From 65d170985ce8de36d7ff4c94e77686cdb3a9a2a1 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Wed, 17 May 2023 17:34:28 +0200 Subject: [PATCH] package/podman: new package Podman (POD manager) is an open source tool for developing, managing, and running containers on your Linux systems. Based on work by Christian Stewart and Nathaniel Husted. Signed-off-by: Joachim Wiberg --- .../rootfs/etc/containers/registries.conf | 77 +++++++++++ .../registries.conf.d/shortnames.conf | 78 +++++++++++ .../rootfs/etc/profile.d/convenience.sh | 2 + package/Config.in | 1 + package/podman/Config.in | 56 ++++++++ package/podman/containers-policy.json | 14 ++ package/podman/podman.hash | 3 + package/podman/podman.mk | 130 ++++++++++++++++++ package/podman/unconfined.conf | 2 + 9 files changed, 363 insertions(+) create mode 100644 board/common/rootfs/etc/containers/registries.conf create mode 100644 board/common/rootfs/etc/containers/registries.conf.d/shortnames.conf create mode 100644 package/podman/Config.in create mode 100644 package/podman/containers-policy.json create mode 100644 package/podman/podman.hash create mode 100644 package/podman/podman.mk create mode 100644 package/podman/unconfined.conf diff --git a/board/common/rootfs/etc/containers/registries.conf b/board/common/rootfs/etc/containers/registries.conf new file mode 100644 index 00000000..d85befbf --- /dev/null +++ b/board/common/rootfs/etc/containers/registries.conf @@ -0,0 +1,77 @@ +# For more information on this configuration file, see containers-registries.conf(5). +# +# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES +# We recommend always using fully qualified image names including the registry +# server (full dns name), namespace, image name, and tag +# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e., +# quay.io/repository/name@digest) further eliminates the ambiguity of tags. +# When using short names, there is always an inherent risk that the image being +# pulled could be spoofed. For example, a user wants to pull an image named +# `foobar` from a registry and expects it to come from myregistry.com. If +# myregistry.com is not first in the search list, an attacker could place a +# different `foobar` image at a registry earlier in the search list. The user +# would accidentally pull and run the attacker's image and code rather than the +# intended content. We recommend only adding registries which are completely +# trusted (i.e., registries which don't allow unknown or anonymous users to +# create accounts with arbitrary names). This will prevent an image from being +# spoofed, squatted or otherwise made insecure. If it is necessary to use one +# of these registries, it should be added at the end of the list. +# +# # An array of host[:port] registries to try when pulling an unqualified image, in order. +# unqualified-search-registries = ["example.com"] +# +# [[registry]] +# # The "prefix" field is used to choose the relevant [[registry]] TOML table; +# # (only) the TOML table with the longest match for the input image name +# # (taking into account namespace/repo/tag/digest separators) is used. +# # +# # The prefix can also be of the form: *.example.com for wildcard subdomain +# # matching. +# # +# # If the prefix field is missing, it defaults to be the same as the "location" field. +# prefix = "example.com/foo" +# +# # If true, unencrypted HTTP as well as TLS connections with untrusted +# # certificates are allowed. +# insecure = false +# +# # If true, pulling images with matching names is forbidden. +# blocked = false +# +# # The physical location of the "prefix"-rooted namespace. +# # +# # By default, this is equal to "prefix" (in which case "prefix" can be omitted +# # and the [[registry]] TOML table can only specify "location"). +# # +# # Example: Given +# # prefix = "example.com/foo" +# # location = "internal-registry-for-example.net/bar" +# # requests for the image example.com/foo/myimage:latest will actually work with the +# # internal-registry-for-example.net/bar/myimage:latest image. +# +# # The location can be empty iff prefix is in a +# # wildcarded format: "*.example.com". In this case, the input reference will +# # be used as-is without any rewrite. +# location = internal-registry-for-example.com/bar" +# +# # (Possibly-partial) mirrors for the "prefix"-rooted namespace. +# # +# # The mirrors are attempted in the specified order; the first