cloud-toaster 1.1.2

data/chef/cookbooks/lxc/recipes/setup_host.rb

@@ -0,0 +1,179 @@
+
+if node["lxc"]["mount_volume"]
+  # if we are on an Openstack host, mount volume and create file system..
+  include_recipe "lxc::mount_volume"
+else
+  # else, dont create the file system, but create the /data/ directory
+  bash "host_link_datadir" do
+    code <<-EOH
+    rm -rf /data
+    ln -s /mnt /data
+  EOH
+    not_if "ls /data/* > /dev/null 2>&1"
+    only_if "test -e /mnt"
+  end
+  bash "host_create_datadir" do
+    code <<-EOH
+    mkdir -p /data
+  EOH
+    not_if "test -e /data"
+  end
+end
+
+bash "host_mount_cgroup" do
+  code <<-EOH
+	# mount control group filesystem
+	mkdir -p /cgroup
+	mount none -t cgroup /cgroup 2> /dev/null
+	exit 0
+EOH
+  not_if "(test -d /cgroup) && (df | grep '/cgroup')"
+end
+
+if platform_family?("debian")
+  apt_package "btrfs-tools" do
+    action :install
+    not_if "which btrfs"
+    only_if do node["lxc"]["host"]["use_copy_on_write"] end
+  end
+  apt_package "host" do
+    action :install
+    not_if "which host"
+    ignore_failure true
+  end
+  apt_package "openjdk-7-jdk" do
+    action :install
+    not_if "which javac"
+    ignore_failure true
+    only_if 'apt-cache search openjdk-7-jdk | grep ""'
+  end
+  # fallback to java 6 if java 7 is not available
+  apt_package "openjdk-6-jdk" do
+    action :install
+    not_if "which javac"
+    ignore_failure true
+  end
+elsif platform_family?("fedora") || platform_family?("linux")
+  yum_package "btrfs-progs" do
+    action :install
+    not_if "which btrfs"
+    only_if do node["lxc"]["host"]["use_copy_on_write"] end
+  end
+  yum_package "bind-utils" do
+    action :install
+    not_if "which host"
+  end
+  yum_package "java-1.7.0-openjdk" do
+    action :install
+    not_if "which javac"
+  end
+end
+
+
+bash "host_create_btrfs_image" do
+  code <<-EOH
+	echo "INFO: Creating image file for btrfs filesystem under #{node["lxc"]["host"]["btrfs_img_path"]}"
+
+	# make sure the parent directory for the image file exists
+	mkdir -p #{node["lxc"]["host"]["btrfs_img_path"]}
+	rm -rf #{node["lxc"]["host"]["btrfs_img_path"]}
+
+	# create image file
+	dd if=/dev/zero of=#{node["lxc"]["host"]["btrfs_img_path"]} bs=1MB count=#{node["lxc"]["host"]["btrfs_img_size_MB"]}
+	mkfs.btrfs #{node["lxc"]["host"]["btrfs_img_path"]}
+EOH
+  not_if "test -f #{node["lxc"]["host"]["btrfs_img_path"]}"
+  only_if do node["lxc"]["host"]["use_copy_on_write"] end
+end
+
+bash "host_config_btrfs" do
+  code <<-EOH
+	mkdir -p /mnt/btrfs
+	mount -t btrfs -o loop #{node["lxc"]["host"]["btrfs_img_path"]} /mnt/btrfs
+	if [ ! -e #{node["lxc"]["root_path"]} ]; then
+		ln -s /mnt/btrfs #{node["lxc"]["root_path"]}
+	fi
+EOH
+  only_if do node["lxc"]["host"]["use_copy_on_write"] end
+  not_if "df | grep /mnt/btrfs"
+end
+
+bash "host_install_lxc" do
+  code <<-EOH
+	# install requirements for lxc and some tools
+	yum install --skip-broken -y libcap-devel febootstrap bridge-utils libvirt git screen
+	# install lxc
+	yum install --skip-broken -y lxc
+	# fix for https://bugs.archlinux.org/task/31211
+	mount --make-rprivate /
+EOH
+  not_if "which lxc-ls 2> /dev/null"
+  # don't execute if we use docker.io tools
+  not_if do node["lxc"]["use_docker.io"] end
+end
+
+# configure SSH settings to disable strict host checking when connecting to LXC containers
+bash "host_config_ssh" do
+  code <<-EOH
+	mkdir -p /root/.ssh
