diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..47345e5 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,23 @@ +FROM registry.fedoraproject.org/fedora:25 + +ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" + +ENV VERSION=0.1 RELEASE=16 ARCH=x86_64 +LABEL com.redhat.component="flannel" \ + name="$FGC/flannel" \ + version="$VERSION" \ + release="$RELEASE.$DISTTAG" \ + architecture="$ARCH" \ + summary="An etcd driven address agent, intended to be run as a system container" \ + maintainer="Giuseppe Scrivano " \ + atomic.type='system' + +RUN dnf -y --setopt=tsflags=nodocs install flannel && dnf clean all + +ADD flanneld-run.sh /usr/bin/ + +# System container files +COPY tmpfiles.template service.template manifest.json \ + config.json.template /exports/ + +CMD ["/usr/bin/flanneld-run.sh"] diff --git a/README.md b/README.md new file mode 100644 index 0000000..fb6dbd4 --- /dev/null +++ b/README.md @@ -0,0 +1,52 @@ +# flannel-container + +This container image is intended to be run as a system container +with the atomic command line. + +Building flannel container for fedora and atomic host: + +``` +# git clone https://github.com/projectatomic/atomic-system-containers +# cd atomic-system-containers/flannel +# docker build -t flannel . +``` + +**Running as system container, with the atomic CLI:** + +Prerequisite: + +1. etcd must be running + +2. a network is configured in etcd + +(example with etcd installed as a system container: `runc exec etcd etcdctl set /atomic.io/network/config '{"Network":"172.17.0.0/16"}'`) + +Pull from local docker into ostree: + +``` +#atomic pull --storage ostree docker:flannel +``` + +Install the container: + +``` +#atomic install --system flannel +``` + +Start as a systemd service: + +``` +#systemctl start flannel +``` + +Stopping the service + +``` +#systemctl stop flannel +``` + +Removing the container + +``` +#atomic uninstall flannel +``` diff --git a/config.json.template b/config.json.template new file mode 100644 index 0000000..fa50bcb --- /dev/null +++ b/config.json.template @@ -0,0 +1,209 @@ +{ + "ociVersion": "1.0.0", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": false, + "user": { + "uid": 0, + "gid": 0 + }, + "args": [ + "/usr/bin/flanneld-run.sh" + ], + "env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "FLANNELD_ETCD_PREFIX=$FLANNELD_ETCD_PREFIX", + "FLANNELD_ETCD_ENDPOINTS=$FLANNELD_ETCD_ENDPOINTS", + "TERM=xterm", + "NAME=$NAME" + ], + "cwd": "/", + "capabilities": { + "bounding": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "permitted": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "inheritable": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "effective": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ], + "ambient": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_NET_ADMIN" + ] + }, + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ], + "noNewPrivileges": false + }, + "root": { + "path": "rootfs", + "readonly": true + }, + "hostname": "flannel", + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "type": "bind", + "source": "/dev", + "destination": "/dev", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev", + "ro" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + }, + { + "type": "bind", + "source": "/etc/systemd/system/docker.service.d", + "destination": "/etc/systemd/system/docker.service.d", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "source": "${RUN_DIRECTORY}/${NAME}", + "destination": "/run/flannel", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + }, + { + "destination": "/etc/resolv.conf", + "type": "bind", + "source": "/etc/resolv.conf", + "options": [ + "ro", + "rbind", + "rprivate" + ] + } + ], + "hooks": {}, + "linux": { + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "ipc" + }, + { + "type": "uts" + }, + { + "type": "mount" + } + ], + "maskedPaths": [ + "/proc/kcore", + "/proc/latency_stats", + "/proc/timer_stats", + "/proc/sched_debug" + ], + "readonlyPaths": [ + "/proc/asound", + "/proc/bus", + "/proc/irq", + "/proc/sysrq-trigger" + ] + } +} diff --git a/flanneld-run.sh b/flanneld-run.sh new file mode 100755 index 0000000..fbd97e0 --- /dev/null +++ b/flanneld-run.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Create flannel.conf for docker service +echo "[Service]" > /etc/systemd/system/docker.service.d/$NAME.conf +echo "EnvironmentFile=-/run/$NAME/docker" >> /etc/systemd/system/docker.service.d/$NAME.conf + +# Ensure this file doesn't already exist. +rm -f run/flannel/subnet.env + +NOTIFY_SOCKET=/dev/null /usr/bin/flanneld & +child=$! + +while test \! -e /run/flannel/subnet.env +do + sleep 0.1 +done + +/usr/libexec/flannel/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker + +systemd-notify --ready + +wait $child diff --git a/manifest.json b/manifest.json new file mode 100644 index 0000000..816c24e --- /dev/null +++ b/manifest.json @@ -0,0 +1,10 @@ +{ + "version": "1.0", + "defaultValues": { + "FLANNELD_ETCD_PREFIX": "/atomic.io/network", + "FLANNELD_ETCD_ENDPOINTS": "http://127.0.0.1:2379", + "AFTER": "etcd.service", + "REQUIRED_BY": "docker.service" + } +} + diff --git a/service.template b/service.template new file mode 100644 index 0000000..b6a2883 --- /dev/null +++ b/service.template @@ -0,0 +1,21 @@ +[Unit] +Description=Flanneld overlay address etcd agent +After=network.target +After=network-online.target +Wants=network-online.target +After=$AFTER +Before=docker.service + +[Service] +Type=notify +NotifyAccess=all +ExecStart=$EXEC_START +ExecStop=$EXEC_STOP +ExecStopPost=/bin/rm /etc/systemd/system/docker.service.d/$NAME.conf +Restart=on-failure +WorkingDirectory=$DESTDIR +RuntimeDirectory=${NAME} + +[Install] +WantedBy=multi-user.target +RequiredBy=$REQUIRED_BY diff --git a/tmpfiles.template b/tmpfiles.template new file mode 100644 index 0000000..77acbd8 --- /dev/null +++ b/tmpfiles.template @@ -0,0 +1,3 @@ +D ${RUN_DIRECTORY}/${NAME} - - - - - +d /etc/systemd/system/docker.service.d - - - - - +r /etc/systemd/system/docker.service.d/$NAME.conf - - - - -