Merge lp:~axwalk/juju-core/local-provider-environs-cloudinit into lp:~go-bot/juju-core/trunk

[Andrew Wilkins]

local: use sudo internally

The local provider has been updated to do several things:
- use environs/cloudinit to bootstrap
- rely on the terminationworker to cleanup
- prevent bootstrap if the user is root (forcing good practice)
- use sudo internally, in bootstrap/destroy

Bootstrap now generates a script, a la manual bootstrap,
and executes it with "sudo bash". Destroy works by repeating
the "juju destroy-environment" command under sudo, which is
necessary to destroy any leftover containers.

https://codereview.appspot.com/55880043/

local: use sudo internally

The local provider has been updated to do several things:
- use environs/cloudinit to bootstrap
- rely on the terminationworker to cleanup
- prevent bootstrap if the user is root (forcing good practice)
- use sudo internally, in bootstrap/destroy

Bootstrap now generates a script, a la manual bootstrap,
and executes it with "sudo bash". Destroy works by repeating
the "juju destroy-environment" command under sudo, which is
necessary to destroy any leftover containers.

https://codereview.appspot.com/55880043/

[Andrew Wilkins (axwalk)]

Reviewers: mp+202791_code.launchpad.net,

Message:
Please take a look.

Description:
local: use sudo internally

The local provider has been updated to do several things:
- use environs/cloudinit to bootstrap
- rely on the terminationworker to cleanup
- prevent bootstrap if the user is root (forcing good practice)
- use sudo internally, in bootstrap/destroy

Bootstrap now generates a script, a la manual bootstrap,
and executes it with "sudo bash". Destroy works by repeating
the "juju destroy-environment" command under sudo, which is
necessary to destroy any leftover containers.

https://code.launchpad.net/~axwalk/juju-core/local-provider-environs-cloudinit/+merge/202791

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/55880043/

Affected files (+351, -477 lines):
   A [revision details]
   M agent/agent.go
   M cmd/jujud/machine.go
   M environs/cloudinit.go
   M environs/cloudinit/cloudinit.go
   M environs/cloudinit/cloudinit_test.go
   M environs/cloudinit_test.go
   M provider/azure/customdata_test.go
   M provider/local/config.go
   M provider/local/config_test.go
   M provider/local/environ.go
   M provider/local/environ_test.go
   M provider/local/environprovider.go
   M provider/local/export_test.go
   M provider/local/instance.go

[Michael Nelson (michael.nelson)]

https://codereview.appspot.com/55880043/diff/1/provider/local/environ.go
File provider/local/environ.go (right):

https://codereview.appspot.com/55880043/diff/1/provider/local/environ.go#newcode402
provider/local/environ.go:402: cmd := exec.Command("sudo",
append([]string{juju}, os.Args[1:]...)...)
Not a review, just a question: If I'm using /home/me/golang/bin/juju
destroy-environment (whether via PATH or explicitly), I think "sudo juju
..." won't necessarily use the same binary - at least, I was caught by
that recently. It might be better to get the actual binary name instead
of []string{juju}?

https://codereview.appspot.com/55880043/

[Andrew Wilkins (axwalk)]

https://codereview.appspot.com/55880043/diff/1/provider/local/environ.go
File provider/local/environ.go (right):

https://codereview.appspot.com/55880043/diff/1/provider/local/environ.go#newcode402
provider/local/environ.go:402: cmd := exec.Command("sudo",
append([]string{juju}, os.Args[1:]...)...)
On 2014/01/23 10:54:28, Michael Nelson wrote:
> Not a review, just a question: If I'm using /home/me/golang/bin/juju
> destroy-environment (whether via PATH or explicitly), I think "sudo
juju ..."
> won't necessarily use the same binary - at least, I was caught by that
recently.

Right, this is one of the problems with using sudo externally: the
environment isn't (by default) propagated through sudo. People have had
to work around this by either using "sudo -E ..." or "sudo `which juju`
...".

> It might be better to get the actual binary name instead of
[]string{juju}?

This is the point of the exec.LookPath above. See:
http://golang.org/pkg/os/exec/#LookPath

https://codereview.appspot.com/55880043/

[Michael Nelson (michael.nelson)]

On Thu, Jan 23, 2014 at 12:02 PM, <email address hidden> wrote:
>
> This is the point of the exec.LookPath above. See:
> http://golang.org/pkg/os/exec/#LookPath
>

Excellent, thanks.

[Andrew Wilkins (axwalk)]

Please take a look.

https://codereview.appspot.com/55880043/

[Tim Penhey (thumper)]

LGTM - looks awesome!

https://codereview.appspot.com/55880043/diff/20001/provider/local/export_test.go
File provider/local/export_test.go (right):

https://codereview.appspot.com/55880043/diff/20001/provider/local/export_test.go#newcode14
provider/local/export_test.go:14: FinishBootstrap = &finishBootstrap
nice...

https://codereview.appspot.com/55880043/

=== modified file 'agent/agent.go'
--- agent/agent.go	2013-11-22 01:52:18 +0000
+++ agent/agent.go	2014-01-23 22:11:39 +0000
@@ -31,6 +31,7 @@
 	SharedStorageAddr = "SHARED_STORAGE_ADDR"
 	AgentServiceName  = "AGENT_SERVICE_NAME"
 	MongoServiceName  = "MONGO_SERVICE_NAME"
+	RsyslogConfPath   = "RSYSLOG_CONF_PATH"
 )
 
 // The Config interface is the sole way that the agent gets access to the

=== modified file 'cmd/jujud/machine.go'
--- cmd/jujud/machine.go	2014-01-22 15:40:18 +0000
+++ cmd/jujud/machine.go	2014-01-23 22:11:39 +0000
@@ -18,6 +18,7 @@
 	"launchpad.net/juju-core/cmd"
 	"launchpad.net/juju-core/container/kvm"
 	"launchpad.net/juju-core/instance"
+	"launchpad.net/juju-core/log/syslog"
 	"launchpad.net/juju-core/names"
 	"launchpad.net/juju-core/provider"
 	"launchpad.net/juju-core/state"
@@ -378,6 +379,15 @@
 			errors = append(errors, fmt.Errorf("cannot remove service %q: %v", agentServiceName, err))
 		}
 	}
+	// Remove the rsyslog conf file and restart rsyslogd.
+	if rsyslogConfPath := a.Conf.config.Value(agent.RsyslogConfPath); rsyslogConfPath != "" {
+		if err := os.Remove(rsyslogConfPath); err != nil {
+			errors = append(errors, err)
+		}
+		if err := syslog.Restart(); err != nil {
+			errors = append(errors, err)
+		}
+	}
 	// Remove the juju-run symlink.
 	if err := os.Remove(jujuRun); err != nil && !os.IsNotExist(err) {
 		errors = append(errors, err)

=== modified file 'environs/cloudinit.go'
--- environs/cloudinit.go	2014-01-21 03:26:37 +0000
+++ environs/cloudinit.go	2014-01-23 22:11:39 +0000
@@ -11,16 +11,29 @@
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/environs/cloudinit"
 	"launchpad.net/juju-core/environs/config"
+	"launchpad.net/juju-core/names"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
 	"launchpad.net/juju-core/utils"
 )
 
-// Default data directory.
+// DataDir is the default data directory.
 // Tests can override this where needed, so they don't need to mess with global
 // system state.
 var DataDir = "/var/lib/juju"
 
+// LogDir is the default log file path.
+const LogDir = "/var/log/juju"
+
+// CloudInitOutputLog is the default cloud-init-output.log file path.
+const CloudInitOutputLog = "/var/log/cloud-init-output.log"
+
+// RsyslogConfPath is the default rsyslogd conf file path.
+const RsyslogConfPath = "/etc/rsyslog.d/25-juju.conf"
+
+// MongoServiceName is the default Upstart service name for Mongo.
+const MongoServiceName = "juju-db"
+
 // NewMachineConfig sets up a basic machine configuration, for a non-bootstrap
 // node.  You'll still need to supply more information, but this takes care of
 // the fixed entries and the ones that are always needed.
@@ -28,7 +41,12 @@
 	stateInfo *state.Info, apiInfo *api.Info) *cloudinit.MachineConfig {
 	return &cloudinit.MachineConfig{
 		// Fixed entries.
-		DataDir: DataDir,
+		DataDir:                 DataDir,
+		LogDir:                  LogDir,
+		CloudInitOutputLog:      CloudInitOutputLog,
+		RsyslogConfPath:         RsyslogConfPath,
+		MachineAgentServiceName: "jujud-" + names.MachineTag(machineID),
+		MongoServiceName:        MongoServiceName,
 
