with 53 additions and 41 deletions

View file

@ -1,10 +1,10 @@
---
language: ruby
rvm:
- 2.2
- 2.3
- 2.4
- 2.5
- 2.6
- 2.7
install:
- gem install -v 1.12.5 bundler
- bundle _1.12.5_ install --jobs=3 --retry=3
- gem install -v 1.16.2 bundler
- bundle _1.16.2_ install --jobs=3 --retry=3
script: "bundle exec rake ci"

View file

@ -1,7 +1,7 @@
source 'https://rubygems.org'
group :development do
gem 'vagrant', git: 'https://github.com/mitchellh/vagrant.git'
gem 'vagrant', git: 'https://github.com/mitchellh/vagrant.git', branch: 'main'
gem 'guard'
gem 'guard-rspec'
gem 'rb-inotify'
@ -11,7 +11,7 @@ group :development, :test do
gem 'rake', '~> 10.4.2'
gem 'rspec', '~> 3.5.0'
gem 'coveralls', '~> 0.7.2', require: (ENV['COVERAGE'] == 'true')
gem 'vagrant-spec', git: 'https://github.com/mitchellh/vagrant-spec.git'
gem 'vagrant-spec', git: 'https://github.com/mitchellh/vagrant-spec.git', branch: 'main'
end
group :plugins do

View file

@ -1,7 +1,3 @@
🟢 We plan to support and maintain vagrant-lxc, as well as clean it up.<br/>
🟢 Please feel free to contribute Issues and pull requests.<br/>
🟢 P.S: Thanks [Fabio Rehm](https://fabiorehm.com) for the amazing initial project.
# vagrant-lxc
[![Build Status](https://travis-ci.org/fgrehm/vagrant-lxc.png?branch=master)](https://travis-ci.org/fgrehm/vagrant-lxc) [![Gem Version](https://badge.fury.io/rb/vagrant-lxc.png)](http://badge.fury.io/rb/vagrant-lxc) [![Code Climate](https://codeclimate.com/github/fgrehm/vagrant-lxc.png)](https://codeclimate.com/github/fgrehm/vagrant-lxc) [![Coverage Status](https://coveralls.io/repos/fgrehm/vagrant-lxc/badge.png?branch=master)](https://coveralls.io/r/fgrehm/vagrant-lxc) [![Gitter chat](https://badges.gitter.im/fgrehm/vagrant-lxc.png)](https://gitter.im/fgrehm/vagrant-lxc)
@ -13,6 +9,10 @@ as an alternative to the built in VirtualBox provider for Linux hosts. Check out
[this blog post](http://fabiorehm.com/blog/2013/04/28/lxc-provider-for-vagrant/)
to see it in action.
## Help Needed!
This project is looking for maintainers, please see [GH-375](https://github.com/fgrehm/vagrant-lxc/issues/375) for more.
## Features
* Provides the same workflow as the Vagrant VirtualBox provider

View file

@ -22,16 +22,17 @@ module Vagrant
end
def configure_private_networks(env)
env[:machine].config.vm.networks.find do |type, config|
env[:machine].config.vm.networks.find_all.each do |type, config|
next if type.to_sym != :private_network
container_name = env[:machine].provider.driver.container_name
container_interface = config[:interface]
address_type = config[:type]
ip = config[:ip]
bridge_ip = config.fetch(:lxc__bridge_ip) { build_bridge_ip(ip) }
bridge = config.fetch(:lxc__bridge_name)
env[:machine].provider.driver.configure_private_network(bridge, bridge_ip, container_name, address_type, ip)
env[:machine].provider.driver.configure_private_network(bridge, bridge_ip, container_name, container_interface, address_type, ip)
end
end

View file

@ -130,8 +130,11 @@ module Vagrant
@cli.info(*command)
end
def configure_private_network(bridge_name, bridge_ip, container_name, address_type, ip)
@logger.info "Configuring network interface for #{container_name} using #{ip} and bridge #{bridge_name}"
def configure_private_network(bridge_name, bridge_ip, container_name, container_interface, address_type, ip)
if ! container_interface
container_interface = "eth1"
end
@logger.info "Configuring network interface #{container_interface} for #{container_name} using #{ip} and bridge #{bridge_name}"
if ip
ip += '/24'
end
@ -170,6 +173,8 @@ module Vagrant
cmd = [
Vagrant::LXC.source_root.join('scripts/pipework').to_s,
bridge_name,
"-i",
container_interface,
container_name,
ip ||= "dhcp"
]
@ -270,7 +275,7 @@ module Vagrant
def write_config(contents)
confpath = base_path.join('config').to_s
begin
File.open(confpath, File::RDWR) do |file|
File.open(confpath, File::WRONLY|File::TRUNC) do |file|
file.write contents
end
rescue

View file

@ -1,5 +1,5 @@
module Vagrant
module LXC
VERSION = "1.4.2"
VERSION = "1.4.3"
end
end

