mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-21 19:01:49 +00:00
base-images: Migrate Debian base images to k/release
Signed-off-by: Stephen Augustus <saugustus@vmware.com>
This commit is contained in:
Stephen Augustus
parent
30ee970640
commit
1ccc8e3ac4
@ -1,19 +0,0 @@
|
||||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
FROM scratch
|
||||
|
||||
ADD rootfs.tar /
|
||||
|
||||
CMD ["/bin/sh"]
|
||||
@ -1,88 +0,0 @@
|
||||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
FROM BASEIMAGE
|
||||
|
||||
# If we're building for another architecture than amd64, the CROSS_BUILD_ placeholder is removed so
|
||||
# e.g. CROSS_BUILD_COPY turns into COPY
|
||||
# If we're building normally, for amd64, CROSS_BUILD lines are removed
|
||||
CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Smaller package install size.
|
||||
COPY excludes /etc/dpkg/dpkg.cfg.d/excludes
|
||||
|
||||
# Convenience script for building on this base image.
|
||||
COPY clean-install /usr/local/bin/clean-install
|
||||
|
||||
# Update system packages.
|
||||
RUN apt-get update \
|
||||
&& apt-get dist-upgrade -y
|
||||
|
||||
# Hold required packages to avoid breaking the installation of packages
|
||||
RUN apt-mark hold apt gnupg adduser passwd libsemanage1 libcap2
|
||||
|
||||
# Remove unnecessary packages.
|
||||
# This list was generated manually by listing the installed packages (`apt list --installed`),
|
||||
# then running `apt-cache rdepends --installed --no-recommends` to find the "root" packages.
|
||||
# The root packages were evaluated based on whether they were needed in the container image.
|
||||
# Several utilities (e.g. ping) were kept for usefulness, but may be removed in later versions.
|
||||
RUN echo "Yes, do as I say!" | apt-get purge \
|
||||
bash \
|
||||
e2fsprogs \
|
||||
libcap2-bin \
|
||||
libmount1 \
|
||||
libsmartcols1 \
|
||||
libblkid1 \
|
||||
libss2 \
|
||||
ncurses-base \
|
||||
ncurses-bin \
|
||||
tzdata
|
||||
|
||||
# No-op stubs replace some unnecessary binaries that may be depended on in the install process (in
|
||||
# particular we don't run an init process).
|
||||
WORKDIR /usr/local/bin
|
||||
RUN touch noop && \
|
||||
chmod 555 noop && \
|
||||
ln -s noop runlevel && \
|
||||
ln -s noop invoke-rc.d && \
|
||||
ln -s noop update-rc.d
|
||||
WORKDIR /
|
||||
|
||||
# Cleanup cached and unnecessary files.
|
||||
RUN apt-get autoremove -y && \
|
||||
apt-get clean -y && \
|
||||
tar -czf /usr/share/copyrights.tar.gz /usr/share/common-licenses /usr/share/doc/*/copyright && \
|
||||
rm -rf \
|
||||
/usr/share/doc \
|
||||
/usr/share/man \
|
||||
/usr/share/info \
|
||||
/usr/share/locale \
|
||||
/var/lib/apt/lists/* \
|
||||
/var/log/* \
|
||||
/var/cache/debconf/* \
|
||||
/usr/share/common-licenses* \
|
||||
/usr/share/bash-completion \
|
||||
~/.bashrc \
|
||||
~/.profile \
|
||||
/etc/systemd \
|
||||
/lib/lsb \
|
||||
/lib/udev \
|
||||
/usr/lib/x86_64-linux-gnu/gconv/IBM* \
|
||||
/usr/lib/x86_64-linux-gnu/gconv/EBC* && \
|
||||
mkdir -p /usr/share/man/man1 /usr/share/man/man2 \
|
||||
/usr/share/man/man3 /usr/share/man/man4 \
|
||||
/usr/share/man/man5 /usr/share/man/man6 \
|
||||
/usr/share/man/man7 /usr/share/man/man8
|
||||
@ -1,105 +0,0 @@
|
||||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