+	echo "Host #{node["network"]["ip_pattern"]}" >> /root/.ssh/config
+	echo '	UserKnownHostsFile=/dev/null' >> /root/.ssh/config
+	echo '	StrictHostKeyChecking=no' >> /root/.ssh/config
+	echo '	ConnectionAttempts=10' >> /root/.ssh/config
+EOH
+  not_if "cat /root/.ssh/config | grep \"#{node["network"]["ip_pattern"]}\""
+end
+
+# install docker.io tools for LXC handling
+if node["lxc"]["use_docker.io"]
+	include_recipe "lxc::install_docker"
+end
+
+# configure network bridge on host
+bash "host_create_bridge" do
+  code <<-EOH
+	/usr/sbin/brctl addbr #{node["network"]["host"]["bridge_device"]}
+	/usr/sbin/brctl setfd #{node["network"]["host"]["bridge_device"]} 0
+EOH
+  not_if "/sbin/iptables | grep #{node["network"]["host"]["bridge_device"]}"
+  # don't execute if we use docker.io tools
+  not_if do node["lxc"]["use_docker.io"] end
+end
+
+# configure network bridge on host
+bash "host_config_bridge" do
+  code <<-EOH
+	/sbin/ifconfig #{node["network"]["host"]["bridge_device"]} #{node["network"]["gateway"]} netmask 255.255.0.0 promisc up
+EOH
+  not_if "/sbin/iptables | grep #{node["network"]["host"]["bridge_device"]}"
+end
+
+bash "host_setup_bridge_iptables" do
+  code <<-EOH
+	/sbin/iptables -t nat -A POSTROUTING -o #{node["network"]["host"]["wan_device"]} -j MASQUERADE
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+EOH
+  not_if "/sbin/iptables -t nat -L POSTROUTING | grep MASQUERADE | grep anywhere"
+end
+
+# disable iptables if packet rejection is turned on
+bash "host_disable_iptables_reject" do
+  code <<-EOH
+	/sbin/service iptables stop
+EOH
+  only_if "iptables -L | grep 'reject-with icmp-host-prohibited'"
+end
+
+
+# setup squid proxy on host
+include_recipe "lxc::setup_proxy"
+
+# setup DB server on host
+include_recipe "lxc::setup_database"
+
+# required gem for adding encoding headers to avoid "invalid multibyte char" errors
+gem_package "magic_encoding" do
+  action :install
+  ignore_failure true
+end
+

data/chef/cookbooks/lxc/recipes/setup_proxy.rb

@@ -0,0 +1,157 @@
+
+# install squid
+#package "squid" do
+#  action :install
+#  not_if "which squid"
+#end
+# due to some recent changes in squid, we have to use version <= 3.1 (--> manual install)
+bash "proxy_install_squid" do
+  code <<-EOH
+	rm -rf /tmp/squidSetup
+	mkdir -p /tmp/squidSetup
+	cd /tmp/squidSetup
+	echo "INFO: Downloading squid archive"
+	squid_version=3.1.21
+	squid_shortversion=3.1
+	#squid_version=3.3.8
+	#squid_shortversion=3.3
+
+	wget http://www.squid-cache.org/Versions/v3/$squid_shortversion/squid-$squid_version.tar.gz -O squid-$squid_version.tar.gz
+	gzip -d squid-$squid_version.tar.gz
+	tar xf squid-$squid_version.tar
+	cd squid-$squid_version
+
+	# do NOT treat compile warnings as errors:
+	sed -i "s/-Werror//g" configure
+
+	./configure
+	echo "INFO: Compiling squid binary, please be patient."
+	make > /dev/null
+	make install
+EOH
+  not_if "which squid"
+end
+
+# link squid binary, config, and log files
+bash "proxy_link_squid" do
+  code <<-EOH
+	ln -s /usr/local/squid/sbin/squid /usr/sbin/squid
+	chmod 777 /usr/local/squid/var/logs/
+	ln -s /usr/local/squid/var/logs/ /var/log/squid
+	mkdir -p /etc/squid
+	if [ -e /etc/squid/squid.conf ]; then
+		mv /etc/squid/squid.conf /etc/squid/squid.conf.bak
+	fi
+	mv /usr/local/squid/etc/squid.conf /etc/squid/squid.conf
+	# do not symlink the other way around..! The "sed -i" command later will 
+	# turn /etc/squid/squid.conf into a regular file, even if it's a symlink...
