Bump RELEASE for automatic rebuild

Dockerfile:
  - update labels
  - use fqn for FROM

config.json.template:
  - update oci version
  - update capabilities for new runc version

service/run.sh
  - update to use systemd-notify

Dockerfile

@@ -0,0 +1,23 @@
+FROM registry.fedoraproject.org/fedora:25
+
+ENV container=docker FLANNELD_ETCD_ENDPOINTS="http://127.0.0.1:2379" FLANNELD_ETCD_PREFIX="/atomic.io/network"
+
+ENV VERSION=0.1 RELEASE=16 ARCH=x86_64
+LABEL com.redhat.component="flannel" \
+      name="$FGC/flannel" \
+      version="$VERSION" \
+      release="$RELEASE.$DISTTAG" \
+      architecture="$ARCH" \
+      summary="An etcd driven address agent, intended to be run as a system container" \
+      maintainer="Giuseppe Scrivano <gscrivan@redhat.com>" \
+      atomic.type='system'
+
+RUN dnf -y --setopt=tsflags=nodocs install flannel && dnf clean all
+
+ADD flanneld-run.sh /usr/bin/
+
+# System container files
+COPY tmpfiles.template service.template manifest.json \
+     config.json.template /exports/
+
+CMD ["/usr/bin/flanneld-run.sh"]

README.md

@@ -0,0 +1,52 @@
+# flannel-container
+
+This container image is intended to be run as a system container
+with the atomic command line.
+
+Building flannel container for fedora and atomic host:
+
+```
+# git clone https://github.com/projectatomic/atomic-system-containers
+# cd atomic-system-containers/flannel
+# docker build -t flannel .
+```
+
+**Running as system container, with the atomic CLI:**
+
+Prerequisite:
+
+1. etcd must be running
+
+2. a network is configured in etcd
+
+(example with etcd installed as a system container: `runc exec etcd etcdctl set /atomic.io/network/config '{"Network":"172.17.0.0/16"}'`)
+
+Pull from local docker into ostree:
+
+```
+#atomic pull --storage ostree docker:flannel
+```
+
+Install the container:
+
+```
+#atomic install --system flannel
+```
+
+Start as a systemd service:
+
+```
+#systemctl start flannel
+```
+
+Stopping the service
+
+```
+#systemctl stop flannel
+```
+
+Removing the container
+
+```
+#atomic uninstall flannel
+```

