Linux容器技术-lxc创建虚拟机的执行过程分析

1. lxc介绍

    容器是一种轻量级的虚拟化技术，与qemu/kvm、VMware、Xen等完全的虚拟化方案相比，LXC更像是加强的“chroot”，因为LXC不但没有没有对硬件设备进行仿真，而且可以与主机共享一模一样的操作系统，所以LXC与solaris的zones和BSD的jails相比，更具优势。

    目前，有两个比较方便的管理容器的用户空间的工具：libvirt和lxc。libvirt通过”lxc:///”像管理其他虚拟机驱动一样管理lxc虚拟机。另一个是与libvirt完全独立的LXC，它定义了一些列的命令，可以更灵活的管理和使用lxc。

    下面，将以LXC为例来介绍lxc的使用。

2 LXC的安装和使用

（1）LXC的安装

1. sudo apt-get install lxc

1. #!/bin/bash
   
2. 
   
3. #
   
4. # template script for generating ubuntu container for LXC
   
5. #
   
6. # This script consolidates and extends the existing lxc ubuntu scripts
   
7. #
   
8. 
   
9. # Copyright ?2011 Serge Hallyn <serge.hallyn@canonical.com>
   
10. # Copyright ?2010 Wilhelm Meier
    
11. # Author: Wilhelm Meier <wilhelm.meier@fh-kl.de>
    
12. #
    
13. # This program is free software; you can redistribute it and/or modify
    
14. # it under the terms of the GNU General Public License version 2, as
    
15. # published by the Free Software Foundation.
    
16. 
    
17. # This program is distributed in the hope that it will be useful,
    
18. # but WITHOUT ANY WARRANTY; without even the implied warranty of
    
19. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    
20. # GNU General Public License for more details.
    
21. 
    
22. # You should have received a copy of the GNU General Public License along
    
23. # with this program; if not, write to the Free Software Foundation, Inc.,
    
24. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
    
25. #
    
26. 
    
27. set -e   ##如果命令带非零值返回,立即退出
    
28. 
    
29. if [ -r /etc/default/lxc ]; then
    
30. . /etc/default/lxc                 #导入一些环境变量
    
31. fi
    
32. 
    
33. configure_ubuntu()
    
34. {
    
35. rootfs=$1
    
36. hostname=$2
    
37. release=$3
    
38. 
    
39. # configure the network using the dhcp
    
40. cat <<EOF > $rootfs/etc/network/interfaces
    
41. # This file describes the network interfaces available on your system
    
42. # and how to activate them. For more information, see interfaces(5).
    
43. 
    
44. # The loopback network interface
    
45. auto lo
    
46. iface lo inet loopback
    
47. 
    
48. auto eth0
    
49. iface eth0 inet dhcp
    
50. EOF
    
51. 
    
52. # set the hostname
    
53. cat <<EOF > $rootfs/etc/hostname
    
54. $hostname
    
55. EOF
    
56. # set minimal hosts
    
57. cat <<EOF > $rootfs/etc/hosts
    
58. 127.0.0.1 localhost
    
59. 127.0.1.1 $hostname
    
60. 
    
61. # The following lines are desirable for IPv6 capable hosts
    
62. ::1 ip6-localhost ip6-loopback
    
63. fe00::0 ip6-localnet
    
64. ff00::0 ip6-mcastprefix
    
65. ff02::1 ip6-allnodes
    
66. ff02::2 ip6-allrouters
    
67. EOF
    
68. 
    
69. if [ ! -f $rootfs/etc/init/container-detect.conf ]; then
    
70. # suppress log level output for udev
    
71. sed -i “s/=\”err\”/=0/” $rootfs/etc/udev/udev.conf
    
72. 
    
73. # remove jobs for consoles 5 and 6 since we only create 4 consoles in
    
74. # this template
    
75. rm -f $rootfs/etc/init/tty{5,6}.conf
    
76. fi
    
77. 
    
