wireguard project: move to new-style init

Rather than re-build the whole init, let's just include the wireguard tools
in a tools repo.

This also moves *most* of the stuff to new linuxkit infrastructure, instead
of the legacy mobylinux. And checks an item off the TODO list.

Signed-off-by: Tycho Andersen <tycho@docker.com>

projects/wireguard/examples/wireguard.yml

@@ -1,21 +0,0 @@
-kernel:
-  image: "mobylinux/kernel-wireguard:4.9.x"
-  cmdline: "console=ttyS0 page_poison=1"
-init:
-  - "mobylinux/init-wireguard:4309fb8b65cafa9e07b0e75d86a0bff4070e67e9"
-onboot:
-  - name: sysctl
-    image: "mobylinux/sysctl:2cf2f9d5b4d314ba1bfc22b2fe931924af666d8c"
-    net: host
-    pid: host
-    ipc: host
-    capabilities:
-     - CAP_SYS_ADMIN
-    readonly: true
-services:
-  - name: rngd
-    image: "mobylinux/rngd:3dad6dd43270fa632ac031e99d1947f20b22eec9"
-    capabilities:
-     - CAP_SYS_ADMIN
-    oomScoreAdj: -800
-    readonly: true

projects/wireguard/init-wireguard/Dockerfile

@@ -1,14 +0,0 @@
-FROM alpine:3.5
-
-COPY repositories /etc/apk/
-
-RUN \
-  apk update && apk upgrade -a && \
-  apk add --no-cache \
-  dhcpcd \
-  e2fsprogs \
-  e2fsprogs-extra \
-  wireguard-tools \
-  && true
-
-COPY . ./

projects/wireguard/init-wireguard/Makefile

@@ -1,52 +0,0 @@
-CONTAINERD_IMAGE=mobylinux/containerd:c9c8a069da6dccd2803ab476ee0d57a8768f0dcb@sha256:ff5aa0b1086e8c600d6e1508cfae4da31e4935d36ec40f0128aa73113b664e7f
-CONTAINERD_BINARIES=usr/bin/containerd usr/bin/containerd-shim usr/bin/ctr usr/bin/dist
-
-RUNC_IMAGE=mobylinux/runc:f1cee12a65e7b7de06a01aec24609dc3175e1542@sha256:ff1ead6aa4388418ee07f8e93304e5b2fa9b975fe2399474d408654a1411a44a
-RUNC_BINARY=usr/bin/runc
-
-C_COMPILE=linuxkit/c-compile:63b085bbaec1aa7c42a7bd22a4b1c350d900617d@sha256:286e3a729c7a0b1a605ae150235416190f9f430c29b00e65fa50ff73158998e5
-START_STOP_DAEMON=sbin/start-stop-daemon
-
-default: push
-
-$(RUNC_BINARY):
-	mkdir -p $(dir $@)
-	docker run --rm --net=none $(RUNC_IMAGE) tar cf - $@ | tar xf -
-
-$(CONTAINERD_BINARIES):
-	mkdir -p $(dir $@)
-	docker run --rm --net=none $(CONTAINERD_IMAGE) tar cf - $@ | tar xf -
-
-$(START_STOP_DAEMON): start-stop-daemon.c
-	mkdir -p $(dir $@)
-	tar cf - $^ | docker run --rm --net=none --log-driver=none -i $(C_COMPILE) -o $@ | tar xf -
-
-.PHONY: tag push
-
-BASE=alpine:3.5
-IMAGE=init-wireguard
-
-ETC=$(shell find etc -type f)
-
-hash: Dockerfile $(ETC) init $(RUNC_BINARY) $(CONTAINERD_BINARIES) $(START_STOP_DAEMON) repositories
-	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
-	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
-	docker run --rm $(IMAGE):build sh -c 'cat $^ /lib/apk/db/installed | sha1sum' | sed 's/ .*//' > $@
-
-push: hash
-	docker pull mobylinux/$(IMAGE):$(shell cat hash) || \
-		(docker tag $(IMAGE):build mobylinux/$(IMAGE):$(shell cat hash) && \
-		 docker push mobylinux/$(IMAGE):$(shell cat hash))
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-tag: hash
-	docker pull mobylinux/$(IMAGE):$(shell cat hash) || \
-		docker tag $(IMAGE):build mobylinux/$(IMAGE):$(shell cat hash)
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-clean:
-	rm -rf hash sbin usr
-
-.DELETE_ON_ERROR:

