forked from 89luca89/distrobox
-
Notifications
You must be signed in to change notification settings - Fork 0
/
distrobox-create
executable file
·634 lines (585 loc) · 20.9 KB
/
distrobox-create
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only
#
# This file is part of the distrobox project:
# https://github.com/89luca89/distrobox
#
# Copyright (C) 2021 distrobox contributors
#
# distrobox is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 3
# as published by the Free Software Foundation.
#
# distrobox is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with distrobox; if not, see <http://www.gnu.org/licenses/>.
# POSIX
# Expected env variables:
# HOME
# USER
# Optional env variables:
# DBX_CONTAINER_ALWAYS_PULL
# DBX_CONTAINER_CUSTOM_HOME
# DBX_CONTAINER_IMAGE
# DBX_CONTAINER_MANAGER
# DBX_CONTAINER_NAME
# DBX_NON_INTERACTIVE
# DBX_SUDO_PROGRAM
trap '[ "$?" -ne 0 ] && printf "\nAn error occurred\n"' EXIT
# Dont' run this command as sudo.
if [ "$(id -u)" -eq 0 ]; then
printf >&2 "Running %s as sudo is not supported.\n" "$(basename "${0}")"
printf >&2 " try instead running:\n"
printf >&2 " %s --root %s\n" "$(basename "${0}")" "$*"
exit 1
fi
# Defaults
container_always_pull=0
container_clone=""
container_image=""
container_image_default="registry.fedoraproject.org/fedora-toolbox:36"
container_init_hook=""
container_manager="autodetect"
container_manager_additional_flags=""
container_name=""
container_pre_init_hook=""
container_user_custom_home=""
container_user_gid="$(id -rg)"
container_user_home="${HOME:-"/"}"
container_user_name="${USER}"
container_user_uid="$(id -ru)"
distrobox_sudo_program="sudo"
dryrun=0
init=0
non_interactive=0
rootful=0
verbose=0
version="1.3.2"
# Source configuration files, this is done in an hierarchy so local files have
# priority over system defaults
# leave priority to environment variables.
config_files="
/usr/share/distrobox/distrobox.conf
/usr/etc/distrobox/distrobox.conf
/etc/distrobox/distrobox.conf
${XDG_CONFIG_HOME:-"${HOME}/.config"}/distrobox/distrobox.conf
${HOME}/.distroboxrc
"
for config_file in ${config_files}; do
# Shellcheck will give error for sourcing a variable file as it cannot follow
# it. We don't care so let's disable this linting for now.
# shellcheck disable=SC1090
[ -e "${config_file}" ] && . "${config_file}"
done
# Fixup non_interactive=[true|false], in case we find it in the config file(s)
[ "${non_interactive}" = "true" ] && non_interactive=1
[ "${non_interactive}" = "false" ] && non_interactive=0
[ -n "${DBX_CONTAINER_ALWAYS_PULL}" ] && container_always_pull="${DBX_CONTAINER_ALWAYS_PULL}"
[ -n "${DBX_CONTAINER_CUSTOM_HOME}" ] && container_user_custom_home="${DBX_CONTAINER_CUSTOM_HOME}"
[ -n "${DBX_CONTAINER_IMAGE}" ] && container_image="${DBX_CONTAINER_IMAGE}"
[ -n "${DBX_CONTAINER_MANAGER}" ] && container_manager="${DBX_CONTAINER_MANAGER}"
[ -n "${DBX_CONTAINER_NAME}" ] && container_name="${DBX_CONTAINER_NAME}"
[ -n "${DBX_NON_INTERACTIVE}" ] && non_interactive="${DBX_NON_INTERACTIVE}"
[ -n "${DBX_SUDO_PROGRAM}" ] && distrobox_sudo_program="${DBX_SUDO_PROGRAM}"