+	# https://bugs.launchpad.net/ubuntu/+source/sed/+bug/367211
+	ln -s /etc/squid/squid.conf /usr/local/squid/etc/squid.conf
+EOH
+  # "test -L" tests for symbolic link
+  not_if "test -L /usr/local/squid/etc/squid.conf"
+end
+
+# setup iptables for transparent use of squid proxy
+bash "proxy_setup_iptables" do
+  code <<-EOH
+	echo "INFO: Setting up local iptables for transparent proxy"
+	/sbin/iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner squid -j REDIRECT --to-ports 3128
+EOH
+  only_if do node["lxc"]["host"]["use_proxy"] end
+  not_if "/sbin/iptables -t nat -L OUTPUT | grep 3128 | grep REDIRECT"
+end
+
+# create cache directory
+bash "proxy_create_cache_dir" do
+  code <<-EOH
+	mkdir -p #{node["lxc"]["proxy"]["cache_dir"]}
+	chmod 777 #{node["lxc"]["proxy"]["cache_dir"]}
+EOH
+  only_if do node["lxc"]["host"]["use_proxy"] end
+  only_if do node["lxc"]["proxy"]["cache_dir"] != "" end
+  not_if "test -d #{node["lxc"]["proxy"]["cache_dir"]}"
+end
+
+# update squid config
+bash "proxy_squid_config" do
+  code <<-EOH
+  	# allow machines from certain subnets to access squid 
+	# TODO make configurable
+	echo "acl localnet src 9.0.0.0/8" >> /etc/squid/squid.conf
+	echo "acl localnet src 128.131.0.0/16" >> /etc/squid/squid.conf
+	echo "acl localnet src 128.130.0.0/16" >> /etc/squid/squid.conf
+
+	# use squid cache directory
+	if [ "#{node["lxc"]["proxy"]["cache_dir"]}" != "" ]; then
+		echo "cache_dir ufs #{node["lxc"]["proxy"]["cache_dir"]} 200000 16 256 max-size=100000000" >> /etc/squid/squid.conf
+	fi
+
+	# increase maximum file size
+	echo "maximum_object_size 50000 KB" >> /etc/squid/squid.conf
+
+	# set refresh patterns/intervals
+	sed -i '1refresh_pattern github 60 20% 4320 override-expire ignore-private' /etc/squid/squid.conf
+
+	# don't cache files from certain servers
+	echo "#no_cache deny dont_cache" >> /etc/squid/squid.conf
+	echo "" >> /etc/squid/squid.conf
+
+	# make sure squid runs in "transparent" mode
+	sed -i 's/\\(http_port .*\\)$/#\\1/g' /etc/squid/squid.conf
+	echo "http_port 3128 transparent" >> /etc/squid/squid.conf
+	echo "" >> /etc/squid/squid.conf
+	
+	# Note 1: this seems to fix an error related to some clients (git?) not handling "Expect: 100-continue" headers correctly
+	# see http://drupal.org/node/1101210
+	# Note 2: Dont add, because: "ERROR: Directive 'ignore_expect_100' is obsolete."
+	#echo "ignore_expect_100 on" >> /etc/squid/squid.conf
+
+	echo "#toaster_squid_config_added (dont remove this line)" >> /etc/squid/squid.conf
+
+	# force restart in next step below
+	if [ -f /etc/init.d/squid ]; then
+		/etc/init.d/squid stop
+	elif [ "`ps -A | grep squid`" != "" ]; then
+		killall squid
+		killall squid
+	fi
+	exit 0
+  EOH
+  not_if "cat /etc/squid/squid.conf | grep toaster_squid_config_added"
+end
+
+# start squid
+bash "proxy_squid_start" do
+  code <<-EOH
+	if [ "#{node["lxc"]["proxy"]["cache_dir"]}" != "" ]; then
+		if [ ! -d #{node["lxc"]["proxy"]["cache_dir"]}/00 ]; then
+			mkdir /data/squid
+			chmod 777 /data/squid
+
+			# force squid to create data directories (-z parameter)..
