mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-07-28 13:08:38 +00:00
Riyaz Faizullabhoy
GitHub
commit
42c2333fa1
@ -1,21 +0,0 @@
|
|||||||
kernel:
|
|
||||||
image: "mobylinux/kernel-wireguard:4.9.x"
|
|
||||||
cmdline: "console=ttyS0 page_poison=1"
|
|
||||||
init:
|
|
||||||
- "mobylinux/init-wireguard:4309fb8b65cafa9e07b0e75d86a0bff4070e67e9"
|
|
||||||
onboot:
|
|
||||||
- name: sysctl
|
|
||||||
image: "mobylinux/sysctl:2cf2f9d5b4d314ba1bfc22b2fe931924af666d8c"
|
|
||||||
net: host
|
|
||||||
pid: host
|
|
||||||
ipc: host
|
|
||||||
capabilities:
|
|
||||||
- CAP_SYS_ADMIN
|
|
||||||
readonly: true
|
|
||||||
services:
|
|
||||||
- name: rngd
|
|
||||||
image: "mobylinux/rngd:3dad6dd43270fa632ac031e99d1947f20b22eec9"
|
|
||||||
capabilities:
|
|
||||||
- CAP_SYS_ADMIN
|
|
||||||
oomScoreAdj: -800
|
|
||||||
readonly: true
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
FROM alpine:3.5
|
|
||||||
|
|
||||||
COPY repositories /etc/apk/
|
|
||||||
|
|
||||||
RUN \
|
|
||||||
apk update && apk upgrade -a && \
|
|
||||||
apk add --no-cache \
|
|
||||||
dhcpcd \
|
|
||||||
e2fsprogs \
|
|
||||||
e2fsprogs-extra \
|
|
||||||
wireguard-tools \
|
|
||||||
&& true
|
|
||||||
|
|
||||||
COPY . ./
|
|
||||||
@ -1,52 +0,0 @@
|
|||||||
CONTAINERD_IMAGE=mobylinux/containerd:c9c8a069da6dccd2803ab476ee0d57a8768f0dcb@sha256:ff5aa0b1086e8c600d6e1508cfae4da31e4935d36ec40f0128aa73113b664e7f
|
|
||||||
CONTAINERD_BINARIES=usr/bin/containerd usr/bin/containerd-shim usr/bin/ctr usr/bin/dist
|
|
||||||
|
|
||||||
RUNC_IMAGE=mobylinux/runc:f1cee12a65e7b7de06a01aec24609dc3175e1542@sha256:ff1ead6aa4388418ee07f8e93304e5b2fa9b975fe2399474d408654a1411a44a
|
|
||||||
RUNC_BINARY=usr/bin/runc
|
|
||||||
|
|
||||||
C_COMPILE=linuxkit/c-compile:63b085bbaec1aa7c42a7bd22a4b1c350d900617d@sha256:286e3a729c7a0b1a605ae150235416190f9f430c29b00e65fa50ff73158998e5
|
|
||||||
START_STOP_DAEMON=sbin/start-stop-daemon
|
|
||||||
|
|
||||||
default: push
|
|
||||||
|
|
||||||
$(RUNC_BINARY):
|
|
||||||
mkdir -p $(dir $@)
|
|
||||||
docker run --rm --net=none $(RUNC_IMAGE) tar cf - $@ | tar xf -
|
|
||||||
|
|
||||||
$(CONTAINERD_BINARIES):
|
|
||||||
mkdir -p $(dir $@)
|
|
||||||
docker run --rm --net=none $(CONTAINERD_IMAGE) tar cf - $@ | tar xf -
|
|
||||||
|
|
||||||
$(START_STOP_DAEMON): start-stop-daemon.c
|
|
||||||
mkdir -p $(dir $@)
|
|
||||||
tar cf - $^ | docker run --rm --net=none --log-driver=none -i $(C_COMPILE) -o $@ | tar xf -
|
|
||||||
|
|
||||||
.PHONY: tag push
|
|
||||||
|
|
||||||
BASE=alpine:3.5
|
|
||||||
IMAGE=init-wireguard
|
|
||||||
|
|
||||||
ETC=$(shell find etc -type f)
|
|
||||||
|
|
||||||
hash: Dockerfile $(ETC) init $(RUNC_BINARY) $(CONTAINERD_BINARIES) $(START_STOP_DAEMON) repositories
|
|
||||||
DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
|
|
||||||
tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
|
|
||||||
docker run --rm $(IMAGE):build sh -c 'cat $^ /lib/apk/db/installed | sha1sum' | sed 's/ .*//' > $@
|
|
||||||
|
|
||||||
push: hash
|
|
||||||
docker pull mobylinux/$(IMAGE):$(shell cat hash) || \
|
|
||||||
(docker tag $(IMAGE):build mobylinux/$(IMAGE):$(shell cat hash) && \
|
|
||||||
docker push mobylinux/$(IMAGE):$(shell cat hash))
|
|
||||||
docker rmi $(IMAGE):build
|
|
||||||
rm -f hash
|
|
||||||
|
|
||||||
tag: hash
|
|
||||||
docker pull mobylinux/$(IMAGE):$(shell cat hash) || \
|
|
||||||
docker tag $(IMAGE):build mobylinux/$(IMAGE):$(shell cat hash)
|
|
||||||
docker rmi $(IMAGE):build
|
|
||||||
rm -f hash
|
|
||||||
|
|
||||||
clean:
|
|
||||||
rm -rf hash sbin usr
|
|
||||||
|
|
||||||
.DELETE_ON_ERROR:
