feat: Improve support for unprivileged hosts (including LXC) (#479)

* * Add fakeroot to extract the dsm system without elevated permissions
* Remove obsolete docker variable "DEV" used to exclude extraction of device nodes

* feat: Detect unprivileged container

* fix: Use fakeroot for mke2fs

---------

Co-authored-by: Kroese <kroese@users.noreply.github.com>

Dockerfile

@@ -29,6 +29,7 @@ RUN apt-get update && apt-get -y upgrade \
         iptables \
         iproute2 \
         dnsmasq \
+        fakeroot \        
         net-tools \
         qemu-utils \
         ca-certificates \

src/check.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+: ${VM_NET_DEV:='eth0'}
+
 [ ! -f "/run/qemu.pid" ] && echo "QEMU not running yet.." && exit 0
 [ -f "/run/qemu.count" ] && echo "QEMU is shutting down.." && exit 1
 
@@ -10,7 +12,18 @@ file="/run/dsm.url"
 location=$(cat "$file")
 
 if ! curl -m 20 -ILfSs "http://$location/" > /dev/null; then
-  echo "Failed to reach page at http://$location" && exit 1
+
+  if [[ "$location" == "20.20"* ]]; then
+    ip="20.20.20.1"
+    port="${location##*:}"
+    echo "Failed to reach DSM at port $port"
+  else
+    echo "Failed to reach DSM at http://$location"
+    ip=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/)
+  fi
+
+  echo "You might need to whitelist IP $ip in the DSM firewall." && exit 1
+
 fi
 
 echo "Healthcheck OK"

src/disk.sh

@@ -8,7 +8,7 @@ set -Eeuo pipefail
 : ${DISK_CACHE:='none'}         # Caching mode, can be set to 'writeback' for better performance
 : ${DISK_DISCARD:='on'}         # Controls whether unmap (TRIM) commands are passed to the host.
 : ${DISK_ROTATION:='1'}         # Rotation rate, set to 1 for SSD storage and increase for HDD
-: ${DISK_FLAGS:='nocow=on'}     # Specifies the options for use with the qcow2 disk format
+: ${DISK_FLAGS:=''}             # Specifies the options for use with the qcow2 disk format
 
 BOOT="$STORAGE/$BASE.boot.img"
 SYSTEM="$STORAGE/$BASE.system.img"
@@ -259,6 +259,45 @@ convertDisk() {
   return 0
 }
 
+checkFS () {
+  local DISK_FILE=$1
+  local DIR FS FA
+
+  DIR=$(dirname "$DISK_FILE")
+  [ ! -d "$DIR" ] && return 0
+
+  FS=$(stat -f -c %T "$DIR")
+
+  if [[ "$FS" == "overlay"* ]]; then
+    info "Warning: the filesystem of $DIR is OverlayFS, this usually means it was binded to an invalid path!"
+  fi
+
+  if [[ "$FS" == "xfs" || "$FS" == "zfs" || "$FS" == "btrfs" || "$FS" == "bcachefs" ]]; then
+    local FLAG="nocow"
+    if [[ "$DISK_FLAGS" != *"$FLAG="* ]]; then
+      if [ -z "$DISK_FLAGS" ]; then
+        DISK_FLAGS="$FLAG=on"
+      else
+        DISK_FLAGS="$DISK_FLAGS,$FLAG=on"
+      fi
+    fi
+
+    if [ -f "$DISK_FILE" ] ; then
+      FA=$(lsattr "$DISK_FILE")
+      [[ "$FA" == *"C"* ]] && FA=$(lsattr -d "$DIR")
+    else
+      FA=$(lsattr -d "$DIR")
+    fi
+
+    if [[ "$FA" != *"C"* ]]; then
+      info "Warning: the filesystem of $DIR is ${FS^^}, and COW (copy on write) is not disabled for that folder!"
+      info "This will negatively affect performance, please empty the folder and disable COW (chattr +C <path>)."
+    fi
+  fi
+
+  return 0
+}
+
 addDisk () {
   local DISK_ID=$1
   local DISK_BASE=$2
@@ -269,30 +308,13 @@ addDisk () {
   local DISK_ADDRESS=$7
   local DISK_FMT=$8
   local DISK_FILE="$DISK_BASE.$DISK_EXT"
-  local DIR FS FA DATA_SIZE PREV_FMT PREV_EXT CUR_SIZE
+  local DIR DATA_SIZE PREV_FMT PREV_EXT CUR_SIZE
 