 		// Parameter entries.
 		MachineId:    machineID,

=== modified file 'environs/cloudinit/cloudinit.go'
--- environs/cloudinit/cloudinit.go	2014-01-22 04:59:41 +0000
+++ environs/cloudinit/cloudinit.go	2014-01-23 22:11:39 +0000
@@ -91,6 +91,17 @@
 	// machine.
 	DataDir string
 
+	// LogDir holds the directory that juju logs will be written to.
+	LogDir string
+
+	// RsyslogConfPath is the path to the rsyslogd conf file written
+	// for configuring distributed logging.
+	RsyslogConfPath string
+
+	// CloudInitOutputLog specifies the path to the output log for cloud-init.
+	// The directory containing the log file must already exist.
+	CloudInitOutputLog string
+
 	// MachineId identifies the new machine.
 	MachineId string
 
@@ -131,6 +142,16 @@
 	// StateServer (member above) is set to true.
 	SystemPrivateSSHKey string
 
+	// DisablePackageCommands is a flag that specifies whether to suppress
+	// the addition of package management commands.
+	DisablePackageCommands bool
+
+	// MachineAgentServiceName is the Upstart service name for the Juju machine agent.
+	MachineAgentServiceName string
+
+	// MongoServiceName is the Upstart service name for the Mongo database.
+	MongoServiceName string
+
 	// ProxySettings define normal http, https and ftp proxies.
 	ProxySettings osenv.ProxySettings
 
@@ -157,8 +178,6 @@
 	return ConfigureJuju(cfg, c)
 }
 
-const cloudInitOutputLog = "/var/log/cloud-init-output.log"
-
 // NonceFile is written by cloud-init as the last thing it does.
 // The file will contain the machine's nonce. The filename is
 // relative to the Juju data-dir.
@@ -181,7 +200,7 @@
 		"set -xe", // ensure we run all the scripts or abort.
 	)
 	c.AddSSHAuthorizedKeys(cfg.AuthorizedKeys)
-	c.SetOutput(cloudinit.OutAll, "| tee -a "+cloudInitOutputLog, "")
+	c.SetOutput(cloudinit.OutAll, "| tee -a "+cfg.CloudInitOutputLog, "")
 	// Create a file in a well-defined location containing the machine's
 	// nonce. The presence and contents of this file will be verified
 	// during bootstrap.
@@ -215,45 +234,50 @@
 	// have been set. We don't want to show the log to the user, so simply
 	// append to the log file rather than teeing.
 	if stdout, _ := c.Output(cloudinit.OutAll); stdout == "" {
-		c.SetOutput(cloudinit.OutAll, ">> "+cloudInitOutputLog, "")
+		c.SetOutput(cloudinit.OutAll, ">> "+cfg.CloudInitOutputLog, "")
 		c.AddBootCmd(initProgressCmd)
-		c.AddBootCmd(cloudinit.LogProgressCmd("Logging to %s on remote host", cloudInitOutputLog))
-	}
-
-	// Write out the apt proxy settings
-	if (cfg.AptProxySettings != osenv.ProxySettings{}) {
-		filename := "/etc/apt/apt.conf.d/42-juju-proxy-settings"
-		c.AddBootCmd(fmt.Sprintf(
-			`[ -f %s ] || (printf '%%s\n' %s > %s)`,
-			filename,
-			shquote(utils.AptProxyContent(cfg.AptProxySettings)),
-			filename))
-	}
-
-	// Bring packages up-to-date.
-	c.SetAptUpdate(true)
-	c.SetAptUpgrade(true)
-
-	// juju requires git for managing charm directories.
-	c.AddPackage("git")
-	c.AddPackage("cpu-checker")
+		c.AddBootCmd(cloudinit.LogProgressCmd("Logging to %s on remote host", cfg.CloudInitOutputLog))
+	}
+
+	if !cfg.DisablePackageCommands {
+		// Bring packages up-to-date.
+		c.SetAptUpdate(true)
+		c.SetAptUpgrade(true)
+
+		// juju requires git for managing charm directories.
+		c.AddPackage("git")
+		c.AddPackage("cpu-checker")
+
+		// Write out the apt proxy settings
+		if (cfg.AptProxySettings != osenv.ProxySettings{}) {
+			filename := "/etc/apt/apt.conf.d/42-juju-proxy-settings"
+			c.AddBootCmd(fmt.Sprintf(
+				`[ -f %s ] || (printf '%%s\n' %s > %s)`,
+				filename,
+				shquote(utils.AptProxyContent(cfg.AptProxySettings)),
+				filename))
+		}
+	}
 
 	// Write out the normal proxy settings so that the settings are
 	// sourced by bash, and ssh through that.
 	c.AddScripts(
 		// We look to see if the proxy line is there already as
-		// the manual provider may have had it aleady.
-		`grep -q '.juju-proxy' /home/ubuntu/.profile || printf '\n# Added by juju\n[ -f "$HOME/.juju-proxy" ] && . "$HOME/.juju-proxy"\n' >> /home/ubuntu/.profile`)
+		// the manual provider may have had it aleady. The ubuntu
+		// user may not exist (local provider only).
+		`([ ! -e /home/ubuntu/.profile ] || grep -q '.juju-proxy' /home/ubuntu/.profile) || ` +
+			`printf '\n# Added by juju\n[ -f "$HOME/.juju-proxy" ] && . "$HOME/.juju-proxy"\n' >> /home/ubuntu/.profile`)
 	if (cfg.ProxySettings != osenv.ProxySettings{}) {
 		c.AddScripts(
 			fmt.Sprintf(
-				`printf '%%s\n' %s > /home/ubuntu/.juju-proxy && chown ubuntu:ubuntu /home/ubuntu/.juju-proxy`,
+				`[ -e /home/ubuntu ] && (printf '%%s\n' %s > /home/ubuntu/.juju-proxy && chown ubuntu:ubuntu /home/ubuntu/.juju-proxy)`,
 				shquote(cfg.ProxySettings.AsEnvironmentValues())))
 	}
 
 	c.AddScripts(
 		fmt.Sprintf("mkdir -p %s", cfg.DataDir),
-		"mkdir -p /var/log/juju")
+		fmt.Sprintf("mkdir -p %s", cfg.LogDir),
+	)
 
 	// Make a directory for the tools to live in, then fetch the
 	// tools and unarchive them into it.
@@ -303,23 +327,27 @@
 	// Add the cloud archive cloud-tools pocket to apt sources
 	// for series that need it. This gives us up-to-date LXC,
 	// MongoDB, and other infrastructure.
-	cfg.MaybeAddCloudArchiveCloudTools(c)
+	if !cfg.DisablePackageCommands {
+		cfg.MaybeAddCloudArchiveCloudTools(c)
+	}
 
 	if cfg.StateServer {
 		identityFile := cfg.dataFile(SystemIdentity)
 		c.AddFile(identityFile, cfg.SystemPrivateSSHKey, 0600)
-		// Disable the default mongodb installed by the mongodb-server package.
-		// Only do this if the file doesn't exist already, so users can run
-		// their own mongodb server if they wish to.
-		c.AddBootCmd(
-			`[ -f /etc/default/mongodb ] ||
+		if !cfg.DisablePackageCommands {
+			// Disable the default mongodb installed by the mongodb-server package.
+			// Only do this if the file doesn't exist already, so users can run
+			// their own mongodb server if they wish to.
+			c.AddBootCmd(
+				`[ -f /etc/default/mongodb ] ||
              (echo ENABLE_MONGODB="no" > /etc/default/mongodb)`)
 
