lxc/lxc — pull request #114 by johnlane (2013-12-12 12:39:25+00:00)
Title: Lxc archlinux

Having experimented with the `lxc-archlinux` to create a Linux container, I found it lacking in a few areas. I normally roll my own containers from scratch so I thought the template could be improved upon.

The thing I changed was to remove the functionality that created an `fstab` file. Originally this mounted `/sys`, `/proc` and `/proc/sys/` and it mounted them read-only which I noticed caused problems with my *DHCP* client, `dhcpcd`. These filesystems are mounted by systemd and should not be explicitly mounted like this.

The next thing I did to remove the *mknod* capability drop. I did this because it is unnecessary and prevents the container from creating its own device nodes. Originally, this was required to stop *systemd* from trying to start *udev* in the container (*udev* does not work inside a container). However, the correct and preffereed way to do this is to mask the services, which prevents *systemd* from starting them. The template does this anyway so having it drop its *mknod* capability is unnecessary overkill.

I wanted to support building a 32-bit container on a 64-bit host. This requires a modified *Pacman* configuration that sets its architecture to *i686*. The improved template accepts a `--arch` or `-a` argumment and, if this is given and differs from the host's architecture, will make a temporary copy of the configuration files and modify them to specify the given architecture. After building the container's file system using these modified files, it copies them into the container as `/etc/pacman.conf` and `/etc/pacman.d/mirrorlist`.

**note** the template assumes the Pacman mirrorlist file specified in the Pacman configuration file is `/etc/pacman.d/mirrorlist`.

The template can install additional packages while creating a container: such packages are specified using its `--packages` or `-P` argument. It doesn't provide a way to enable their services, however. I wanted to support this, so I added a `--enable_units` or `-e` argument that allows a comma-separate list of *systemd* unit names to be given. Each unit will be enabled in the container so that they will start when it is booted up. If the unit name does not contain a dot `.` then `.service` will be appended to it, making the unit type to default to *service* if this is not specified.

The final thing that I did was to provide a way to set the root password of the container. A new `--root_passwd` or `-r` can supplied on the command-line to set the container's root password.

Example command-line for the improved template:

lxc-create -n test32 -t archlinux -- --arch i686 -P dhcpcd,openssh --enable_units dhcpcd,sshd.socket --root_passwd mysecret