diff --git a/Dockerfile b/Dockerfile index 775f445..352b1c3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,14 +1,14 @@ -FROM fedora:rawhide +FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=2 ARCH=x86_64 -LABEL BZComponent="flannel" \ - Name="$FGC/flannel" \ - Version="$VERSION" \ - Release="$RELEASE.$DISTTAG" \ - Architecture="$ARCH" \ - Summary="An etcd driven address agent, intended to be run as a system container" \ +ENV VERSION=0 RELEASE=9 ARCH=x86_64 +LABEL com.redhat.component="flannel" \ + name="$FGC/flannel" \ + version="$VERSION" \ + release="$RELEASE.$DISTTAG" \ + architecture="$ARCH" \ + summary="An etcd driven address agent, intended to be run as a system container" \ maintainer="Giuseppe Scrivano " \ atomic.type='system' @@ -16,6 +16,9 @@ RUN dnf -y --setopt=tsflags=nodocs install flannel && dnf clean all ADD flanneld-run.sh /usr/bin/ +RUN mkdir -p /exports/hostfs/etc/sysconfig/ && cp /etc/sysconfig/flanneld /exports/hostfs/etc/sysconfig/ +RUN mkdir -p /exports/hostfs/etc/flanneld + # System container files COPY tmpfiles.template service.template manifest.json \ config.json.template /exports/ diff --git a/config.json.template b/config.json.template index 457dfd6..e1cae75 100644 --- a/config.json.template +++ b/config.json.template @@ -1,12 +1,15 @@ { - "ociVersion": "0.5.0", + "ociVersion": "1.0.0", "platform": { "os": "linux", "arch": "amd64" }, "process": { "terminal": false, - "user": {}, + "user": { + "uid": 0, + "gid": 0 + }, "args": [ "/usr/bin/flanneld-run.sh" ], @@ -18,42 +21,43 @@ "NAME=$NAME" ], "cwd": "/", - "capabilities": [ - "CAP_FOWNER", - "CAP_FSETID", - "CAP_KILL", - "CAP_SETGID", - "CAP_SETUID", - "CAP_SETPCAP", - "CAP_LINUX_IMMUTABLE", - "CAP_NET_BIND_SERVICE", - "CAP_NET_BROADCAST", - "CAP_NET_ADMIN", - "CAP_NET_RAW", - "CAP_IPC_LOCK", - "CAP_IPC_OWNER", - "CAP_SYS_MODULE", - "CAP_SYS_RAWIO", - "CAP_SYS_CHROOT", - "CAP_SYS_PTRACE", - "CAP_SYS_PACCT", - "CAP_SYS_ADMIN", - "CAP_SYS_BOOT", - "CAP_SYS_NICE", - "CAP_SYS_RESOURCE", - "CAP_SYS_TIME", - "CAP_SYS_TTY_CONFIG", - "CAP_MKNOD", - "CAP_LEASE", - "CAP_AUDIT_WRITE", - "CAP_AUDIT_CONTROL", - "CAP_SETFCAP", - "CAP_MAC_OVERRIDE", - "CAP_MAC_ADMIN", - "CAP_SYSLOG", - "CAP_WAKE_ALARM", - "CAP_BLOCK_SUSPEND" - ], + "capabilities": { + "bounding": [ + "CAP_DAC_READ_SEARCH", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "permitted": [ + "CAP_DAC_READ_SEARCH", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "inheritable": [ + "CAP_DAC_READ_SEARCH", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "effective": [ + "CAP_DAC_READ_SEARCH", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "ambient": [ + "CAP_DAC_READ_SEARCH", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ] + }, "rlimits": [ { "type": "RLIMIT_NOFILE", @@ -171,7 +175,27 @@ "rbind", "rprivate" ] - } + }, + { + "source": "/etc/sysconfig/flanneld", + "destination": "/etc/sysconfig/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + }, + { + "source": "/etc/flanneld", + "destination": "/etc/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + } ], "hooks": {}, "linux": { diff --git a/flanneld-run.sh b/flanneld-run.sh index 5303a90..e527d3c 100755 --- a/flanneld-run.sh +++ b/flanneld-run.sh @@ -4,10 +4,12 @@ echo "[Service]" > /etc/systemd/system/docker.service.d/$NAME.conf echo "EnvironmentFile=-/run/$NAME/docker" >> /etc/systemd/system/docker.service.d/$NAME.conf +source /etc/sysconfig/flanneld + # Ensure this file doesn't already exist. rm -f run/flannel/subnet.env -/usr/bin/flanneld & +NOTIFY_SOCKET=/dev/null /usr/bin/flanneld -etcd-endpoints=${FLANNEL_ETCD_ENDPOINTS} -etcd-prefix=${FLANNEL_ETCD_PREFIX} -etcd-cafile=${FLANNEL_ETCD_CAFILE} -etcd-certfile=${FLANNEL_ETCD_CERTFILE} -etcd-keyfile=${FLANNEL_ETCD_KEYFILE} $FLANNEL_OPTIONS & child=$! while test \! -e /run/flannel/subnet.env @@ -17,4 +19,6 @@ done /usr/libexec/flannel/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker +systemd-notify --ready + wait $child diff --git a/service.template b/service.template index d25dc8c..b6a2883 100644 --- a/service.template +++ b/service.template @@ -7,9 +7,10 @@ After=$AFTER Before=docker.service [Service] +Type=notify +NotifyAccess=all ExecStart=$EXEC_START ExecStop=$EXEC_STOP -ExecStartPost=/usr/bin/sh -c "while test \! -s ${RUN_DIRECTORY}/${NAME}/docker; do sleep 0.1; done" ExecStopPost=/bin/rm /etc/systemd/system/docker.service.d/$NAME.conf Restart=on-failure WorkingDirectory=$DESTDIR