-		if cfg.NeedMongoPPA() {
-			const key = "" // key is loaded from PPA
-			c.AddAptSource("ppa:juju/stable", key)
+			if cfg.NeedMongoPPA() {
+				const key = "" // key is loaded from PPA
+				c.AddAptSource("ppa:juju/stable", key)
+			}
+			c.AddPackage("mongodb-server")
 		}
-		c.AddPackage("mongodb-server")
 		certKey := string(cfg.StateServerCert) + string(cfg.StateServerKey)
 		c.AddFile(cfg.dataFile("server.pem"), certKey, 0600)
 		if err := cfg.addMongoToBoot(c); err != nil {
@@ -358,7 +386,7 @@
 
 func (cfg *MachineConfig) addLogging(c *cloudinit.Config) error {
 	namespace := cfg.AgentEnvironment[agent.Namespace]
-	var configRenderer syslog.SyslogConfigRenderer
+	var configRenderer *syslog.SyslogConfig
 	if cfg.StateServer {
 		configRenderer = syslog.NewAccumulateConfig(
 			names.MachineTag(cfg.MachineId), cfg.SyslogPort, namespace)
@@ -366,11 +394,12 @@
 		configRenderer = syslog.NewForwardConfig(
 			names.MachineTag(cfg.MachineId), cfg.SyslogPort, namespace, cfg.stateHostAddrs())
 	}
+	configRenderer.LogDir = cfg.LogDir
 	content, err := configRenderer.Render()
 	if err != nil {
 		return err
 	}
-	c.AddFile("/etc/rsyslog.d/25-juju.conf", string(content), 0600)
+	c.AddFile(cfg.RsyslogConfPath, string(content), 0600)
 	c.AddRunCmd("restart rsyslog")
 	return nil
 }
@@ -418,9 +447,10 @@
 	if err != nil {
 		return nil, err
 	}
-	acfg.SetValue(agent.AgentServiceName, machineAgentServiceName(tag))
+	acfg.SetValue(agent.RsyslogConfPath, cfg.RsyslogConfPath)
+	acfg.SetValue(agent.AgentServiceName, cfg.MachineAgentServiceName)
 	if cfg.StateServer {
-		acfg.SetValue(agent.MongoServiceName, mongoServiceName)
+		acfg.SetValue(agent.MongoServiceName, cfg.MongoServiceName)
 	}
 	cmds, err := acfg.WriteCommands()
 	if err != nil {
@@ -430,12 +460,6 @@
 	return acfg, nil
 }
 
-const mongoServiceName = "juju-db"
-
-func machineAgentServiceName(tag string) string {
-	return "jujud-" + tag
-}
-
 func (cfg *MachineConfig) addMachineAgentToBoot(c *cloudinit.Config, tag, machineId string) error {
 	// Make the agent run via a symbolic link to the actual tools
 	// directory, so it can upgrade itself without needing to change
@@ -444,8 +468,8 @@
 	// TODO(dfc) ln -nfs, so it doesn't fail if for some reason that the target already exists
 	c.AddScripts(fmt.Sprintf("ln -s %v %s", cfg.Tools.Version, shquote(toolsDir)))
 
-	name := machineAgentServiceName(tag)
-	conf := upstart.MachineAgentUpstartService(name, toolsDir, cfg.DataDir, "/var/log/juju/", tag, machineId, nil)
+	name := cfg.MachineAgentServiceName
+	conf := upstart.MachineAgentUpstartService(name, toolsDir, cfg.DataDir, cfg.LogDir, tag, machineId, nil)
 	cmds, err := conf.InstallCommands()
 	if err != nil {
 		return fmt.Errorf("cannot make cloud-init upstart script for the %s agent: %v", tag, err)
@@ -466,7 +490,7 @@
 		"dd bs=1M count=1 if=/dev/zero of="+dbDir+"/journal/prealloc.2",
 	)
 
-	name := mongoServiceName
+	name := cfg.MongoServiceName
 	conf := upstart.MongoUpstartService(name, cfg.DataDir, dbDir, cfg.StatePort)
 	cmds, err := conf.InstallCommands()
 	if err != nil {
@@ -602,6 +626,15 @@
 	if cfg.DataDir == "" {
 		return fmt.Errorf("missing var directory")
 	}
+	if cfg.LogDir == "" {
+		return fmt.Errorf("missing log directory")
+	}
+	if cfg.CloudInitOutputLog == "" {
+		return fmt.Errorf("missing cloud-init output log path")
+	}
+	if cfg.RsyslogConfPath == "" {
+		return fmt.Errorf("missing rsyslog.d conf path")
+	}
 	if cfg.Tools == nil {
 		return fmt.Errorf("missing tools")
 	}
@@ -623,7 +656,13 @@
 	if len(cfg.APIInfo.CACert) == 0 {
 		return fmt.Errorf("missing API CA certificate")
 	}
+	if cfg.MachineAgentServiceName == "" {
+		return fmt.Errorf("missing machine agent service name")
+	}
 	if cfg.StateServer {
+		if cfg.MongoServiceName == "" {
+			return fmt.Errorf("missing mongo service name")
+		}
 		if cfg.Config == nil {
 			return fmt.Errorf("missing environment configuration")
 		}

