1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
index 962d274..ce7226f 100644
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
@@ -1,20 +1,99 @@
#!/bin/sh
+key_sha256sums="9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4 alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
+2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub"
+
+get_static_apk () {
+ wget="wget -q -O -"
+ pkglist=alpine-keys:apk-tools-static
+ auto_repo_dir=
+
+ if [ -z "$repository" ]; then
+ url=http://wiki.alpinelinux.org/cgi-bin/dl.cgi
+ if [ -z "$release" ]; then
+ echo -n "Determining the latest release... "
+ release=$($wget $url/.latest.$apk_arch.txt | \
+ cut -d " " -f 3 | cut -d / -f 1 | uniq)
+ if [ -z "$release" ]; then
+ echo failed
+ return 1
+ fi
+ echo $release
+ fi
+ auto_repo_dir=$release/main
+ repository=$url/$auto_repo_dir
+ pkglist=$pkglist:alpine-mirrors
+ fi
+
+ rootfs="$1"
+ echo "Using static apk from $repository/$apk_arch"
+ wget="$wget $repository/$apk_arch"
+
+ # parse APKINDEX to find the current versions
+ static_pkgs=$($wget/APKINDEX.tar.gz | \
+ tar -Oxz APKINDEX | \
+ awk -F: -v pkglist=$pkglist '
+ BEGIN { split(pkglist,pkg) }
+ $0 != "" { f[$1] = $2 }
+ $0 == "" { for (i in pkg)
+ if (pkg[i] == f["P"])
+ print(f["P"] "-" f["V"] ".apk") }')
+ [ "$static_pkgs" ] || return 1
+
+ mkdir -p "$rootfs" || return 1
+ for pkg in $static_pkgs; do
+ echo "Downloading $pkg"
+ $wget/$pkg | tar -xz -C "$rootfs"
+ done
+
+ # clean up .apk meta files
+ rm -f "$rootfs"/.[A-Z]*
+
+ # verify checksum of the key
+ keyname=$(echo $rootfs/sbin/apk.static.*.pub | sed 's/.*\.SIGN\.RSA\.//')
+ checksum=$(echo "$key_sha256sums" | grep -w "$keyname")
+ if [ -z "$checksum" ]; then
+ echo "ERROR: checksum is missing for $keyname"
+ return 1
+ fi
+ (cd $rootfs/etc/apk/keys && echo "$checksum" | sha256sum -c -) || return 1
+
+ # verify the static apk binary signature
+ APK=$rootfs/sbin/apk.static
+ openssl dgst -verify $rootfs/etc/apk/keys/$keyname \
+ -signature "$APK.SIGN.RSA.$keyname" "$APK" || return 1
+
+ if [ "$auto_repo_dir" ]; then
+ mirror_list=$rootfs/usr/share/alpine-mirrors/MIRRORS.txt
+ mirror_count=$(wc -l $mirror_list | cut -d " " -f 1)
+ repository=$(sed $(expr $RANDOM % $mirror_count + 1)\!d \
+ $mirror_list)$auto_repo_dir
+ echo "Selecting mirror $repository"
+ fi
+}
+
install_alpine() {
rootfs="$1"
shift
mkdir -p "$rootfs"/etc/apk || return 1
- cp -r ${keys_dir:-/etc/apk/keys} "$rootfs"/etc/apk/
+ : ${keys_dir:=/etc/apk/keys}
+ if ! [ -d "$rootfs"/etc/apk/keys ] && [ -d "$keys_dir" ]; then
+ cp -r "$keys_dir" "$rootfs"/etc/apk/keys
+ fi
if [ -n "$repository" ]; then
echo "$repository" > "$rootfs"/etc/apk/repositories
else
cp /etc/apk/repositories "$rootfs"/etc/apk/repositories || return 1
+ if [ -n "$release" ]; then
+ sed -i -e "s:/[^/]\+/\([^/]\+\)$:/$release/\1:" \
+ "$rootfs"/etc/apk/repositories
+ fi
fi
opt_arch=
if [ -n "$apk_arch" ]; then
opt_arch="--arch $apk_arch"
fi
- ${APK:-apk} add -U --initdb --root $rootfs $opt_arch "$@" alpine-base
+ $APK add -U --initdb --root $rootfs $opt_arch "$@" alpine-base
}
configure_alpine() {
@@ -109,6 +188,7 @@ EOF
lxc.tty = 4
lxc.pts = 1024
lxc.utsname = $hostname
+lxc.cap.drop = sys_module mac_admin mac_override sys_time
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
@@ -129,7 +209,7 @@ lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
-lxc.cgroup.devices.allow = c 254:0 rwm
+lxc.cgroup.devices.allow = c 254:0 rm
# mounts point
lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
@@ -148,8 +228,10 @@ die() {
usage() {
cat >&2 <<EOF
-Usage: $(basename $0) [-h|--help] [-r|--repository <url>] [-a|--arch <arch>]
- -p|--path <path> -n|--name <name> [PKG...]
+Usage: $(basename $0) [-h|--help] [-r|--repository <url>]
+ [-R|--release <release>] [-a|--arch <arch>]
+ [--rootfs <rootfs>] -p|--path <path> -n|--name <name>
+ [PKG...]
EOF
}
@@ -165,6 +247,14 @@ optarg_check() {
}
default_path=@LXCPATH@
+release=
+arch=$(uname -m)
+
+# template mknods, requires root
+if [ $(id -u) -ne 0 ]; then
+ echo "$(basename $0): must be run as root" >&2
+ exit 1
+fi
while [ $# -gt 0 ]; do
opt="$1"
@@ -179,6 +269,11 @@ while [ $# -gt 0 ]; do
name=$1
shift
;;
+ --rootfs)
+ optarg_check $opt "$1"
+ rootfs=$1
+ shift
+ ;;
-p|--path)
optarg_check $opt "$1"
path=$1
@@ -189,6 +284,11 @@ while [ $# -gt 0 ]; do
repository=$1
shift
;;
+ -R|--release)
+ optarg_check $opt "$1"
+ release=$1
+ shift
+ ;;
-a|--arch)
optarg_check $opt "$1"
arch=$1
@@ -217,9 +317,11 @@ if [ -z "${path}" ]; then
path="${default_path}/${name}"
fi
-rootfs=`awk -F= '$1 ~ /^lxc.rootfs/ { print $2 }' "$path/config" 2>/dev/null`
if [ -z "$rootfs" ]; then
- rootfs="${path}/rootfs"
+ rootfs=`awk -F= '$1 ~ /^lxc.rootfs/ { print $2 }' "$path/config" 2>/dev/null`
+ if [ -z "$rootfs" ]; then
+ rootfs="${path}/rootfs"
+ fi
fi
lxc_arch=$arch
@@ -234,6 +336,11 @@ case "$arch" in
*) die "unsupported architecture: $arch";;
esac
+: ${APK:=apk}
+if ! which $APK >/dev/null; then
+ get_static_apk "$rootfs" || die "Failed to download a valid static apk"
+fi
+
install_alpine "$rootfs" "$@" || die "Failed to install rootfs for $name"
configure_alpine "$rootfs" "$name" || die "Failed to configure $name"
copy_configuration "$path" "$rootfs" "$name"
|