+			screen -d -m /usr/sbin/squid -z
+			sleep 4
+			killall squid > /dev/null 2>&1
+		fi
+	fi
+	if [ -f /etc/init.d/squid ]; then
+		/etc/init.d/squid start
+	else
+	  # DON'T run via screen! squid will go to background 
+	  # automatically and this line fails in EC2
+		#screen -d -m /usr/sbin/squid
+    /usr/sbin/squid
+	fi
+  sleep 2
+  running=`ps -A | grep squid`
+	if [ "$running" == "" ]; then
+	  echo "ERROR: Squid failed to start using '/usr/sbin/squid'."
+	  exit 1
+	end
+	fi
+EOH
+  not_if "ps -A | grep squid"
+end
+
+

data/chef/cookbooks/lxc/recipes/start_lxc.rb

@@ -0,0 +1,180 @@
+
+rootfs = node["lxc"]["cont"]["root_fs"]
+
+bash "lxc_prepare_proto" do
+  code <<-EOH
+	# do some additional tasks for prototypes
+	echo "INFO: Turn /etc/resolv.conf symlink within prototype into actual file"
+	# turn /etc/resolv.conf symlink into actual file
+	rm -f #{node["lxc"]["cont"]["root_fs"]}/etc/resolv.conf
+	cp /etc/resolv.conf #{node["lxc"]["cont"]["root_fs"]}/etc/resolv.conf
+	# enable forwarding on the host
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+EOH
+  only_if do node["lxc"]["cont"]["name"].match(/^prototype_.*/) end
+  # don't execute if we use docker.io tools
+  not_if do node["lxc"]["use_docker.io"] end
+end
+
+if node["lxc"]["use_docker.io"]
+  bash "lxc_start" do
+    code <<-EOH
+	ip_addr=#{node["lxc"]["cont"]["ip_address"]}
+	name=#{node["lxc"]["cont"]["name"]}
+	proto_name=#{node["lxc"]["proto"]["name"]}
+	echo "$proto_name" >> /tmp/tmp.lxc.protos
+	if [ "$proto_name" == "" ]; then
+		proto_name=`cat #{node["lxc"]["root_path"]}/$name/container.prototype.name`
+	fi
+	echo "$proto_name" >> /tmp/tmp.lxc.protos
+	if [ "$proto_name" == "" ]; then
+		proto_name=#{node["lxc"]["cont"]["name"]}
+	fi
+	cidfile=#{node["lxc"]["root_path"]}/$name/docker.container.id
+	rm -f $cidfile
+	screen -m -d docker run --cidfile=$cidfile --privileged prototypes:$proto_name bash -c "ifconfig eth0 $ip_addr && route add default gw #{node["network"]["gateway"]} && /usr/sbin/sshd -D"
+	echo "INFO: LXC container '#{node["lxc"]["cont"]["name"]}' started in the background using 'screen'."
+	sleep 2
+	#contID=`docker ps | grep -v IMAGE | head -n 1 | awk '{print $1}'`
+  contID=`cat "$cidfile"`
+	if [ "$contID" == "" ]; then
+		echo "WARN: Container could not be started. Name '$name', prototype '$proto_name', IP '$ip_addr'"
+		exit 1
+	fi
+	#contID=`ls /var/lib/docker/containers/ | grep "$contID"`
+  echo "$contID" >> /tmp/tmp.lxc.cont.ids
+	rm -f #{node["lxc"]["root_path"]}/$name/rootfs
+
+	# create a symlink to the rootfs folder. This 
+	# differs in different versions of docker.. :/
+	if [ -d /var/lib/docker/aufs/mnt/$contID ]; then
+    ln -s /var/lib/docker/aufs/mnt/$contID #{node["lxc"]["root_path"]}/$name/rootfs
+	elif [ -d /var/lib/docker/containers/$contID/rootfs ]; then
+    ln -s /var/lib/docker/containers/$contID/rootfs #{node["lxc"]["root_path"]}/$name/rootfs
+	else
+	  echo "ERROR: Unable to determine container root directory."
+	  exit 1
+	fi
+
+EOH
+  end
+else
+  bash "lxc_start" do
+    code <<-EOH
+	lxc-create -f #{node["lxc"]["cont"]["config_file"]} -n #{node["lxc"]["cont"]["name"]}
+	screen -m -d lxc-start -n #{node["lxc"]["cont"]["name"]}
+	echo "INFO: LXC container '#{node["lxc"]["cont"]["name"]}' started in the background using 'screen'."
