Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds a landing page, generated from the top README.md. It
is a temporary fix before adding a proper web ui.
Run ./gen.sh from the directory to update index.html using the template.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On any change to a container network interface we should schedule a
restart of the container to activate the changes. This code triggers
also at boot, when applying the whole startup-config, which initctl
handles by queuing any create/touch events for services.
This patch depends on the two previous commtis backporing fixes to
Finit's initctl tool and an upgrade of the k8s-logger.
Fixes#375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, log the actual `podman create` arguments to the container log so
we can see what the script actually does when customers report bizarre
happenings with containers.
Fixes#370
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds limited support for container capabilities. It allows
a more fine-grained control than priviliged mode does.
Fixes#365
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add exception for local images, the "pull" step must be handled by the
operator, i.e., wget of the latest image to the same location as set up
in the image configuration, e.g., for oci-archive:/tmp/foo.tar.gz that
/tmp/foo.tar.gz exists when issuing the upgrade command.
Fixes#368
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Because sysrepo callbacks are threaded and factory-default RPC is called
from a separate subscription (to prevent blocking), we cannot prevent
ietf-intefaces.c from being called before infix-containers.c, regardless
of the priority we set for our subscriptions.
When assigning a physical network interface this becomes a bit of a pain
during factory-default RPC since the physical interface is hidden from
the host network namespace.
So, when applying factory to running, we check each interface if it was
a container-network previously, if so we call on the container script in
the exit of the current dagger generation to move the interface back to
the host netns.
This affects all other functions that assume interfaces only live in the
host netns. To that end a set of new helper functions have been added
to wrap iproute2 commands in nsenter when the interface lives elsewhere.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. add support for extracting, and finding the directory holding the
index.json metadata file in, OCI images. An archive in Infix is either
a .tar or .tar.gz archive, which we need to unpack for this version of
podman to be able to load them.
2. new RPC '/infix-containers:oci-load' calls 'container load' of an
OCI archive (tarball), optionally gzipped. The resulting image uses
the directory name of the unpacked tarball, so the container script
offers a way to retag the image after loading it.
First class citizens in container transport are docker:// and the OCI
family of URI:s. A docker:// URL, or a local docker-archive:path, is
assumed to be well formed, in which case we leave it up to podman to
handle.
Note: 'podman import' does not fully understand OCI formats. It drops
ENTRYPOINT and COMMAND, while 'podman load' handles things a lot
better. Only letdown is it does not support nameing the image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- drop debug logs
- no need to restart upgraded containers, they restart automatically
- fix ordering in volume prune (when containers are removed)
- skip directories in container activation (inbox -> execd queue)
- Fix 'container pull IMG creds USER[:PASS]' bug, extra '=' variable
assignment inside infix.xml
- Fix 'container run IMG CMD ARGS' to actually put the CMD in
ENTRYPOINT and append ARGS to image. The podman run and create
commands are *not* behaving the same way
- Rename 'attach' to 'exec', execute command inside an running container
- Add 'container [shell | connect]' to start shell in -- " -- " -- " --
- Add 'container [stat | cleanup | usage stats]' commands
- Add in="tty" to commands thay may end up being interactive
- Split <ACTION> line into multiple lines for readability
- Fix container shift logic:
root@infix-00-00-00:/> show container
/usr/sbin/container: line 361: shift: shift count out of range
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the container configuration context:
edit file ntp.conf
set path /etc/ntp.conf
set content
The last command opens a text editor where you can paste the contents
of the file. This is stored base64 encoded in the datastore as well
as in JSON/XML.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new CLI command 'container upgrade foo', where 'foo'
is the name of the container. If more than one container use the same
image, multiple upgrades must be done because a container runs not on
the 'image:tag' but on the hash of the 'image:tag' it was created from.
Rename "done" queue to "active", since we want to recreate an active
container after fetching an updated base image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for writable container volumes. A volume, when
compared to a mount, is a writable directory created when the container
starts and is automatically rsync'ed with the underlying directory it
is mounted on on first use. A mount otoh does not rsync so it results
only in an empty directory inside the container.
The podman/docker mount feature will be used later to bind mount single
files or sharing directories from the host, e.g., /sys/class/leds/ to
one of more containers.
Note: unused volumes are automatically pruned. Hence, a volume
currently cannot be moved to another container.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This was a tough nut to crack. Turns out the trick to changing the
ENTRYPOINT is to set --entrypoint=command and then call 'podman create
... command args'. Not entirely obvious since the documented approach
is to use a JSON array as the argument: podman create
--entrypoint='["command", "args" ]'.
Admittedly, encoding this in C to transfer it via a POSIX shell script
to the command line, is not the easiest task I've undertaken. So I gave
up and found this workaround.
Worth noting, however, is that one *must* set `--entrypoint`, it is not
enough to just append the command to the 'podman create' command line.
Due to differences in docker and podman, we cannot supply the full args
to an alternate entrypoint command. But for the command to actually run
we need to override the image's ENTRYPOINT and send the command and args
as the last arguments on the command line to podman create.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, ensure the deleted container is actually deleted before recreating
it with a new configuration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds 'manual:yes' to the container's Finit service
configuration and changes from pod: to container: prefix for a
unique namespace to prevent collision with regular services.
The prefix container: is more correct that pod:, which should
be reserved for any future pod support.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
confd: fix missing variable in container script condition
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should be the last outstanding issue to fix#278. Please note,
it is undefined what happens if you have two DHCP clients that request
hostname, and changing hostname from NETCONF at runtime will overwrite
any hostname set by the DHCP client.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New log() function replaces stdout logging
- New set_dhcp_routes() and clr_dhcp_routes() functions
- Set all option 121 routes with same metric
- Set all option 3 routers with increasing metric (this is what the
reference udhcpc scripts do, and RFC says the routers should be
listed in order of preference ...)
- Clearing routes must, like IP addresses, be done both by interface
and protocol. This refactor makes sure to delete any DHCP routes
set on the given interface (in case options change)
- Use resolvconf per-interface search+nameserver
- Cache IP lease so we can ask for it back later
- On deconfig|leasefail|nak, make sure to clean up anything that might
be lingering from this interface. E.g., we can get leasefail when a
server denies our request to prolong a lease.
- On renew|bound, refresh routes, and set search+dns + NTP servers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Flush addresses during shutdown and renewal with new address.
This is kind of a hack and needs further testing.
Signed-off-by: Richard Alpe <richard@bit42.se>
This fixes one bug in Infix, namely that dhcp removes all other
statically configured addresses. However it introduces a new one
where dhcp renewals with new ip addresses are added as "duplicates",
we fix this in a later commit in this patchset.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine version of default.script to our local board override.
The reason for this commit is to track changes we do to it.
Signed-off-by: Richard Alpe <richard@bit42.se>
This reverts an earlier change where nano was made the default editor in
a misguided attemt by yours truly to accomodate beginner users.
With the recent improvements of the CLI and the fact that the NETCONF
support has matured greatly, the need for a user-friendly editor have
diminished drastically. Editing system files is now limited to devs
and the core team prefers Mg over nano and vi.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The nano editor has been shown, over and over again, to be more
user-friendly to complete UNIX/Linux beginners than even Mg.
Also, change the default pager/less to be less (again), it was
very confusing to have less be most and more just be more. We
recommend scripts to use pager and edit/editor to call system
safe defaults.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Various scripts and tools search for the ip command in different
places. Most distros install it to /bin/ip and symlink to /sbin
and /usr dito, but Buildroot only installs to /sbin/ip
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