# Print usage to stdout.
# Arguments:
# None
# Outputs:
# print usage with examples.
show_help() {
cat << EOF
distrobox version: ${version}
Usage:
distrobox create --image alpine:latest --name test --init-hooks "touch /var/tmp/test1 && touch /var/tmp/test2"
distrobox create --image fedora:35 --name test --additional-flags "--env MY_VAR-value"
distrobox create --image fedora:35 --name test --volume /opt/my-dir:/usr/local/my-dir:rw --additional-flags "--pids-limit -1"
distrobox create -i docker.io/almalinux/8-init --init --name test --pre-init-hooks "dnf config-manager --enable powertools && dnf -y install epel-release"
distrobox create --clone fedora-35 --name fedora-35-copy
distrobox create --image alpine my-alpine-container
distrobox create --image registry.fedoraproject.org/fedora-toolbox:35 --name fedora-toolbox-35
distrobox create --pull --image centos:stream9 --home ~/distrobox/centos9
DBX_NON_INTERACTIVE=1 DBX_CONTAINER_NAME=test-alpine DBX_CONTAINER_IMAGE=alpine distrobox-create
Options:
--image/-i: image to use for the container default: registry.fedoraproject.org/fedora-toolbox:36
--name/-n: name for the distrobox default: my-distrobox
--pull/-p: pull the image even if it exists locally (implies --yes)
--yes/-Y: non-interactive, pull images without asking
--root/-r: launch podman/docker with root privileges. Note that if you need root this is the preferred
way over "sudo distrobox" (note: if using a program other than 'sudo' for root privileges is necessary,
specify it through the DBX_SUDO_PROGRAM env variable, or 'distrobox_sudo_program' config variable)
--clone/-c: name of the distrobox container to use as base for a new container
this will be useful to either rename an existing distrobox or have multiple copies
of the same environment.
--home/-H select a custom HOME directory for the container. Useful to avoid host's home littering with temp files.
--volume additional volumes to add to the container
--additional-flags/-a: additional flags to pass to the container manager command
--init-hooks additional commands to execute during container initialization
--pre-init-hooks additional commands to execute prior to container initialization
--init/-I use init system (like systemd) inside the container.
this will make host's processes not visible from within the container.
--help/-h: show this message
--dry-run/-d: only print the container manager command generated
--verbose/-v: show more verbosity
--version/-V: show version
Compatibility:
for a list of compatible images and container managers, please consult the man page:
man distrobox-compatibility
or consult the documentation page on: https://github.com/89luca89/distrobox/blob/main/docs/compatibility.md
EOF
}
# Parse arguments
while :; do
case $1 in
-h | --help)
# Call a "show_help" function to display a synopsis, then exit.
show_help
exit 0
;;
-v | --verbose)
verbose=1
shift
;;
-V | --version)
printf "distrobox: %s\n" "${version}"
exit 0
;;
-d | --dry-run)
shift
dryrun=1
;;
-r | --root)
shift
rootful=1
;;
-I | --init)
shift
init=1
;;
-i | --image)
if [ -n "$2" ]; then
container_image="$2"
shift
shift
fi
;;
-n | --name)
if [ -n "$2" ]; then
container_name="$2"
shift
shift
fi
;;
-c | --clone)
if [ -n "$2" ]; then
container_clone="$2"
shift
shift
fi
;;
-H | --home)
if [ -n "$2" ]; then
container_user_custom_home="$2"
shift
shift
fi
;;
-p | --pull)
container_always_pull=1
shift
;;
-Y | --yes)
non_interactive=1
shift
;;
--volume)
if [ -n "$2" ]; then
container_manager_additional_flags="${container_manager_additional_flags} ${1} ${2}"
shift
shift
fi
;;
-a | --additional-flags)
if [ -n "$2" ]; then
container_manager_additional_flags="${container_manager_additional_flags} ${2}"
shift
shift
fi
;;
--init-hooks)
if [ -n "$2" ]; then
container_init_hook="$2"
shift
shift
fi
;;
--pre-init-hooks)
if [ -n "$2" ]; then
container_pre_init_hook="--pre-init-hooks \"${2}\""
shift
shift
fi
;;
--) # End of all options.
shift
break
;;
-*) # Invalid options.
printf >&2 "ERROR: Invalid flag '%s'\n\n" "$1"
show_help
exit 1
;;
*) # Default case: If no more options then break out of the loop.