projects/wireguard/init-wireguard/etc/dhcpcd.conf

@@ -1,46 +0,0 @@
-# Moby dhcpcd config
-
-# Only configure standard external ethernet
-allowinterfaces eth*
-
-# Inform the DHCP server of our hostname for DDNS.
-hostname
-
-# Use the hardware address of the interface for the Client ID.
-clientid
-# or
-# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
-# Some non-RFC compliant DHCP servers do not reply with this set.
-# In this case, comment out duid and enable clientid above.
-#duid
-
-# Persist interface configuration when dhcpcd exits.
-persistent
-
-# Rapid commit support.
-# Safe to enable by default because it requires the equivalent option set
-# on the server to actually work.
-option rapid_commit
-
-# A list of options to request from the DHCP server.
-option domain_name_servers, domain_name, domain_search, host_name
-option classless_static_routes
-# Most distributions have NTP support.
-option ntp_servers
-# Respect the network MTU. This is applied to DHCP routes.
-option interface_mtu
-
-# A ServerID is required by RFC2131.
-require dhcp_server_identifier
-
-# Generate Stable Private IPv6 Addresses instead of hardware based ones
-slaac private
-
-# Do not wait
-nodelay
-
-# Do not arp to check IP
-noarp
-
-# Only fork when we have ipv4
-# waitip 4

projects/wireguard/init-wireguard/etc/init.d/containerd

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-# bring up containerd
-ulimit -n 1048576
-ulimit -p unlimited
-
-printf "\nStarting containerd\n"
-mkdir -p /var/log
-/sbin/start-stop-daemon --start --exec /usr/bin/containerd

projects/wireguard/init-wireguard/etc/init.d/containers

@@ -1,31 +0,0 @@
-#!/bin/sh
-
-# TODO more robust
-# while [ ! -S /run/containerd/containerd.sock ]; do sleep 1; done
-# while ! ctr list 2> /dev/null; do sleep 1; done
-
-# start system containers
-# temporarily using runc not containerd
-
-if [ -d /containers/system ]
-then
-	for f in $(find /containers/system -mindepth 1 -maxdepth 1 | sort)
-	do
-		base="$(basename $f)"
-		/usr/bin/runc run --bundle "$f" "$(basename $f)"
-		printf " - $base\n"
-	done
-fi
-
-if [ -d /containers/daemon ]
-then
-	for f in $(find /containers/daemon -mindepth 1 -maxdepth 1 | sort)
-	do
-		base="$(basename $f)"
-		log="/var/log/$base.log"
-		/sbin/start-stop-daemon --start --pidfile /run/$base.pid --exec /usr/bin/runc -- run --bundle "$f" --pid-file /run/$base.pid "$(basename $f)" </dev/null 2>$log >$log &
-		printf " - $base\n"
-	done
-fi
-
-wait

