From 095b367363cdc51039d27e1db9637b091fe1e77a Mon Sep 17 00:00:00 2001 From: yuqi-zhang Date: Wed, 8 Mar 2017 16:05:06 -0500 Subject: [PATCH 1/8] Pin to stable tag for f26 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 775f445..659d6f5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM fedora:rawhide +FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" From 5a4c36d2a790d7d4a5d6273e6ca49c17788b5ac7 Mon Sep 17 00:00:00 2001 From: yuqi-zhang Date: Wed, 10 May 2017 16:09:48 -0400 Subject: [PATCH 2/8] Update dockerfile and runc config Change labels to lowercase and update runc config file. --- Dockerfile | 14 ++++----- config.json.template | 75 ++++++++++++++++++++++---------------------- 2 files changed, 44 insertions(+), 45 deletions(-) diff --git a/Dockerfile b/Dockerfile index 659d6f5..a2defa7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,13 +2,13 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=2 ARCH=x86_64 -LABEL BZComponent="flannel" \ - Name="$FGC/flannel" \ - Version="$VERSION" \ - Release="$RELEASE.$DISTTAG" \ - Architecture="$ARCH" \ - Summary="An etcd driven address agent, intended to be run as a system container" \ +ENV VERSION=0.1 RELEASE=3 ARCH=x86_64 +LABEL com.redhat.component="flannel" \ + name="$FGC/flannel" \ + version="$VERSION" \ + release="$RELEASE.$DISTTAG" \ + architecture="$ARCH" \ + summary="An etcd driven address agent, intended to be run as a system container" \ maintainer="Giuseppe Scrivano " \ atomic.type='system' diff --git a/config.json.template b/config.json.template index 457dfd6..fa50bcb 100644 --- a/config.json.template +++ b/config.json.template @@ -1,12 +1,15 @@ { - "ociVersion": "0.5.0", + "ociVersion": "1.0.0", "platform": { "os": "linux", "arch": "amd64" }, "process": { "terminal": false, - "user": {}, + "user": { + "uid": 0, + "gid": 0 + }, "args": [ "/usr/bin/flanneld-run.sh" ], @@ -18,42 +21,38 @@ "NAME=$NAME" ], "cwd": "/", - "capabilities": [ - "CAP_FOWNER", - "CAP_FSETID", - "CAP_KILL", - "CAP_SETGID", - "CAP_SETUID", - "CAP_SETPCAP", - "CAP_LINUX_IMMUTABLE", - "CAP_NET_BIND_SERVICE", - "CAP_NET_BROADCAST", - "CAP_NET_ADMIN", - "CAP_NET_RAW", - "CAP_IPC_LOCK", - "CAP_IPC_OWNER", - "CAP_SYS_MODULE", - "CAP_SYS_RAWIO", - "CAP_SYS_CHROOT", - "CAP_SYS_PTRACE", - "CAP_SYS_PACCT", - "CAP_SYS_ADMIN", - "CAP_SYS_BOOT", - "CAP_SYS_NICE", - "CAP_SYS_RESOURCE", - "CAP_SYS_TIME", - "CAP_SYS_TTY_CONFIG", - "CAP_MKNOD", - "CAP_LEASE", - "CAP_AUDIT_WRITE", - "CAP_AUDIT_CONTROL", - "CAP_SETFCAP", - "CAP_MAC_OVERRIDE", - "CAP_MAC_ADMIN", - "CAP_SYSLOG", - "CAP_WAKE_ALARM", - "CAP_BLOCK_SUSPEND" - ], + "capabilities": { + "bounding": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "permitted": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "inheritable": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "effective": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "ambient": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ] + }, "rlimits": [ { "type": "RLIMIT_NOFILE", From ed24a03e0fe7f5c968d5e2b06fd81f319bc4da1e Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Tue, 25 Jul 2017 16:23:26 -0500 Subject: [PATCH 3/8] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index a2defa7..4dcfee7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=3 ARCH=x86_64 +ENV VERSION=0.1 RELEASE=4 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ From 58eb609ced910c14dcddde5ad5617dbb283adebb Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Thu, 24 Aug 2017 16:55:33 -0500 Subject: [PATCH 4/8] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4dcfee7..8f9c4b6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=4 ARCH=x86_64 +ENV VERSION=0.1 RELEASE=5 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ From ca0176e62bb5c97305404f8c84d65430a9296f58 Mon Sep 17 00:00:00 2001 From: yuqi-zhang Date: Wed, 6 Sep 2017 15:22:50 -0400 Subject: [PATCH 5/8] Update f26 branch to upstream Signed-off-by: Yu Qi Zhang --- Dockerfile | 5 ++++- config.json.template | 27 ++++++++++++++++++++++++++- flanneld-run.sh | 6 +++++- service.template | 3 ++- 4 files changed, 37 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8f9c4b6..20fb2d9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=5 ARCH=x86_64 +ENV VERSION=0 RELEASE=6 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ @@ -16,6 +16,9 @@ RUN dnf -y --setopt=tsflags=nodocs install flannel && dnf clean all ADD flanneld-run.sh /usr/bin/ +RUN mkdir -p /exports/hostfs/etc/sysconfig/ && cp /etc/sysconfig/flanneld /exports/hostfs/etc/sysconfig/ +RUN mkdir -p /exports/hostfs/etc/flanneld + # System container files COPY tmpfiles.template service.template manifest.json \ config.json.template /exports/ diff --git a/config.json.template b/config.json.template index fa50bcb..e1cae75 100644 --- a/config.json.template +++ b/config.json.template @@ -23,30 +23,35 @@ "cwd": "/", "capabilities": { "bounding": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "permitted": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "inheritable": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "effective": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "ambient": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", @@ -170,7 +175,27 @@ "rbind", "rprivate" ] - } + }, + { + "source": "/etc/sysconfig/flanneld", + "destination": "/etc/sysconfig/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + }, + { + "source": "/etc/flanneld", + "destination": "/etc/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + } ], "hooks": {}, "linux": { diff --git a/flanneld-run.sh b/flanneld-run.sh index 5303a90..e527d3c 100755 --- a/flanneld-run.sh +++ b/flanneld-run.sh @@ -4,10 +4,12 @@ echo "[Service]" > /etc/systemd/system/docker.service.d/$NAME.conf echo "EnvironmentFile=-/run/$NAME/docker" >> /etc/systemd/system/docker.service.d/$NAME.conf +source /etc/sysconfig/flanneld + # Ensure this file doesn't already exist. rm -f run/flannel/subnet.env -/usr/bin/flanneld & +NOTIFY_SOCKET=/dev/null /usr/bin/flanneld -etcd-endpoints=${FLANNEL_ETCD_ENDPOINTS} -etcd-prefix=${FLANNEL_ETCD_PREFIX} -etcd-cafile=${FLANNEL_ETCD_CAFILE} -etcd-certfile=${FLANNEL_ETCD_CERTFILE} -etcd-keyfile=${FLANNEL_ETCD_KEYFILE} $FLANNEL_OPTIONS & child=$! while test \! -e /run/flannel/subnet.env @@ -17,4 +19,6 @@ done /usr/libexec/flannel/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker +systemd-notify --ready + wait $child diff --git a/service.template b/service.template index d25dc8c..b6a2883 100644 --- a/service.template +++ b/service.template @@ -7,9 +7,10 @@ After=$AFTER Before=docker.service [Service] +Type=notify +NotifyAccess=all ExecStart=$EXEC_START ExecStop=$EXEC_STOP -ExecStartPost=/usr/bin/sh -c "while test \! -s ${RUN_DIRECTORY}/${NAME}/docker; do sleep 0.1; done" ExecStopPost=/bin/rm /etc/systemd/system/docker.service.d/$NAME.conf Restart=on-failure WorkingDirectory=$DESTDIR From 8422496b200bfbf11e880cd076177b17136fb5d2 Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Thu, 21 Sep 2017 14:02:31 -0500 Subject: [PATCH 6/8] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 20fb2d9..0c49eb3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0 RELEASE=6 ARCH=x86_64 +ENV VERSION=0 RELEASE=7 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ From 86f6ef99945a2e804b13c7ae0dc953c88ec583d3 Mon Sep 17 00:00:00 2001 From: Adam Miller Date: Tue, 14 Nov 2017 14:16:53 -0600 Subject: [PATCH 7/8] Bump RELEASE for automatic rebuild --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 0c49eb3..60eedd6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0 RELEASE=7 ARCH=x86_64 +ENV VERSION=0 RELEASE=8 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ From 3157d75f56015710623006d08af3e97ab759d22b Mon Sep 17 00:00:00 2001 From: Mohan Boddu Date: Thu, 15 Mar 2018 14:39:02 +0000 Subject: [PATCH 8/8] "Bump RELEASE for automatic rebuild" --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 60eedd6..352b1c3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:26 ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0 RELEASE=8 ARCH=x86_64 +ENV VERSION=0 RELEASE=9 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \