1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
|
# Copyright 2022-2026 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
inherit linux-info meson optfeature shell-completion systemd xdg-utils verify-sig
DESCRIPTION="A userspace interface for the Linux kernel containment features"
HOMEPAGE="https://linuxcontainers.org/ https://github.com/lxc/lxc"
SRC_URI="https://linuxcontainers.org/downloads/lxc/${P}.tar.gz
verify-sig? ( https://linuxcontainers.org/downloads/lxc/${P}.tar.gz.asc )"
LICENSE="GPL-2 LGPL-2.1 LGPL-3" # LGPL-2.1+ is listed, but it's covered by "LGPL-3"
SLOT="0/1.700" # SONAME liblxc.so.1 + ${PV//./} _if_ breaking ABI change while bumping.
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
IUSE="apparmor +caps doc examples io-uring landlock man pam seccomp selinux ssl systemd test test-install +tools"
REQUIRED_USE="landlock? ( seccomp )"
RESTRICT="!test? ( test )"
RDEPEND="acct-group/lxc
acct-user/lxc
apparmor? ( sys-libs/libapparmor )
caps? ( sys-libs/libcap )
io-uring? ( >=sys-libs/liburing-2:= )
pam? ( sys-libs/pam )
seccomp? ( sys-libs/libseccomp )
selinux? ( sys-libs/libselinux )
ssl? ( dev-libs/openssl:0= )
systemd? (
sys-apps/dbus
sys-apps/systemd:=
)
tools? ( sys-libs/libcap )"
DEPEND="${RDEPEND}
caps? ( sys-libs/libcap[static-libs] )
tools? ( sys-libs/libcap[static-libs] )
sys-kernel/linux-headers"
BDEPEND="virtual/pkgconfig
doc? ( app-text/doxygen )
man? ( app-text/docbook2X )
verify-sig? ( sec-keys/openpgp-keys-linuxcontainers )"
CONFIG_CHECK="~!NETPRIO_CGROUP
~CGROUPS
~CGROUP_CPUACCT
~CGROUP_DEVICE
~CGROUP_FREEZER
~CGROUP_SCHED
~CPUSETS
~IPC_NS
~MACVLAN
~MEMCG
~NAMESPACES
~NET_NS
~PID_NS
~POSIX_MQUEUE
~USER_NS
~UTS_NS
~VETH"
ERROR_CGROUP_FREEZER="CONFIG_CGROUP_FREEZER: needed to freeze containers"
ERROR_MACVLAN="CONFIG_MACVLAN: needed for internal (inter-container) networking"
ERROR_MEMCG="CONFIG_MEMCG: needed for memory resource control in containers"
ERROR_NET_NS="CONFIG_NET_NS: needed for unshared network"
ERROR_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: needed for lxc-execute command"
ERROR_UTS_NS="CONFIG_UTS_NS: needed to unshare hostnames and uname info"
ERROR_VETH="CONFIG_VETH: needed for internal (host-to-container) networking"
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/linuxcontainers.asc
DOCS=( AUTHORS MAINTAINERS README.md doc/FAQ.txt )
PATCHES=(
"${FILESDIR}"/lxc-7.0.0-glibc-2.43-const-fix.patch
)
pkg_setup() {
if use landlock ; then
WARNING_SECURITY_LANDLOCK="CONFIG_SECURITY_LANDLOCK: needed with landlock"
fi
linux-info_pkg_setup
}
src_configure() {
# -Dtools-multicall=false: will create a single binary called 'lxc' that conflicts with LXD.
local emesonargs=(
--localstatedir "${EPREFIX}/var"
-Dcoverity-build=false
-Dinstall-state-dirs=false
-Doss-fuzz=false
-Dspecfile=false
-Dtools-multicall=false
-Dcommands=true
-Dinstall-init-files=true
-Dmemfd-rexec=true
-Dthread-safety=true
$(meson_use apparmor)
$(meson_use caps capabilities)
$(meson_use doc api-docs)
$(meson_use examples)
$(meson_use io-uring io-uring-event-loop)
$(meson_use landlock landlock-monitor)
$(meson_use man)
$(meson_use pam pam-cgroup)
$(meson_use seccomp)
$(meson_use selinux)
$(meson_use ssl openssl)
$(meson_use test-install tests)
$(meson_use $(usex test test test-install) tests)
$(meson_use tools)
$(usex systemd -Ddbus=true -Ddbus=false)
$(usex systemd -Dinit-script="systemd" -Dinit-script="openrc")
-Ddata-path=/var/lib/lxc
-Ddoc-path=/usr/share/doc/${PF}
-Dlog-path=/var/log/lxc
-Drootfs-mount-path=/var/lib/lxc/rootfs
-Druntime-path=/run
)
use tools && local emesonargs+=( -Dcapabilities=true )
meson_src_configure
}
src_test() {
# tests not hooked into meson test
# See:
# https://github.com/lxc/lxc/blob/main/.github/workflows/tests.yml
# https://github.com/lxc/lxc-ci/blob/main/deps/lxc-exercise
local -a skip_tests=(
# problematic tests per upstream
lxc-test-concurrent
lxc-test-share-ns
# skipped by upstream for containers
lxc-test-apparmor
lxc-test-device-add-remove
lxc-test-reboot
lxc-test-unpriv
lxc-test-usernic
# Skips due to required arguments
lxc-test-may-control
# Required apt and messes with system users
lxc-test-usernic-2
# Tries to mount kernel module + snaps
lxc-test-snapdeps