all: all-build
|
||||
|
||||
REGISTRY ?= gcr.io/k8s-staging-build-image
|
||||
IMAGE ?= $(REGISTRY)/debian-base
|
||||
BUILD_IMAGE ?= debian-build
|
||||
|
||||
TAG ?= v2.1.1
|
||||
|
||||
TAR_FILE ?= rootfs.tar
|
||||
ARCH?=amd64
|
||||
ALL_ARCH = amd64 arm arm64 ppc64le s390x
|
||||
|
||||
TEMP_DIR:=$(shell mktemp -d)
|
||||
QEMUVERSION=v4.2.0-6
|
||||
|
||||
SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
|
||||
|
||||
# This option is for running docker manifest command
|
||||
export DOCKER_CLI_EXPERIMENTAL := enabled
|
||||
|
||||
ifeq ($(ARCH),amd64)
|
||||
BASEIMAGE?=debian:buster-slim
|
||||
endif
|
||||
ifeq ($(ARCH),arm)
|
||||
BASEIMAGE?=arm32v7/debian:buster-slim
|
||||
QEMUARCH=arm
|
||||
endif
|
||||
ifeq ($(ARCH),arm64)
|
||||
BASEIMAGE?=arm64v8/debian:buster-slim
|
||||
QEMUARCH=aarch64
|
||||
endif
|
||||
ifeq ($(ARCH),ppc64le)
|
||||
BASEIMAGE?=ppc64le/debian:buster-slim
|
||||
QEMUARCH=ppc64le
|
||||
endif
|
||||
ifeq ($(ARCH),s390x)
|
||||
BASEIMAGE?=s390x/debian:buster-slim
|
||||
QEMUARCH=s390x
|
||||
endif
|
||||
|
||||
sub-build-%:
|
||||
$(MAKE) ARCH=$* build
|
||||
|
||||
all-build: $(addprefix sub-build-,$(ALL_ARCH))
|
||||
|
||||
sub-push-image-%:
|
||||
$(MAKE) ARCH=$* push
|
||||
|
||||
all-push-images: $(addprefix sub-push-image-,$(ALL_ARCH))
|
||||
|
||||
all-push: all-push-images push-manifest
|
||||
|
||||
push-manifest:
|
||||
docker manifest create --amend $(IMAGE):$(TAG) $(shell echo $(ALL_ARCH) | sed -e "s~[^ ]*~$(IMAGE)\-&:$(TAG)~g")
|
||||
@for arch in $(ALL_ARCH); do docker manifest annotate --arch $${arch} ${IMAGE}:${TAG} ${IMAGE}-$${arch}:${TAG}; done
|
||||
docker manifest push --purge ${IMAGE}:${TAG}
|
||||
|
||||
build: clean
|
||||
cp ./* $(TEMP_DIR)
|
||||
cat Dockerfile.build \
|
||||
| sed "s|BASEIMAGE|$(BASEIMAGE)|g" \
|
||||
| sed "s|ARCH|$(QEMUARCH)|g" \
|
||||
> $(TEMP_DIR)/Dockerfile.build
|
||||
|
||||
ifeq ($(ARCH),amd64)
|
||||
# When building "normally" for amd64, remove the whole line, it has no part in the amd64 image
|
||||
sed "/CROSS_BUILD_/d" $(TEMP_DIR)/Dockerfile.build > $(TEMP_DIR)/Dockerfile.build.tmp
|
||||
else
|
||||
# When cross-building, only the placeholder "CROSS_BUILD_" should be removed
|
||||
# Register /usr/bin/qemu-ARCH-static as the handler for non-x86 binaries in the kernel
|
||||
$(SUDO) ../../third_party/multiarch/qemu-user-static/register/register.sh --reset
|
||||
curl -sSL https://github.com/multiarch/qemu-user-static/releases/download/$(QEMUVERSION)/x86_64_qemu-$(QEMUARCH)-static.tar.gz | tar -xz -C $(TEMP_DIR)
|
||||
# Ensure we don't get surprised by umask settings
|
||||
chmod 0755 $(TEMP_DIR)/qemu-$(QEMUARCH)-static
|
||||
sed "s/CROSS_BUILD_//g" $(TEMP_DIR)/Dockerfile.build > $(TEMP_DIR)/Dockerfile.build.tmp
|
||||
endif
|
||||
mv $(TEMP_DIR)/Dockerfile.build.tmp $(TEMP_DIR)/Dockerfile.build
|
||||
|
||||
docker build --pull -t $(BUILD_IMAGE) -f $(TEMP_DIR)/Dockerfile.build $(TEMP_DIR)
|
||||
docker create --name $(BUILD_IMAGE) $(BUILD_IMAGE)
|
||||
docker export $(BUILD_IMAGE) > $(TEMP_DIR)/$(TAR_FILE)
|
||||
docker build -t $(IMAGE)-$(ARCH):$(TAG) $(TEMP_DIR)
|
||||
rm -rf $(TEMP_DIR)
|
||||
|
||||
push: build
|
||||
docker push $(IMAGE)-$(ARCH):$(TAG)
|
||||
|
||||
clean:
|
||||