|
|
||||||
@ -1,46 +0,0 @@
|
|||||||
# Moby dhcpcd config
|
|
||||||
|
|
||||||
# Only configure standard external ethernet
|
|
||||||
allowinterfaces eth*
|
|
||||||
|
|
||||||
# Inform the DHCP server of our hostname for DDNS.
|
|
||||||
hostname
|
|
||||||
|
|
||||||
# Use the hardware address of the interface for the Client ID.
|
|
||||||
clientid
|
|
||||||
# or
|
|
||||||
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
|
|
||||||
# Some non-RFC compliant DHCP servers do not reply with this set.
|
|
||||||
# In this case, comment out duid and enable clientid above.
|
|
||||||
#duid
|
|
||||||
|
|
||||||
# Persist interface configuration when dhcpcd exits.
|
|
||||||
persistent
|
|
||||||
|
|
||||||
# Rapid commit support.
|
|
||||||
# Safe to enable by default because it requires the equivalent option set
|
|
||||||
# on the server to actually work.
|
|
||||||
option rapid_commit
|
|
||||||
|
|
||||||
# A list of options to request from the DHCP server.
|
|
||||||
option domain_name_servers, domain_name, domain_search, host_name
|
|
||||||
option classless_static_routes
|
|
||||||
# Most distributions have NTP support.
|
|
||||||
option ntp_servers
|
|
||||||
# Respect the network MTU. This is applied to DHCP routes.
|
|
||||||
option interface_mtu
|
|
||||||
|
|
||||||
# A ServerID is required by RFC2131.
|
|
||||||
require dhcp_server_identifier
|
|
||||||
|
|
||||||
# Generate Stable Private IPv6 Addresses instead of hardware based ones
|
|
||||||
slaac private
|
|
||||||
|
|
||||||
# Do not wait
|
|
||||||
nodelay
|
|
||||||
|
|
||||||
# Do not arp to check IP
|
|
||||||
noarp
|
|
||||||
|
|
||||||
# Only fork when we have ipv4
|
|
||||||
# waitip 4
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# bring up containerd
|
|
||||||
ulimit -n 1048576
|
|
||||||
ulimit -p unlimited
|
|
||||||
|
|
||||||
printf "\nStarting containerd\n"
|
|
||||||
mkdir -p /var/log
|
|
||||||
/sbin/start-stop-daemon --start --exec /usr/bin/containerd
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# TODO more robust
|
|
||||||
# while [ ! -S /run/containerd/containerd.sock ]; do sleep 1; done
|
|
||||||
# while ! ctr list 2> /dev/null; do sleep 1; done
|
|
||||||
|
|
||||||
# start system containers
|
|
||||||
# temporarily using runc not containerd
|
|
||||||
|
|
||||||
if [ -d /containers/system ]
|
|
||||||
then
|
|
||||||
for f in $(find /containers/system -mindepth 1 -maxdepth 1 | sort)
|
|
||||||
do
|
|
||||||
base="$(basename $f)"
|
|
||||||
/usr/bin/runc run --bundle "$f" "$(basename $f)"
|
|
||||||
printf " - $base\n"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -d /containers/daemon ]
|
|
||||||
then
|
|
||||||
for f in $(find /containers/daemon -mindepth 1 -maxdepth 1 | sort)
|
|
||||||
do
|
|
||||||
base="$(basename $f)"
|
|
||||||
log="/var/log/$base.log"
|
|
||||||
/sbin/start-stop-daemon --start --pidfile /run/$base.pid --exec /usr/bin/runc -- run --bundle "$f" --pid-file /run/$base.pid "$(basename $f)" </dev/null 2>$log >$log &
|
|
||||||
printf " - $base\n"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
wait
|
|
||||||
@ -1,106 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# mount filesystems
|
|
||||||
mkdir -p -m 0755 /proc /run /tmp /sys /dev
|
|
||||||
|
|
||||||
mount -n -t proc proc /proc -o nodev,nosuid,noexec,relatime
|
|
||||||
|
|
||||||
mount -n -t tmpfs tmpfs /run -o nodev,nosuid,noexec,relatime,size=10%,mode=755
|
|
||||||
mount -n -t tmpfs tmpfs /tmp -o nodev,nosuid,noexec,relatime,size=10%,mode=1777
|
|
||||||
|
|
||||||
# mount devfs
|
|
||||||
mount -n -t devtmpfs dev /dev -o nosuid,noexec,relatime,size=10m,nr_inodes=248418,mode=755
|
|
||||||
# devices
|
|
||||||
[ -c /dev/console ] || mknod -m 600 /dev/console c 5 1
|
|
||||||
[ -c /dev/tty1 ] || mknod -m 620 /dev/tty1 c 4 1
|
|
||||||
[ -c /dev/tty ] || mknod -m 666 /dev/tty c 5 0
|
|
||||||
|
|
||||||
[ -c /dev/null ] || mknod -m 666 /dev/null c 1 3
|
|
||||||
[ -c /dev/kmsg ] || mknod -m 660 /dev/kmsg c 1 11
|
|
||||||
|
|
||||||
# extra symbolic links not provided by default
|
|
||||||
[ -e /dev/fd ] || ln -snf /proc/self/fd /dev/fd
|
|
||||||
[ -e /dev/stdin ] || ln -snf /proc/self/fd/0 /dev/stdin
|
|
||||||
[ -e /dev/stdout ] || ln -snf /proc/self/fd/1 /dev/stdout
|
|
||||||