78. if [ -z “$bindhome” ]; then
    
79. chroot $rootfs useradd –create-home -s /bin/bash ubuntu
    
80. echo “ubuntu:ubuntu” | chroot $rootfs chpasswd
    
81. fi
    
82. 
    
83. return 0
    
84. }
    
85. 
    
86. # finish setting up the user in the container by injecting ssh key and
    
87. # adding sudo group membership.
    
88. # passed-in user is either ‘ubuntu’ or the user to bind in from host.
    
89. finalize_user()
    
90. {
    
91. user=$1
    
92. 
    
93. sudo_version=$(chroot $rootfs dpkg-query -W -f=’${Version}’ sudo)
    
94. 
    
95. if chroot $rootfs dpkg –compare-versions $sudo_version gt “1.8.3p1-1”; then
    
96. groups=”sudo”
    
97. else
    
98. groups=”sudo admin”
    
99. fi
    
100. 
     
101. for group in $groups; do
     
102. chroot $rootfs groupadd –system $group >/dev/null 2>&1 || true
     
103. chroot $rootfs adduser ${user} $group >/dev/null 2>&1 || true
     
104. done
     
105. 
     
106. if [ -n “$auth_key” -a -f “$auth_key” ]; then
     
107. u_path=”/home/${user}/.ssh”
     
108. root_u_path=”$rootfs/$u_path”
     
109. 
     
110. mkdir -p $root_u_path
     
111. cp $auth_key “$root_u_path/authorized_keys”
     
112. chroot $rootfs chown -R ${user}: “$u_path”
     
113. 
     
114. echo “Inserted SSH public key from $auth_key into /home/${user}/.ssh/authorized_keys”
     
115. fi
     
116. return 0
     
117. }
     
118. 
     
119. write_sourceslist()
     
120. {
     
121. # $1 => path to the rootfs
     
122. # $2 => architecture we want to add
     
123. # $3 => whether to use the multi-arch syntax or not
     
124. 
     
125. case $2 in
     
126. amd64|i386)
     
127. MIRROR=${MIRROR:-http://archive.ubuntu.com/ubuntu}
     
128. SECURITY_MIRROR=${SECURITY_MIRROR:-http://security.ubuntu.com/ubuntu}
     
129. ;;
     
130. *)
     
131. MIRROR=${MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
     
132. SECURITY_MIRROR=${SECURITY_MIRROR:-http://ports.ubuntu.com/ubuntu-ports}
     
133. ;;
     
134. esac
     
135. if [ -n “$3” ]; then
     
136. cat >> “$1/etc/apt/sources.list” << EOF
     
137. deb [arch=$2] $MIRROR ${release} main restricted universe multiverse
     
138. deb [arch=$2] $MIRROR ${release}-updates main restricted universe multiverse
     
139. deb [arch=$2] $SECURITY_MIRROR ${release}-security main restricted universe multiverse
     
140. EOF
     
141. else
     
142. cat >> “$1/etc/apt/sources.list” << EOF
     
143. deb $MIRROR ${release} main restricted universe multiverse
     
144. deb $MIRROR ${release}-updates main restricted universe multiverse
     
145. deb $SECURITY_MIRROR ${release}-security main restricted universe multiverse
     
146. EOF
     
147. fi
     
148. }
     
149. 
     
150. download_ubuntu()
     
151. {
     
152. cache=$1
     
153. arch=$2
     
154. release=$3
     
155. 
     
156. packages=vim,ssh
     
157. echo “installing packages: $packages”
     
158. 
     
159. # check the mini ubuntu was not already downloaded
     
160. mkdir -p “$cache/partial-$arch”
     
161. if [ $? -ne 0 ]; then
     
162. echo “Failed to create ‘$cache/partial-$arch’ directory”
     
163. return 1
     
164. fi
     
165. 
     