# If we have a flagless option and container_name is not specified
# then let's accept argument as container_name
if [ -n "$1" ]; then
container_name="$1"
shift
else
break
fi
;;
esac
done
set -o errexit
set -o nounset
# set verbosity
if [ "${verbose}" -ne 0 ]; then
set -o xtrace
fi
# If no clone option and no container image, let's choose a default image to use.
# Fedora toolbox is a sensitive default
if [ -z "${container_clone}" ] && [ -z "${container_image}" ]; then
container_image="${container_image_default}"
fi
# If no name is specified and we're using the default container_image, then let's
# set a default name for the container, that is distinguishable from the default
# toolbx one. This will avoid problems when using both toolbx and distrobox on
# the same system.
if [ -z "${container_name}" ] && [ "${container_image}" = "${container_image_default}" ]; then
container_name="my-distrobox"
fi
# If no container_name is declared, we build our container name starting from the
# container image specified.
#
# Examples:
# alpine -> alpine
# ubuntu:20.04 -> ubuntu-20.04
# registry.fedoraproject.org/fedora-toolbox:35 -> fedora-toolbox-35
# ghcr.io/void-linux/void-linux:latest-full-x86_64 -> void-linux-latest-full-x86_64
if [ -z "${container_name}" ]; then
container_name="$(basename "${container_image}" | sed -E 's/[:.]/-/g')"
fi
# We depend on a container manager let's be sure we have it
# First we use podman, else docker
case "${container_manager}" in
autodetect)
if command -v podman > /dev/null; then
container_manager="podman"
elif command -v docker > /dev/null; then
container_manager="docker"
fi
;;
podman)
container_manager="podman"
;;
docker)
container_manager="docker"
;;
*)
printf >&2 "Invalid input %s.\n" "${container_manager}"
printf >&2 "The available choices are: 'autodetect', 'podman', 'docker'\n"
;;
esac
# Be sure we have a container manager to work with.
if ! command -v "${container_manager}" > /dev/null && [ "${dryrun}" -eq 0 ]; then
# Error: we need at least one between docker or podman.
printf >&2 "Missing dependency: we need a container manager.\n"
printf >&2 "Please install one of podman or docker.\n"
printf >&2 "You can follow the documentation on:\n"
printf >&2 "\tman distrobox-compatibility\n"
printf >&2 "or:\n"
printf >&2 "\thttps://github.com/89luca89/distrobox/blob/main/docs/compatibility.md\n"
exit 127
fi
# add verbose if -v is specified
if [ "${verbose}" -ne 0 ]; then
container_manager="${container_manager} --log-level debug"
fi
# prepend sudo (or the specified sudo program) if we want podman or docker to be rootful
if [ "${rootful}" -ne 0 ]; then
container_manager="${distrobox_sudo_program} ${container_manager}"
fi
# Clone a container as a snapshot.
# Arguments:
# None
# Outputs:
# prints the image name of the newly cloned container
clone_container() {
# We need to clone a container.
# to do this we will commit the container and create a new tag. Then use it
# as image for the new container.
#
# to perform this we first ensure the source container exists and that the
# source container is stopped, else the clone will not work,
container_source_status="$(${container_manager} inspect --type container \
"${container_clone}" --format '{{.State.Status}}')"
# If the container is not already running, we need to start if first
if [ "${container_source_status}" = "running" ]; then
printf >&2 "Container %s is running.\nPlease stop it first.\n" "${container_clone}"
printf >&2 "Cannot clone a running container.\n"
return 1
fi
# Now we can extract the container ID and commit it to use as source image
# for the new container.
container_source_id="$(${container_manager} inspect --type container \
"${container_clone}" --format '{{.Id}}')"
container_commit_tag="$(echo "${container_clone}:$(date +%F)" | tr '[:upper:]' '[:lower:]')"
# Commit current container state to a new image tag
printf >&2 "Duplicating %s...\n" "${container_clone}"
if ! ${container_manager} container commit \
"${container_source_id}" "${container_commit_tag}" > /dev/null; then
printf >&2 "Cannot clone container: %s\n" "${container_clone}"
return 1
fi
# Return the image tag to use for the new container creation.
printf "%s" "${container_commit_tag}"
return 0
}
# Generate Podman or Docker command to execute.
# Arguments:
# None
# Outputs:
# prints the podman or docker command to create the distrobox container
generate_command() {
# Set the container hostname the same as the container name.
result_command="${container_manager} create"
# use the host's namespace for ipc, network, pid, ulimit
result_command="${result_command}
--hostname \"${container_name}.$(uname -n)\"
--ipc host
--name \"${container_name}\"
--network host
--privileged
--security-opt label=disable
--user root:root"
if [ "${init}" -eq 0 ]; then
result_command="${result_command}
--pid host"