+	sleep 3
+EOH
+  end
+end
+
+
+bash "auth_ssh" do
+  code <<-EOH
+	# authorize local ssh public key within container
+	if [ ! -f "/root/.ssh/id_rsa" ]; then
+		ssh-keygen -N "" -f /root/.ssh/id_rsa
+	fi
+	mkdir -p #{rootfs}/root/.ssh
+	touch #{rootfs}/root/.ssh/authorized_keys
+	key=`cat /root/.ssh/id_rsa.pub | head -n 1 | awk '{print $2}'`
+	existing=`cat #{rootfs}/root/.ssh/authorized_keys | grep "$key"`
+	if [ "$existing" == "" ]; then
+		cat /root/.ssh/id_rsa.pub >> #{rootfs}/root/.ssh/authorized_keys
+	fi
+
+	# make sure we have the right permissions (ssh will fail on too loose permissions)
+	chmod 700 #{rootfs}/root/.ssh
+	chmod 600 #{rootfs}/root/.ssh/authorized_keys
+	
+EOH
+end
+
+
+bash "lxc_adjust_iptables" do
+  code <<-EOH
+	iptables -F
+EOH
+  only_if "iptables -L | grep REJECT | grep all"
+end
+
+bash "lxc_wait_for_connectivity" do
+  code <<-EOH
+	# sometimes the network is not immediately available
+	echo "INFO: ssh'ing into '#{node["lxc"]["cont"]["ip_address"]}'"
+	for i in {1..10}; do
+		ssh #{node["lxc"]["cont"]["ip_address"]} echo && break
+		sleep 1
+		if [ "$i" == "10" ]; then
+			echo "WARN: Unable to ssh into new container."
+		fi
+	done
+EOH
+end
+
+file "lxc_create_setup_script" do
+  path "#{node["lxc"]["cont"]["root_fs"]}/tmp/setup.instance.inside.sh"
+  mode "0755"
+  content <<-EOH
+#!/bin/bash
+
+	# make sure we have a default route
+	existing=`route | grep "^default"`
+	if [ "$existing" == "" ]; then
+		route add default gw #{node["network"]["gateway"]}
+		echo
+	fi
+
+	# this should fix problems with TTY when trying to ssh into ubuntu container
+	if [ "#{node["lxc"]["bare_os"]["distribution"]}" != "fedora" ]; then
+		mount -t devpts none /dev/pts -o rw,noexec,nosuid,gid=5,mode=0620 2> /dev/null
+		echo
+	fi
+
+	# setup transparent proxy forwarding
+	existing=`iptables -t nat -L OUTPUT | grep 3128 | grep DNAT`
+	if [ "$existing" == "" ] && [ "#{node["lxc"]["cont"]["proxy_ip"]}" != "" ]; then
+		echo "INFO: Setting up local iptables for transparent proxy residing under '#{node["lxc"]["cont"]["proxy_ip"]}:3128'"
+		if [ -f "/etc/init.d/iptables" ]; then
+			/etc/init.d/iptables start
+		fi
+		iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to #{node["lxc"]["cont"]["proxy_ip"]}:3128
+	fi
+
+	exit 0
+EOH
+end
+
+bash "lxc_setup_inside" do
+  code <<-EOH
+	# again, wait for connectivity
+	echo "INFO: ssh'ing into '#{node["lxc"]["cont"]["ip_address"]}'"
+	for i in {1..3}; do
+		ssh #{node["lxc"]["cont"]["ip_address"]} echo && break
+		sleep 2
+		if [ "$i" == "3" ]; then
+			echo "WARN: Unable to ssh into new container."
+			exit 1
+		fi
+	done
+	# ssh into the container and run config scripts from there
+	echo "INFO: ssh'ing into the LXC container at '#{node["lxc"]["cont"]["ip_address"]}' to perform some configurations."