   DIR=$(dirname "$DISK_FILE")
   [ ! -d "$DIR" ] && return 0
 
-  FS=$(stat -f -c %T "$DIR")
-  if [[ "$FS" == "overlay"* ]]; then
-    info "Warning: the filesystem of $DIR is OverlayFS, this usually means it was binded to an invalid path!"
-  fi
-  if [[ "$FS" == "btrfs"* ]]; then
-    if [ -f "$DISK_FILE" ] ; then
-      FA=$(lsattr "$DISK_FILE")
-      [[ "$FA" == *"C"* ]] && FA=$(lsattr -d "$DIR")
-    else
-      FA=$(lsattr -d "$DIR")
-    fi
-    if [[ "$FA" != *"C"* ]]; then
-      info "Warning: the filesystem of $DIR is BTRFS, and COW (copy on write) is not disabled for that folder!"
-      info "This will negatively affect write performance, please empty the folder and disable COW (chattr +C <path>)."
-    fi
-  fi
-
   [ -z "$DISK_SPACE" ] && DISK_SPACE="16G"
-  DISK_SPACE=$(echo "$DISK_SPACE" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
+  DISK_SPACE=$(echo "${DISK_SPACE^^}" | sed 's/MB/M/g;s/GB/G/g;s/TB/T/g')
   DATA_SIZE=$(numfmt --from=iec "$DISK_SPACE")
 
   if (( DATA_SIZE < 6442450944 )); then
@@ -303,6 +325,8 @@ addDisk () {
     fi
   fi
 
+  checkFS "$DISK_FILE" || exit $?
+
   if ! [ -f "$DISK_FILE" ] ; then
 
     if [[ "${DISK_FMT,,}" != "raw" ]]; then

src/install.sh

@@ -2,7 +2,6 @@
 set -Eeuo pipefail
 
 : ${URL:=''}    # URL of the PAT file to be downloaded.
-: ${DEV:='Y'}   # Controls whether device nodes are created.
 
 if [ -f "$STORAGE"/dsm.ver ]; then
   BASE=$(cat "$STORAGE/dsm.ver")
@@ -55,11 +54,11 @@ FS=$(stat -f -c %T "$STORAGE")
 if [[ "$FS" == "overlay"* ]]; then
   info "Warning: the filesystem of $STORAGE is OverlayFS, this usually means it was binded to an invalid path!"
 fi
-if [[ "$FS" == "btrfs"* ]]; then
+if [[ "$FS" == "xfs" || "$FS" == "zfs" || "$FS" == "btrfs" || "$FS" == "bcachefs" ]]; then
   FA=$(lsattr -d "$STORAGE")
   if [[ "$FA" != *"C"* ]]; then
-    info "Warning: the filesystem of $STORAGE is BTRFS, and COW (copy on write) is not disabled for that folder!"
-    info "This will negatively affect write performance, please empty the folder and disable COW (chattr +C <path>)."
+    info "Warning: the filesystem of $STORAGE is ${FS^^}, and COW (copy on write) is not disabled for that folder!"
+    info "This will negatively affect performance, please empty the folder and disable COW (chattr +C <path>)."
   fi
 fi
 
@@ -100,6 +99,7 @@ fi
 
 # Download the required files from the Synology website
 
+ROOT="Y"
 RDC="$STORAGE/dsm.rd"
 
 if [ ! -f "$RDC" ]; then
@@ -139,14 +139,12 @@ if [ -f "$RDC" ]; then
   { xz -dc <"$RDC" >"$TMP/rd" 2>/dev/null; rc=$?; } || :
   (( rc != 1 )) && error "Failed to unxz $RDC, reason $rc" && exit 91
 
-  if [[ "$DEV" == [Nn]* ]]; then
-    # Exclude dev/ from cpio extract
-    { (cd "$TMP" && cpio -it < "$TMP/rd" | grep -Ev 'dev/' | while read -r entry; do cpio -idm "$entry" < "$TMP/rd" 2>/dev/null; done); rc=$?; } || :
-    (( rc != 0 )) && error "Failed to extract $RDC, reason $rc" && exit 92
-  else
   { (cd "$TMP" && cpio -idm <"$TMP/rd" 2>/dev/null); rc=$?; } || :
-    (( rc != 0 )) && error "Failed to extract $RDC, reason $rc"
-    (( rc != 0 )) && error "If the container runs unprivileged, please set DEV=N to exclude device nodes." && exit 92
+
+  if (( rc != 0 )); then
+    ROOT="N"
+    { (cd "$TMP" && fakeroot cpio -idmu <"$TMP/rd" 2>/dev/null); rc=$?; } || :
+    (( rc != 0 )) && error "Failed to extract $RDC, reason $rc" && exit 92
   fi
 
   mkdir -p /run/extract
@@ -199,15 +197,14 @@ if ((SIZE<250000000)); then
   error "The specified PAT file is probably an update pack as it's too small." && exit 62
 fi
 
+info "Install: Extracting downloaded image..."
+
 if { tar tf "$PAT"; } >/dev/null 2>&1; then
 
-  info "Install: Extracting downloaded image..."
   tar xpf "$PAT" -C "$TMP/."
 
 else
 
-  info "Install: Extracting downloaded image..."
-
   export LD_LIBRARY_PATH="/run/extract"
 
   if [ "$ARCH" == "amd64" ]; then
@@ -272,32 +269,47 @@ sfdisk -q "$SYSTEM" < "$PART"
 
 info "Install: Extracting system partition..."
 
