path: root/lib/container/start

#!/bin/sh

# container-tools - Manage systemd-nspawn containers
# Copyright (C) 2014-2017 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

set -e

COMMAND="$(basename ${0})"

CONFIG="/etc/systemd/nspawn"
HOOKS="/etc/container-tools/hooks"
MACHINES="/var/lib/machines"

START="false"
SYSTEMCTL="true"

Parameters ()
{
	GETOPT_LONGOPTIONS="name:,force,nspawn,start,"
	GETOPT_OPTIONS="n:f,"

	PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${COMMAND} --options ${GETOPT_OPTIONS} --shell sh -- ${@})"

	if [ "${?}" != "0" ]
	then
		echo "'${COMMAND}': getopt exit" >&2
		exit 1
	fi

	eval set -- "${PARAMETERS}"

	while true
	do
		case "${1}" in
			-n|--name)
				NAME="${2}"
				shift 2
				;;

			-f|--force)
				FORCE="true"
				shift 1
				;;

			--nspawn)
				# internal option
				SYSTEMCTL="false"
				shift 1
				;;

			--start)
				# internal option
				START="true"
				SYSTEMCTL="false"
				shift 1
				;;

			--)
				shift 1
				break
				;;

			*)
				echo "'${COMMAND}': getopt error" >&2
				exit 1
				;;
		esac
	done
}

Usage ()
{
	echo "Usage: container ${COMMAND} -n|--name NAME [-f|--force]" >&2
	exit 1
}

Parameters "${@}"

if [ -z "${NAME}" ]
then
	Usage
fi

if [ ! -e "${MACHINES}/${NAME}" ]
then
	echo "'${NAME}': no such container" >&2
	exit 1
fi

case "${START}" in
	false)
		STATE="$(machinectl show ${NAME} 2>&1 | awk -F= '/^State=/ { print $2 }')"

		case "${STATE}" in
			running)
				echo "'${NAME}': container is already started" >&2
				exit 1
				;;
		esac
		;;
esac

if [ -e "${MACHINES}/.#${NAME}.lck" ]
then
	case "${FORCE}" in
		true)
			rm -f "${MACHINES}/.#${NAME}.lck"
			;;

		*)
			echo "'${NAME}': container is locked" >&2
			exit 1
			;;
	esac
fi

HOST_ARCHITECTURE="$(dpkg --print-architecture)"
MACHINE_ARCHITECTURE="$(chroot ${MACHINES}/${NAME} dpkg --print-architecture)"

case "${HOST_ARCHITECTURE}" in
	amd64)
		case "${MACHINE_ARCHITECTURE}" in
			i386)
				SETARCH="setarch i686"
				;;

			*)
				SETARCH=""
				;;
		esac
		;;

	arm64)
		case "${MACHINE_ARCHITECTURE}" in
			armel|armhf)
				SETARCH="setarch armv7l"
				;;

			*)
				SETARCH=""
				;;
		esac
		;;
esac

case "${START}" in
	start)
		;;

	*)
		# Pre hooks
		for FILE in "${HOOKS}/pre-${COMMAND}".* "${HOOKS}/${NAME}.pre-${COMMAND}"
		do
			if [ -x "${FILE}" ]
			then
				"${FILE}"
			fi
		done
		;;
esac

# config
if [ -e "${CONFIG}/${NAME}.nspawn" ]
then
	CNT_OVERLAY="$(crudini --get ${CONFIG}/${NAME}.nspawn Files Overlay)"

	if [ -n "${CNT_OVERLAY}" ]
	then
		CNT_OVERLAYS="$(echo ${CNT_OVERLAY} | sed -e 's|;| |g')"

		for CNT_OVERLAY in ${CNT_OVERLAYS}
		do
			DIRECTORY_LOWER="$(echo ${CNT_OVERLAY} | awk -F: '{ print $1 }')"
			DIRECTORY_UPPER="$(echo ${CNT_OVERLAY} | awk -F: '{ print $2 }')"
			DIRECTORY_WORK="$(echo ${CNT_OVERLAY} | awk -F: '{ print $3 }')"
			DIRECTORY_MERGED="$(echo ${CNT_OVERLAY} | awk -F: '{ print $4 }')"

			for DIRECTORY in "${DIRECTORY_LOWER}" "${DIRECTORY_UPPER}" "${DIRECTORY_WORK}" "${DIRECTORY_MERGED}"
			do
				mkdir -p "${DIRECTORY}"
			done

			if ! findmnt -n -o SOURCE "${DIRECTORY_MERGED}" | grep -qs '^cnt.overlay-'
			then
				mount cnt.overlay-${NAME} -t overlay -olowerdir="${DIRECTORY_LOWER}",upperdir="${DIRECTORY_UPPER}",workdir="${DIRECTORY_WORK}",default_permissions "${DIRECTORY_MERGED}"
			fi
		done
	fi