=== modified file 'environs/cloudinit/cloudinit_test.go'
--- environs/cloudinit/cloudinit_test.go	2014-01-22 04:59:41 +0000
+++ environs/cloudinit/cloudinit_test.go	2014-01-23 22:11:39 +0000
@@ -82,10 +82,15 @@
 				Password: "bletch",
 				CACert:   []byte("CA CERT\n" + testing.CACert),
 			},
-			Constraints:         envConstraints,
-			DataDir:             environs.DataDir,
-			StateInfoURL:        "some-url",
-			SystemPrivateSSHKey: "private rsa key",
+			Constraints:             envConstraints,
+			DataDir:                 environs.DataDir,
+			LogDir:                  environs.LogDir,
+			CloudInitOutputLog:      environs.CloudInitOutputLog,
+			RsyslogConfPath:         environs.RsyslogConfPath,
+			StateInfoURL:            "some-url",
+			SystemPrivateSSHKey:     "private rsa key",
+			MachineAgentServiceName: "jujud-machine-0",
+			MongoServiceName:        "juju-db",
 		},
 		setEnvConfig: true,
 		expectScripts: `
@@ -94,7 +99,7 @@
 install -D -m 644 /dev/null '/var/lib/juju/nonce.txt'
 printf '%s\\n' 'FAKE_NONCE' > '/var/lib/juju/nonce.txt'
 test -e /proc/self/fd/9 \|\| exec 9>&2
-grep -q '.juju-proxy' /home/ubuntu/.profile \|\| printf .* >> /home/ubuntu/.profile
+\(\[ ! -e /home/ubuntu/.profile \] \|\| grep -q '.juju-proxy' /home/ubuntu/.profile\) \|\| printf .* >> /home/ubuntu/.profile
 mkdir -p /var/lib/juju
 mkdir -p /var/log/juju
 echo 'Fetching tools.*
@@ -163,10 +168,15 @@
 				Password: "bletch",
 				CACert:   []byte("CA CERT\n" + testing.CACert),
 			},
-			Constraints:         envConstraints,
-			DataDir:             environs.DataDir,
-			StateInfoURL:        "some-url",
-			SystemPrivateSSHKey: "private rsa key",
+			Constraints:             envConstraints,
+			DataDir:                 environs.DataDir,
+			LogDir:                  environs.LogDir,
+			CloudInitOutputLog:      environs.CloudInitOutputLog,
+			RsyslogConfPath:         environs.RsyslogConfPath,
+			StateInfoURL:            "some-url",
+			SystemPrivateSSHKey:     "private rsa key",
+			MachineAgentServiceName: "jujud-machine-0",
+			MongoServiceName:        "juju-db",
 		},
 		setEnvConfig: true,
 		inexactMatch: true,
@@ -184,13 +194,16 @@
 	}, {
 		// non state server.
 		cfg: cloudinit.MachineConfig{
-			MachineId:        "99",
-			AuthorizedKeys:   "sshkey1",
-			AgentEnvironment: map[string]string{agent.ProviderType: "dummy"},
-			DataDir:          environs.DataDir,
-			StateServer:      false,
-			Tools:            newSimpleTools("1.2.3-linux-amd64"),
-			MachineNonce:     "FAKE_NONCE",
+			MachineId:          "99",
+			AuthorizedKeys:     "sshkey1",
+			AgentEnvironment:   map[string]string{agent.ProviderType: "dummy"},
+			DataDir:            environs.DataDir,
+			LogDir:             environs.LogDir,
+			CloudInitOutputLog: environs.CloudInitOutputLog,
+			RsyslogConfPath:    environs.RsyslogConfPath,
+			StateServer:        false,
+			Tools:              newSimpleTools("1.2.3-linux-amd64"),
+			MachineNonce:       "FAKE_NONCE",
 			StateInfo: &state.Info{
 				Addrs:    []string{"state-addr.testing.invalid:12345"},
 				Tag:      "machine-99",
@@ -203,14 +216,15 @@
 				Password: "bletch",
 				CACert:   []byte("CA CERT\n" + testing.CACert),
 			},
-			SyslogPort: 514,
+			SyslogPort:              514,
+			MachineAgentServiceName: "jujud-machine-99",
 		},
 		expectScripts: `
 set -xe
 install -D -m 644 /dev/null '/var/lib/juju/nonce.txt'
 printf '%s\\n' 'FAKE_NONCE' > '/var/lib/juju/nonce.txt'
 test -e /proc/self/fd/9 \|\| exec 9>&2
-grep -q '.juju-proxy' /home/ubuntu/.profile \|\| printf .* >> /home/ubuntu/.profile
+\(\[ ! -e /home/ubuntu/\.profile \] \|\| grep -q '.juju-proxy' /home/ubuntu/.profile\) \|\| printf .* >> /home/ubuntu/.profile
 mkdir -p /var/lib/juju
 mkdir -p /var/log/juju
 echo 'Fetching tools.*
@@ -243,6 +257,9 @@
 			AuthorizedKeys:       "sshkey1",
 			AgentEnvironment:     map[string]string{agent.ProviderType: "dummy"},
 			DataDir:              environs.DataDir,
+			LogDir:               environs.LogDir,
+			CloudInitOutputLog:   environs.CloudInitOutputLog,
+			RsyslogConfPath:      environs.RsyslogConfPath,
 			StateServer:          false,
 			Tools:                newSimpleTools("1.2.3-linux-amd64"),
 			MachineNonce:         "FAKE_NONCE",
@@ -258,7 +275,8 @@
 				Password: "bletch",
 				CACert:   []byte("CA CERT\n" + testing.CACert),
 			},
-			SyslogPort: 514,
+			SyslogPort:              514,
+			MachineAgentServiceName: "jujud-machine-2-lxc-1",
 		},
 		inexactMatch: true,
 		expectScripts: `
@@ -276,13 +294,16 @@
 	}, {
 		// hostname verification disabled.
 		cfg: cloudinit.MachineConfig{
-			MachineId:        "99",
-			AuthorizedKeys:   "sshkey1",
-			AgentEnvironment: map[string]string{agent.ProviderType: "dummy"},
-			DataDir:          environs.DataDir,
-			StateServer:      false,
-			Tools:            newSimpleTools("1.2.3-linux-amd64"),
-			MachineNonce:     "FAKE_NONCE",
+			MachineId:          "99",
+			AuthorizedKeys:     "sshkey1",
+			AgentEnvironment:   map[string]string{agent.ProviderType: "dummy"},
+			DataDir:            environs.DataDir,
+			LogDir:             environs.LogDir,
+			CloudInitOutputLog: environs.CloudInitOutputLog,
+			RsyslogConfPath:    environs.RsyslogConfPath,
+			StateServer:        false,
+			Tools:              newSimpleTools("1.2.3-linux-amd64"),
+			MachineNonce:       "FAKE_NONCE",
 			StateInfo: &state.Info{
 				Addrs:    []string{"state-addr.testing.invalid:12345"},
 				Tag:      "machine-99",
@@ -297,6 +318,7 @@
 			},
 			SyslogPort:                     514,
 			DisableSSLHostnameVerification: true,
+			MachineAgentServiceName:        "jujud-machine-99",
 		},
 		inexactMatch: true,
 		expectScripts: `
@@ -325,9 +347,14 @@
 				Password: "bletch",
 				CACert:   []byte("CA CERT\n" + testing.CACert),
 			},
-			DataDir:             environs.DataDir,
-			StateInfoURL:        "some-url",
-			SystemPrivateSSHKey: "private rsa key",
+			DataDir:                 environs.DataDir,
+			LogDir:                  environs.LogDir,
+			CloudInitOutputLog:      environs.CloudInitOutputLog,
+			RsyslogConfPath:         environs.RsyslogConfPath,
+			StateInfoURL:            "some-url",
+			SystemPrivateSSHKey:     "private rsa key",
+			MachineAgentServiceName: "jujud-machine-0",
+			MongoServiceName:        "juju-db",
 		},
 		setEnvConfig: true,
 		inexactMatch: true,
@@ -653,6 +680,15 @@
 	{"missing var directory", func(cfg *cloudinit.MachineConfig) {
 		cfg.DataDir = ""
 	}},
+	{"missing log directory", func(cfg *cloudinit.MachineConfig) {
+		cfg.LogDir = ""
+	}},
+	{"missing cloud-init output log path", func(cfg *cloudinit.MachineConfig) {
+		cfg.CloudInitOutputLog = ""
+	}},
+	{"missing rsyslog.d conf path", func(cfg *cloudinit.MachineConfig) {
+		cfg.RsyslogConfPath = ""
+	}},
 	{"missing tools", func(cfg *cloudinit.MachineConfig) {
 		cfg.Tools = nil
 	}},
@@ -702,6 +738,12 @@
 	{"missing machine nonce", func(cfg *cloudinit.MachineConfig) {
 		cfg.MachineNonce = ""
 	}},
+	{"missing machine agent service name", func(cfg *cloudinit.MachineConfig) {
+		cfg.MachineAgentServiceName = ""
+	}},
+	{"missing mongo service name", func(cfg *cloudinit.MachineConfig) {
+		cfg.MongoServiceName = ""
+	}},
 }
 
 // TestCloudInitVerify checks that required fields are appropriately
@@ -727,10 +769,15 @@
 			Addrs:  []string{"host:9999"},
 			CACert: []byte(testing.CACert),
 		},
-		Config:              minimalConfig(c),
-		DataDir:             environs.DataDir,
-		MachineNonce:        "FAKE_NONCE",
-		SystemPrivateSSHKey: "private rsa key",
+		Config:                  minimalConfig(c),
+		DataDir:                 environs.DataDir,
+		LogDir:                  environs.LogDir,
+		CloudInitOutputLog:      environs.CloudInitOutputLog,
+		RsyslogConfPath:         environs.RsyslogConfPath,
+		MachineNonce:            "FAKE_NONCE",
+		SystemPrivateSSHKey:     "private rsa key",
+		MachineAgentServiceName: "jujud-machine-99",
+		MongoServiceName:        "juju-db",
 	}
 	// check that the base configuration does not give an error
 	ci := coreCloudinit.New()
@@ -800,9 +847,9 @@
 	c.Assert(err, gc.IsNil)
 
 	cmds := cloudcfg.RunCmds()
-	first := `grep -q '.juju-proxy' /home/ubuntu/.profile || printf '\n# Added by juju\n[ -f "$HOME/.juju-proxy" ] && . "$HOME/.juju-proxy"\n' >> /home/ubuntu/.profile`
-	second := `printf '%s\n' 'export http_proxy=http://user@10.0.0.1
-export HTTP_PROXY=http://user@10.0.0.1' > /home/ubuntu/.juju-proxy && chown ubuntu:ubuntu /home/ubuntu/.juju-proxy`
+	first := `([ ! -e /home/ubuntu/.profile ] || grep -q '.juju-proxy' /home/ubuntu/.profile) || printf '\n# Added by juju\n[ -f "$HOME/.juju-proxy" ] && . "$HOME/.juju-proxy"\n' >> /home/ubuntu/.profile`
+	second := `[ -e /home/ubuntu ] && (printf '%s\n' 'export http_proxy=http://user@10.0.0.1
+export HTTP_PROXY=http://user@10.0.0.1' > /home/ubuntu/.juju-proxy && chown ubuntu:ubuntu /home/ubuntu/.juju-proxy)`
 	found := false
 	for i, cmd := range cmds {
 		if cmd == first {

