github/linuxkit
1
0
Fork 0
mirror of https://github.com/linuxkit/linuxkit.git synced 2025-07-19 09:16:29 +00:00
Code Issues Projects Releases Wiki Activity
A toolkit for building secure, portable and lean operating systems for containers
7,650 Commits 1 Branch 27 Tags 240 MiB
Go 47.8%
text 21.7%
Shell 13.7%
Dockerfile 5.8%
OCaml 4.7%
Other 6.3%
5020612534
Go to file
Sebastiaan van Stijn 5020612534
rc.init: fix mkchar not setting correct filemode 
Commit bcfb760a1d rewrote the init from a shell
script to a go implementation. However, unlike `mknod`, the active umask is
applied when using Go's unix.Mknod().

This patch:

- sets the correct mode when calling unix.Mknod()
- temporarily overrides the umask during doMounts()

Steps I used to reproduce the original issue, and to verify the changes in this
patch (tried inside a container):

    docker run -it --rm -w /app golang bash

    cat > mknod.go <<'EOF'
    package main

    import (
        "log"

        "golang.org/x/sys/unix"
    )

    func main() {
        mkchar("/dev/null2", 0666, 1, 3)

        umask := unix.Umask(0000)
        defer unix.Umask(umask)
        mkchar2("/dev/null3", 0666, 1, 3)
    }

    // make a character device
    func mkchar(path string, mode, major, minor uint32) {
        // unix.Mknod only supports int dev numbers; this is ok for us
        dev := int(unix.Mkdev(major, minor))
        err := unix.Mknod(path, mode, dev)
        if err != nil {
            if err.Error() == "file exists" {
                return
            }
            log.Printf("error making device %s: %v", path, err)
        }
    }

    // make a character device
    func mkchar2(path string, mode, major, minor uint32) {
        // unix.Mknod only supports int dev numbers; this is ok for us
        dev := int(unix.Mkdev(major, minor))
        err := unix.Mknod(path, mode|unix.S_IFCHR, dev)
        if err != nil {
            if err.Error() == "file exists" {
                return
            }
            log.Printf("error making device %s: %v", path, err)
        }
    }
    EOF

Initialize module and fetch dependencies:

    go mod init foo && go mod tidy

Check active umask:

    umask
    0022

Run the test code:

    go run mknod.go

Check the results:

    ls -la /dev/null*
    crw-rw-rw- 1 root root 1, 3 Apr 13 11:45 /dev/null
    -rw-r--r-- 1 root root    0 Apr 13 11:45 /dev/null2
    crw-rw-rw- 1 root root 1, 3 Apr 13 11:45 /dev/null3

Notice that:

- `/dev/null2` (before) was created with active umask (`0022`) applied, and did not create a character device
- `/dev/null3` (after) has both the correct (0666) permissions and mode

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-04-13 16:14:09 +02:00
.github ci: Fix multi-arch builds 2021-04-04 10:46:07 +01:00
contrib contrib: add control-plane toleration for open-vm-tools 2020-12-22 22:25:58 +01:00
docs build: Update go-compile package 2021-04-02 18:45:38 +01:00
examples Merge pull request #3539 from djs55/trim-after-delete-container 2021-04-05 13:21:02 +01:00
kernel Merge pull request #3606 from qarnot/up-intel-microcode-20210216 2021-04-02 18:08:19 +01:00
logo
pkg rc.init: fix mkchar not setting correct filemode 2021-04-13 16:14:09 +02:00
projects Remove Notary and Content Trust 2021-03-30 14:51:11 +01:00
reports
scripts Remove Notary and Content Trust 2021-03-30 14:51:11 +01:00
sigs
src/cmd/linuxkit Remove Notary and Content Trust 2021-03-30 14:51:11 +01:00
test Remove Notary and Content Trust 2021-03-30 14:51:11 +01:00
tools gp-compile: Use '-mod=vendor' when using go modules 2021-04-02 18:45:38 +01:00
.gitattributes
.gitignore
.mailmap
ADOPTERS.md
AUTHORS
CHANGELOG.md Update Changelog to what was posted on release page 2020-07-27 09:06:43 +01:00
CONTRIBUTING.md
LICENSE
linuxkit.yml update to linuxkit/containerd:1ae8f054e9fe792d1dbdb9a65f1b5e14491cb106 2021-01-18 16:54:37 +03:00
MAINTAINERS
Makefile build: Bump rtf to latest 2021-04-05 11:19:42 +01:00
NOTICE
poule.yml
README.md README: Don't go get 2021-04-03 11:30:09 +01:00

README.md

LinuxKit

CircleCI

LinuxKit, a toolkit for building custom minimal, immutable Linux distributions.