one that can be +# # contacted and contains the image will be used (and if none of the mirrors contains the image, +# # the primary location specified by the "registry.location" field, or using the unmodified +# # user-specified reference, is tried last). +# # +# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics +# # as if specified in the [[registry]] TOML table directly: +# # - location +# # - insecure +# [[registry.mirror]] +# location = "example-mirror-0.local/mirror-for-foo" +# [[registry.mirror]] +# location = "example-mirror-1.local/mirrors/foo" +# insecure = true +# # Given the above, a pull of example.com/foo/image:latest will try: +# # 1. example-mirror-0.local/mirror-for-foo/image:latest +# # 2. example-mirror-1.local/mirrors/foo/image:latest +# # 3. internal-registry-for-example.net/bar/image:latest +# # in order, and use the first one that exists. diff --git a/board/common/rootfs/etc/containers/registries.conf.d/shortnames.conf b/board/common/rootfs/etc/containers/registries.conf.d/shortnames.conf new file mode 100644 index 00000000..80df6f09 --- /dev/null +++ b/board/common/rootfs/etc/containers/registries.conf.d/shortnames.conf @@ -0,0 +1,78 @@ +[aliases] + # almalinux + "almalinux" = "docker.io/library/almalinux" + "almalinux-minimal" = "docker.io/library/almalinux-minimal" + # centos + "centos" = "quay.io/centos/centos" + # containers + "skopeo" = "quay.io/skopeo/stable" + "buildah" = "quay.io/buildah/stable" + "podman" = "quay.io/podman/stable" + # docker + "alpine" = "docker.io/library/alpine" + "docker" = "docker.io/library/docker" + "registry" = "docker.io/library/registry" + "hello-world" = "docker.io/library/hello-world" + "swarm" = "docker.io/library/swarm" + # Fedora + "fedora-minimal" = "registry.fedoraproject.org/fedora-minimal" + "fedora" = "registry.fedoraproject.org/fedora" + # openSUSE + "opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed" + "opensuse/tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf" + "opensuse/tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf" + "opensuse/leap" = "registry.opensuse.org/opensuse/leap" + "opensuse/busybox" = "registry.opensuse.org/opensuse/busybox" + "tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed" + "tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf" + "tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf" + "leap" = "registry.opensuse.org/opensuse/leap" + "leap-dnf" = "registry.opensuse.org/opensuse/leap-dnf" + "leap-microdnf" = "registry.opensuse.org/opensuse/leap-microdnf" + "tw-busybox" = "registry.opensuse.org/opensuse/busybox" + # SUSE + "suse/sle15" = "registry.suse.com/suse/sle15" + "suse/sles12sp5" = "registry.suse.com/suse/sles12sp5" + "suse/sles12sp4" = "registry.suse.com/suse/sles12sp4" + "suse/sles12sp3" = "registry.suse.com/suse/sles12sp3" + "sle15" = "registry.suse.com/suse/sle15" + "sles12sp5" = "registry.suse.com/suse/sles12sp5" + "sles12sp4" = "registry.suse.com/suse/sles12sp4" + "sles12sp3" = "registry.suse.com/suse/sles12sp3" + # Red Hat Enterprise Linux + "rhel" = "registry.access.redhat.com/rhel" + "rhel6" = "registry.access.redhat.com/rhel6" + "rhel7" = "registry.access.redhat.com/rhel7" + "ubi7" = "registry.access.redhat.com/ubi7" + "ubi7-init" = "registry.access.redhat.com/ubi7-init" + "ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal" + "ubi8" = "registry.access.redhat.com/ubi8" + "ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal" + "ubi8-init" = "registry.access.redhat.com/ubi8-init" + "ubi8-micro" = "registry.access.redhat.com/ubi8-micro" + "ubi8/ubi" = "registry.access.redhat.com/ubi8/ubi" + "ubi8/ubi-minimal" = "registry.access.redhat.com/ubi8-minimal" + "ubi8/ubi-init" = "registry.access.redhat.com/ubi8-init" + "ubi8/ubi-micro" = "registry.access.redhat.com/ubi8-micro" + # Rocky Linux + "rockylinux" = "docker.io/library/rockylinux" + # Debian + "debian" = "docker.io/library/debian" + # Kali Linux + "kali-bleeding-edge" = "docker.io/kalilinux/kali-bleeding-edge" + "kali-dev" = "docker.io/kalilinux/kali-dev" + "kali-experimental" = "docker.io/kalilinux/kali-experimental" + "kali-last-release" = "docker.io/kalilinux/kali-last-release" + "kali-rolling" = "docker.io/kalilinux/kali-rolling" + # Ubuntu + "ubuntu" = "docker.io/library/ubuntu" + # Oracle Linux + "oraclelinux" = "container-registry.oracle.com/os/oraclelinux" + # busybox + "busybox" = "docker.io/library/busybox" + # php + "php" = "docker.io/library/php" + # python + "python" = "docker.io/library/python" + # node + "node" = "docker.io/library/node" diff --git a/board/common/rootfs/etc/profile.d/convenience.sh b/board/common/rootfs/etc/profile.d/convenience.sh index 72509b17..445e2409 100644 --- a/board/common/rootfs/etc/profile.d/convenience.sh +++ b/board/common/rootfs/etc/profile.d/convenience.sh @@ -16,3 +16,5 @@ alias ipaddr='ip addr' alias iplink='ip link' alias bridge='bridge --color=auto' alias cli='klish' + +alias docker=podman diff --git a/package/Config.in b/package/Config.in index 8d84e0b0..5ecd4dad 100644 --- a/package/Config.in +++ b/package/Config.in @@ -11,6 +11,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/mdnsd/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/net/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/osal/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/p-net/Config.in" +source "$BR2_EXTERNAL_INFIX_PATH/package/podman/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/profeth/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in" source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in" diff --git a/package/podman/Config.in b/package/podman/Config.in new file mode 100644 index 00000000..5f291d96 --- /dev/null +++ b/package/podman/Config.in @@ -0,0 +1,56 @@ +config BR2_PACKAGE_PODMAN + bool "podman" + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_TOOLCHAIN_HAS_THREADS + depends on !BR2_TOOLCHAIN_USES_UCLIBC # no fexecve + depends on BR2_USE_MMU # libgpgme + select BR2_PACKAGE_CRUN # runtime dependency + select BR2_PACKAGE_CONMON # runtime dependency + select BR2_PACKAGE_CNI_PLUGINS # runtime dependency + select BR2_PACKAGE_BRIDGE_UTILS # Required for container networking + select BR2_PACKAGE_IPTABLES # Required for container network + select BR2_PACKAGE_CGROUPFS_MOUNT if !BR2_PACKAGE_SYSTEMD # runtime dependency + select BR2_PACKAGE_CA_CERTIFICATES # Required for the podman pull command via https + select BR2_PACKAGE_LIBGPGME + help + podman is a CLI tool for spawning and running containers + according to the OCI specification. + + https://github.com/containers/podman + +if BR2_PACKAGE_PODMAN + +config BR2_PACKAGE_PODMAN_DRIVER_BTRFS + bool "btrfs filesystem driver" + depends on BR2_USE_MMU # btrfs-progs + depends on BR2_TOOLCHAIN_HAS_THREADS # btrfs-progs + select BR2_PACKAGE_BTRFS_PROGS + help + Build the btrfs filesystem driver. + +config BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER + bool "devicemapper filesystem driver" + depends on BR2_TOOLCHAIN_HAS_THREADS # lvm2 + depends on BR2_USE_MMU # lvm2 + depends on !BR2_STATIC_LIBS # lvm2 + select BR2_PACKAGE_LVM2 + help + Build the devicemapper filesystem driver. + +config BR2_PACKAGE_PODMAN_DRIVER_VFS + bool "vfs filesystem driver" + depends on BR2_USE_WCHAR # gvfs + depends on BR2_USE_MMU # gvfs + depends on BR2_TOOLCHAIN_HAS_THREADS # gvfs + depends on !BR2_STATIC_LIBS # gvfs + select BR2_PACKAGE_GVFS + help + Build the vfs filesystem driver. + +endif + +comment "podman needs a glibc or musl toolchain w/ threads" + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS && \ + BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_TOOLCHAIN_USES_UCLIBC diff --git a/package/podman/containers-policy.json b/package/podman/containers-policy.json new file mode 100644 index 00000000..4480eb82 --- /dev/null +++ b/package/podman/containers-policy.json @@ -0,0 +1,14 @@ +{ + "default": [ + { + "type": "insecureAcceptAnything" + } + ], + "transports": + { + "docker-daemon": + { + "": [{"type":"insecureAcceptAnything"}] + } + } +} diff --git a/package/podman/podman.hash b/package/podman/podman.hash new file mode 100644 index 00000000..c0110686 --- /dev/null +++ b/package/podman/podman.hash @@ -0,0 +1,3 @@ +# Locally computed +sha256 830a633630bf6e61f2b8d4ca00efdd9a173ef25cdd49d4a4364c293e088561df podman-4.5.0.tar.gz +sha256 62fb8a3a9621dc2388174caaabe9c2317b694bb9a1d46c98bcf5655b68f51be3 LICENSE diff --git a/package/podman/podman.mk b/package/podman/podman.mk new file mode 100644 index 00000000..b29f502c --- /dev/null +++ b/package/podman/podman.mk @@ -0,0 +1,130 @@ +################################################################################ +# +# podman +# +################################################################################ + +PODMAN_VERSION = 4.5.0 +PODMAN_SITE = $(call