+LABEL="1.44.1-42218"
+OFFSET="1048576" # 2048 * 512
+NUMBLOCKS="622560" # (4980480 * 512) / 4096
+
 MOUNT="$TMP/system"
 rm -rf "$MOUNT" && mkdir -p "$MOUNT"
 
 mv "$HDA.tgz" "$HDA.txz"
 
-if [[ "$DEV" == [Nn]* ]]; then
-  # Exclude dev/ from tar extract
-  tar xpfJ "$HDA.txz" --absolute-names --exclude="dev" -C "$MOUNT/"
-else
+if [[ "$ROOT" != [Nn]* ]]; then
+
   tar xpfJ "$HDA.txz" --absolute-names -C "$MOUNT/"
+
 fi
 
 [ -d "$PKG" ] && mv "$PKG/" "$MOUNT/.SynoUpgradePackages/"
 rm -f "$MOUNT/.SynoUpgradePackages/ActiveInsight-"*
 
 [ -f "$HDP.txz" ] && tar xpfJ "$HDP.txz" --absolute-names -C "$MOUNT/"
-[ -f "$IDB.txz" ] && tar xpfJ "$IDB.txz" --absolute-names -C "$MOUNT/usr/syno/synoman/indexdb/"
+
+if [ -f "$IDB.txz" ]; then
+  INDEX_DB="$MOUNT/usr/syno/synoman/indexdb/"
+  mkdir -p "$INDEX_DB"
+  tar xpfJ "$IDB.txz" --absolute-names -C "$INDEX_DB"
+fi
+
+if [[ "$ROOT" != [Nn]* ]]; then
 
   info "Install: Installing system partition..."
 
-LABEL="1.44.1-42218"
-OFFSET="1048576" # 2048 * 512
-NUMBLOCKS="622560" # (4980480 * 512) / 4096
-
   mke2fs -q -t ext4 -b 4096 -d "$MOUNT/" -L "$LABEL" -F -E "offset=$OFFSET" "$SYSTEM" "$NUMBLOCKS"
 
+else
+
+  fakeroot -- bash -c "set -Eeu;\
+        tar xpfJ $HDA.txz --absolute-names --skip-old-files -C $MOUNT/;\
+        printf '%b%s%b' '\E[1;34m❯ \E[1;36m' 'Install: Installing system partition...' '\E[0m\n';\
+        mke2fs -q -t ext4 -b 4096 -d $MOUNT/ -L $LABEL -F -E offset=$OFFSET $SYSTEM $NUMBLOCKS"
+
+fi
+
 rm -rf "$MOUNT"
 
 echo "$BASE" > "$STORAGE"/dsm.ver

src/power.sh

@@ -67,9 +67,10 @@ _graceful_shutdown() {
 
   if [ "$(cat $QEMU_COUNT)" -ge "$QEMU_TIMEOUT" ]; then
     echo && error "Shutdown timeout reached, forcefully quitting.."
+  else
+    echo && echo "❯ Quitting..."
   fi
 
-  echo && echo "❯ Quitting..."
   echo 'quit' | nc -q 1 -w 1 localhost "$QEMU_PORT" >/dev/null 2>&1 || true
 
   { pkill -f print.sh || true; } 2>/dev/null

src/print.sh

@@ -2,6 +2,7 @@
 set -Eeuo pipefail
 
 : ${DHCP:='N'}
+: ${VM_NET_DEV:='eth0'}
 
 info () { printf "%b%s%b" "\E[1;34m❯ \E[1;36m" "$1" "\E[0m\n" >&2; }
 error () { printf "%b%s%b" "\E[1;31m❯ " "ERROR: $1" "\E[0m\n" >&2; }
@@ -67,7 +68,7 @@ if [[ "$location" != "20.20"* ]]; then
 
 else
 
-  ip=$(ip address show dev eth0 | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/)
+  ip=$(ip address show dev "$VM_NET_DEV" | grep inet | awk '/inet / { print $2 }' | cut -f1 -d/)
   port="${location##*:}"
 
   if [[ "$ip" == "172."* ]]; then