docker rmi -f $(IMAGE)-$(ARCH):$(TAG) || true
|
||||
docker rmi -f $(BUILD_IMAGE) || true
|
||||
docker rm -f $(BUILD_IMAGE) || true
|
||||
@ -1,12 +0,0 @@
|
||||
# See the OWNERS docs at https://go.k8s.io/owners
|
||||
|
||||
reviewers:
|
||||
- build-image-reviewers
|
||||
- BenTheElder
|
||||
- mkumatag
|
||||
- tallclair
|
||||
approvers:
|
||||
- build-image-approvers
|
||||
- BenTheElder
|
||||
- mkumatag
|
||||
- tallclair
|
||||
@ -1,12 +0,0 @@
|
||||
# Kubernetes Debian Base
|
||||
|
||||
The Kubernetes debian-base image provides a common base for Kubernetes system images that require
|
||||
external dependencies (such as `iptables`, `sh`, or anything that is more than a static go-binary).
|
||||
|
||||
This image differs from the standard debian image by removing a lot of packages and files that are
|
||||
generally not necessary in containers. The end result is an image that is just over 40 MB, down from
|
||||
123 MB.
|
||||
|
||||
The image also provides a convenience script `/usr/local/bin/clean-install` that encapsulates the
|
||||
process of updating apt repositories, installing the packages, and then cleaning up unnecessary
|
||||
caches & logs.
|
||||
@ -1,36 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# A script encapsulating a common Dockerimage pattern for installing packages
|
||||
# and then cleaning up the unnecessary install artifacts.
|
||||
# e.g. clean-install iptables ebtables conntrack
|
||||
|
||||
set -o errexit
|
||||
|
||||
if [ $# = 0 ]; then
|
||||
echo >&2 "No packages specified"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends $@
|
||||
apt-get clean -y
|
||||
rm -rf \
|
||||
/var/cache/debconf/* \
|
||||
/var/lib/apt/lists/* \
|
||||
/var/log/* \
|
||||
/tmp/* \
|
||||
/var/tmp/*
|
||||
@ -1,16 +0,0 @@
|
||||
# See https://cloud.google.com/cloud-build/docs/build-config
|
||||
timeout: 1200s
|
||||
options:
|
||||
substitution_option: ALLOW_LOOSE
|
||||
machineType: 'N1_HIGHCPU_8'
|
||||
steps:
|
||||
- name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
|
||||
entrypoint: make
|
||||
dir: ./build/debian-base
|
||||
env:
|
||||
- DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
- REGISTRY=gcr.io/$PROJECT_ID
|
||||
- IMAGE=gcr.io/$PROJECT_ID/debian-base
|
||||
- BUILD_IMAGE=debian-build
|
||||
args:
|
||||
- all-push
|
||||
@ -1,10 +0,0 @@
|
||||
path-exclude /usr/share/doc/*
|
||||
path-include /usr/share/doc/*/copyright
|
||||
path-exclude /usr/share/groff/*
|
||||
path-exclude /usr/share/i18n/locales/*
|
||||
path-include /usr/share/i18n/locales/en_US*
|
||||
path-exclude /usr/share/info/*
|
||||
path-exclude /usr/share/locale/*
|
||||
path-include /usr/share/locale/en_US*
|
||||
path-include /usr/share/locale/locale.alias
|
||||
path-exclude /usr/share/man/*
|
||||
@ -1,41 +0,0 @@
|
||||
# Copyright 2016 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
FROM BASEIMAGE
|
||||
|
||||
# Install latest iptables package from buster-backports
|
||||
RUN echo deb http://deb.debian.org/debian buster-backports main >> /etc/apt/sources.list; \
|
||||
apt-get update; \
|
||||
apt-get -t buster-backports -y --no-install-recommends install iptables
|
||||
|
||||
# Install other dependencies and then clean up apt caches
|
||||
RUN clean-install \
|
||||
conntrack \