github,containers,podman,v$(PODMAN_VERSION)) +PODMAN_LICENSE = Apache-2.0 +PODMAN_LICENSE_FILES = LICENSE + +PODMAN_CPE_ID_VENDOR = podman_project +PODMAN_GOMOD = github.com/containers/podman/v4 + +PODMAN_BUILD_TARGETS = cmd/podman cmd/rootlessport cmd/quadlet +PODMAN_DEPENDENCIES += libgpgme +PODMAN_LDFLAGS = \ + -X $(PODMAN_GOMOD)/libpod/define.gitCommit=$(PODMAN_VERSION) +PODMAN_TAGS = \ + btrfs_noversion containers_image_openpgp \ + exclude_graphdriver_devicemapper exclude_graphdriver_zfs + +ifeq ($(BR2_INIT_SYSTEMD),y) +PODMAN_TAGS += systemd +endif + +ifeq ($(BR2_PACKAGE_LIBAPPARMOR),y) +PODMAN_DEPENDENCIES += libapparmor +PODMAN_TAGS += apparmor +endif + +ifeq ($(BR2_PACKAGE_LIBSECCOMP),y) +PODMAN_TAGS += seccomp +PODMAN_DEPENDENCIES += libseccomp host-pkgconf +else +define PODMAN_SECCOMP_PROFILE + $(INSTALL) -D -m 644 $(PODMAN_PKGDIR)/unconfined.conf \ + $(TARGET_DIR)/etc/containers/containers.conf +endef +endif + +ifeq ($(BR2_PACKAGE_LIBSELINUX),y) +PODMAN_TAGS += selinux +PODMAN_DEPENDENCIES += libselinux +endif + +ifeq ($(BR2_PACKAGE_PODMAN_DRIVER_BTRFS),y) +PODMAN_DEPENDENCIES += btrfs-progs +define PODMAN_BTFRS_DRIVER_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_BTRFS_FS) + $(call KCONFIG_ENABLE_OPT,CONFIG_BTRFS_FS_POSIX_ACL) +endef +else +PODMAN_TAGS += exclude_graphdriver_btrfs +endif + +ifeq ($(BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER),y) +PODMAN_DEPENDENCIES += lvm2 +define PODMAN_DEVICEMAPPER_DRIVER_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_MD) + $(call KCONFIG_ENABLE_OPT,CONFIG_BLK_DEV_DM) + $(call KCONFIG_ENABLE_OPT,CONFIG_MD_THIN_PROVISIONING) +endef +else +PODMAN_TAGS += exclude_graphdriver_devicemapper +endif + +ifeq ($(BR2_PACKAGE_PODMAN_DRIVER_VFS),y) +PODMAN_DEPENDENCIES += gvfs +else +PODMAN_TAGS += exclude_graphdriver_vfs +endif + +define PODMAN_INSTALL_TARGET_CMDS + $(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) PREFIX=/usr \ + install.bin + $(INSTALL) -d -m 700 $(TARGET_DIR)/etc/cni + $(INSTALL) -d -m 700 $(TARGET_DIR)/etc/cni/net.d + $(INSTALL) -D -m 644 $(@D)/cni/87-podman-bridge.conflist \ + $(TARGET_DIR)/etc/cni/net.d/87-podman-bridge.conflist + $(INSTALL) -d -m 755 $(TARGET_DIR)/etc/containers + $(INSTALL) -D -m 644 $(PODMAN_PKGDIR)/containers-policy.json \ + $(TARGET_DIR)/etc/containers/policy.json + $(PODMAN_SECCOMP_PROFILE) +endef + +define PODMAN_INSTALL_INIT_SYSTEMD + $(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) PREFIX=/usr \ + install.systemd +endef + +define PODMAN_LINUX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_MEMCG) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUPS) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_SCHED) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_FREEZER) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_DEVICE) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_CPUACCT) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_PIDS) + $(call KCONFIG_ENABLE_OPT,CONFIG_CPUSETS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NAMESPACES) + $(call KCONFIG_ENABLE_OPT,CONFIG_UTS_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_IPC_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_PID_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NET_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_ADVANCED) + $(call KCONFIG_ENABLE_OPT,CONFIG_BRIDGE_NETFILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_NF_CONNTRACK) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_ADDRTYPE) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_CONNTRACK) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_IPVS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_COMMENT) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_NAT) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_TARGET_MASQUERADE) + $(call KCONFIG_ENABLE_OPT,CONFIG_BRIDGE) + $(call KCONFIG_ENABLE_OPT,CONFIG_NET_CORE) + $(call KCONFIG_ENABLE_OPT,CONFIG_VETH) + $(call KCONFIG_ENABLE_OPT,CONFIG_KEYS) + $(call KCONFIG_ENABLE_OPT,CONFIG_POSIX_MQUEUE) + $(call KCONFIG_ENABLE_OPT,CONFIG_OVERLAY_FS) + $(PODMAN_BTFRS_DRIVER_CONFIG_FIXUPS) + $(PODMAN_DEVICEMAPPER_DRIVER_CONFIG_FIXUPS) +endef + +$(eval $(golang-package)) diff --git a/package/podman/unconfined.conf b/package/podman/unconfined.conf new file mode 100644 index 00000000..8171e9ea --- /dev/null +++ b/package/podman/unconfined.conf @@ -0,0 +1,2 @@ +[containers] +seccomp_profile = "unconfined"