[ -e /dev/stderr ] || ln -snf /proc/self/fd/2 /dev/stderr
|
|
||||||
[ -e /proc/kcore ] && ln -snf /proc/kcore /dev/core
|
|
||||||
|
|
||||||
# devfs filesystems
|
|
||||||
mkdir -p -m 1777 /dev/mqueue
|
|
||||||
mkdir -p -m 1777 /dev/shm
|
|
||||||
mkdir -p -m 0755 /dev/pts
|
|
||||||
mount -n -t mqueue -o noexec,nosuid,nodev mqueue /dev/mqueue
|
|
||||||
mount -n -t tmpfs -o noexec,nosuid,nodev,mode=1777 shm /dev/shm
|
|
||||||
mount -n -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts
|
|
||||||
|
|
||||||
# mount sysfs
|
|
||||||
sysfs_opts=nodev,noexec,nosuid
|
|
||||||
mount -n -t sysfs -o ${sysfs_opts} sysfs /sys
|
|
||||||
[ -d /sys/kernel/security ] && mount -n -t securityfs -o ${sysfs_opts} securityfs /sys/kernel/security
|
|
||||||
[ -d /sys/kernel/debug ] && mount -n -t debugfs -o ${sysfs_opts} debugfs /sys/kernel/debug
|
|
||||||
[ -d /sys/kernel/config ] && mount -n -t configfs -o ${sysfs_opts} configfs /sys/kernel/config
|
|
||||||
[ -d /sys/fs/fuse/connections ] && mount -n -t fusectl -o ${sysfs_opts} fusectl /sys/fs/fuse/connections
|
|
||||||
[ -d /sys/fs/selinux ] && mount -n -t selinuxfs -o nosuid,noexec selinuxfs /sys/fs/selinux
|
|
||||||
[ -d /sys/fs/pstore ] && mount -n -t pstore pstore -o ${sysfs_opts} /sys/fs/pstore
|
|
||||||
[ -d /sys/firmware/efi/efivars ] && mount -n -t efivarfs -o ro,${sysfs_opts} efivarfs /sys/firmware/efi/efivars
|
|
||||||
|
|
||||||
# misc /proc mounted fs
|
|
||||||
[ -d /proc/sys/fs/binfmt_misc ] && mount -t binfmt_misc -o nodev,noexec,nosuid binfmt_misc /proc/sys/fs/binfmt_misc
|
|
||||||
|
|
||||||
# mount cgroups
|
|
||||||
mount -n -t tmpfs -o nodev,noexec,nosuid,mode=755,size=10m cgroup_root /sys/fs/cgroup
|
|
||||||
|
|
||||||
while read name hier groups enabled rest
|
|
||||||
do
|
|
||||||
case "${enabled}" in
|
|
||||||
1) mkdir -p /sys/fs/cgroup/${name}
|
|
||||||
mount -n -t cgroup -o ${sysfs_opts},${name} ${name} /sys/fs/cgroup/${name}
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done < /proc/cgroups
|
|
||||||
|
|
||||||
# for compatibility
|
|
||||||
mkdir -p /sys/fs/cgroup/systemd
|
|
||||||
mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd
|
|
||||||
|
|
||||||
# set SELinux contexts
|
|
||||||
if [ -x /sbin/restorecon ]
|
|
||||||
then
|
|
||||||
restorecon -F /sys/devices/system/cpu/online >/dev/null 2>&1
|
|
||||||
restorecon -rF /sys/fs/cgroup >/dev/null 2>&1
|
|
||||||
restorecon -rF /dev >/dev/null 2>&1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# start mdev for hotplug
|
|
||||||
echo "/sbin/mdev" > /proc/sys/kernel/hotplug
|
|
||||||
|
|
||||||
# mdev -s will not create /dev/usb[1-9] devices with recent kernels
|
|
||||||
# so we trigger hotplug events for usb for now
|
|
||||||
for i in $(find /sys/devices -name 'usb[0-9]*'); do
|
|
||||||
[ -e $i/uevent ] && echo add > $i/uevent
|
|
||||||
done
|
|
||||||
|
|
||||||
mdev -s
|
|
||||||
|
|
||||||
# set hostname
|
|
||||||
if [ -s /etc/hostname ]
|
|
||||||
then
|
|
||||||
hostname -F /etc/hostname
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ $(hostname) = "moby" -a -f /sys/class/net/eth0/address ]
|
|
||||||
then
|
|
||||||
mac=$(cat /sys/class/net/eth0/address)
|
|
||||||
hostname moby-$(echo $mac | sed 's/://g')
|
|
||||||
fi
|
|
||||||
|
|
||||||
# set system clock from hwclock
|
|
||||||
hwclock --hctosys --utc
|
|
||||||
|
|
||||||
# bring up loopback interface
|
|
||||||
ip addr add 127.0.0.1/8 dev lo brd + scope host
|
|
||||||
ip route add 127.0.0.0/8 dev lo scope host
|
|
||||||
ip link set lo up
|
|
||||||
|
|
||||||
# will be containerised
|
|
||||||
/sbin/dhcpcd
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
# /etc/inittab
|
|
||||||
|
|
||||||
::sysinit:/etc/init.d/rcS
|
|
||||||
::once:/etc/init.d/containerd
|
|
||||||
::once:/etc/init.d/containers
|
|
||||||
|
|
||||||
# Stuff to do for the 3-finger salute
|
|
||||||
::ctrlaltdel:/sbin/reboot
|
|
||||||
|
|
||||||
# Stuff to do before rebooting
|
|
||||||
::shutdown:/usr/sbin/killall5 -15
|
|
||||||
::shutdown:/bin/sleep 5
|
|
||||||
::shutdown:/usr/sbin/killall5 -9
|
|
||||||
::shutdown:/bin/echo "Unmounting filesystems"
|
|
||||||
::shutdown:/bin/umount -a -r
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
|
|
||||||
Welcome to Moby
|
|
||||||
|
|
||||||
