Commit Graph

202 Commits

Author SHA1 Message Date
Justin Cormack
9fe9e95349 Replace mkinitrd.sh with a tool to convert base image to initrd
Better split between content and tools.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-02-01 22:32:34 +00:00
Riyaz Faizullabhoy
56899b318d reformat tags before digests
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2017-01-31 09:33:06 -08:00
Justin Cormack
fa4f1aaedc Start diagnostics server earlier, before Docker
Allows it to be used to see what the boot state is.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-25 15:17:55 +00:00
Justin Cormack
b53e83d695 Merge pull request #1086 from justincormack/new-containerd
Shift to development track containerd
2017-01-24 17:50:45 +00:00
Justin Cormack
89e98eefa0 Shift to development track containerd
Move to the development track of `containerd` not the legacy 0.2
branch. The commands have changed a bit.

This does increase the image size as we are bundling the Docker
copy and our copy, and the new one is larger as it is growing features.
Hopefully Docker will shrink eventually. Also we may replace `ctr`
with a library.

Fix #1029

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-24 15:39:44 +00:00
Justin Cormack
321c180c60 Split config database setup by platform
Add basic database setup for AWS, GCP although these are not yet used
by the setup code but will be useful later.

Currently each is gated by `mobyplatform` but this can be removed once we
construct Moby per platform, and once these are containerised so they
are not run from `openrc`.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-23 18:08:26 +00:00
Justin Cormack
8d3fe19140 Merge pull request #931 from justincormack/alpine-3.5-base
Update base image to Alpine 3.5 official image
2016-12-28 17:43:08 +00:00
David Gageot
245e64ac94 Set hostname on GCP
Split GCP startup script in two:

 + One started before Docker, to set the hostname
 + Another to run the startup script

Signed-off-by: David Gageot <david@gageot.net>
2016-12-28 17:51:33 +01:00
Justin Cormack
74dfe84cf0 Update base image to Alpine 3.5 official image
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-27 19:02:29 +00:00
David Gageot
a54f2ae179 Specific init.d script for GCP
Signed-off-by: David Gageot <david@gageot.net>
2016-12-23 12:03:20 +01:00
Justin Cormack
8e32828a9f Update Alpine base image
Security update

- openssh 7.4

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-19 18:04:42 +00:00
Justin Cormack
aace941bab Update base image
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-15 13:22:11 -08:00
Justin Cormack
ad87c3b93b Update alpine-base
Updates ca-certificates to 20161130

Includes the 20161102 updates see http://metadata.ftp-master.debian.org/changelogs/main/c/ca-certificates/ca-certificates_20161130_changelog

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-12 10:45:10 -08:00
Justin Cormack
933372e45a Run rngd inside a system container
- this needs an init as it does not respond to stop signals, so include tini
- needs CAP_SYS_ADMIN to write to kernel entropy estimate
- set kernel.random.write_wakeup_threshold so that rngd does not need sysctl write access
- build patches from Alpine, but statically linked
- remove rngd from base image, means we no longer need community repository

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-12-02 14:00:12 +00:00
Riyaz Faizullabhoy
4011d4842a Use digests instead of tags where possible
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-12-01 09:39:02 -08:00
Justin Cormack
8d3691fabb Containerize binfmt_misc
- statically make containerd symlinks so rootfs can be read only
- run binfmt_misc in a containerd container
- ship arm, aarch64, ppc64le qemu static versions that always "just work" as this is supported in Linux 4.8

fix #53

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-30 12:49:37 +00:00
Justin Cormack
2f0211b1e8 Disable rc swap script
We now do our own swap management in automount.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-29 15:31:12 +00:00
Justin Cormack
9dd0b21f61 Use the upstream binfmt script not out custom one
This makes the binfmt package much simpler, just a config file.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-28 13:53:14 +00:00
Justin Cormack
0a4b71edbe Use the procfs script to mount binfmt
This means our script does not need to do mount.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-28 12:17:23 +00:00
Justin Cormack
be56c8e68a Re-add strace
Trying to debug apk issues.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-25 17:26:34 +00:00
Justin Cormack
35c0bfe529 Make sure we do apk upgrade -a
Also base off 3.4 for consistency.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-24 21:07:00 +00:00
Justin Cormack
a984ddba27 Update Alpine 3.5 base image
- openrc updates
- SSL certs package no longer depends on openssl tool in libressl package.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-24 12:08:13 +00:00
Justin Cormack
20f6db11b3 Remove ssh server packages
These will be containerised, and were disabled anyway.