166. # download a mini ubuntu into a cache
     
167. echo “Downloading ubuntu $release minimal …”
     
168. if [ -n “$(which qemu-debootstrap)” ]; then
     
169. qemu-debootstrap –verbose –components=main,universe –arch=$arch –include=$packages $release $cache/partial-$arch $MIRROR
     
170. else
     
171. debootstrap –verbose –components=main,universe –arch=$arch –include=$packages $release $cache/partial-$arch $MIRROR   ##在这里下载制定的linux发行版
     
172. fi
     
173. 
     
174. if [ $? -ne 0 ]; then
     
175. echo “Failed to download the rootfs, aborting.”
     
176. return 1
     
177. fi
     
178. 
     
179. # Serge isn’t sure whether we should avoid doing this when
     
180. # $release == `distro-info -d`
     
181. echo “Installing updates”
     
182. > $cache/partial-$arch/etc/apt/sources.list
     
183. write_sourceslist $cache/partial-$arch/ $arch   ##下载完成后，修改source.lst文件，升级和安装软件做准备
     
184. 
     
     
185. ##改变系统的根目录，执行update，因为，要用新的source.lst

1. chroot “$1/partial-${arch}” apt-get update
   
2. if [ $? -ne 0 ]; then
   
3. echo “Failed to update the apt cache”
   
4. return 1
   
5. fi
   
6. cat > “$1/partial-${arch}”/usr/sbin/policy-rc.d << EOF
   
7. #!/bin/sh
   
8. exit 101
   
9. EOF
   
10. chmod +x “$1/partial-${arch}”/usr/sbin/policy-rc.d
    
11. 
    
12. lxc-unshare -s MOUNT — chroot “$1/partial-${arch}” apt-get dist-upgrade -y
    
13. ret=$?
    
14. rm -f “$1/partial-${arch}”/usr/sbin/policy-rc.d
    
15. 
    
16. if [ $ret -ne 0 ]; then
    
17. echo “Failed to upgrade the cache”
    
18. return 1
    
19. fi
    
20. 
    
21. mv “$1/partial-$arch” “$1/rootfs-$arch”
    
22. echo “Download complete”
    
23. return 0
    
24. }
    
25. 
    
26. copy_ubuntu()
    
27. {
    
28. cache=$1
    
29. arch=$2
    
30. rootfs=$3
    
31. 
    
32. # make a local copy of the miniubuntu
    
33. echo “Copying rootfs to $rootfs …”
    
34. mkdir -p $rootfs
    
35. #使用rsync进行镜像的备份，实际相当于镜像的拷贝
    
36. rsync -a $cache/rootfs-$arch/ $rootfs/ || return 1
    
37. return 0
    
38. }
    
39. 
    
40. install_ubuntu()
    
41. {
    
42. rootfs=$1
    
43. release=$2
    
44. flushcache=$3
    
45. cache=”/var/cache/lxc/$release”
    
46. mkdir -p /var/lock/subsys/
    
47. 
    
48. (
    
49. flock -x 200
    
50. if [ $? -ne 0 ]; then
    
51. echo “Cache repository is busy.”
    
52. return 1
    
53. fi
    
54. 
    
55. 
    
56. if [ $flushcache -eq 1 ]; then
    
57. echo “Flushing cache…”
    
58. rm -rf “$cache/partial-$arch”
    
59. rm -rf “$cache/rootfs-$arch”
    
60. fi
    
61. 
    
62. echo “Checking cache download in $cache/rootfs-$arch … ”
    
63. if [ ! -e “$cache/rootfs-$arch” ]; then
    
64. download_ubuntu $cache $arch $release  ##下载指定版本的系统到cache目录下
    
65. if [ $? -ne 0 ]; then
    
66. echo “Failed to download ‘ubuntu $release base'”
    
67. return 1
    
68. fi
    
69. fi
    
70. 
    
71. echo “Copy $cache/rootfs-$arch to $rootfs … ”
    
72. copy_ubuntu $cache $arch $rootfs  ##从cache目录下拷贝到真正的根目录下
    
73. if [ $? -ne 0 ]; then
    
74. echo “Failed to copy rootfs”
    
75. return 1
    
76. fi
    
77. 
    