## .
|
|
||||||
## ## ## ==
|
|
||||||
## ## ## ## ## ===
|
|
||||||
/"""""""""""""""""\___/ ===
|
|
||||||
~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ / ===- ~~~
|
|
||||||
\______ o __/
|
|
||||||
\ \ __/
|
|
||||||
\____\_______/
|
|
||||||
|
|
||||||
@ -1,44 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
setup_console() {
|
|
||||||
tty=${1%,*}
|
|
||||||
speed=${1#*,}
|
|
||||||
inittab="$2"
|
|
||||||
securetty="$3"
|
|
||||||
line=
|
|
||||||
term="linux"
|
|
||||||
[ "$speed" = "$1" ] && speed=115200
|
|
||||||
|
|
||||||
case "$tty" in
|
|
||||||
ttyS*|ttyAMA*|ttyUSB*|ttyMFD*)
|
|
||||||
line="-L"
|
|
||||||
term="vt100"
|
|
||||||
;;
|
|
||||||
tty0)
|
|
||||||
# skip current console
|
|
||||||
return 0
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
# skip consoles already in inittab
|
|
||||||
grep -q "^$tty:" "$inittab" && return
|
|
||||||
|
|
||||||
echo "$tty::once:cat /etc/issue" >> "$inittab"
|
|
||||||
echo "$tty::respawn:/sbin/getty -n -l /bin/sh $line $speed $tty $term" >> "$inittab"
|
|
||||||
if ! grep -q -w "$tty" "$securetty"; then
|
|
||||||
echo "$tty" >> "$securetty"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
/bin/mount -t tmpfs tmpfs /mnt
|
|
||||||
|
|
||||||
/bin/cp -a / /mnt 2>/dev/null
|
|
||||||
|
|
||||||
/bin/mount -t proc -o noexec,nosuid,nodev proc /proc
|
|
||||||
for opt in $(cat /proc/cmdline); do
|
|
||||||
case "$opt" in
|
|
||||||
console=*)
|
|
||||||
setup_console ${opt#console=} /mnt/etc/inittab /mnt/etc/securetty;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
exec /bin/busybox switch_root /mnt /sbin/init
|
|
||||||
@ -1,2 +0,0 @@
|
|||||||
http://dl-cdn.alpinelinux.org/alpine/v3.5/main
|
|
||||||
http://dl-cdn.alpinelinux.org/alpine/edge/testing
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,53 +0,0 @@
|
|||||||
FROM linuxkit/alpine-build-kernel:cfdd576c36a52ed2dd62f237f79eeedc2dd3697b@sha256:3fe08db373a9373ba1616a485858f01ebd2d7a3cb364a099d0ed8b45fa419da2
|
|
||||||
|
|
||||||
ARG KERNEL_VERSION
|
|
||||||
ARG DEBUG=0
|
|
||||||
|
|
||||||
ENV KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VERSION}.tar.xz
|
|
||||||
|
|
||||||
RUN curl -fsSL -o linux-${KERNEL_VERSION}.tar.xz ${KERNEL_SOURCE}
|
|
||||||
|
|
||||||
RUN cat linux-${KERNEL_VERSION}.tar.xz | tar --absolute-names -xJ && mv /linux-${KERNEL_VERSION} /linux
|
|
||||||
|
|
||||||
COPY kernel_config /linux/arch/x86/configs/x86_64_defconfig
|
|
||||||
COPY kernel_config.debug /linux/debug_config
|
|
||||||
|
|
||||||
RUN if [ $DEBUG -ne "0" ]; then \
|
|
||||||
sed -i 's/CONFIG_PANIC_ON_OOPS=y/# CONFIG_PANIC_ON_OOPS is not set/' /linux/arch/x86/configs/x86_64_defconfig; \
|
|
||||||
cat /linux/debug_config >> /linux/arch/x86/configs/x86_64_defconfig; \
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Apply local patches
|
|
||||||
COPY patches-4.9 /patches
|
|
||||||
RUN cd /linux && \
|
|
||||||
set -e && for patch in /patches/*.patch; do \
|
|
||||||
echo "Applying $patch"; \
|
|
||||||
patch -p1 < "$patch"; \
|
|
||||||
done
|
|
||||||
|
|
||||||
RUN cd /linux && \
|
|
||||||
make defconfig && \
|
|
||||||
make oldconfig && \
|
|
||||||
make -j "$(getconf _NPROCESSORS_ONLN)" KCFLAGS="-fno-pie"
|
|
||||||
RUN cd /linux && \
|
|
||||||
make INSTALL_MOD_PATH=/tmp/kernel-modules modules_install && \
|
|
||||||
( DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \
|
|
||||||
cd /tmp/kernel-modules/lib/modules/$DVER && \
|
|
||||||
rm build source && \
|
|
||||||
ln -s /usr/src/linux-headers-$DVER build ) && \
|
|
||||||
mkdir -p /tmp/kernel-headers/usr && \
|
|
||||||
make INSTALL_HDR_PATH=/tmp/kernel-headers/usr headers_install && \
|
|
||||||
( cd /tmp/kernel-headers && tar cf /kernel-headers.tar usr ) && \
|
|
||||||
( cd /tmp/kernel-modules && tar cf /kernel-modules.tar lib ) && \
|
|
||||||
cp vmlinux arch/x86_64/boot/bzImage /
|
|
||||||
|
|
||||||
RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \
|
|
||||||
dir=/tmp/usr/src/linux-headers-$DVER && \
|
|
||||||
mkdir -p $dir && \
|
|
||||||
cp /linux/.config $dir && \
|
|
||||||
cd /linux && \
|
|
||||||
cp -a include "$dir" && \
|
|
||||||
mkdir -p "$dir"/arch/x86 && cp -a arch/x86/include "$dir"/arch/x86/ && \
|
|
||||||
( cd /tmp && tar cf /kernel-dev.tar usr/src )