View file

@ -144,9 +144,12 @@ CONTAINER_IFNAME=${CONTAINER_IFNAME:-eth1}
# Second step: find the guest (for now, we only support LXC containers)
while read _ mnt fstype options _; do
[ "$fstype" != "cgroup" ] && continue
[ "$fstype" != "cgroup2" ] && [ "$fstype" != "cgroup" ] && continue
if [ "$fstype" = "cgroup" ]; then
echo "$options" | grep -qw devices || continue
fi
CGROUPMNT=$mnt
CGROUPTYPE=$fstype
done < /proc/mounts
[ "$CGROUPMNT" ] || {
@ -154,7 +157,9 @@ done < /proc/mounts
}
# Try to find a cgroup matching exactly the provided name.
N=$(find "$CGROUPMNT" -name "$GUESTNAME" | wc -l)
[ "$CGROUPTYPE" = "cgroup" ] && N=$(find "$CGROUPMNT" -name "$GUESTNAME" | wc -l)
[ "$CGROUPTYPE" = "cgroup2" ] && N=$(find "$CGROUPMNT" -name "lxc.payload.$GUESTNAME" | wc -l)
case "$N" in
0)
# If we didn't find anything, try to lookup the container with Docker.
@ -235,7 +240,8 @@ fi
if [ "$DOCKERPID" ]; then
NSPID=$DOCKERPID
else
NSPID=$(head -n 1 "$(find "$CGROUPMNT" -name "$GUESTNAME" | head -n 1)/tasks")
NSPATH=$(find "$CGROUPMNT" -name "$GUESTNAME" | head -n 1)
[ -f "$NSPATH/tasks" ] && NSPID=$(head -n 1 "$NSPATH/tasks")
[ "$NSPID" ] || {
# it is an alternative way to get the pid
NSPID=$(lxc-info -n "$GUESTNAME" | grep PID | grep -Eo '[0-9]+')
@ -390,7 +396,7 @@ else
;;
"")
if installed ipcalc; then
eval "$(ipcalc -b $IPADDR)"
eval $(ipcalc -b $IPADDR)
ip netns exec "$NSPID" ip addr add "$IPADDR" brd "$BROADCAST" dev "$CONTAINER_IFNAME"
else
ip netns exec "$NSPID" ip addr add "$IPADDR" dev "$CONTAINER_IFNAME"

View file

@ -79,7 +79,7 @@ class Whitelist
end
base = "<%= lxc_base_path %>"
base_path = %r{\A#{base}/.*\z}
base_path = %r{\A#{base}/[\ -_\/\.\d\w]+$\z}
##
# Commands from provider.rb
@ -93,11 +93,11 @@ Whitelist.add '<%= cmd_paths['cat'] %>', base_path
# - Shared folders
Whitelist.add '<%= cmd_paths['mkdir'] %>', '-p', base_path
# - Container config customizations and pruning
Whitelist.add '<%= cmd_paths['cp'] %>', '-f', %r{/tmp/.*}, base_path
Whitelist.add '<%= cmd_paths['cp'] %>', '-f', %r{/tmp/[\ -_\/\.\d\w]+$}, base_path
Whitelist.add '<%= cmd_paths['chown'] %>', 'root:root', base_path
# - Packaging
Whitelist.add '<%= cmd_paths['tar'] %>', '--numeric-owner', '-cvzf', %r{/tmp/.*/rootfs.tar.gz}, '-C', base_path, './rootfs'
Whitelist.add '<%= cmd_paths['chown'] %>', /\A\d+:\d+\z/, %r{\A/tmp/.*/rootfs\.tar\.gz\z}
Whitelist.add '<%= cmd_paths['tar'] %>', '--numeric-owner', '-cvzf', %r{/tmp/^[\ -_\/\.\d\w]+$/rootfs.tar.gz}, '-C', base_path, './rootfs'
Whitelist.add '<%= cmd_paths['chown'] %>', /\A\d+:\d+\z/, %r{\A/tmp/^[\ -_\/\.\d\w]+$/rootfs\.tar\.gz\z}
# - Private network script and commands
Whitelist.add '<%= cmd_paths['ip'] %>', 'addr', 'add', /(\d+|\.)+\/24/, 'dev', /.+/
Whitelist.add '<%= cmd_paths['ip'] %>', 'link', 'set', /.+/, /(up|down)/
@ -108,22 +108,22 @@ Whitelist.add_regex %r{<%= pipework_regex %>}, '**'
# Commands from driver/cli.rb
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-version'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-ls'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /.*/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /.*/, '-iH'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-create', '-B', /.*/, '--template', /.*/, '--name', /.*/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /^[\ -_\/\.\d\w]+$/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-info', '--name', /^[\ -_\/\.\d\w]+$/, '-iH'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-create', '-B', /^[\ -_\/\.\d\w]+$/, '--template', /^[\ -_\/\.\d\w]+$/, '--name', /^[\ -_\/\.\d\w]+$/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-create', '--version'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-destroy', '--name', /.*/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-start', '-d', '--name', /.*/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-stop', '--name', /.*/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-shutdown', '--name', /.*/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-attach', '--name', /.*/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-destroy', '--name', /^[\ -_\/\.\d\w]+$/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-start', '-d', '--name', /^[\ -_\/\.\d\w]+$/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-stop', '--name', /^[\ -_\/\.\d\w]+$/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-shutdown', '--name', /^[\ -_\/\.\d\w]+$/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-attach', '--name', /^[\ -_\/\.\d\w]+$/, '**'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-attach', '-h'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-config', 'lxc.lxcpath'
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-update-config', '-c', /.*/
Whitelist.add '<%= cmd_paths['lxc_bin'] %>/lxc-update-config', '-c', /^[\ -_\/\.\d\w]+$/
##
# Commands from driver/action/remove_temporary_files.rb
Whitelist.add '<%= cmd_paths['rm'] %>', '-rf', %r{\A#{base}/.*/rootfs/tmp/.*}
Whitelist.add '<%= cmd_paths['rm'] %>', '-rf', %r{\A#{base}/^[\ -_\/\.\d\w]+$/rootfs/tmp/[\ -_\/\.\d\w]+$}
# Watch out for stones
Whitelist.run!(ARGV)