78. return 0
    
79. 
    
80. ) 200>/var/lock/subsys/lxc
    
81. 
    
82. return $?
    
83. }
    
84. 
    
85. copy_configuration()
    
86. {
    
87. path=$1
    
88. rootfs=$2
    
89. name=$3
    
90. arch=$4
    
91. release=$5
    
92. 
    
93. if [ $arch = “i386” ]; then
    
94. arch=”i686″
    
95. fi
    
96. 
    
97. ttydir=””
    
98. if [ -f $rootfs/etc/init/container-detect.conf ]; then
    
99. ttydir=” lxc”
    
100. fi
     
101. 
     
102. # if there is exactly one veth network entry, make sure it has an
     
103. # associated hwaddr.
     
104. nics=`grep -e ‘^lxc\.network\.type[ \t]*=[ \t]*veth’ $path/config | wc -l`
     
105. if [ $nics -eq 1 ]; then
     
106. grep -q “^lxc.network.hwaddr” $path/config || cat <<EOF >> $path/config
     
107. lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed ‘s/\(..\)/\1:/g; s/.$//’)
     
108. EOF
     
109. fi
     
110. 
     
111. cat <<EOF >> $path/config
     
112. lxc.utsname = $name
     
113. 
     
114. lxc.devttydir =$ttydir
     
115. lxc.tty = 4
     
116. lxc.pts = 1024
     
117. lxc.rootfs = $rootfs
     
118. lxc.mount = $path/fstab
     
119. lxc.arch = $arch
     
120. lxc.cap.drop = sys_module mac_admin
     
121. lxc.pivotdir = lxc_putold
     
122. 
     
123. # uncomment the next line to run the container unconfined:
     
124. #lxc.aa_profile = unconfined
     
125. 
     
126. lxc.cgroup.devices.deny = a
     
127. # Allow any mknod (but not using the node)
     
128. lxc.cgroup.devices.allow = c *:* m
     
129. lxc.cgroup.devices.allow = b *:* m
     
130. # /dev/null and zero
     
131. lxc.cgroup.devices.allow = c 1:3 rwm
     
132. lxc.cgroup.devices.allow = c 1:5 rwm
     
133. # consoles
     
134. lxc.cgroup.devices.allow = c 5:1 rwm
     
135. lxc.cgroup.devices.allow = c 5:0 rwm
     
136. #lxc.cgroup.devices.allow = c 4:0 rwm
     
137. #lxc.cgroup.devices.allow = c 4:1 rwm
     
138. # /dev/{,u}random
     
139. lxc.cgroup.devices.allow = c 1:9 rwm
     
140. lxc.cgroup.devices.allow = c 1:8 rwm
     
141. lxc.cgroup.devices.allow = c 136:* rwm
     
142. lxc.cgroup.devices.allow = c 5:2 rwm
     
143. # rtc
     
144. lxc.cgroup.devices.allow = c 254:0 rwm
     
145. #fuse
     
146. lxc.cgroup.devices.allow = c 10:229 rwm
     
147. #tun
     
148. lxc.cgroup.devices.allow = c 10:200 rwm
     
149. #full
     
150. lxc.cgroup.devices.allow = c 1:7 rwm
     
151. #hpet
     
152. lxc.cgroup.devices.allow = c 10:228 rwm
     
153. #kvm
     
154. lxc.cgroup.devices.allow = c 10:232 rwm
     
155. EOF
     
156. 
     
157. cat <<EOF > $path/fstab
     
158. proc proc proc nodev,noexec,nosuid 0 0
     
159. sysfs sys sysfs defaults 0 0
     
160. EOF
     
161. 
     
162. if [ $? -ne 0 ]; then
     
163. echo “Failed to add configuration”
     
164. return 1
     
165. fi
     
166. 
     