|
|
||||||
|
|
||||||
RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /kernel-source-info
|
|
||||||
@ -1,70 +0,0 @@
|
|||||||
DEBUG ?= 0
|
|
||||||
|
|
||||||
all: bzImage push
|
|
||||||
|
|
||||||
# We push the image to hub twice, once with the full kernel version of
|
|
||||||
# "mobylinux/kernel:<kernel version>.<major version>.<minor version>-<n>",
|
|
||||||
# where "<n>" is a monotonically increasing config number, and as
|
|
||||||
# "mobylinux/kernel:<kernel version>.<major version>.x". This version
|
|
||||||
# number is stored in IMAGE_VERSION.
|
|
||||||
#
|
|
||||||
# We expect most users to us the "<kernel version>.<major version>.x"
|
|
||||||
# variant as this simply is the latest version of a given major kernel
|
|
||||||
# version. This version number is stored in IMAGE_MAJOR_VERSION.
|
|
||||||
#
|
|
||||||
# For IMAGE_VERSION, the "<n>" must be increased whenever
|
|
||||||
# the kernel config or the patches change. We don't expect this to
|
|
||||||
# happen very often as the minor version number gets update quite
|
|
||||||
# frequently.
|
|
||||||
#
|
|
||||||
# IMAGE_VERSION is used to determine if a new image should be pushed to hub.
|
|
||||||
KERNEL_VERSION=4.9.15
|
|
||||||
IMAGE_VERSION=$(KERNEL_VERSION)-1
|
|
||||||
IMAGE_MAJOR_VERSION=4.9.x
|
|
||||||
DEPS=Dockerfile Makefile kernel_config kernel_config.debug patches-4.9
|
|
||||||
|
|
||||||
kernel.tag: $(DEPS)
|
|
||||||
BUILD=$$( tar cf - $^ | docker build -f $< --build-arg DEBUG=$(DEBUG) --build-arg KERNEL_VERSION=$(KERNEL_VERSION) -q - ) && [ -n "$$BUILD" ] && echo "Built $$BUILD" && echo "$$BUILD" > $@
|
|
||||||
|
|
||||||
bzImage: kernel.tag
|
|
||||||
rm -rf etc/kernel-patches
|
|
||||||
mkdir -p x86_64 etc lib usr sbin etc/kernel-patches
|
|
||||||
docker run --rm --net=none --log-driver=none $(shell cat kernel.tag) tar cf - bzImage kernel-dev.tar kernel-headers.tar vmlinux kernel-modules.tar | tar xf - -C x86_64
|
|
||||||
cp x86_64/kernel-modules.tar kernel.tar
|
|
||||||
cp x86_64/bzImage $@
|
|
||||||
|
|
||||||
.PHONY: image push tag
|
|
||||||
|
|
||||||
MEDIA_TOYBOX=linuxkit/toybox-media:d7e82a7d19ccc84c9071fa7a88ecaa58ae958f7c@sha256:4c7d25f2be2429cd08417c36e04161cb924e46f3e419ee33a0aa9ff3a0942e02
|
|
||||||
|
|
||||||
BASE="$MEDIA_TOYBOX"
|
|
||||||
IMAGE=kernel-wireguard
|
|
||||||
|
|
||||||
default: push
|
|
||||||
|
|
||||||
Dockerfile.media:
|
|
||||||
printf "FROM $(MEDIA_TOYBOX)\nADD . /\n" > $@
|
|
||||||
|
|
||||||
image: Dockerfile.media bzImage kernel.tar $(DEPS)
|
|
||||||
tar cf - $^ | docker build --no-cache -t $(IMAGE):build -f Dockerfile.media -
|
|
||||||
|
|
||||||
push: image
|
|
||||||
docker pull mobylinux/$(IMAGE):$(IMAGE_VERSION) || \
|
|
||||||
(docker tag $(IMAGE):build mobylinux/$(IMAGE):$(IMAGE_VERSION) && \
|
|
||||||
docker push mobylinux/$(IMAGE):$(IMAGE_VERSION) && \
|
|
||||||
docker tag $(IMAGE):build mobylinux/$(IMAGE):$(IMAGE_MAJOR_VERSION) && \
|
|
||||||
docker push mobylinux/$(IMAGE):$(IMAGE_MAJOR_VERSION))
|
|