	BIND="$(crudini --get ${CONFIG}/${NAME}.nspawn Files Bind)"

	if [ -n "${BIND}" ]
	then
		BINDS="$(echo ${BIND} | sed -e 's|;| |g')"

		for BIND in ${BINDS}
		do
			DIRECTORY="$(echo ${BIND} | awk -F: '{ print $1 }')"

			mkdir -p "${DIRECTORY}"
		done

		BIND=""

		for DIRECTORIES in ${BINDS}
		do
			BIND="${BIND} --bind ${DIRECTORIES}"
		done
	fi

	BIND_RO="$(crudini --get ${CONFIG}/${NAME}.nspawn Files BindReadOnly)"

	if [ -n "${BIND_RO}" ]
	then
		BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"

		for BIND_RO in ${BINDS_RO}
		do
			DIRECTORY="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"

			mkdir -p "${DIRECTORY}"
		done

		BIND_RO=""

		for DIRECTORIES in ${BINDS_RO}
		do
			BIND_RO="${BIND_RO} --bind-ro ${DIRECTORIES}"
		done
	fi

	BOOT="$(crudini --get ${CONFIG}/${NAME}.nspawn Exec Boot)"

	case "${BOOT}" in
		yes)
			BOOT="--boot"
			;;

		*)
			BOOT=""
			;;
	esac

	CAPABILITY="$(crudini --get ${CONFIG}/${NAME}.nspawn Exec Capability)"

	case "${CAPABILITY}" in
		"")
			CAPABILITY=""
			;;

		*)
			CAPABILITY="--capability=${CAPABILITY}"
			;;
	esac

	DIRECTORY="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools directory)"
	DIRECTORY="--directory ${DIRECTORY}"

	DROP_CAPABILITY="$(crudini --get ${CONFIG}/${NAME}.nspawn Exec DropCapability)"

	case "${DROP_CAPABILITY}" in
		"")
			DROP_CAPABILITY=""
			;;

		*)
			DROP_CAPABILITY="--drop-capability=${DROP_CAPABILITY}"
			;;
	esac

	LINK_JOURNAL="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools link-journal)"

	case "${LINK_JOURNAL}" in
		yes)
			LINK_JOURNAL="--link-journal=yes"
			;;

		*)
			LINK_JOURNAL="--link-journal=no"
			;;
	esac

	MACHINE="--machine=${NAME}"

	NETWORK_VETH_EXTRA_CONF="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools network-veth-extra)"
	NETWORK_VETH_EXTRA=""

	case "${NETWORK_VETH_EXTRA_CONF}" in
		"")
			;;

		*)
			for VETH in ${NETWORK_VETH_EXTRA_CONF}
			do
				NETWORK_VETH_EXTRA="${NETWORK_VETH_EXTRA} --network-veth-extra=${VETH}"
				INTERFACE="$(echo ${VETH} | awk -F: '{ print $1 }')"

				if [ "$(echo ${INTERFACE} | wc -c)" -gt 15 ]
				then
					echo "'${INTERFACE}': name exceeds maximum of 15 characters, network might be not working."
				fi

cat > "/etc/network/interfaces.d/${INTERFACE}" << EOF
allow-hotplug ${INTERFACE}
iface ${INTERFACE} inet manual
	pre-up ifconfig ${INTERFACE} up
	post-down ifconfig ${INTERFACE} down
EOF

			done
			;;
	esac

	NETWORK_BRIDGES="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools cnt.network-bridge)"

	case "${NETWORK_BRIDGES}" in
		"")
			;;

		*)
			for BRIDGE_DEFINITION in ${NETWORK_BRIDGES}
			do
				INTERFACE="$(echo ${BRIDGE_DEFINITION} | awk -F: '{ print $1 }')"
				BRIDGE="$(echo ${BRIDGE_DEFINITION} | awk -F: '{ print $2 }')"

				if [ "$(echo ${INTERFACE} | wc -c)" -gt 15 ]
				then
					echo "'${INTERFACE}': name exceeds maximum of 15 characters, network might be not working."
				fi

				if [ -n "${BRIDGE}" ] && [ -n "${INTERFACE}" ]
				then

cat > "/etc/network/interfaces.d/${INTERFACE}" << EOF
allow-hotplug ${INTERFACE}
iface ${INTERFACE} inet manual
	pre-up ifconfig ${INTERFACE} up
	post-up brctl addif ${BRIDGE} ${INTERFACE}
	pre-down brctl delif ${BRIDGE} ${INTERFACE}
	post-down ifconfig ${INTERFACE} down
EOF

				else
					echo "Warning bridge definition '${BRIDGE_DEFINITION}' not recognized (expected <bridge>:<interface>): Ignoring"
				fi
			done
			;;
	esac