config.json.template

@@ -0,0 +1,209 @@
+{
+	"ociVersion": "1.0.0",
+	"platform": {
+		"os": "linux",
+		"arch": "amd64"
+	},
+	"process": {
+		"terminal": false,
+		"user": {
+			"uid": 0,
+			"gid": 0
+		},
+		"args": [
+			"/usr/bin/flanneld-run.sh"
+		],
+		"env": [
+			"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "FLANNELD_ETCD_PREFIX=$FLANNELD_ETCD_PREFIX",
+                        "FLANNELD_ETCD_ENDPOINTS=$FLANNELD_ETCD_ENDPOINTS",
+			"TERM=xterm",
+			"NAME=$NAME"
+		],
+		"cwd": "/",
+                "capabilities": {
+                        "bounding": [
+                                "CAP_AUDIT_WRITE",
+                                "CAP_KILL",
+                                "CAP_NET_BIND_SERVICE",
+                                "CAP_NET_ADMIN"
+                        ],
+                        "permitted": [
+                                "CAP_AUDIT_WRITE",
+                                "CAP_KILL",
+                                "CAP_NET_BIND_SERVICE",
+                                "CAP_NET_ADMIN"
+                        ],
+                        "inheritable": [
+                                "CAP_AUDIT_WRITE",
+                                "CAP_KILL",
+                                "CAP_NET_BIND_SERVICE",
+                                "CAP_NET_ADMIN"
+                        ],
+                        "effective": [
+                                "CAP_AUDIT_WRITE",
+                                "CAP_KILL",
+                                "CAP_NET_BIND_SERVICE",
+                                "CAP_NET_ADMIN"
+                        ],
+                        "ambient": [
+                                "CAP_AUDIT_WRITE",
+                                "CAP_KILL",
+                                "CAP_NET_BIND_SERVICE",
+                                "CAP_NET_ADMIN"
+                        ]
+                },
+		"rlimits": [
+			{
+				"type": "RLIMIT_NOFILE",
+				"hard": 1024,
+				"soft": 1024
+			}
+		],
+		"noNewPrivileges": false
+	},
+	"root": {
+		"path": "rootfs",
+		"readonly": true
+	},
+	"hostname": "flannel",
+	"mounts": [
+		{
+			"destination": "/proc",
+			"type": "proc",
+			"source": "proc"
+		},
+                {
+                        "type": "bind",
+                        "source": "/dev",
+                        "destination": "/dev",
+                        "options": [
+                                "rbind",
+                                "rw",
+                                "mode=755"
+                        ]
+                },
+		{
+			"destination": "/dev/pts",
+			"type": "devpts",
+			"source": "devpts",
+			"options": [
+				"nosuid",
+				"noexec",
+				"newinstance",
+				"ptmxmode=0666",
+				"mode=0620",
+				"gid=5"
+			]
+		},
+		{
+			"destination": "/dev/shm",
+			"type": "tmpfs",
+			"source": "shm",
+			"options": [
+				"nosuid",
+				"noexec",
+				"nodev",
+				"mode=1777",
+				"size=65536k"
+			]
+		},
+		{
+			"destination": "/dev/mqueue",
+			"type": "mqueue",
+			"source": "mqueue",
+			"options": [
+				"nosuid",
+				"noexec",
+				"nodev"
+			]
+		},
+		{
+			"destination": "/sys",
+			"type": "sysfs",
+			"source": "sysfs",
+			"options": [
+				"nosuid",
+				"noexec",
+				"nodev",
+				"ro"
+			]
+		},
+		{
+			"destination": "/sys/fs/cgroup",
+			"type": "cgroup",
+			"source": "cgroup",
+			"options": [
+				"nosuid",
+				"noexec",
+				"nodev",
+				"relatime",
+				"ro"
+			]
+		},
+                {
+                        "type": "bind",
+                        "source": "/etc/systemd/system/docker.service.d",
+                        "destination": "/etc/systemd/system/docker.service.d",
+                        "options": [
+                                "rbind",
+                                "rw",
+                                "mode=755"
+                        ]
+                },
+                {
+			"source": "${RUN_DIRECTORY}/${NAME}",
+                        "destination": "/run/flannel",
+                        "type": "bind",
+                        "options": [
+                                "rw",
+                                "rbind",
+                                "rprivate"
+                        ]
+                },
+                {
+                        "destination": "/etc/resolv.conf",
+                        "type": "bind",
+                        "source": "/etc/resolv.conf",
+                        "options": [
+                                "ro",
+                                "rbind",
+                                "rprivate"
+                        ]
+        }
+	],
+	"hooks": {},
+	"linux": {
+		"resources": {
+			"devices": [
+				{
+					"allow": false,
+					"access": "rwm"
+				}
+			]
+		},
+		"namespaces": [
+			{
+				"type": "ipc"
+			},
+			{
+				"type": "uts"
+			},
+			{
+				"type": "mount"
+			}
+		],
+		"maskedPaths": [
+			"/proc/kcore",
+			"/proc/latency_stats",
+			"/proc/timer_stats",
+			"/proc/sched_debug"
+		],
+		"readonlyPaths": [
+			"/proc/asound",
+			"/proc/bus",
+			"/proc/irq",
+			"/proc/sysrq-trigger"
+		]
+	}
+}

flanneld-run.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Create flannel.conf for docker service
+echo "[Service]" > /etc/systemd/system/docker.service.d/$NAME.conf
+echo "EnvironmentFile=-/run/$NAME/docker" >> /etc/systemd/system/docker.service.d/$NAME.conf
+
+# Ensure this file doesn't already exist.
+rm -f run/flannel/subnet.env
+
+NOTIFY_SOCKET=/dev/null /usr/bin/flanneld &
+child=$!
+
+while test \! -e /run/flannel/subnet.env
+do
+    sleep 0.1
+done
+
+/usr/libexec/flannel/mk-docker-opts.sh -k DOCKER_NETWORK_OPTIONS -d /run/flannel/docker
+
+systemd-notify --ready
+
+wait $child

manifest.json

@@ -0,0 +1,10 @@
+{
+    "version": "1.0",
+    "defaultValues": {
+	"FLANNELD_ETCD_PREFIX": "/atomic.io/network",
+	"FLANNELD_ETCD_ENDPOINTS": "http://127.0.0.1:2379",
+	"AFTER": "etcd.service",
+	"REQUIRED_BY": "docker.service"
+    }
+}
+

service.template

@@ -0,0 +1,21 @@
+[Unit]
+Description=Flanneld overlay address etcd agent
+After=network.target
+After=network-online.target
+Wants=network-online.target
+After=$AFTER
+Before=docker.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+ExecStart=$EXEC_START
+ExecStop=$EXEC_STOP
+ExecStopPost=/bin/rm /etc/systemd/system/docker.service.d/$NAME.conf
+Restart=on-failure
+WorkingDirectory=$DESTDIR
+RuntimeDirectory=${NAME}
+
+[Install]
+WantedBy=multi-user.target
+RequiredBy=$REQUIRED_BY

tmpfiles.template

@@ -0,0 +1,3 @@
+D    ${RUN_DIRECTORY}/${NAME}   - - - - -
+d    /etc/systemd/system/docker.service.d - - - - -
+r    /etc/systemd/system/docker.service.d/$NAME.conf - - - - -