||||||
docker rmi $(IMAGE):build
|
|
||||||
rm -f hash
|
|
||||||
|
|
||||||
tag: image
|
|
||||||
(docker tag $(IMAGE):build mobylinux/$(IMAGE):$(IMAGE_VERSION) && \
|
|
||||||
docker tag $(IMAGE):build mobylinux/$(IMAGE):$(IMAGE_MAJOR_VERSION))
|
|
||||||
docker rmi $(IMAGE):build
|
|
||||||
rm -f hash
|
|
||||||
|
|
||||||
.PHONY: clean
|
|
||||||
clean:
|
|
||||||
rm -rf x86_64 lib usr sbin kernel.tag Dockerfile.media bzImage kernel.tar
|
|
||||||
|
|
||||||
.DELETE_ON_ERROR:
|
|
||||||
73
projects/wireguard/kernel/Dockerfile
Normal file
73
projects/wireguard/kernel/Dockerfile
Normal file
@ -0,0 +1,73 @@
|
|||||||
|
FROM linuxkit/kernel-compile:1b396c221af673757703258159ddc8539843b02b@sha256:6b32d205bfc6407568324337b707d195d027328dbfec554428ea93e7b0a8299b AS kernel-build
|
||||||
|
|
||||||
|
ARG KERNEL_VERSION
|
||||||
|
ARG KERNEL_SERIES
|
||||||
|
ARG DEBUG
|
||||||
|
|
||||||
|
ENV KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VERSION}.tar.xz
|
||||||
|
|
||||||
|
RUN curl -fsSL -o linux-${KERNEL_VERSION}.tar.xz ${KERNEL_SOURCE}
|
||||||
|
|
||||||
|
RUN cat linux-${KERNEL_VERSION}.tar.xz | tar --absolute-names -xJ && mv /linux-${KERNEL_VERSION} /linux
|
||||||
|
|
||||||
|
COPY kernel_config-${KERNEL_SERIES} /linux/arch/x86/configs/x86_64_defconfig
|
||||||
|
COPY kernel_config.debug /linux/debug_config
|
||||||
|
|
||||||
|
RUN if [ -n "${DEBUG}" ]; then \
|
||||||
|
sed -i 's/CONFIG_PANIC_ON_OOPS=y/# CONFIG_PANIC_ON_OOPS is not set/' /linux/arch/x86/configs/x86_64_defconfig; \
|
||||||
|
cat /linux/debug_config >> /linux/arch/x86/configs/x86_64_defconfig; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Apply local patches
|
||||||
|
COPY patches-${KERNEL_SERIES} /patches
|
||||||
|
WORKDIR /linux
|
||||||
|
RUN set -e && for patch in /patches/*.patch; do \
|
||||||
|
echo "Applying $patch"; \
|
||||||
|
patch -p1 < "$patch"; \
|
||||||
|
done
|
||||||
|
|
||||||
|
RUN mkdir /out
|
||||||
|
|
||||||
|
# Kernel
|
||||||
|
RUN make defconfig && \
|
||||||
|
make oldconfig && \
|
||||||
|
make -j "$(getconf _NPROCESSORS_ONLN)" KCFLAGS="-fno-pie" && \
|
||||||
|
cp arch/x86_64/boot/bzImage /out/kernel && \
|
||||||
|
cp System.map /out && \
|
||||||
|
([ -n "${DEBUG}" ] && cp vmlinux /out || true)
|
||||||
|
|
||||||
|
# Modules
|
||||||
|
RUN make INSTALL_MOD_PATH=/tmp/kernel-modules modules_install && \
|
||||||
|
( DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \
|
||||||
|
cd /tmp/kernel-modules/lib/modules/$DVER && \
|
||||||
|
rm build source && \
|
||||||
|
ln -s /usr/src/linux-headers-$DVER build ) && \
|
||||||
|
( cd /tmp/kernel-modules && tar cf /out/kernel.tar lib )
|
||||||
|
|
||||||
|
# Headers (userspace API)
|
||||||
|
RUN mkdir -p /tmp/kernel-headers/usr && \
|
||||||
|
make INSTALL_HDR_PATH=/tmp/kernel-headers/usr headers_install && \
|
||||||
|
( cd /tmp/kernel-headers && tar cf /out/kernel-headers.tar usr )
|
||||||
|
|
||||||
|
# Headers (kernel development)
|
||||||
|
RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \
|
||||||
|
dir=/tmp/usr/src/linux-headers-$DVER && \
|
||||||
|
mkdir -p $dir && \
|
||||||
|
cp /linux/.config $dir && \
|
||||||
|
cp /linux/Module.symvers $dir && \
|
||||||
|
find . -path './include/*' -prune -o \
|
||||||
|
-path './arch/*/include' -prune -o \
|
||||||
|
-path './scripts/*' -prune -o \
|
||||||
|
-type f \( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
|
||||||
|
-name '*.lds' -o -name '*.pl' -o -name '*.sh' \) | \
|
||||||
|
tar cf - -T - | (cd $dir; tar xf -) && \
|
||||||
|
( cd /tmp && tar cf /out/kernel-dev.tar usr/src )
|
||||||
|
|
||||||
|
RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info
|
||||||
|
|
||||||
|
|
||||||
|
FROM scratch
|
||||||
|
ENTRYPOINT []
|
||||||
|
CMD []
|
||||||
|
WORKDIR /
|
||||||
|
COPY --from=kernel-build /out/* /
|
||||||
66
projects/wireguard/kernel/Makefile
Normal file
66
projects/wireguard/kernel/Makefile
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
# This builds the supported LinuxKit kernels. Kernels are wrapped up
|
||||||
|
# in a minimal toybox container, which contains the bzImage, a tar
|
||||||
|
# ball with modules and the kernel source.
|
||||||
|
#
|
||||||
|
# Each kernel is pushed to hub twice, once as
|
||||||
|
# linuxkit/kernel:<kernel>.<major>.<minor>-<hash> and once as
|
||||||
|
# inuxkit/kernel:<kernel>.<major>.x. The <hash> is the git tree hash
|
||||||
|
# of the current directory. The build will only rebuild the kernel
|
||||||
|
# image if the git tree hash changed.
|
||||||
|
|
||||||
|
# Git tree hash of this directory. Override to force build
|
||||||
|
HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
|
||||||
|
# Name and Org on Hub
|
||||||
|
ORG?=linuxkit
|
||||||
|
IMAGE:=kernel-wireguard
|
||||||
|
|
||||||
|
.PHONY: check tag push sign
|
||||||
|
# Targets:
|
||||||
|
# build: builds all kernels
|
||||||
|
# push: pushes all tagged kernel images to hub
|
||||||
|
# sign: sign and push all kernel images to hub
|
||||||
|
build:
|
||||||
|
push:
|
||||||
|
sign:
|
||||||
|
|
||||||
|
# A template for defining kernel build
|
||||||
|
# Arguments:
|
||||||
|
# $1: Full kernel version, e.g., 4.9.22
|
||||||
|
# $2: Kernel "series", e.g., 4.9.x
|
||||||
|
# $3: Build a debug kernel (used as suffix for image)
|
||||||
|
# This defines targets like:
|
||||||
|
# build_4.9.x, push_4.9.x and sign_4.9.x and adds them as dependencies
|
||||||
|
# to the global targets
|
||||||
|
# Set $3 to "_dbg", to build debug kernels. This defines targets like
|
||||||
|
# build_4.9.x_dbg and adds "_dbg" to the hub image name.
|
||||||
|
define kernel
|
||||||
|
build_$(2)$(3): Dockerfile Makefile $(wildcard patches-$(2)/*) kernel_config-$(2) kernel_config.debug
|
||||||
|
docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
|
||||||
|
docker build \
|
||||||
|
--build-arg KERNEL_VERSION=$(1) \
|
||||||
|
--build-arg KERNEL_SERIES=$(2) \
|
||||||
|
--build-arg DEBUG=$(3) \
|
||||||
|
--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) .