	PRIVATE_USERS="$(crudini --get ${CONFIG}/${NAME}.nspawn Exec PrivateUsers)"

	case "${PRIVATE_USERS}" in
		yes)
			PRIVATE_USERS="--private-users=yes"
			;;

		*)
			PRIVATE_USERS="--private-users=no"
			;;
	esac

	REGISTER="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools register)"

	case "${REGISTER}" in
		yes)
			REGISTER="--register=yes"
			;;

		*)
			REGISTER="--register=no"
			;;
	esac

	BLOCK_IO_DEVICE_WEIGHT="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools BlockIODeviceWeight)"

	if [ -n "${BLOCK_IO_DEVICE_WEIGHT}" ]
	then
		BLOCK_IO_DEVICE_WEIGHT="BlockIODeviceWeight=${BLOCK_IO_DEVICE_WEIGHT}"BlockIODeviceWeight
		SET_PROPERTY="true"
	fi

	BLOCK_IO_READ_BANDWIDTH="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools BlockIOReadBandwidth)"

	if [ -n "${BLOCK_IO_READ_BANDWIDTH}" ]
	then
		BLOCK_IO_READ_BANDWIDTH="BlockIOReadBandwidth=${BLOCK_IO_READ_BANDWIDTH}"
		SET_PROPERTY="true"
	fi

	BLOCK_IO_WEIGHT="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools BlockIOWeight)"

	if [ -n "${BLOCK_IO_WEIGHT}" ]
	then
		BLOCK_IO_WEIGHT="BlockIOWeight=${BLOCK_IO_WEIGHT}"
		SET_PROPERTY="true"
	fi

	BLOCK_IO_WRITE_BANDWIDTH="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools BlockIOWriteBandwidth)"

	if [ -n "${BLOCK_IO_WRITE_BANDWIDTH}" ]
	then
		BLOCK_IO_WRITE_BANDWIDTH="BlockIOWriteBandwidth=${BLOCK_IO_WRITE_BANDWIDTH}"
		SET_PROPERTY="true"
	fi

	CPU_QUOTA="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools CPUQuota)"

	if [ -n "${CPU_QUOTA}" ]
	then
		CPU_QUOTA="CPUQuota=${CPU_QUOTA}"
		SET_PROPERTY="true"
	fi

	CPU_SHARES="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools CPUShares)"

	if [ -n "${CPU_SHARES}" ]
	then
		CPU_SHARES="CPUShares=${CPU_SHARES}"
		SET_PROPERTY="true"
	fi

	MEMORY_LIMIT="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools MemoryLimit)"

	if [ -n "${MEMORY_LIMIT}" ]
	then
		MEMORY_LIMIT="MemoryLimit=${MEMORY_LIMIT}"
		SET_PROPERTY="true"
	fi

	TASKS_MAX="$(crudini --get ${CONFIG}/${NAME}.nspawn ContainerTools TasksMax)"

	if [ -n "${TASKS_MAX}" ]
	then
		TASKS_MAX="TasksMax=${TASKS_MAX}"
		SET_PROPERTY="true"
	fi
fi

case "${SYSTEMCTL}" in
	true)
		systemctl start container@${NAME}.service
		# FIXME start console .. after sleep? + configuration option
		exit 0
		;;
esac

case "${START}" in
	true)
		case "${SET_PROPERTY}" in
			true)
				systemctl --runtime set-property ${NAME} ${BLOCK_IO_DEVICE_WEIGHT} ${BLOCK_IO_READ_BANDWIDTH} ${BLOCK_IO_WEIGHT} ${BLOCK_IO_WRITE_BANDWIDTH} ${CPU_QUOTA} ${CPU_SHARES} ${MEMORY_LIMIT} ${TASKS_MAX}
				;;
		esac
		;;

	*)
		# Run
		${SETARCH} systemd-nspawn --keep-unit ${BIND} ${BIND_RO} ${BOOT} ${CAPABILITY} ${DIRECTORY} ${DROP_CAPABILITY} ${MACHINE} ${NETWORK_VETH_EXTRA} ${LINK_JOURNAL} ${REGISTER}

		# Post hooks
		for FILE in "${HOOKS}/post-${COMMAND}".* "${HOOKS}/${NAME}.post-${COMMAND}"
		do
			if [ -x "${FILE}" ]
			then
				"${FILE}"
			fi
		done
		;;
esac