=== modified file 'environs/cloudinit_test.go'
--- environs/cloudinit_test.go	2014-01-22 23:36:28 +0000
+++ environs/cloudinit_test.go	2014-01-23 22:11:39 +0000
@@ -175,14 +175,18 @@
 			CACert:   []byte("CA CERT\n" + testing.CACert),
 			Tag:      "machine-10",
 		},
-		DataDir:          environs.DataDir,
-		Config:           envConfig,
-		StatePort:        envConfig.StatePort(),
-		APIPort:          envConfig.APIPort(),
-		SyslogPort:       envConfig.SyslogPort(),
-		StateServer:      stateServer,
-		AgentEnvironment: map[string]string{agent.ProviderType: "dummy"},
-		AuthorizedKeys:   "wheredidileavemykeys",
+		DataDir:                 environs.DataDir,
+		LogDir:                  environs.LogDir,
+		CloudInitOutputLog:      environs.CloudInitOutputLog,
+		RsyslogConfPath:         environs.RsyslogConfPath,
+		Config:                  envConfig,
+		StatePort:               envConfig.StatePort(),
+		APIPort:                 envConfig.APIPort(),
+		SyslogPort:              envConfig.SyslogPort(),
+		StateServer:             stateServer,
+		AgentEnvironment:        map[string]string{agent.ProviderType: "dummy"},
+		AuthorizedKeys:          "wheredidileavemykeys",
+		MachineAgentServiceName: "jujud-machine-10",
 	}
 	script1 := "script1"
 	script2 := "script2"

=== modified file 'provider/azure/customdata_test.go'
--- provider/azure/customdata_test.go	2013-11-20 04:29:46 +0000
+++ provider/azure/customdata_test.go	2014-01-23 22:11:39 +0000
@@ -26,13 +26,15 @@
 
 // makeMachineConfig produces a valid cloudinit machine config.
 func makeMachineConfig(c *gc.C) *cloudinit.MachineConfig {
-	dir := c.MkDir()
 	machineID := "0"
 	return &cloudinit.MachineConfig{
-		MachineId:    machineID,
-		MachineNonce: "gxshasqlnng",
-		DataDir:      dir,
-		Tools:        &tools.Tools{URL: "file://" + dir},
+		MachineId:          machineID,
+		MachineNonce:       "gxshasqlnng",
+		DataDir:            environs.DataDir,
+		LogDir:             environs.LogDir,
+		CloudInitOutputLog: environs.CloudInitOutputLog,
+		RsyslogConfPath:    environs.RsyslogConfPath,
+		Tools:              &tools.Tools{URL: "file://" + c.MkDir()},
 		StateInfo: &state.Info{
 			CACert:   []byte(testing.CACert),
 			Addrs:    []string{"127.0.0.1:123"},
@@ -44,7 +46,8 @@
 			Addrs:  []string{"127.0.0.1:123"},
 			Tag:    names.MachineTag(machineID),
 		},
-		SyslogPort: 2345,
+		SyslogPort:              2345,
+		MachineAgentServiceName: "jujud-machine-0",
 	}
 }
 

=== modified file 'provider/local/config.go'
--- provider/local/config.go	2013-12-02 21:39:03 +0000
+++ provider/local/config.go	2014-01-23 22:11:39 +0000
@@ -11,7 +11,6 @@
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/schema"
-	"launchpad.net/juju-core/utils"
 )
 
 var checkIfRoot = func() bool {
@@ -26,6 +25,7 @@
 		"container":           schema.String(),
 		"storage-port":        schema.ForceInt(),
 		"shared-storage-port": schema.ForceInt(),
+		"namespace":           schema.String(),
 	}
 	// The port defaults below are not entirely arbitrary.  Local user web
 	// frameworks often use 8000 or 8080, so I didn't want to use either of
@@ -38,30 +38,20 @@
 		"bootstrap-ip":        schema.Omit,
 		"storage-port":        8040,
 		"shared-storage-port": 8041,
+		// namespace has a default of "", for backwards compatibility.
+		"namespace": "",
 	}
 )
 
 type environConfig struct {
 	*config.Config
-	user          string
-	attrs         map[string]interface{}
-	runningAsRoot bool
+	attrs map[string]interface{}
 }
 
 func newEnvironConfig(config *config.Config, attrs map[string]interface{}) *environConfig {
-	user := os.Getenv("USER")
-	root := checkIfRoot()
-	if root {
-		sudo_user := os.Getenv("SUDO_USER")
-		if sudo_user != "" {
-			user = sudo_user
-		}
-	}
 	return &environConfig{
-		Config:        config,
-		user:          user,
-		attrs:         attrs,
-		runningAsRoot: root,
+		Config: config,
+		attrs:  attrs,
 	}
 }
 
@@ -69,7 +59,7 @@
 // have the same local provider name, we need to have a simple way to
 // namespace the file locations, but more importantly the containers.
 func (c *environConfig) namespace() string {
-	return fmt.Sprintf("%s-%s", c.user, c.Name())
+	return c.attrs["namespace"].(string)
 }
 
 func (c *environConfig) rootDir() string {
@@ -146,24 +136,5 @@
 			return err
 		}
 	}
-	if c.runningAsRoot {
-		// If we have SUDO_UID and SUDO_GID, start with rootDir(), and
-		// change ownership of the directories.
-		uid, gid, err := utils.SudoCallerIds()
-		if err != nil {
-			return err
-		}
-		if uid != 0 || gid != 0 {
-			filepath.Walk(c.rootDir(),
-				func(path string, info os.FileInfo, err error) error {
-					if info != nil && info.IsDir() {
-						if err := os.Chown(path, uid, gid); err != nil {
-							return err
-						}
-					}
-					return nil
-				})
-		}
-	}
 	return nil
 }

=== modified file 'provider/local/config_test.go'
--- provider/local/config_test.go	2013-10-03 03:03:09 +0000
+++ provider/local/config_test.go	2014-01-23 22:11:39 +0000
@@ -26,7 +26,6 @@
 
 func (s *configSuite) SetUpTest(c *gc.C) {
 	s.baseProviderSuite.SetUpTest(c)
-	s.PatchEnvironment("USER", "tester")
 }
 
 func minimalConfigValues() map[string]interface{} {
@@ -108,28 +107,15 @@
 
 func (s *configSuite) TestNamespace(c *gc.C) {
 	testConfig := minimalConfig(c)
-	c.Assert(local.ConfigNamespace(testConfig), gc.Equals, "tester-test")
-}
-
-func (s *configSuite) TestNamespaceRootNoSudo(c *gc.C) {
-	restore := local.SetRootCheckFunction(func() bool { return true })
-	defer restore()
-	err := os.Setenv("USER", "root")
-	c.Assert(err, gc.IsNil)
-	testConfig := minimalConfig(c)
-	c.Assert(local.ConfigNamespace(testConfig), gc.Equals, "root-test")
-}
-
-func (s *configSuite) TestNamespaceRootWithSudo(c *gc.C) {
-	restore := local.SetRootCheckFunction(func() bool { return true })
-	defer restore()
-	err := os.Setenv("USER", "root")
-	c.Assert(err, gc.IsNil)
-	err = os.Setenv("SUDO_USER", "tester")
-	c.Assert(err, gc.IsNil)
-	defer os.Setenv("SUDO_USER", "")
-	testConfig := minimalConfig(c)
-	c.Assert(local.ConfigNamespace(testConfig), gc.Equals, "tester-test")
+	s.PatchEnvironment("USER", "tester")
+	c.Assert(local.ConfigNamespace(testConfig), gc.Equals, "tester-test")
+}
+
+func (s *configSuite) TestBootstrapAsRoot(c *gc.C) {
+	restore := local.SetRootCheckFunction(func() bool { return true })
+	defer restore()
+	_, err := local.Provider.Prepare(minimalConfig(c))
+	c.Assert(err, gc.ErrorMatches, "bootstrapping a local environment must not be done as root")
 }
 
 type configRootSuite struct {

=== modified file 'provider/local/environ.go'
--- provider/local/environ.go	2014-01-21 23:04:24 +0000
+++ provider/local/environ.go	2014-01-23 22:11:39 +0000
@@ -5,16 +5,16 @@
 
 import (
 	"fmt"
-	"io/ioutil"
 	"net"
-	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"sync"
-	"time"
 
 	"launchpad.net/juju-core/agent"
-	agenttools "launchpad.net/juju-core/agent/tools"
+	coreCloudinit "launchpad.net/juju-core/cloudinit"
+	"launchpad.net/juju-core/cloudinit/sshinit"
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/container"
 	"launchpad.net/juju-core/container/factory"
@@ -29,29 +29,18 @@
 	envtools "launchpad.net/juju-core/environs/tools"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/juju/osenv"
-	"launchpad.net/juju-core/log/syslog"
-	"launchpad.net/juju-core/names"
 	"launchpad.net/juju-core/provider/common"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
 	"launchpad.net/juju-core/tools"
-	"launchpad.net/juju-core/upstart"
-	"launchpad.net/juju-core/utils"
 	"launchpad.net/juju-core/version"
+	"launchpad.net/juju-core/worker/terminationworker"
 )
 