|
||||||
|
|
||||||
|
push_$(2)$(3): build_$(2)$(3)
|
||||||
|
docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
|
||||||
|
(docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \
|
||||||
|
docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \
|
||||||
|
docker push $(ORG)/$(IMAGE):$(2)$(3))
|
||||||
|
|
||||||
|
sign_$(2)$(3): build_$(2)$(3)
|
||||||
|
DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \
|
||||||
|
(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \
|
||||||
|
docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \
|
||||||
|
DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(2)$(3))
|
||||||
|
|
||||||
|
build: build_$(2)$(3)
|
||||||
|
push: push_$(2)$(3)
|
||||||
|
sign: sign_$(2)$(3)
|
||||||
|
endef
|
||||||
|
|
||||||
|
#
|
||||||
|
# Build Targets
|
||||||
|
# Debug targets only for latest stable and LTS stable
|
||||||
|
#
|
||||||
|
$(eval $(call kernel,4.9.15,4.9.x))
|
||||||
@ -33,7 +33,6 @@ WireGuard has a [network namespace integration](https://www.wireguard.io/netns/)
|
|||||||
## Roadmap
|
## Roadmap
|
||||||
|
|
||||||
**Near-term:**
|
**Near-term:**
|
||||||
- moving `wireguard-tools` out of the init image (with any other tools, as well)
|
|
||||||
- decide between either carrying the WireGuard patches in our kernel tree or using a module
|
- decide between either carrying the WireGuard patches in our kernel tree or using a module
|
||||||
|
|
||||||
**Long-term:**
|
**Long-term:**
|
||||||
|
|||||||
13
projects/wireguard/tools/Dockerfile
Normal file
13
projects/wireguard/tools/Dockerfile
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
FROM linuxkit/alpine:630ee558e4869672fae230c78364e367b8ea67a9 as tools
|
||||||
|
RUN echo http://dl-cdn.alpinelinux.org/alpine/edge/testing >> /etc/apk/repositories
|
||||||
|
RUN \
|
||||||
|
apk update && \
|
||||||
|
apk upgrade -a && \
|
||||||
|
apk add --no-cache wireguard-tools
|
||||||
|
|
||||||
|
FROM scratch
|
||||||
|
ENTRYPOINT []
|
||||||
|
CMD []
|
||||||
|
WORKDIR /
|
||||||
|
COPY --from=tools /usr/bin/wg /usr/bin/wg-quick /usr/bin/
|
||||||
|
COPY --from=tools /usr/lib/libmnl.so* /lib/
|
||||||
16
projects/wireguard/tools/Makefile
Normal file
16
projects/wireguard/tools/Makefile
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
.PHONY: tag push
|
||||||
|
default: push
|
||||||
|
|
||||||
|
IMAGE=wireguard-utils
|
||||||
|
DEPS=Dockerfile
|
||||||
|
ORG?=linuxkit
|
||||||
|
|
||||||
|
HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
|
||||||
|
|
||||||
|
tag: $(DEPS)
|
||||||
|
docker pull $(ORG)/$(IMAGE):$(HASH) || \
|
||||||
|
docker build --no-cache -t $(ORG)/$(IMAGE):$(HASH) .
|
||||||
|
|
||||||
|
push: tag
|
||||||
|
docker pull $(ORG)/$(IMAGE):$(HASH) || \
|
||||||
|
docker push $(ORG)/$(IMAGE):$(HASH)
|
||||||
35
projects/wireguard/wireguard.yml
Normal file
35
projects/wireguard/wireguard.yml
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
kernel:
|
||||||
|
image: "linuxkit/kernel-wireguard:4.9.15-2ca28b7589b673373a33274023ca870a3a77e081"
|
||||||
|
cmdline: "console=ttyS0 console=tty0 page_poison=1"
|
||||||
|
init:
|
||||||
|
- linuxkit/init:cbd7ae748f0a082516501a3e914fa0c924ee941e
|
||||||
|
- linuxkit/runc:24dfe632ed3ff53a026ee3fac046fd544434e2d6
|
||||||
|
- linuxkit/containerd:f1130450206d4f64f0ddc13d15bb68435aa1ff61
|
||||||
|
- linuxkit/ca-certificates:4e9a83e890e6477dcd25029fc4f1ced61d0642f4
|
||||||
|
- linuxkit/wireguard-utils:26fe3d38455f2d441549e3c54bdec1b26ac819b8
|
||||||
|
onboot:
|
||||||
|
- name: sysctl
|
||||||
|
image: "linuxkit/sysctl:225c52c2d6f04a040663bac84cabf81825027f64"
|
||||||
|
- name: binfmt
|
||||||
|
image: "linuxkit/binfmt:603e5f064b3e8a64088c0fcf7a80d2783541ee1d"
|
||||||
|
- name: dhcpcd
|
||||||
|
image: "linuxkit/dhcpcd:ae03169274d19fe8841314fa5a6fea3c61adbf4e"
|
||||||
|
command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
|
||||||
|
services:
|
||||||
|
- name: rngd
|
||||||
|
image: "linuxkit/rngd:69f951ce2a3a9534dbbc7ba8119e1df4391f06c0"
|
||||||
|
- name: nginx
|
||||||
|
image: "nginx:alpine"
|
||||||
|
capabilities:
|
||||||
|
- CAP_NET_BIND_SERVICE
|
||||||
|
- CAP_CHOWN
|
||||||
|
- CAP_SETUID
|
||||||
|
- CAP_SETGID
|
||||||
|
- CAP_DAC_OVERRIDE
|
||||||
|
net: host
|
||||||
|
files:
|
||||||
|
- path: etc/docker/daemon.json
|
||||||
|
contents: '{"debug": true}'
|
||||||
|
trust:
|
||||||
|
org:
|
||||||
|
- linuxkit
|
||||||
Loading…
Reference in New Issue
Block a user