167. return 0
     
168. }
     
169. 
     
170. trim()
     
171. {
     
172. rootfs=$1
     
173. release=$2
     
174. 
     
175. # provide the lxc service
     
176. cat <<EOF > $rootfs/etc/init/lxc.conf
     
177. # fake some events needed for correct startup other services
     
178. 
     
179. description “Container Upstart”
     
180. 
     
181. start on startup
     
182. 
     
183. script
     
184. rm -rf /var/run/*.pid
     
185. rm -rf /var/run/network/*
     
186. /sbin/initctl emit stopped JOB=udevtrigger –no-wait
     
187. /sbin/initctl emit started JOB=udev –no-wait
     
188. end script
     
189. EOF
     
190. 
     
191. # fix buggus runlevel with sshd
     
192. cat <<EOF > $rootfs/etc/init/ssh.conf
     
193. # ssh – OpenBSD Secure Shell server
     
194. #
     
195. # The OpenSSH server provides secure shell access to the system.
     
196. 
     
197. description “OpenSSH server”
     
198. 
     
199. start on filesystem
     
200. stop on runlevel [!2345]
     
201. 
     
202. expect fork
     
203. respawn
     
204. respawn limit 10 5
     
205. umask 022
     
206. # replaces SSHD_OOM_ADJUST in /etc/default/ssh
     
207. oom never
     
208. 
     
209. pre-start script
     
210. test -x /usr/sbin/sshd || { stop; exit 0; }
     
211. test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; }
     
212. test -c /dev/null || { stop; exit 0; }
     
213. 
     
214. mkdir -p -m0755 /var/run/sshd
     
215. end script
     
216. 
     
217. # if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
     
218. # ‘exec’ line here instead
     
219. exec /usr/sbin/sshd
     
220. EOF
     
221. 
     
222. cat <<EOF > $rootfs/etc/init/console.conf
     
223. # console – getty
     
224. #
     
225. # This service maintains a console on tty1 from the point the system is
     
226. # started until it is shut down again.
     
227. 
     
228. start on stopped rc RUNLEVEL=[2345]
     
229. stop on runlevel [!2345]
     
230. 
     
231. respawn
     
232. exec /sbin/getty -8 38400 /dev/console
     
233. EOF
     
234. 
     
235. cat <<EOF > $rootfs/lib/init/fstab
     
236. # /lib/init/fstab: cleared out for bare-bones lxc
     
237. EOF
     
238. 
     
239. # reconfigure some services
     
240. if [ -z “$LANG” ]; then
     
241. chroot $rootfs locale-gen en_US.UTF-8
     
242. chroot $rootfs update-locale LANG=en_US.UTF-8
     
243. else
     
244. chroot $rootfs locale-gen $LANG
     
245. chroot $rootfs update-locale LANG=$LANG
     
246. fi
     
247. 
     
248. # remove pointless services in a container
     
249. chroot $rootfs /usr/sbin/update-rc.d -f ondemand remove
     
250. 
     
251. chroot $rootfs /bin/bash -c ‘cd /etc/init; for f in $(ls u*.conf); do mv $f $f.orig; done’
     
252. chroot $rootfs /bin/bash -c ‘cd /etc/init; for f in $(ls tty[2-9].conf); do mv $f $f.orig; done’
     
253. chroot $rootfs /bin/bash -c ‘cd /etc/init; for f in $(ls plymouth*.conf); do mv $f $f.orig; done’
     
254. chroot $rootfs /bin/bash -c ‘cd /etc/init; for f in $(ls hwclock*.conf); do mv $f $f.orig; done’
     
255. chroot $rootfs /bin/bash -c ‘cd /etc/init; for f in $(ls module*.conf); do mv $f $f.orig; done’
     
256. 
     
257. # if this isn’t lucid, then we need to twiddle the network upstart bits 🙁
     
258. if [ $release != “lucid” ]; then
     
259. sed -i ‘s/^.*emission handled.*$/echo Emitting lo/’ $rootfs/etc/network/if-up.d/upstart
     
260. fi
     
261. }
     
262. 
     
