Commit Graph

95 Commits

Author SHA1 Message Date
Riyaz Faizullabhoy
b919d6483b Add fs link protection sysctls
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2017-01-18 15:20:40 +00:00
Justin Cormack
d7508166bf Combine sysctl configs
Where the suggestions came from is not that useful, just have a
single file for the main ones and then distro specific versions.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-10 11:40:36 +00:00
Riyaz Faizullabhoy
07f4f90b6c Add kspp recommended sysctl settings
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-22 10:00:22 -08:00
Justin Cormack
3cb47b0b00 Fix the cgroup memory hierarchy warning
Needed to make the memory cgroup work properly

fix #373

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-22 00:21:47 +00:00
Riyaz Faizullabhoy
bee11d02f7 Only disable sysrq for cloud editions
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-16 09:24:34 -08:00
Justin Cormack
9fc867629f Improve mkfs options
- make quiet
- force, so some adjustments are not checked see https://github.com/docker/pinata/issues/6198
- set resize_inode as we do resize partitions on cloud and they could have very few inodes otherwise
- inline all the default options and remove the config file, so script is more standalone

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 10:36:49 -08:00
Riyaz Faizullabhoy
9284759f2c Disable kexec from kernel_config, revert sysctl config because key is now unknown
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-07 11:43:10 -08:00
Justin Cormack
5794640a04 Merge pull request #840 from riyazdf/kexec-load
Disable kexec load in sysctl config
2016-12-07 10:44:44 -08:00
Justin Cormack
085a2f7fbd Only TRIM on Mac if configured via database
Stops unnecessary log spam.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-06 08:50:45 -08:00
Justin Cormack
ccec51c2ca Typo in crontab
Its 15min not 15m

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-06 08:37:04 -08:00
David Scott
f570ef6dac Use TRIM on Mac as well as Windows
Previously we only ran `fstrim` on Windows. Docker for Mac now supports
TRIM so we should run `fstrim` there too.

Note it's possible to turn off TRIM on the Mac at the virtual hardware
level via the database, but this should be harmless -- the `fstrim`
fails immediately with an obvious error if the device doesn't support it:
`fstrim: ioctl 0xc0185879 failed: Not supported`.

Signed-off-by: David Scott <dave.scott@docker.com>
2016-12-06 12:03:26 +00:00
Riyaz Faizullabhoy
23c895a3d3 Disable kexec load in sysctl config
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-05 09:26:17 -08:00
Justin Cormack
933372e45a Run rngd inside a system container
- this needs an init as it does not respond to stop signals, so include tini
- needs CAP_SYS_ADMIN to write to kernel entropy estimate
- set kernel.random.write_wakeup_threshold so that rngd does not need sysctl write access
- build patches from Alpine, but statically linked
- remove rngd from base image, means we no longer need community repository

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-02 14:00:12 +00:00
Riyaz Faizullabhoy
0eefa15623 Add sysctl changes as suggested by lynis
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-01 15:41:57 -08:00
Justin Cormack
d523b95b1f Merge pull request #806 from riyazdf/disable-kernel-modules
Disable kernel modules for cloud editions from moby
2016-11-28 16:07:03 -08:00
Riyaz Faizullabhoy
c492c01c82 Disable kernel modules for cloud editions from moby by checking in
a modified sysctl init with a cloud config

Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-11-28 15:40:02 -08:00
Justin Cormack
46adfec8a7 Add a tmpfs at /tmp
This makes sure that once we have ro rootfs any programs that still
for any reason use `/tmp` can still write to it, or if people expect
sharing it into a container to work.

fix #778

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-25 17:05:45 +00:00
Justin Cormack
80c9cee485 Make /run nosuid,noexec
This was not sufficiently locked down.

Fix #720

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-23 12:08:53 +00:00
Justin Cormack
41f4841399 Run TRIM on Windows every 15m
As the Windows virtual device supports TRIM we can run this to free
up disk space frequently. Not recommended to run on physical devices
this often.

See https://github.com/docker/pinata/issues/5298

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-23 11:30:35 +00:00
Justin Cormack
f69f9a3427 Use syslog local0 for docker logs
This allows log rotation, redirect via syslog etc.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-18 16:23:41 +00:00
Justin Cormack
e0eda2d1e0 Remove syslog conf file
We are not using busybox syslog any more so this is unused.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-18 16:23:41 +00:00
Justin Cormack
23415c038b Rework moving automount earlier in boot sequence
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-15 09:54:07 +00:00
Justin Cormack
bd800943d9 Fix /run symlink issues
- run bootmisc before sysklogd so symlinks from /var/run to
  /run are created
- recreate symlinks that bootmisc created when we remount /var
  until this gets moved earlier

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-14 22:00:12 +00:00
Justin Cormack
dc10cff096 Revert "Use /run for pidfiles for sysklogd"
This reverts commit b8ff787239.

syslogd always uses /var/run internally, need to fix symlinks.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-14 19:55:07 +00:00
Justin Cormack
29df1f9f7b Use /run for pidfiles for sysklogd
This is the real location, and /var may be overmounted.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-14 18:38:37 +00:00
Justin Cormack
9d81e2efef Always start vsudd before syslog
If we are using vsudd to forward syslog to the host, as on osx,
we need to start it before syslog starts, and make sure it has
created its socket.

Add a pidfile to vsudd to make startup more reliable.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-14 17:08:37 +00:00
Justin Cormack
b042b5127f Revert "Format filesystems earlier, before syslog"
This reverts commit 4dd5dca106.