|
||||
ebtables \
|
||||
ipset \
|
||||
kmod \
|
||||
netbase
|
||||
|
||||
# Install iptables wrapper scripts to detect the correct iptables mode
|
||||
# the first time any of them is run
|
||||
COPY iptables-wrapper /usr/sbin/iptables-wrapper
|
||||
|
||||
RUN update-alternatives \
|
||||
--install /usr/sbin/iptables iptables /usr/sbin/iptables-wrapper 100 \
|
||||
--slave /usr/sbin/iptables-restore iptables-restore /usr/sbin/iptables-wrapper \
|
||||
--slave /usr/sbin/iptables-save iptables-save /usr/sbin/iptables-wrapper
|
||||
RUN update-alternatives \
|
||||
--install /usr/sbin/ip6tables ip6tables /usr/sbin/iptables-wrapper 100 \
|
||||
--slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/iptables-wrapper \
|
||||
--slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/iptables-wrapper
|
||||
@ -1,63 +0,0 @@
|
||||
# Copyright 2016 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
.PHONY: build push all all-build all-push-images all-push push-manifest
|
||||
|
||||
REGISTRY?="gcr.io/k8s-staging-build-image"
|
||||
IMAGE=$(REGISTRY)/debian-iptables
|
||||
TAG?=v12.1.0
|
||||
ARCH?=amd64
|
||||
ALL_ARCH = amd64 arm arm64 ppc64le s390x
|
||||
TEMP_DIR:=$(shell mktemp -d)
|
||||
|
||||
BASE_REGISTRY?=k8s.gcr.io/build-image
|
||||
BASEIMAGE?=$(BASE_REGISTRY)/debian-base-$(ARCH):v2.1.0
|
||||
|
||||
# This option is for running docker manifest command
|
||||
export DOCKER_CLI_EXPERIMENTAL := enabled
|
||||
|
||||
SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
|
||||
|
||||
build:
|
||||
cp ./* $(TEMP_DIR)
|
||||
cd $(TEMP_DIR) && sed -i "s|BASEIMAGE|$(BASEIMAGE)|g" Dockerfile
|
||||
|
||||
ifneq ($(ARCH),amd64)
|
||||
# Register /usr/bin/qemu-ARCH-static as the handler for non-x86 binaries in the kernel
|
||||
$(SUDO) ../../third_party/multiarch/qemu-user-static/register/register.sh --reset
|
||||
endif
|
||||
|
||||
docker build --pull -t $(IMAGE)-$(ARCH):$(TAG) $(TEMP_DIR)
|
||||
|
||||
push: build
|
||||
docker push $(IMAGE)-$(ARCH):$(TAG)
|
||||
|
||||
sub-build-%:
|
||||
$(MAKE) ARCH=$* build
|
||||
|
||||
all-build: $(addprefix sub-build-,$(ALL_ARCH))
|
||||
|
||||
sub-push-image-%:
|
||||
$(MAKE) ARCH=$* push
|
||||
|
||||
all-push-images: $(addprefix sub-push-image-,$(ALL_ARCH))
|
||||
|
||||
all-push: all-push-images push-manifest
|
||||
|
||||
push-manifest:
|
||||
docker manifest create --amend $(IMAGE):$(TAG) $(shell echo $(ALL_ARCH) | sed -e "s~[^ ]*~$(IMAGE)\-&:$(TAG)~g")
|
||||
@for arch in $(ALL_ARCH); do docker manifest annotate --arch $${arch} ${IMAGE}:${TAG} ${IMAGE}-$${arch}:${TAG}; done
|
||||
docker manifest push --purge ${IMAGE}:${TAG}
|
||||
|
||||
all: all-push
|
||||
@ -1,20 +0,0 @@
|
||||
# See the OWNERS docs at https://go.k8s.io/owners
|
||||
|
||||
reviewers:
|
||||
- build-image-reviewers
|
||||
- BenTheElder
|
||||
- bowei
|
||||
- freehan
|
||||
- jingax10
|
||||
- mkumatag
|
||||
- mrhohn
|
||||
- tallclair
|
||||
approvers:
|
||||
- build-image-approvers
|
||||
- BenTheElder
|
||||
- bowei
|
||||
- freehan
|
||||
- jingax10
|
||||
- mkumatag
|
||||
- mrhohn
|
||||
- tallclair
|
||||
@ -1,24 +0,0 @@
|
||||
### debian-iptables
|
||||
|
||||
Serves as the base image for `k8s.gcr.io/kube-proxy-${ARCH}` and multiarch (not `amd64`) `k8s.gcr.io/flannel-${ARCH}` images.