Need client, as git needs it, and docker needs git.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-21 21:47:10 +00:00
Justin Cormack
835a16d601 Update base image to Alpine 3.5-rc2
- switch to libressl
- hvtools in main

Note the build images are not switched over yet

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-21 20:30:33 +00:00
Justin Cormack
d2992691a1 Remove Alpine packages just used for debugging and build
- make, GNU tar only used for self hosting
- strace, ipvsadmin, openssl just for debug

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-21 20:15:37 +00:00
Justin Cormack
7730fa15ca Simplify file system format code
- use our own code rather than Alpine setup-disk
- remove alpine setup code as not needed
- do not create swap partitions
- create swap file on desktop editions for now (may remove)

Fix #619

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-21 18:35:13 +00:00
Justin Cormack
23415c038b Rework moving automount earlier in boot sequence
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-15 09:54:07 +00:00
Justin Cormack
b042b5127f Revert "Format filesystems earlier, before syslog"
This reverts commit 4dd5dca106.

Fix #710 where system hangs after klogd startup on AWS. Possibly
also affects Windows too. Still unclear why but lets revert and
continue investif=gating.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-12 15:29:27 +00:00
Justin Cormack
43d956c201 Update base image
- tar update

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 21:06:45 +00:00
Justin Cormack
e3169f68d7 Merge pull request #703 from justincormack/move-disk-format
Format filesystems earlier, before syslog
2016-11-08 15:30:53 +00:00
Justin Cormack
9a95224681 Format filesystems earlier, before syslog
So that we can write to /var early, move filesystem formatting as early as possible.

Adds a dummy fsck service, as we already do fsck in format script.

Replaces #535

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 15:20:46 +00:00
Justin Cormack
85fd9a96ae Remove lvm2 package
We have no lvm support, so not needed.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 10:48:44 +00:00
Justin Cormack
db3be17a84 Remove bind tools
We are not using these anywhere, busybox provides some of them.

Avoids security warnings.

Rework of #684

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 10:14:07 +00:00
Justin Cormack
dc8b40f0e1 Update base image
- bind update
- edge packages moved to 3.5

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-08 10:09:10 +00:00
Justin Cormack
218e345136 Curl security update
Upgrade to 7.51, fix the following CVEs

  CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616,
  CVE-2016-8617, CVE-2016-8618, CVE-2016-8619, CVE-2016-8620,
  CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-06 19:32:19 +00:00
Justin Cormack
e30acbc517 Merge pull request #670 from justincormack/ipvsadm
Add ipvsadm for debugging
2016-11-02 20:09:07 +00:00
Justin Cormack
fed22cee00 Split out Windows network config from hostsettings
On cloud editions eg AWS settings may come from the network, so
we need to move this to after network setup, while the Windows
network config changes need to happen before, so split the init script.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-02 14:49:24 +00:00
Justin Cormack
7c43ec4d01 Add ipvsadm for debugging
Fix #437

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-11-02 00:10:16 +00:00
Justin Cormack
e34c320abd Update base image with Musl bugfix
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-20 13:20:00 +01:00
Justin Cormack
0ac6beff82 Do not create latest tags for base images
As we never use these, do not create them.

Also update images where applicable.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-10 14:55:48 +01:00
Justin Cormack
0abcf36f2a Remove syslinux from base image
Only needed for build, so save space and avoid security scan errors.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-27 11:23:54 +01:00
Justin Cormack
c8da76aa02 openssl security update
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-27 10:15:50 +01:00
Justin Cormack
24042ad443 Update alpine-base
Seems insignificant, should probably improve hash function, as
ordering only visibly changed.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-26 00:27:24 +01:00
Justin Cormack
ff57ad7789 Merge pull request #531 from rneugeba/hvtools-out
remove special hack hvtools
2016-09-24 14:29:55 +01:00
Justin Cormack
07103e7e62 Switch to dhcpcd
Should fix issue with not sending hostname which Azure needs.

This should be requesting all the dhcp features we currently use.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-23 15:52:30 +01:00
Justin Cormack
af2bc73551 remove dhcpcd as was running anyway
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-23 13:34:17 +01:00
Rolf Neugebauer
fa0104c04c base: update manifest
Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
2016-09-23 11:11:07 +01:00
Justin Cormack
041da8cf1b Merge pull request #546 from rneugeba/if-clean
Clean up network interface
2016-09-23 10:41:15 +01:00
Rolf Neugebauer
803be36b96 net: consolidate DHCP onto eth0 only
- rename DfW main interface eth0
- remove eth1 DHCP config
- create tap device in init script not interfaces file

Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
2016-09-22 18:12:45 +01:00
Justin Cormack
a62f4ce7dd Update base image
- fix `df` failing with overlay
- four more openssl CVEs
- add dhcpcd (unused)
- add openssh server (unused)

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-09-22 16:42:06 +01:00