 // boostrapInstanceId is just the name we give to the bootstrap machine.
 // Using "localhost" because it is, and it makes sense.
 const bootstrapInstanceId instance.Id = "localhost"
 
-// upstartScriptLocation and syslogConfigDir are parameterised purely for
-// testing purposes as we don't really want to be installing and starting
-// scripts as root for testing.
-var (
-	upstartScriptLocation = "/etc/init"
-	syslogConfigDir       = "/etc/rsyslog.d"
-)
-
 // localEnviron implements Environ.
 var _ environs.Environ = (*localEnviron)(nil)
 
@@ -87,8 +76,8 @@
 	return "juju-agent-" + env.config.namespace()
 }
 
-func (env *localEnviron) syslogFilename() string {
-	return fmt.Sprintf("25-juju-%s.conf", env.config.namespace())
+func (env *localEnviron) rsyslogConfPath() string {
+	return fmt.Sprintf("/etc/rsyslog.d/25-juju-%s.conf", env.config.namespace())
 }
 
 // PrecheckInstance is specified in the environs.Prechecker interface.
@@ -103,29 +92,29 @@
 	return environs.NewContainersUnsupported("local provider does not support nested containers")
 }
 
+func ensureNotRoot() error {
+	if checkIfRoot() {
+		return fmt.Errorf("bootstrapping a local environment must not be done as root")
+	}
+	return nil
+}
+
 // Bootstrap is specified in the Environ interface.
 func (env *localEnviron) Bootstrap(ctx environs.BootstrapContext, cons constraints.Value) error {
-	if !env.config.runningAsRoot {
-		return fmt.Errorf("bootstrapping a local environment must be done as root")
-	}
-	if err := env.config.createDirs(); err != nil {
-		logger.Errorf("failed to create necessary directories: %v", err)
+	if err := ensureNotRoot(); err != nil {
 		return err
 	}
-
-	// TODO(thumper): check that the constraints don't include "container=lxc" for now.
 	privateKey, err := common.GenerateSystemSSHKey(env)
 	if err != nil {
 		return err
 	}
 
-	cert, key, err := env.setupLocalMongoService()
-	if err != nil {
-		return err
-	}
-
 	// Before we write the agent config file, we need to make sure the
 	// instance is saved in the StateInfo.
+	stateFileURL, err := bootstrap.CreateStateFile(env.Storage())
+	if err != nil {
+		return err
+	}
 	if err := bootstrap.SaveState(env.Storage(), &bootstrap.BootstrapState{
 		StateInstances: []instance.Id{bootstrapInstanceId},
 	}); err != nil {
@@ -139,23 +128,49 @@
 		return err
 	}
 
-	if err := env.configureLocalSyslog(); err != nil {
-		return err
-	}
+	mcfg := environs.NewBootstrapMachineConfig(stateFileURL, privateKey)
+	mcfg.Tools = selectedTools[0]
+	mcfg.DataDir = env.config.rootDir()
+	mcfg.LogDir = env.config.logDir()
+	mcfg.RsyslogConfPath = env.rsyslogConfPath()
+	mcfg.CloudInitOutputLog = filepath.Join(mcfg.LogDir, "cloud-init-output.log")
+	mcfg.DisablePackageCommands = true
+	mcfg.MachineAgentServiceName = env.machineAgentServiceName()
+	mcfg.MongoServiceName = env.mongoServiceName()
+	mcfg.AgentEnvironment = map[string]string{
+		agent.Namespace:         env.config.namespace(),
+		agent.StorageDir:        env.config.storageDir(),
+		agent.StorageAddr:       env.config.storageAddr(),
+		agent.SharedStorageDir:  env.config.sharedStorageDir(),
+		agent.SharedStorageAddr: env.config.sharedStorageAddr(),
+	}
+	if err := environs.FinishMachineConfig(mcfg, env.Config(), cons); err != nil {
+		return err
+	}
+	// don't write proxy settings for local machine
+	mcfg.AptProxySettings = osenv.ProxySettings{}
+	mcfg.ProxySettings = osenv.ProxySettings{}
+	cloudcfg := coreCloudinit.New()
+	if err := cloudinit.ConfigureJuju(mcfg, cloudcfg); err != nil {
+		return err
+	}
+	return finishBootstrap(mcfg, cloudcfg, ctx)
+}
 
-	// Need to write out the agent file for machine-0 before initializing
-	// state, as as part of that process, it will reset the password in the
-	// agent file.
-	agentConfig, err := env.writeBootstrapAgentConfFile(env.config.AdminSecret(), cert, key)
+// finishBootstrap converts the machine config to cloud-config,
+// converts that to a script, and then executes it locally.
+//
+// mcfg is supplied for testing purposes.
+var finishBootstrap = func(mcfg *cloudinit.MachineConfig, cloudcfg *coreCloudinit.Config, ctx environs.BootstrapContext) error {
+	script, err := sshinit.ConfigureScript(cloudcfg)
 	if err != nil {
-		return err
-	}
-
-	if err := env.initializeState(agentConfig, cons); err != nil {
-		return err
-	}
-
-	return env.setupLocalMachineAgent(cons, selectedTools, privateKey)
+		return nil
+	}
+	cmd := exec.Command("sudo", "/bin/bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Stdout = ctx.Stdout()
+	cmd.Stderr = ctx.Stderr()
+	return cmd.Run()
 }
 
 // StateInfo is specified in the Environ interface.
@@ -212,6 +227,9 @@
 	if ecfg.bootstrapped() {
 		return nil
 	}
+	if err := ensureNotRoot(); err != nil {
+		return err
+	}
 	return env.bootstrapAddressAndStorage(cfg)
 }
 
@@ -233,7 +251,7 @@
 		return err
 	}
 	networkBridge := config.networkBridge()
-	bridgeAddress, err := env.findBridgeAddress(networkBridge)
+	bridgeAddress, err := getAddressForInterface(networkBridge)
 	if err != nil {
 		logger.Infof("configure a different bridge using 'network-bridge' in the config file")
 		return fmt.Errorf("cannot find address of network-bridge: %q", networkBridge)
@@ -380,46 +398,34 @@
 
 // Destroy is specified in the Environ interface.
 func (env *localEnviron) Destroy() error {
-	if !env.config.runningAsRoot {
-		return fmt.Errorf("destroying a local environment must be done as root")
-	}
-	// Kill all running instances.
-	containers, err := env.containerManager.ListContainers()
-	if err != nil {
-		return err
-	}
-	for _, inst := range containers {
-		if err := env.containerManager.StopContainer(inst); err != nil {
-			return err
-		}
-	}
-
-	logger.Infof("removing service %s", env.machineAgentServiceName())
-	machineAgent := upstart.NewService(env.machineAgentServiceName())
-	machineAgent.InitDir = upstartScriptLocation
-	if err := machineAgent.StopAndRemove(); err != nil {
-		logger.Errorf("could not remove machine agent service: %v", err)
-		return err
-	}
-
-	logger.Infof("removing service %s", env.mongoServiceName())
-	mongo := upstart.NewService(env.mongoServiceName())
-	mongo.InitDir = upstartScriptLocation
-	if err := mongo.StopAndRemove(); err != nil {
-		logger.Errorf("could not remove mongo service: %v", err)
-		return err
-	}
-
-	env.removeLocalSyslog()
-
-	// Remove the rootdir.
-	logger.Infof("removing state dir %s", env.config.rootDir())
-	if err := os.RemoveAll(env.config.rootDir()); err != nil {
-		logger.Errorf("could not remove local state dir: %v", err)
-		return err
-	}
-
-	return nil
+	// Kill all running instances. This must be done as
+	// root, or listing/stopping containers will fail.
+	if !checkIfRoot() {
+		juju, err := exec.LookPath(os.Args[0])
+		if err != nil {
+			return err
+		}
+		cmd := exec.Command("sudo", append([]string{juju}, os.Args[1:]...)...)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		return cmd.Run()
+	} else {
+		containers, err := env.containerManager.ListContainers()
+		if err != nil {
+			return err
+		}
+		for _, inst := range containers {
+			if err := env.containerManager.StopContainer(inst); err != nil {
+				return err
+			}
+		}
+		cmd := exec.Command(
+			"pkill",
+			fmt.Sprintf("-%d", terminationworker.TerminationSignal),
+			"jujud",
+		)
+		return cmd.Run()
+	}
 }
 