Fix #710 where system hangs after klogd startup on AWS. Possibly
also affects Windows too. Still unclear why but lets revert and
continue investif=gating.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-12 15:29:27 +00:00
Justin Cormack
9a95224681 Format filesystems earlier, before syslog
So that we can write to /var early, move filesystem formatting as early as possible.

Adds a dummy fsck service, as we already do fsck in format script.

Replaces #535

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 15:20:46 +00:00
Justin Cormack
53e367326b Increase neighbor cache threshold values
Needed for larger clusters.

Needed for https://github.com/docker/editions/issues/377

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-28 22:25:36 +01:00
Justin Cormack
68da2c2a49 Support memory overcommit
One less complaint in Redis startup.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-05 11:46:58 +02:00
Justin Cormack
635d99d243 Add weekly cron job to TRIM drive
See #536

This is the recommended frequency. For desktop this might be less
suitable, so we may want to adjust

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-24 14:18:49 +01:00
Justin Cormack
07103e7e62 Switch to dhcpcd
Should fix issue with not sending hostname which Azure needs.

This should be requesting all the dhcp features we currently use.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-23 15:52:30 +01:00
Rolf Neugebauer
803be36b96 net: consolidate DHCP onto eth0 only
- rename DfW main interface eth0
- remove eth1 DHCP config
- create tap device in init script not interfaces file

Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
2016-09-22 18:12:45 +01:00
Rolf Neugebauer
b5e38ce811 net: rename Hyper-V internal network to hvint0 and configure it
Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
2016-09-22 16:17:26 +01:00
Justin Cormack
ed88a46f97 Increase default fs.aio-max-nr
As recommended by Oracle for MySQL.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-19 23:38:26 +01:00
Justin Cormack
468c8ba010 Add rngd
Tweak the config to use RDSEED or (fallback) RDRAND. Makes sure
we have initial random seed in cases where there is no other
random source if these are supported.

The default config in Alpine currently disables these, which makes
it pretty useless, as there is no motherboard rng support any more.

Replaces #517
Fix #514
Fix #183

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-16 15:32:56 +01:00
Justin Cormack
9305b37153 Do not prompt for username at login
Given you can login as root with no password on the console,
asking which user you would like to login as is rather pointless.

Do have to tweak /etc/issue though as busybox getty does not display it
without a prompt, and we want a whale.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-14 11:38:55 +00:00
David Scott
8f92071848 dhcp: request search domains (DHCP option 119)
Signed-off-by: David Scott <dave.scott@docker.com>
2016-08-31 14:06:55 +01:00
Justin Cormack
0032e8dcfc Fix shared mount of /run
Needs util-linux for now, see https://github.com/docker/moby/issues/424

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-08-22 23:04:57 +01:00
Justin Cormack
06dd021782 Busybox mount will not mount shared, so add a bind
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-08-22 19:09:24 +01:00
Sebastiaan van Stijn
075da30ad7 remove "alpha" from motd
commit 3eae35d77b removed
"alpha" from "issue", but missed removing it here.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2016-08-13 20:20:03 +02:00
Justin Cormack
f4442e388b Add default sysfs settings
This uses the new Alpine sysfs.conf service to allow config of sysfs.

Default file that sets transparent huge pages to only be used on request
to fix #368

Database setting available for user configuration.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-08-12 14:13:40 +01:00
Justin Cormack
eca2215a96 Not alpha any more, missed this
Signed-off-by: Justin Cormack <justin@specialbusservice.com>
2016-08-12 09:40:16 +01:00
Justin Cormack
82c391f47f Merge pull request #397 from nathanleclaire/kickup_dhcp_timeouts
Increase DHCP timeout and retries
2016-08-09 16:18:25 +01:00
Justin Cormack
398ade787e Mount /run as shared
This is needed for volume drivers as they will mount their
volumes under here, and if they are running in a container
docker on the host will need to see these.

Also provide our own fstab, removes the media devices that were
there previously.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-08-09 11:46:08 +01:00
Nathan LeClaire
de80738b07 Increase DHCP timeout and retries
Signed-off-by: Nathan LeClaire <nathan.leclaire@gmail.com>
2016-08-08 17:41:46 -07:00
Justin Cormack
55d3a0dd42 use openrc for shutdown
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-07-21 12:57:05 +01:00
Justin Cormack
96489524e7 Use upstream /etc/securetty
Now we modify the file if we use a different console, can use
upstream unmodified.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-07-15 11:58:01 +01:00
Natanael Copa
9bbf27cb66 merge inittab.x86_64 and inittab.armhf
with the login tty generated from boot cmdline the inittab will be equal
on all archs and platforms so we can merge and move to etc/

Signed-off-by: Natanael Copa <natanael.copa@docker.com>
2016-07-13 18:48:26 +02:00
Ian Campbell
916d920bfb Direct syslog to log to /var/run/syslog.vsock on mac
Avoid doing this on non-Docker-for-{Mac,Win} editions (which don't run vsudd)
by checking for vsudd.pid and avoid doing it on Docker-for-Win (for now) by
checking for /sys/bus/vmbus (as /etc/init.d/vsudd does too).

Ideally we would just check for /var/run/syslog.vsock but this may not have
arrived yet (typically vsudd is now started immediately prior to syslog and it
forks via start-stop-daemon and thus before it creates the socket). Since
syslogd will reopen as needed we don't want to delay boot either here or in the
vsudd initscript to await the arrival of the socket.

Signed-off-by: Ian Campbell <ian.campbell@docker.com>
2016-07-04 14:47:02 +01:00