diff --git a/Dockerfile b/Dockerfile index 47345e5..b36dd50 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,11 @@ -FROM registry.fedoraproject.org/fedora:25 +FROM registry.fedoraproject.org/fedora:rawhide ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network" -ENV VERSION=0.1 RELEASE=16 ARCH=x86_64 +ENV VERSION=0 ARCH=x86_64 LABEL com.redhat.component="flannel" \ name="$FGC/flannel" \ version="$VERSION" \ - release="$RELEASE.$DISTTAG" \ architecture="$ARCH" \ summary="An etcd driven address agent, intended to be run as a system container" \ maintainer="Giuseppe Scrivano " \ @@ -16,6 +15,9 @@ RUN dnf -y --setopt=tsflags=nodocs install flannel && dnf clean all ADD flanneld-run.sh /usr/bin/ +RUN mkdir -p /exports/hostfs/etc/sysconfig/ && cp /etc/sysconfig/flanneld /exports/hostfs/etc/sysconfig/ +RUN mkdir -p /exports/hostfs/etc/flanneld + # System container files COPY tmpfiles.template service.template manifest.json \ config.json.template /exports/ diff --git a/config.json.template b/config.json.template index fa50bcb..e1cae75 100644 --- a/config.json.template +++ b/config.json.template @@ -23,30 +23,35 @@ "cwd": "/", "capabilities": { "bounding": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "permitted": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "inheritable": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "effective": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_NET_ADMIN" ], "ambient": [ + "CAP_DAC_READ_SEARCH", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE", @@ -170,7 +175,27 @@ "rbind", "rprivate" ] - } + }, + { + "source": "/etc/sysconfig/flanneld", + "destination": "/etc/sysconfig/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + }, + { + "source": "/etc/flanneld", + "destination": "/etc/flanneld", + "type": "bind", + "options": [ + "rw", + "rbind", + "rprivate" + ] + } ], "hooks": {}, "linux": { diff --git a/flanneld-run.sh b/flanneld-run.sh index fbd97e0..e527d3c 100755 --- a/flanneld-run.sh +++ b/flanneld-run.sh @@ -4,10 +4,12 @@ echo "[Service]" > /etc/systemd/system/docker.service.d/$NAME.conf echo "EnvironmentFile=-/run/$NAME/docker" >> /etc/systemd/system/docker.service.d/$NAME.conf +source /etc/sysconfig/flanneld + # Ensure this file doesn't already exist. rm -f run/flannel/subnet.env -NOTIFY_SOCKET=/dev/null /usr/bin/flanneld & +NOTIFY_SOCKET=/dev/null /usr/bin/flanneld -etcd-endpoints=${FLANNEL_ETCD_ENDPOINTS} -etcd-prefix=${FLANNEL_ETCD_PREFIX} -etcd-cafile=${FLANNEL_ETCD_CAFILE} -etcd-certfile=${FLANNEL_ETCD_CERTFILE} -etcd-keyfile=${FLANNEL_ETCD_KEYFILE} $FLANNEL_OPTIONS & child=$! while test \! -e /run/flannel/subnet.env