|
||||
|
||||
This image is compiled for multiple architectures.
|
||||
|
||||
#### How to release
|
||||
|
||||
If you're editing the Dockerfile or some other thing, please bump the `TAG` in the Makefile.
|
||||
|
||||
```console
|
||||
Build and push images for all the architectures
|
||||
$ make all-push
|
||||
# ---> staging-k8s.gcr.io/debian-iptables-amd64:TAG
|
||||
# ---> staging-k8s.gcr.io/debian-iptables-arm:TAG
|
||||
# ---> staging-k8s.gcr.io/debian-iptables-arm64:TAG
|
||||
# ---> staging-k8s.gcr.io/debian-iptables-ppc64le:TAG
|
||||
# ---> staging-k8s.gcr.io/debian-iptables-s390x:TAG
|
||||
```
|
||||
|
||||
If you don't want to push the images, run `make build ARCH={target_arch}` or `make all-build` instead
|
||||
|
||||
|
||||
[]()
|
||||
@ -1,15 +0,0 @@
|
||||
# See https://cloud.google.com/cloud-build/docs/build-config
|
||||
timeout: 1200s
|
||||
options:
|
||||
substitution_option: ALLOW_LOOSE
|
||||
machineType: 'N1_HIGHCPU_8'
|
||||
steps:
|
||||
- name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
|
||||
entrypoint: make
|
||||
dir: ./build/debian-iptables
|
||||
env:
|
||||
- DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
- REGISTRY=gcr.io/$PROJECT_ID
|
||||
- IMAGE=gcr.io/$PROJECT_ID/debian-iptables
|
||||
args:
|
||||
- all-push
|
||||
@ -1,44 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Copyright 2019 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -e
|
||||
|
||||
# Detect whether the base system is using iptables-legacy or
|
||||
# iptables-nft. This assumes that some non-containerized process (eg
|
||||
# kubelet) has already created some iptables rules.
|
||||
|
||||
# Bugs in iptables-nft 1.8.3 may cause it to get stuck in a loop in
|
||||
# some circumstances, so we have to run the nft check in a timeout. To
|
||||
# avoid hitting that timeout, we only bother to even check nft if
|
||||
# legacy iptables was empty / mostly empty.
|
||||
|
||||
num_legacy_lines=$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
|
||||
if [ "${num_legacy_lines}" -ge 10 ]; then
|
||||
mode=legacy
|
||||
else
|
||||
num_nft_lines=$( (timeout 5 sh -c "iptables-nft-save; ip6tables-nft-save" || true) 2>/dev/null | grep '^-' | wc -l)
|
||||
if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
|
||||
mode=legacy
|
||||
else
|
||||
mode=nft
|
||||
fi
|
||||
fi
|
||||
|
||||
update-alternatives --set iptables "/usr/sbin/iptables-${mode}" > /dev/null
|
||||
update-alternatives --set ip6tables "/usr/sbin/ip6tables-${mode}" > /dev/null
|
||||
|
||||
# Now re-exec the original command with the newly-selected alternative
|
||||
exec "$0" "$@"
|
||||
Loading…
Reference in New Issue
Block a user