fi
# Mount useful stuff inside the container.
# We also mount host's root filesystem to /run/host, to be able to syphon
# dynamic configurations from the host.
#
# Mount user home, dev and host's root inside container.
# This grants access to external devices like usb webcams, disks and so on.
#
# Mount also the distrobox-init utility as the container entrypoint.
# Also mount in the container the distrobox-export and distrobox-host-exec
# utilities.
result_command="${result_command}
--label \"manager=distrobox\"
--env \"SHELL=${SHELL:-"/bin/bash"}\"
--env \"HOME=${container_user_home}\"
--volume \"${container_user_home}\":\"${container_user_home}\":rslave
--volume /:/run/host:rslave
--volume /dev:/dev:rslave
--volume /sys:/sys:rslave
--volume /tmp:/tmp:rslave"
# This fix is needed as on Selinux systems, the host's selinux sysfs directory
# will be mounted inside the rootless container.
#
# This works around this and allows the rootless container to work when selinux
# policies are installed inside it.
#
# Ref. Podman issue 4452:
# https://github.com/containers/podman/issues/4452
if [ -e "/sys/fs/selinux" ]; then
result_command="${result_command}
--volume /sys/fs/selinux"
fi
# This fix is needed as systemd (or journald) will try to set ACLs on this
# path. For now overlayfs and fuse.overlayfs are not compatible with ACLs
#
# This works around this using an unnamed volume so that this path will be
# mounted with a normal non-overlay FS, allowing ACLs and preventing errors.
#
# This work around works in conjunction with distrobox-init's package manager
# setups.
# So that we can use pre/post hooks for package managers to present to the
# systemd install script a blank path to work with, and mount the host's
# journal path afterwards.
result_command="${result_command}
--volume /var/log/journal"
# In some systems, for example using sysvinit, /dev/shm is a symlink
# to /run/shm, instead of the other way around.
# Resolve this detecting if /dev/shm is a symlink and mount original
# source also in the container.
if [ -L "/dev/shm" ]; then
result_command="${result_command}
--volume $(realpath /dev/shm):$(realpath /dev/shm)"
fi
# If you are using NixOS, or have Nix installed, /nix is a volume containing
# you binaries and many configs.
# /nix needs to be mounted if you want to execute those binaries from within
# the container. Therefore we need to mount /nix as a volume, but only if it exists.
if [ -d "/nix" ]; then
result_command="${result_command}
--volume /nix:/nix"
fi
if [ -d "/run/current-system/sw" ]; then
result_command="${result_command}
--volume /run/current-system/sw:/run/current-system/sw"
fi
# If we have a custom home to use,
# 1- override the HOME env variable
# 2- expor the DISTROBOX_HOST_HOME env variable pointing to original HOME
# 3- mount the custom home inside the container.
if [ -n "${container_user_custom_home}" ]; then
result_command="${result_command}
--env \"HOME=${container_user_custom_home}\"
--env \"DISTROBOX_HOST_HOME=${container_user_home}\"
--volume ${container_user_custom_home}:${container_user_custom_home}:rslave"
fi
# Mount also the /var/home dir on ostree based systems
# do this only if $HOME was not already set to /var/home/username
if [ "${container_user_home}" != "/var/home/${container_user_name}" ] &&
[ -d "/var/home/${container_user_name}" ]; then
result_command="${result_command}
--volume \"/var/home/${container_user_name}\":\"/var/home/${container_user_name}\":rslave"
fi
# Mount also the XDG_RUNTIME_DIR to ensure functionality of the apps.
if [ -d "/run/user/${container_user_uid}" ]; then
result_command="${result_command}
--volume /run/user/${container_user_uid}:/run/user/${container_user_uid}:rslave"