 // OpenPorts is specified in the Environ interface.
@@ -441,218 +447,3 @@
 func (env *localEnviron) Provider() environs.EnvironProvider {
 	return providerInstance
 }
-
-// setupLocalMongoService returns the cert and key if there was no error.
-func (env *localEnviron) setupLocalMongoService() ([]byte, []byte, error) {
-	journalDir := filepath.Join(env.config.mongoDir(), "journal")
-	logger.Debugf("create mongo journal dir: %v", journalDir)
-	if err := os.MkdirAll(journalDir, 0755); err != nil {
-		logger.Errorf("failed to make mongo journal dir %s: %v", journalDir, err)
-		return nil, nil, err
-	}
-
-	logger.Debugf("generate server cert")
-	cert, key, err := env.config.GenerateStateServerCertAndKey()
-	if err != nil {
-		logger.Errorf("failed to generate server cert: %v", err)
-		return nil, nil, err
-	}
-	if err := ioutil.WriteFile(
-		env.config.configFile("server.pem"),
-		append(cert, key...),
-		0600); err != nil {
-		logger.Errorf("failed to write server.pem: %v", err)
-		return nil, nil, err
-	}
-
-	mongo := upstart.MongoUpstartService(
-		env.mongoServiceName(),
-		env.config.rootDir(),
-		env.config.mongoDir(),
-		env.config.StatePort())
-	mongo.InitDir = upstartScriptLocation
-	logger.Infof("installing service %s to %s", env.mongoServiceName(), mongo.InitDir)
-	if err := mongo.Install(); err != nil {
-		logger.Errorf("could not install mongo service: %v", err)
-		return nil, nil, err
-	}
-	return cert, key, nil
-}
-
-func (env *localEnviron) setupLocalMachineAgent(cons constraints.Value, possibleTools tools.List, privateKey string) error {
-	dataDir := env.config.rootDir()
-	// unpack the first tools into the agent dir.
-	agentTools := possibleTools[0]
-	logger.Debugf("tools: %#v", agentTools)
-	// save the system identity file
-	systemIdentityFilename := filepath.Join(dataDir, cloudinit.SystemIdentity)
-	logger.Debugf("writing system identity to %s", systemIdentityFilename)
-	if err := ioutil.WriteFile(systemIdentityFilename, []byte(privateKey), 0600); err != nil {
-		return fmt.Errorf("failed to write system identity: %v", err)
-	}
-
-	// brutally abuse our knowledge of storage to directly open the file
-	toolsUrl, err := url.Parse(agentTools.URL)
-	if err != nil {
-		return err
-	}
-	toolsLocation := filepath.Join(env.config.storageDir(), toolsUrl.Path)
-	logger.Infof("tools location: %v", toolsLocation)
-	toolsFile, err := os.Open(toolsLocation)
-	defer toolsFile.Close()
-	// Again, brutally abuse our knowledge here.
-
-	// The tools that possible bootstrap tools are based on the
-	// default series in the config.  However we are running potentially on a
-	// different series.  When the machine agent is started, it will be
-	// looking based on the current series, so we need to override the series
-	// returned in the tools to be the current series.
-	agentTools.Version.Series = version.Current.Series
-	err = agenttools.UnpackTools(dataDir, agentTools, toolsFile)
-
-	machineId := "0" // Always machine 0
-	tag := names.MachineTag(machineId)
-
-	// make sure we create the symlink so we have it for the upstart config to use
-	if _, err := agenttools.ChangeAgentTools(dataDir, tag, agentTools.Version); err != nil {
-		logger.Errorf("could not create tools directory symlink: %v", err)
-		return err
-	}
-
-	toolsDir := agenttools.ToolsDir(dataDir, tag)
-
-	logDir := env.config.logDir()
-	machineEnvironment := map[string]string{
-		"USER": env.config.user,
-		"HOME": osenv.Home(),
-	}
-	agentService := upstart.MachineAgentUpstartService(
-		env.machineAgentServiceName(),
-		toolsDir, dataDir, logDir, tag, machineId, machineEnvironment)
-
-	agentService.InitDir = upstartScriptLocation
-	logger.Infof("installing service %s to %s", env.machineAgentServiceName(), agentService.InitDir)
-	if err := agentService.Install(); err != nil {
-		logger.Errorf("could not install machine agent service: %v", err)
-		return err
-	}
-	return nil
-}
-
-func (env *localEnviron) findBridgeAddress(networkBridge string) (string, error) {
-	return getAddressForInterface(networkBridge)
-}
-
-func (env *localEnviron) writeBootstrapAgentConfFile(secret string, cert, key []byte) (agent.Config, error) {
-	tag := names.MachineTag("0")
-	passwordHash := utils.UserPasswordHash(secret, utils.CompatSalt)
-	// We don't check the existance of the CACert here as if it wasn't set, we
-	// wouldn't get this far.
-	cfg := env.config.Config
-	caCert, _ := cfg.CACert()
-	agentValues := map[string]string{
-		agent.ProviderType:      env.config.Type(),
-		agent.Namespace:         env.config.namespace(),
-		agent.StorageDir:        env.config.storageDir(),
-		agent.StorageAddr:       env.config.storageAddr(),
-		agent.SharedStorageDir:  env.config.sharedStorageDir(),
-		agent.SharedStorageAddr: env.config.sharedStorageAddr(),
-		agent.AgentServiceName:  env.machineAgentServiceName(),
-		agent.MongoServiceName:  env.mongoServiceName(),
-	}
-	// NOTE: the state address HAS to be localhost, otherwise the mongo
-	// initialization fails.  There is some magic code somewhere in the mongo
-	// connection code that treats connections from localhost as special, and
-	// will raise unauthorized errors during the initialization if the caller
-	// is not connected from localhost.
-	stateAddress := fmt.Sprintf("localhost:%d", cfg.StatePort())
-	apiAddress := fmt.Sprintf("localhost:%d", cfg.APIPort())
-	config, err := agent.NewStateMachineConfig(
-		agent.StateMachineConfigParams{
-			AgentConfigParams: agent.AgentConfigParams{
-				DataDir:        env.config.rootDir(),
-				Tag:            tag,
-				Password:       passwordHash,
-				Nonce:          state.BootstrapNonce,
-				StateAddresses: []string{stateAddress},
-				APIAddresses:   []string{apiAddress},
-				CACert:         caCert,
-				Values:         agentValues,
-			},
-			StateServerCert: cert,
-			StateServerKey:  key,
-			StatePort:       cfg.StatePort(),
-			APIPort:         cfg.APIPort(),
-		})
-	if err != nil {
-		return nil, err
-	}
-	if err := config.Write(); err != nil {
-		logger.Errorf("failed to write bootstrap agent file: %v", err)
-		return nil, err
-	}
-	return config, nil
-}
-
-func (env *localEnviron) initializeState(agentConfig agent.Config, cons constraints.Value) error {
-	bootstrapCfg, err := environs.BootstrapConfig(env.config.Config)
-	if err != nil {
-		return err
-	}
-	st, m, err := agentConfig.InitializeState(bootstrapCfg, agent.BootstrapMachineConfig{
-		Constraints: cons,
-		Jobs: []state.MachineJob{
-			state.JobManageEnviron,
-			state.JobManageState,
-		},
-		InstanceId: bootstrapInstanceId,
-	}, state.DialOpts{
-		Timeout: 60 * time.Second,
-	})
-	if err != nil {
-		return err
-	}
-	defer st.Close()
-	addr, err := env.findBridgeAddress(env.config.networkBridge())
-	if err != nil {
-		return fmt.Errorf("failed to get bridge address: %v", err)
-	}
-	err = m.SetAddresses([]instance.Address{{
-		NetworkScope: instance.NetworkPublic,
-		Type:         instance.HostName,
-		Value:        "localhost",
-	}, {
-		NetworkScope: instance.NetworkCloudLocal,
-		Type:         instance.Ipv4Address,
-		Value:        addr,
-	}})
-	if err != nil {
-		return fmt.Errorf("cannot set addresses on bootstrap instance: %v", err)
-	}
-	return nil
-}
-
-func (env *localEnviron) configureLocalSyslog() error {
-	tag := names.MachineTag("0")
-	syslogConfigRenderer := syslog.NewAccumulateConfig(tag, env.config.SyslogPort(), env.config.namespace())
-	syslogConfigRenderer.ConfigDir = syslogConfigDir
-	syslogConfigRenderer.ConfigFileName = env.syslogFilename()
-	syslogConfigRenderer.LogDir = env.config.logDir()
-	if err := syslogConfigRenderer.Write(); err != nil {
-		return err
-	}
-	if err := syslog.Restart(); err != nil {
-		logger.Warningf("cannot restart syslog daemon: %v", err)
-	}
-	return nil
-}
-
-func (env *localEnviron) removeLocalSyslog() {
-	// Don't fail if we have issues, but warn the user.
-	if err := os.Remove(filepath.Join(syslogConfigDir, env.syslogFilename())); err != nil {
-		logger.Warningf("could not remove local syslog config: %v", err)
-	}
-	if err := syslog.Restart(); err != nil {
-		logger.Warningf("cannot restart syslog daemon: %v", err)
-	}
-}