projects/wireguard/init-wireguard/etc/init.d/rcS

@@ -1,106 +0,0 @@
-#!/bin/sh
-
-# mount filesystems
-mkdir -p -m 0755 /proc /run /tmp /sys /dev
-
-mount -n -t proc proc /proc -o nodev,nosuid,noexec,relatime
-
-mount -n -t tmpfs tmpfs /run -o nodev,nosuid,noexec,relatime,size=10%,mode=755
-mount -n -t tmpfs tmpfs /tmp -o nodev,nosuid,noexec,relatime,size=10%,mode=1777
-
-# mount devfs
-mount -n -t devtmpfs dev /dev -o nosuid,noexec,relatime,size=10m,nr_inodes=248418,mode=755
-# devices
-[ -c /dev/console ] || mknod -m 600 /dev/console c 5 1
-[ -c /dev/tty1 ] || mknod -m 620 /dev/tty1 c 4 1
-[ -c /dev/tty ] || mknod -m 666 /dev/tty c 5 0
-
-[ -c /dev/null ] || mknod -m 666 /dev/null c 1 3
-[ -c /dev/kmsg ] || mknod -m 660 /dev/kmsg c 1 11
-
-# extra symbolic links not provided by default
-[ -e /dev/fd ] || ln -snf /proc/self/fd /dev/fd
-[ -e /dev/stdin ] || ln -snf /proc/self/fd/0 /dev/stdin
-[ -e /dev/stdout ] || ln -snf /proc/self/fd/1 /dev/stdout
-[ -e /dev/stderr ] || ln -snf /proc/self/fd/2 /dev/stderr
-[ -e /proc/kcore ] && ln -snf /proc/kcore /dev/core
-
-# devfs filesystems
-mkdir -p -m 1777 /dev/mqueue
-mkdir -p -m 1777 /dev/shm
-mkdir -p -m 0755 /dev/pts
-mount -n -t mqueue -o noexec,nosuid,nodev mqueue /dev/mqueue
-mount -n -t tmpfs -o noexec,nosuid,nodev,mode=1777 shm /dev/shm
-mount -n -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts
-
-# mount sysfs
-sysfs_opts=nodev,noexec,nosuid
-mount -n -t sysfs -o ${sysfs_opts} sysfs /sys
-[ -d /sys/kernel/security ] && mount -n -t securityfs -o ${sysfs_opts} securityfs /sys/kernel/security
-[ -d /sys/kernel/debug ] && mount -n -t debugfs -o ${sysfs_opts} debugfs /sys/kernel/debug
-[ -d /sys/kernel/config ] && mount -n -t configfs -o ${sysfs_opts} configfs /sys/kernel/config
-[ -d /sys/fs/fuse/connections ] && mount -n -t fusectl -o ${sysfs_opts} fusectl /sys/fs/fuse/connections
-[ -d /sys/fs/selinux ] && mount -n -t selinuxfs -o nosuid,noexec selinuxfs /sys/fs/selinux
-[ -d /sys/fs/pstore ] && mount -n -t pstore pstore -o ${sysfs_opts} /sys/fs/pstore
-[ -d /sys/firmware/efi/efivars ] && mount -n -t efivarfs -o ro,${sysfs_opts} efivarfs /sys/firmware/efi/efivars
-
-# misc /proc mounted fs
-[ -d /proc/sys/fs/binfmt_misc ] && mount -t binfmt_misc -o nodev,noexec,nosuid binfmt_misc /proc/sys/fs/binfmt_misc
-
-# mount cgroups
-mount -n -t tmpfs -o nodev,noexec,nosuid,mode=755,size=10m cgroup_root /sys/fs/cgroup
-
-while read name hier groups enabled rest
-do
-	case "${enabled}" in
-	1)	mkdir -p /sys/fs/cgroup/${name}
-		mount -n -t cgroup -o ${sysfs_opts},${name} ${name} /sys/fs/cgroup/${name}
-	;;
-	esac
-done < /proc/cgroups
-
-# for compatibility
-mkdir -p /sys/fs/cgroup/systemd
-mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd
-
-# set SELinux contexts
-if [ -x /sbin/restorecon ]
-then
-	restorecon -F /sys/devices/system/cpu/online >/dev/null 2>&1
-	restorecon -rF /sys/fs/cgroup >/dev/null 2>&1
-	restorecon -rF /dev >/dev/null 2>&1
-fi
-
-# start mdev for hotplug
-echo "/sbin/mdev" > /proc/sys/kernel/hotplug
-
-# mdev -s will not create /dev/usb[1-9] devices with recent kernels
-# so we trigger hotplug events for usb for now
-for i in $(find /sys/devices -name 'usb[0-9]*'); do
-	[ -e $i/uevent ] && echo add > $i/uevent
-done
-
-mdev -s
-
-# set hostname
-if [ -s /etc/hostname ]
-then
-	hostname -F /etc/hostname
-fi
-
-if [ $(hostname) = "moby" -a -f /sys/class/net/eth0/address ]
-then
-	mac=$(cat /sys/class/net/eth0/address)
-	hostname moby-$(echo $mac | sed 's/://g')
-fi
-
-# set system clock from hwclock
-hwclock --hctosys --utc
-
-# bring up loopback interface
-ip addr add 127.0.0.1/8 dev lo brd + scope host
-ip route add 127.0.0.0/8 dev lo scope host
-ip link set lo up
-
-# will be containerised
-/sbin/dhcpcd

projects/wireguard/init-wireguard/etc/inittab

@@ -1,15 +0,0 @@
-# /etc/inittab
-
-::sysinit:/etc/init.d/rcS
-::once:/etc/init.d/containerd
-::once:/etc/init.d/containers
-
-# Stuff to do for the 3-finger salute
-::ctrlaltdel:/sbin/reboot
-
-# Stuff to do before rebooting
-::shutdown:/usr/sbin/killall5 -15
-::shutdown:/bin/sleep 5
-::shutdown:/usr/sbin/killall5 -9
-::shutdown:/bin/echo "Unmounting filesystems"
-::shutdown:/bin/umount -a -r

projects/wireguard/init-wireguard/etc/issue

@@ -1,12 +0,0 @@
-
-Welcome to Moby
-
-                        ##         .
-                  ## ## ##        ==
-               ## ## ## ## ##    ===
-           /"""""""""""""""""\___/ ===
-      ~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ /  ===- ~~~
-           \______ o           __/
-             \    \         __/
-              \____\_______/
-