fi
# These are dynamic configs needed by the container to function properly
# and integrate with the host
#
# We're doing this now instead of inside the init because some distros will
# have symlinks places for these files that use absolute paths instead of
# relative paths.
# This is the bare minimum to ensure connectivity inside the container.
# These files, will then be kept updated by the main loop every 15 seconds.
result_command="${result_command}
--volume /etc/hosts:/etc/hosts:ro
--volume /etc/localtime:/etc/localtime:ro
--volume /etc/resolv.conf:/etc/resolv.conf:ro"
# These flags are not supported by docker, so we use them only if our
# container manager is podman.
if [ -z "${container_manager#*podman*}" ]; then
result_command="${result_command}
--ulimit host
--annotation run.oci.keep_original_groups=1
--mount type=devpts,destination=/dev/pts"
if [ "${init}" -eq 1 ]; then
result_command="${result_command}
--systemd=always"
fi
# Use keep-id only if going rootless.
if [ "${rootful}" -eq 0 ]; then
result_command="${result_command}
--userns keep-id"
fi
fi
# Add additional flags
result_command="${result_command} ${container_manager_additional_flags}"
# Now execute the entrypoint, refer to `distrobox-init -h` for instructions
#
# Be aware that entrypoint corresponds to distrobox-init, the copying of it
# inside the container is moved to distrobox-enter, in the start phase.
# This is done to make init, export and host-exec location independent from
# the host, and easier to upgrade.
result_command="${result_command} ${container_image}
/usr/bin/entrypoint -v --name \"${container_user_name}\"
--user ${container_user_uid}
--group ${container_user_gid}
--home \"${container_user_custom_home:-"${container_user_home}"}\"
--init \"${init}\"
${container_pre_init_hook}
-- '${container_init_hook}'
"
# use container_user_custom_home if defined, else fallback to normal home.
# Return generated command.
printf "%s" "${result_command}"
}
# dry run mode, just generate the command and print it. No creation.
if [ "${dryrun}" -ne 0 ]; then
if [ -n "${container_clone}" ]; then
container_image="${container_clone}"
fi
cmd="$(generate_command)"
cmd="$(echo "${cmd}" | tr '[:blank:]\n' ' ' | tr -s ' ')"
printf "%s\n" "${cmd}"
exit 0
fi
# Check if the container already exists.
# If it does, notify the user and exit.
if ${container_manager} inspect --type container "${container_name}" > /dev/null 2>&1; then
printf "Distrobox named '%s' already exists.\n" "${container_name}"
printf "To enter, run:\n\n"
if [ "${rootful}" -ne 0 ]; then
printf "distrobox-enter --root %s\n\n" "${container_name}"
else
printf "distrobox-enter %s\n\n" "${container_name}"
fi
exit 0
fi
# if we are using the clone flag, let's set the image variable
# to the output of container duplication
if [ -n "${container_clone}" ]; then
container_image="$(clone_container)"
fi
# First, check if the image exists in the host or auto-pull is enabled
# If not prompt to download it.
if [ "${container_always_pull}" -eq 1 ] ||
! ${container_manager} inspect --type image "${container_image}" > /dev/null 2>&1; then
# If we do auto-pull, don't ask questions
if [ "${non_interactive}" -eq 1 ] || [ "${container_always_pull}" -eq 1 ]; then
response="yes"
else
# Prompt to download it.
printf >&2 "Image %s not found.\n" "${container_image}"
printf >&2 "Do you want to pull the image now? [Y/n]: "
read -r response
response="${response:-"Y"}"
fi
# Accept only y,Y,Yes,yes,n,N,No,no.
case "${response}" in
y | Y | Yes | yes | YES)
# Pull the image
${container_manager} pull "${container_image}"
;;
n | N | No | no | NO)
printf >&2 "next time, run this command first:\n"
printf >&2 "\t%s pull %s\n" "${container_manager}" "${container_image}"
exit 0
;;
*) # Default case: If no more options then break out of the loop.
printf >&2 "Invalid input.\n"
printf >&2 "The available choices are: y,Y,Yes,yes,YES or n,N,No,no,NO.\nExiting.\n"
exit 1
;;
esac
fi
# Generate the create command and run it
printf >&2 "Creating '%s' using image %s\t" "${container_name}" "${container_image}"
cmd="$(generate_command)"
# Eval the generated command. If successful display an helpful message.
# shellcheck disable=SC2086
if eval ${cmd} > /dev/null; then
printf >&2 "\033[32m [ OK ]\n\033[0mDistrobox '%s' successfully created.\n" "${container_name}"
printf >&2 "To enter, run:\n\n"
if [ "${rootful}" -ne 0 ]; then
printf "distrobox enter --root %s\n\n" "${container_name}"
else
printf "distrobox enter %s\n\n" "${container_name}"
fi
# We've created the box, let's also create the entry
"$(dirname "${0}")/distrobox-generate-entry" "${container_name}"
exit $?
fi
printf >&2 "\033[31m [ ERR ]\n\033[0m"