263. post_process()
     
264. {
     
265. rootfs=$1
     
266. release=$2
     
267. trim_container=$3
     
268. 
     
269. if [ $trim_container -eq 1 ]; then
     
270. trim $rootfs $release
     
271. elif [ ! -f $rootfs/etc/init/container-detect.conf ]; then
     
272. # Make sure we have a working resolv.conf
     
273. cresolvonf=”${rootfs}/etc/resolv.conf”
     
274. mv $cresolvonf ${cresolvonf}.lxcbak
     
275. cat /etc/resolv.conf > ${cresolvonf}
     
276. 
     
277. # for lucid, if not trimming, then add the ubuntu-virt
     
278. # ppa and install lxcguest
     
279. if [ $release = “lucid” ]; then
     
280. chroot $rootfs apt-get install –force-yes -y python-software-properties
     
281. chroot $rootfs add-apt-repository ppa:ubuntu-virt/ppa
     
282. fi
     
283. 
     
284. chroot $rootfs apt-get update
     
285. chroot $rootfs apt-get install –force-yes -y lxcguest
     
286. 
     
287. # Restore old resolv.conf
     
288. rm -f ${cresolvonf}
     
289. mv ${cresolvonf}.lxcbak ${cresolvonf}
     
290. fi
     
291. 
     
292. # If the container isn’t running a native architecture, setup multiarch
     
293. if [ -x “$(ls -1 ${rootfs}/usr/bin/qemu-*-static 2>/dev/null)” ]; then
     
294. dpkg_version=$(chroot $rootfs dpkg-query -W -f=’${Version}’ dpkg)
     
295. if chroot $rootfs dpkg –compare-versions $dpkg_version ge “1.16.2”; then
     
296. chroot $rootfs dpkg –add-architecture ${hostarch}
     
297. else
     
298. mkdir -p ${rootfs}/etc/dpkg/dpkg.cfg.d
     
299. echo “foreign-architecture ${hostarch}” > ${rootfs}/etc/dpkg/dpkg.cfg.d/lxc-multiarch
     
300. fi
     
301. 
     
302. # Save existing value of MIRROR and SECURITY_MIRROR
     
303. DEFAULT_MIRROR=$MIRROR
     
304. DEFAULT_SECURITY_MIRROR=$SECURITY_MIRROR
     
305. 
     
306. # Write a new sources.list containing both native and multiarch entries
     
307. > ${rootfs}/etc/apt/sources.list
     
308. write_sourceslist $rootfs $arch “native”
     
309. 
     
310. MIRROR=$DEFAULT_MIRROR
     
311. SECURITY_MIRROR=$DEFAULT_SECURITY_MIRROR
     
312. write_sourceslist $rootfs $hostarch “multiarch”
     
313. 
     
314. # Finally update the lists and install upstart using the host architecture
     
315. chroot $rootfs apt-get update
     
316. chroot $rootfs apt-get install –force-yes -y –no-install-recommends upstart:${hostarch} mountall:${hostarch} iproute:${hostarch} isc-dhcp-client:${hostarch}
     
317. fi
     
318. 
     
319. # rmdir /dev/shm for containers that have /run/shm
     
320. # I’m afraid of doing rm -rf $rootfs/dev/shm, in case it did
     
321. # get bind mounted to the host’s /run/shm. So try to rmdir
     
322. # it, and in case that fails move it out of the way.
     
323. if [ -d $rootfs/run/shm ]; then
     
324. [ -d “$rootfs/dev/shm” ] && rmdir $rootfs/dev/shm
     
325. [ -e “$rootfs/dev/shm” ] && mv $rootfs/dev/shm $rootfs/dev/shm.bak
     
326. ln -s /run/shm $rootfs/dev/shm
     
327. fi
     
328. }
     
329. 
     