  • Secure defaults without compromising usability
  • Everything is replaceable and customisable
  • Immutable infrastructure applied to building Linux distributions
  • Completely stateless, but persistent storage can be attached
  • Easy tooling, with easy iteration
  • Built with containers, for running containers
  • Designed to create reproducible builds [WIP]
  • Designed for building and running clustered applications, including but not limited to container orchestration such as Docker or Kubernetes
  • Designed from the experience of building Docker Editions, but redesigned as a general-purpose toolkit
  • Designed to be managed by external tooling, such as Infrakit (renamed to deploykit which has been archived in 2019) or similar tools
  • Includes a set of longer-term collaborative projects in various stages of development to innovate on kernel and userspace changes, particularly around security

LinuxKit currently supports the x86_64, arm64, and s390x architectures on a variety of platforms, both as virtual machines and baremetal (see below for details).

Subprojects

  • LinuxKit kubernetes aims to build minimal and immutable Kubernetes images. (previously projects/kubernetes in this repository).
  • LinuxKit LCOW LinuxKit images and utilities for Microsoft's Linux Containers on Windows.
  • linux A copy of the Linux stable tree with branches LinuxKit kernels.
  • virtsock A go library and test utilities for virtio and Hyper-V sockets.
  • rtf A regression test framework used for the LinuxKit CI tests (and other projects).
  • homebrew Homebrew packages for the linuxkit tool.

Getting Started

Build the linuxkit tool

LinuxKit uses the linuxkit tool for building, pushing and running VM images.

Simple build instructions: use make to build. This will build the tool in bin/. Add this to your PATH or copy it to somewhere in your PATH eg sudo cp bin/* /usr/local/bin/. Or you can use sudo make install.

If you already have go installed you can use go install github.com/linuxkit/linuxkit/src/cmd/linuxkit@latest to install the linuxkit tool.

On MacOS there is a brew tap available. Detailed instructions are at linuxkit/homebrew-linuxkit, the short summary is

brew tap linuxkit/linuxkit
brew install --HEAD linuxkit

Build requirements from source using a container

  • GNU make
  • Docker
  • optionally qemu

For a local build using make local

  • go
  • make
  • go get -u golang.org/x/lint/golint
  • go get -u github.com/gordonklaus/ineffassign

Building images

Once you have built the tool, use

linuxkit build linuxkit.yml

to build the example configuration. You can also specify different output formats, eg linuxkit build -format raw-bios linuxkit.yml to output a raw BIOS bootable disk image, or linuxkit build -format iso-efi linuxkit.yml to output an EFI bootable ISO image. See linuxkit build -help for more information.

Booting and Testing

You can use linuxkit run <name> or linuxkit run <name>.<format> to execute the image you created with linuxkit build <name>.yml. This will use a suitable backend for your platform or you can choose one, for example VMWare. See linuxkit run --help.

Currently supported platforms are:

Running the Tests

The test suite uses rtf To install this you should use make bin/rtf && make install. You will also need to install expect on your system as some tests use it.

To run the test suite:

cd test
rtf -v run -x

This will run the tests and put the results in a the _results directory!

Run control is handled using labels and with pattern matching. To run add a label you may use:

rtf -v -l slow run -x

To run tests that match the pattern linuxkit.examples you would use the following command:

rtf -v run -x linuxkit.examples

Building your own customised image

To customise, copy or modify the linuxkit.yml to your own file.yml or use one of the examples and then run linuxkit build file.yml to generate its specified output. You can run the output with linuxkit run file.

The yaml file specifies a kernel and base init system, a set of containers that are built into the generated image and started at boot time. You can specify the type of artifact to build eg linuxkit build -format vhd linuxkit.yml.

If you want to build your own packages, see this document.

Yaml Specification

The yaml format specifies the image to be built:

  • kernel specifies a kernel Docker image, containing a kernel and a filesystem tarball, eg containing modules. The example kernels are built from kernel/
  • init is the base init process Docker image, which is unpacked as the base system, containing init, containerd, runc and a few tools. Built from pkg/init/
  • onboot are the system containers, executed sequentially in order. They should terminate quickly when done.
  • services is the system services, which normally run for the whole time the system is up
  • files are additional files to add to the image

For a more detailed overview of the options see yaml documentation

Architecture and security

There is an overview of the architecture covering how the system works.

There is an overview of the security considerations and direction covering the security design of the system.

Roadmap

This project was extensively reworked from the code we are shipping in Docker Editions, and the result is not yet production quality. The plan is to return to production quality during Q3 2017, and rebase the Docker Editions on this open source project during this quarter. We plan to start making stable releases on this timescale.

This is an open project without fixed judgements, open to the community to set the direction. The guiding principles are:

  • Security informs design
  • Infrastructure as code: immutable, manageable with code
  • Sensible, secure, and well-tested defaults
  • An open, pluggable platform for diverse use cases
  • Easy to use and participate in the project
  • Built with containers, for portability and reproducibility
  • Run with system containers, for isolation and extensibility
  • A base for robust products

Development reports

There are monthly development reports summarising the work carried out each month.

Adopters

We maintain an incomplete list of adopters. Please open a PR if you are using LinuxKit in production or in your project, or both.

FAQ

See FAQ.

Released under the Apache 2.0 license.