projects/wireguard/init-wireguard/init

@@ -1,44 +0,0 @@
-#!/bin/sh
-
-setup_console() {
-	tty=${1%,*}
-	speed=${1#*,}
-	inittab="$2"
-	securetty="$3"
-	line=
-	term="linux"
-	[ "$speed" = "$1" ] && speed=115200
-
-	case "$tty" in
-	ttyS*|ttyAMA*|ttyUSB*|ttyMFD*)
-		line="-L"
-		term="vt100"
-		;;
-	tty0)
-		# skip current console
-		return 0
-		;;
-	esac
-	# skip consoles already in inittab
-	grep -q "^$tty:" "$inittab" && return
-
-	echo "$tty::once:cat /etc/issue" >> "$inittab"
-	echo "$tty::respawn:/sbin/getty -n -l /bin/sh $line $speed $tty $term" >> "$inittab"
-	if ! grep -q -w "$tty" "$securetty"; then
-		echo "$tty" >> "$securetty"
-	fi
-}
-
-/bin/mount -t tmpfs tmpfs /mnt
-
-/bin/cp -a / /mnt 2>/dev/null
-
-/bin/mount -t proc -o noexec,nosuid,nodev proc /proc
-for opt in $(cat /proc/cmdline); do
-	case "$opt" in
-	console=*)
-		setup_console ${opt#console=} /mnt/etc/inittab /mnt/etc/securetty;;
-	esac
-done
-
-exec /bin/busybox switch_root /mnt /sbin/init

projects/wireguard/init-wireguard/repositories

@@ -1,2 +0,0 @@
-http://dl-cdn.alpinelinux.org/alpine/v3.5/main
-http://dl-cdn.alpinelinux.org/alpine/edge/testing

projects/wireguard/roadmap.md

@@ -33,7 +33,6 @@ WireGuard has a [network namespace integration](https://www.wireguard.io/netns/)
 ## Roadmap
 
 **Near-term:**
-- moving `wireguard-tools` out of the init image (with any other tools, as well)
 - decide between either carrying the WireGuard patches in our kernel tree or using a module
 
 **Long-term:**

projects/wireguard/tools/Dockerfile

@@ -0,0 +1,13 @@
+FROM alpine:edge as tools
+RUN echo http://dl-cdn.alpinelinux.org/alpine/edge/testing >> /etc/apk/repositories
+RUN \
+  apk update && \
+  apk upgrade -a && \
+  apk add --no-cache wireguard-tools
+
+FROM scratch
+ENTRYPOINT []
+CMD []
+WORKDIR /
+COPY --from=tools /usr/bin/wg /usr/bin/wg-quick /usr/bin/
+COPY --from=tools /usr/lib/libmnl.so* /lib/

projects/wireguard/tools/Makefile

@@ -0,0 +1,15 @@
+.PHONY: tag push
+default: push
+
+IMAGE=wireguard-utils
+DEPS=Dockerfile
+
+HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
+
+tag: $(DEPS)
+	docker pull linuxkit/$(IMAGE):$(HASH) || \
+	docker build --no-cache -t linuxkit/$(IMAGE):$(HASH) .
+
+push: tag
+	docker pull linuxkit/$(IMAGE):$(HASH) || \
+	docker push linuxkit/$(IMAGE):$(HASH)

projects/wireguard/wireguard.yml

@@ -0,0 +1,37 @@
+kernel:
+  image: "mobylinux/kernel-wireguard:4.9.x"
+  cmdline: "console=ttyS0 console=tty0 page_poison=1"
+init:
+  - linuxkit/init:cbd7ae748f0a082516501a3e914fa0c924ee941e
+  - linuxkit/runc:24dfe632ed3ff53a026ee3fac046fd544434e2d6
+  - linuxkit/containerd:f1130450206d4f64f0ddc13d15bb68435aa1ff61
+  - linuxkit/ca-certificates:4e9a83e890e6477dcd25029fc4f1ced61d0642f4
+  - linuxkit/wireguard-utils:984114305fe31abfeaaeb735c413bb20bc20f47b
+onboot:
+  - name: sysctl
+    image: "linuxkit/sysctl:225c52c2d6f04a040663bac84cabf81825027f64"
+  - name: binfmt
+    image: "linuxkit/binfmt:603e5f064b3e8a64088c0fcf7a80d2783541ee1d"
+  - name: dhcpcd
+    image: "linuxkit/dhcpcd:ae03169274d19fe8841314fa5a6fea3c61adbf4e"
+    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
+services:
+  - name: rngd
+    image: "linuxkit/rngd:69f951ce2a3a9534dbbc7ba8119e1df4391f06c0"
+  - name: nginx
+    image: "nginx:alpine"
+    capabilities:
+     - CAP_NET_BIND_SERVICE
+     - CAP_CHOWN
+     - CAP_SETUID
+     - CAP_SETGID
+     - CAP_DAC_OVERRIDE
+    net: host
+files:
+  - path: etc/docker/daemon.json
+    contents: '{"debug": true}'
+trust:
+  image:
+    - linuxkit/kernel
+    - linuxkit/binfmt
+    - linuxkit/rngd