330. do_bindhome()
     
331. {
     
332. rootfs=$1
     
333. user=$2
     
334. 
     
335. # copy /etc/passwd, /etc/shadow, and /etc/group entries into container
     
336. pwd=`getent passwd $user` || { echo “Failed to copy password entry for $user”; false; }
     
337. echo $pwd >> $rootfs/etc/passwd
     
338. 
     
339. # make sure user’s shell exists in the container
     
340. shell=`echo $pwd | cut -d: -f 7`
     
341. if [ ! -x $rootfs/$shell ]; then
     
342. echo “shell $shell for user $user was not found in the container.”
     
343. pkg=`dpkg -S $(readlink -m $shell) | cut -d ‘:’ -f1`
     
344. echo “Installing $pkg”
     
345. chroot $rootfs apt-get –force-yes -y install $pkg
     
346. fi
     
347. 
     
348. shad=`getent shadow $user`
     
349. echo “$shad” >> $rootfs/etc/shadow
     
350. 
     
351. # bind-mount the user’s path into the container’s /home
     
352. h=`getent passwd $user | cut -d: -f 6`
     
353. mkdir -p $rootfs/$h
     
354. 
     
355. # use relative path in container
     
356. h2=${h#/}
     
357. while [ ${h2:0:1} = “/” ]; do
     
358. h2=${h2#/}
     
359. done
     
360. echo “$h $h2 none bind 0 0” >> $path/fstab
     
361. 
     
362. # Make sure the group exists in container
     
363. grp=`echo $pwd | cut -d: -f 4` # group number for $user
     
364. grpe=`getent group $grp` || return 0 # if host doesn’t define grp, ignore in container
     
365. chroot $rootfs getent group “$grpe” || echo “$grpe” >> $rootfs/etc/group
     
366. }
     
367. 
     
368. usage()
     
369. {
     
370. cat <<EOF
     
371. $1 -h|–help [-a|–arch] [-b|–bindhome <user>] [–trim] [-d|–debug]
     
372. [-F | –flush-cache] [-r|–release <release>] [ -S | –auth-key <keyfile>]
     
373. release: the ubuntu release (e.g. precise): defaults to host release on ubuntu, otherwise uses latest LTS
     
374. trim: make a minimal (faster, but not upgrade-safe) container
     
375. bindhome: bind <user>’s home into the container
     
376. The ubuntu user will not be created, and <user> will have
     
377. sudo access.
     
378. arch: the container architecture (e.g. amd64): defaults to host arch
     
379. auth-key: SSH Public key file to inject into container
     
380. EOF
     
381. return 0
     
382. }
     
383. 
     
384. options=$(getopt -o a:b:hp:r:xn:FS:d -l arch:,bindhome:,help,path:,release:,trim,name:,flush-cache,auth-key:,debug — “$@”)
     
385. if [ $? -ne 0 ]; then
     
386. usage $(basename $0)
     
387. exit 1
     
388. fi
     
389. eval set — “$options”
     
390. 
     
391. release=precise # Default to the last Ubuntu LTS release for non-Ubuntu systems
     
392. if [ -f /etc/lsb-release ]; then
     
393. . /etc/lsb-release
     
394. if [ “$DISTRIB_ID” = “Ubuntu” ]; then
     
395. release=$DISTRIB_CODENAME
     
396. fi
     
397. fi
     
398. 
     
399. bindhome=
     
400. arch=$(arch)
     
401. 
     
402. # Code taken from debootstrap
     
403. if [ -x /usr/bin/dpkg ] && /usr/bin/dpkg –print-architecture >/dev/null 2>&1; then
     
404. arch=`/usr/bin/dpkg –print-architecture`
     
405. elif type udpkg >/dev/null 2>&1 && udpkg –print-architecture >/dev/null 2>&1; then
     
406. arch=`/usr/bin/udpkg –print-architecture`
     
407. else
     
408. arch=$(arch)
     
409. if [ “$arch” = “i686” ]; then
     
410. arch=”i386″
     
411. elif [ “$arch” = “x86_64” ]; then
     
412. arch=”amd64″
     
413. elif [ “$arch” = “armv7l” ]; then
     
414. arch=”armel”
     
415. fi
     
416. fi
     
417. 
     