# Unpriviledged containers need to touch uid mappings + root chown
lxc-test-autostart
lxc-test-cloneconfig
lxc-test-createconfig
lxc-test-cve-2019-5736
lxc-test-destroytest
lxc-test-exit-code
lxc-test-lxc-attach
lxc-test-no-new-privs
lxc-test-procsys
lxc-test-rootfs
# Wants to create a symlink in /var/lib
lxc-test-symlink
# Must run as root
lxc-test-checkpoint-restore
# failed to create container
lxc-test-clonetest
lxc-test-console-log
lxc-test-createtest
lxc-test-get_item
lxc-test-rootfs-options
lxc-test-shutdowntest
lxc-test-snapshot
lxc-test-sys-mixed
lxc-test-sysctls
# need allocated subuids, subgids
lxc-test-api-reboot
lxc-test-attach
lxc-test-capabilities
lxc-test-proc-pid
lxc-test-saveconfig
lxc-test-shortlived
lxc-test-startone
lxc-test-state-server
lxc-test-usernsexec
# failed to set config
lxc-test-parse-config-file
# failed to mount
lxc-test-mount-injection
# could not unshare mount namespace
lxc-test-utils
# filename not created
lxc-test-locktests
# config path needs to match
lxc-test-containertests
# wants a configured network interface
lxc-test-apparmor-mount
)
if use !apparmor; then
skip_tests+=(
lxc-test-apparmor-generated
)
fi
mkdir -p "${HOME}"/.config/lxc || die
touch "${HOME}"/.config/lxc/default.conf || die
# silence complaints about unset XDG_RUNTIME_DIR
xdg_environment_reset
local -a passes_tests=()
local -a failed_tests=()
local ret testfile
pushd "${BUILD_DIR}"/src/tests >/dev/null || die
for testfile in $(find . -maxdepth 1 -name "lxc-test-*" -type f); do
if [[ ${skip_tests[@]} =~ ${testfile#./} ]]; then
continue
fi
einfo "Running ${testfile}"
"${testfile}"
ret="${?}"
if [[ ${ret} == 0 ]]; then
einfo "${testfile} passed"
passed_tests+=( "${testfile#./}" )
else
eerror "${testfile} failed"
failed_tests+=( "${testfile#./}" )
fi
done
popd >/dev/null || die
einfo "Tests passed: ${passed_tests[@]}"
if [[ ${#failed_tests[@]} -gt 0 ]]; then
die "Tests failed: ${failed_tests[@]}"
fi
}
src_install() {
if use doc ; then
local HTML_DOCS=( "${BUILD_DIR}/html/"* )
fi
meson_src_install
# The main bash-completion file will collide with lxd, need to relocate and update symlinks.
local lxcbashcompdir="${D}/$(get_bashcompdir)"
mkdir -p "${lxcbashcompdir}" || die "Failed to create bashcompdir."
mv "${lxcbashcompdir}"/_lxc "${lxcbashcompdir}"/lxc-start || die "Failed to move _lxc bash completion file."
# Build system will install all bash completion files regardless of our 'tools' use flag.
# Though installing them all will add bash completions for commands that don't exist, it's
# cleaner than dealing with individual files based on the use flag status.
bashcomp_alias lxc-start lxc-{attach,autostart,cgroup,checkpoint,config,console,copy,create,destroy,device,execute,freeze,info,ls,monitor,snapshot,stop,top,unfreeze,unshare,update-config,usernsexec,wait}
find "${ED}" -name '*.la' -delete -o -name '*.a' -delete || die
# Replace upstream systemd files.
if use systemd ; then
rm -r "${D}$(systemd_get_systemunitdir)" || die "Failed to remove systemd lib dir"
else
# The openrc files aren't installed with correct permissions.
fperms 0755 /etc/init.d/lxc-{containers,net}
fi
newinitd "${FILESDIR}/${PN}.initd.9" ${PN}
systemd_newunit "${FILESDIR}"/lxc-monitord.service.5.0.0 lxc-monitord.service
systemd_newunit "${FILESDIR}"/lxc-net.service.5.0.0 lxc-net.service
systemd_newunit "${FILESDIR}"/lxc.service-5.0.0 lxc.service
systemd_newunit "${FILESDIR}"/lxc_at.service.5.0.0 "lxc@.service"
if ! use apparmor; then
sed -i '/lxc-apparmor-load/d' "${D}$(systemd_get_systemunitdir)/lxc.service" ||
die "Failed to remove apparmor references from lxc.service systemd unit."
fi
if use !test-install; then
find "${ED}"/usr/bin -name "lxc-test-*" -delete || die
fi
}
pkg_postinst() {
elog "Please refer to "
elog "https://wiki.gentoo.org/wiki/LXC for introduction and usage guide."
elog
elog "Run 'lxc-checkconfig' to see optional kernel features."
elog
optfeature "creating your own LXC containers" app-containers/distrobuilder
optfeature "automatic template scripts" app-containers/lxc-templates
optfeature "Debian-based distribution container image support" dev-util/debootstrap
optfeature "snapshot & restore functionality" sys-process/criu
}
|