=== modified file 'provider/local/environ_test.go'
--- provider/local/environ_test.go	2013-10-24 00:20:59 +0000
+++ provider/local/environ_test.go	2014-01-23 22:11:39 +0000
@@ -11,14 +11,17 @@
 
 	gc "launchpad.net/gocheck"
 
+	coreCloudinit "launchpad.net/juju-core/cloudinit"
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/environs"
+	"launchpad.net/juju-core/environs/cloudinit"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/environs/jujutest"
 	envtesting "launchpad.net/juju-core/environs/testing"
 	"launchpad.net/juju-core/environs/tools"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/provider/local"
+	coretesting "launchpad.net/juju-core/testing"
 	jc "launchpad.net/juju-core/testing/checkers"
 )
 
@@ -96,14 +99,13 @@
 	// Construct the directories first.
 	err := local.CreateDirs(c, minimalConfig(c))
 	c.Assert(err, gc.IsNil)
-	s.oldUpstartLocation = local.SetUpstartScriptLocation(c.MkDir())
 	s.oldPath = os.Getenv("PATH")
 	s.testPath = c.MkDir()
 	os.Setenv("PATH", s.testPath+":"+s.oldPath)
 
 	// Add in an admin secret
 	s.Tests.TestConfig["admin-secret"] = "sekrit"
-	s.restoreRootCheck = local.SetRootCheckFunction(func() bool { return true })
+	s.restoreRootCheck = local.SetRootCheckFunction(func() bool { return false })
 	s.Tests.SetUpTest(c)
 
 	cfg, err := config.New(config.NoDefaults, s.TestConfig)
@@ -115,7 +117,6 @@
 	s.Tests.TearDownTest(c)
 	os.Setenv("PATH", s.oldPath)
 	s.restoreRootCheck()
-	local.SetUpstartScriptLocation(s.oldUpstartLocation)
 	s.baseProviderSuite.TearDownTest(c)
 }
 
@@ -141,7 +142,20 @@
 })
 
 func (s *localJujuTestSuite) TestBootstrap(c *gc.C) {
-	c.Skip("Cannot test bootstrap at this stage.")
+	s.PatchValue(local.FinishBootstrap, func(mcfg *cloudinit.MachineConfig, cloudcfg *coreCloudinit.Config, ctx environs.BootstrapContext) error {
+		c.Assert(cloudcfg.AptUpdate(), jc.IsFalse)
+		c.Assert(cloudcfg.AptUpgrade(), jc.IsFalse)
+		c.Assert(cloudcfg.Packages(), gc.HasLen, 0)
+		return nil
+	})
+	testConfig := minimalConfig(c)
+	environ, err := local.Provider.Prepare(testConfig)
+	c.Assert(err, gc.IsNil)
+	envtesting.UploadFakeTools(c, environ.Storage())
+	defer environ.Storage().RemoveAll()
+	ctx := envtesting.NewBootstrapContext(coretesting.Context(c))
+	err = environ.Bootstrap(ctx, constraints.Value{})
+	c.Assert(err, gc.IsNil)
 }
 
 func (s *localJujuTestSuite) TestStartStop(c *gc.C) {

=== modified file 'provider/local/environprovider.go'
--- provider/local/environprovider.go	2014-01-22 22:48:54 +0000
+++ provider/local/environprovider.go	2014-01-23 22:11:39 +0000
@@ -6,6 +6,7 @@
 import (
 	"fmt"
 	"net"
+	"os"
 	"syscall"
 
 	"launchpad.net/loggo"
@@ -43,6 +44,17 @@
 		}
 		cfg = newCfg
 	}
+	// Set the "namespace" attribute. We do this here, and not in Prepare,
+	// for backwards compatibility: older versions did not store the namespace
+	// in config.
+	if namespace := cfg.UnknownAttrs()["namespace"]; namespace == "" {
+		var err error
+		namespace = fmt.Sprintf("%s-%s", os.Getenv("USER"), cfg.Name())
+		cfg, err = cfg.Apply(map[string]interface{}{"namespace": namespace})
+		if err != nil {
+			return nil, fmt.Errorf("failed to create namespace: %v", err)
+		}
+	}
 	// Do the initial validation on the config.
 	localConfig, err := providerInstance.newConfig(cfg)
 	if err != nil {

=== modified file 'provider/local/export_test.go'
--- provider/local/export_test.go	2013-10-14 14:47:52 +0000
+++ provider/local/export_test.go	2014-01-23 22:11:39 +0000
@@ -10,7 +10,8 @@
 )
 
 var (
-	Provider = providerInstance
+	Provider        = providerInstance
+	FinishBootstrap = &finishBootstrap
 )
 
 // SetRootCheckFunction allows tests to override the check for a root user.
@@ -21,25 +22,18 @@
 	return func() { checkIfRoot = old }
 }
 
-// SetUpstartScriptLocation allows tests to override the directory where the
-// provider writes the upstart scripts.
-func SetUpstartScriptLocation(location string) (old string) {
-	old, upstartScriptLocation = upstartScriptLocation, location
-	return
-}
-
 // ConfigNamespace returns the result of the namespace call on the
 // localConfig.
 func ConfigNamespace(cfg *config.Config) string {
-	localConfig, _ := providerInstance.newConfig(cfg)
-	return localConfig.namespace()
+	env, _ := providerInstance.Open(cfg)
+	return env.(*localEnviron).config.namespace()
 }
 
 // CreateDirs calls createDirs on the localEnviron.
 func CreateDirs(c *gc.C, cfg *config.Config) error {
-	localConfig, err := providerInstance.newConfig(cfg)
+	env, err := providerInstance.Open(cfg)
 	c.Assert(err, gc.IsNil)
-	return localConfig.createDirs()
+	return env.(*localEnviron).config.createDirs()
 }
 
 // CheckDirs returns the list of directories to check for permissions in the test.

=== modified file 'provider/local/instance.go'
--- provider/local/instance.go	2013-12-16 09:53:26 +0000
+++ provider/local/instance.go	2014-01-23 22:11:39 +0000
@@ -33,19 +33,25 @@
 }
 
 func (inst *localInstance) Addresses() ([]instance.Address, error) {
+	if inst.id == bootstrapInstanceId {
+		addrs := []instance.Address{{
+			NetworkScope: instance.NetworkPublic,
+			Type:         instance.HostName,
+			Value:        "localhost",
+		}, {
+			NetworkScope: instance.NetworkCloudLocal,
+			Type:         instance.Ipv4Address,
+			Value:        inst.env.config.bootstrapIPAddress(),
+		}}
+		return addrs, nil
+	}
 	return nil, errors.NewNotImplementedError("localInstance.Addresses")
 }
 
 // DNSName implements instance.Instance.DNSName.
 func (inst *localInstance) DNSName() (string, error) {
-	if string(inst.id) == "localhost" {
-		// get the bridge address from the environment
-		addr, err := inst.env.findBridgeAddress(inst.env.config.networkBridge())
-		if err != nil {
-			logger.Errorf("failed to get bridge address: %v", err)
-			return "", instance.ErrNoDNSName
-		}
-		return addr, nil
+	if inst.id == bootstrapInstanceId {
+		return inst.env.config.bootstrapIPAddress(), nil
 	}
 	// Get the IPv4 address from eth0
 	return getAddressForInterface("eth0")