418. debug=0
     
419. trim_container=0
     
420. hostarch=$arch
     
421. flushcache=0
     
422. while true
     
423. do
     
424. case “$1” in
     
425. -h|–help) usage $0 && exit 0;;
     
426. -p|–path) path=$2; shift 2;;
     
427. -n|–name) name=$2; shift 2;;
     
428. -F|–flush-cache) flushcache=1; shift 1;;
     
429. -r|–release) release=$2; shift 2;;
     
430. -b|–bindhome) bindhome=$2; shift 2;;
     
431. -a|–arch) arch=$2; shift 2;;
     
432. -x|–trim) trim_container=1; shift 1;;
     
433. -S|–auth-key) auth_key=$2; shift 2;;
     
434. -d|–debug) debug=1; shift 1;;
     
435. –) shift 1; break ;;
     
436. *) break ;;
     
437. esac
     
438. done
     
439. 
     
440. if [ $debug -eq 1 ]; then
     
441. set -x
     
442. fi
     
443. 
     
444. if [ -n “$bindhome” ]; then
     
445. pwd=`getent passwd $bindhome`
     
446. if [ $? -ne 0 ]; then
     
447. echo “Error: no password entry found for $bindhome”
     
448. exit 1
     
449. fi
     
450. fi
     
451. 
     
452. 
     
453. if [ “$arch” == “i686” ]; then
     
454. arch=i386
     
455. fi
     
456. 
     
457. if [ $hostarch = “i386” -a $arch = “amd64” ]; then
     
458. echo “can’t create amd64 container on i386”
     
459. exit 1
     
460. fi
     
461. 
     
462. type debootstrap
     
463. if [ $? -ne 0 ]; then
     
464. echo “‘debootstrap’ command is missing”
     
465. exit 1
     
466. fi
     
467. 
     
468. if [ -z “$path” ]; then
     
469. echo “‘path’ parameter is required”
     
470. exit 1
     
471. fi
     
472. 
     
473. if [ “$(id -u)” != “0” ]; then
     
474. echo “This script should be run as ‘root'”
     
475. exit 1
     
476. fi
     
477. 
     
478. rootfs=$path/rootfs
     
479. ##执行的第一个操作，rootfs文件系统挂载点，flushcache创建cache的目录，release创建实例的版本
     
480. install_ubuntu $rootfs $release $flushcache  
     
481. if [ $? -ne 0 ]; then
     
482. echo “failed to install ubuntu $release”
     
483. exit 1
     
484. fi
     
485. 
     
486. configure_ubuntu $rootfs $name $release ##将镜像从cache拷贝到真正的rootfs
     
487. if [ $? -ne 0 ]; then
     
488. echo “failed to configure ubuntu $release for a container”
     
489. exit 1
     
490. fi
     
491. 
     
492. copy_configuration $path $rootfs $name $arch $release  ##在根目录下生成config文件，并在fstab中挂载/proc和/fs
     
493. if [ $? -ne 0 ]; then
     
494. echo “failed write configuration file”
     
495. exit 1
     
496. fi

1. post_process $rootfs $release $trim_container
   
2. 
   
3. if [ -n “$bindhome” ]; then
   
4. do_bindhome $rootfs $bindhome
   
5. finalize_user $bindhome
   
6. else
   
7. finalize_user ubuntu ##创建用户/属组，配置ssh用户名和密码
   
8. fi
   
9. 
   
10. echo “”
    
11. echo “##”
    
12. echo “# The default user is ‘ubuntu’ with password ‘ubuntu’!”
    
13. echo “# Use the ‘sudo’ command to run tasks as root in the container.”
    
14. echo “##”
    
15. echo “”