+	ssh #{node["lxc"]["cont"]["ip_address"]} /tmp/setup.instance.inside.sh
+EOH
+end
+
+bash "lxc_wait_for_dns" do
+  code <<-EOH
+	# sometimes DNS is not immediately available
+	for i in {1..20}; do
+		ssh #{node["lxc"]["cont"]["ip_address"]} ping -c 1 www.google.com && break
+		sleep 1
+		if [ "$i" == "20" ]; then
+			echo "WARN: Unable to ssh into new container and ping host 'www.google.com'."
+			exit 1
+		fi
+	done
+EOH
+end
+

data/chef/cookbooks/lxc/recipes/stop_lxc.rb

@@ -0,0 +1,86 @@
+
+# save changes of prototype container with docker
+bash "lxc_docker_commit" do
+  code <<-EOH
+  cont_name=#{node["lxc"]["cont"]["name"]}
+  ip_address=#{node["lxc"]["cont"]["ip_address"]}
+  root_path=#{node["lxc"]["root_path"]}
+
+  imgID=`cat $root_path/$cont_name/docker.image.id`
+  instID=`cat $root_path/$cont_name/docker.container.id`
+  if [ "$imgID" == "" ] || [ "$instID" == "" ]; then
+    echo "WARN: Invalid image ID or instance ID for prototype '$cont_name': '$imgID', '$instID'"
+    exit 1
+  fi
+  # TODO config.lxc now renamed to config.json in new docker versions!
+  cp /var/lib/docker/containers/$instID/config.lxc $root_path/$cont_name/config
+  echo "lxc.network.ipv4 = $ip_address/16" >> $root_path/$cont_name/config
+  newImgID=`docker commit $instID prototypes "$cont_name"` # old syntax
+  if [ "$newImgID" == "" ]; then
+    newImgID=`docker commit $instID prototypes:$cont_name` # new syntax
+  fi
+  if [ "$newImgID" != "" ]; then
+    # remove old docker image
+    docker rmi $imgID
+    # update new image id
+    echo $newImgID > $root_path/$cont_name/docker.image.id
+  else
+    echo "WARN: Unable to save/commit prototype with docker (invalid new image ID received)"
+    exit 1
+  fi
+EOH
+  # only execute if we use docker.io tools
+  only_if do node["lxc"]["use_docker.io"] end
+  # only execute if this is a prototype container
+  only_if do node["lxc"]["cont"]["name"].match(/^prototype_.*/) end
+end
+
+bash "lxc_stop" do
+  if node["lxc"]["use_docker.io"] 
+  code <<-EOH
+	name=#{node["lxc"]["cont"]["name"]}
+	contID=`cat #{node["lxc"]["root_path"]}/$name/docker.container.id`
+  docker kill $contID
+  docker rm $contID
+EOH
+  else
+  code <<-EOH
+	name=#{node["lxc"]["cont"]["name"]}
+	lxc-stop -n $name
+	version=`lxc-version`
+	if [ "${version:0:3}" == "0.7" ]; then
+		lxc-destroy -n #{node["lxc"]["cont"]["name"]}
+	else
+		# WARN: starting with LXC 0.8.0, lxc-destroy deletes the rootfs!
+	  root_path=#{node["lxc"]["root_path"]}
+
+		if [ #{node["lxc"]["use_copy_on_write"] ? 1 : 0} ]; then
+			mv $root_path/$name $root_path/$name.copy
+			#/sbin/btrfs subvolume snapshot $root_path/$name $root_path/$name.copy
+			lxc-destroy -n $name
+			#/sbin/btrfs subvolume delete $root_path/$name
+		else
+			cp -r $root_path/$name $root_path/$name.copy
+			lxc-destroy -n $name
+			rm -r $root_path/$name
+		fi
+		mv $root_path/$name.copy $root_path/$name
+	fi
+EOH
+  end
+end
+
+bash "lxc_stop_proto" do
+  code <<-EOH
+	# do some additional tasks for prototypes
+
+	echo "INFO: Resetting /etc/resolv.conf within prototype to a symlink"
+	# reset /etc/resolv.conf to symlink
+	rm -f #{node["lxc"]["cont"]["root_fs"]}/etc/resolv.conf
+	ln -s /etc/resolv.conf #{node["lxc"]["cont"]["root_fs"]}/etc/resolv.conf
+EOH
+  only_if do node["lxc"]["cont"]["name"].match(/^prototype_.*/) end
+  # don't execute if we use docker.io tools
+  not_if do node["lxc"]["use_docker.io"] end
+end
+