The rauc event logger is a separate glib logger that by default logs to
the system console, with annoying ANSI escape sequences. This commit
drops the default stdout/stderr redirect of these log messages and adds
a more exhaustive bundle install and event log, in json format, instead.
For more information about event logging, see the rauc documentation:
https://rauc.readthedocs.io/en/latest/advanced.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- cli: add '-r' to log/pager/follow for "raw" control chars, including unicode
- sysklogd: backport unicode fix for em-dash character (—) in slogan
- sysklogd: drop old patches
- sysklogd: run in 8-bit safe mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add HISTCONTROL=ignoreboth to ignore duplicate commands and those
starting with space, enable histappend, and improve tab completion
behavior. Also add /etc/inputrc for better readline key bindings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
From the documentation:
> 'podman image prune' removes all dangling images from local storage.
> With the all option, all unused images are deleted (i.e., images not
> in use by any container).
>
> The image prune command does not prune cache images that only use
> layers that are necessary for other images.
So, when the container script is called in the cleanup phase of the
lifetime of a container, we can use the '--all' option to ensure we also
remove this container's loaded image. In the case this happens before
a reboot of the system, there will be no old version of the image loaded
to /var/lib/containers after boot.
Issue #1098
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Previously, upgrading Podman containers with the same tag left
behind dangling images, causing overlay storage to grow and fill
disk space.
This change ensures dangling images are cleaned up using
podman image prune. The command is run without -a, so only
unreferenced images are removed. This provides safe cleanup while
preventing unnecessary overlay growth.
Fixes#1098
Signed-off-by: Richard Alpe <richard@bit42.se>
This since the feature is called 'wifi' in Infix, this makes the naming
consistent over the system.
Also trigger start of a wpa_supplicant, for scanning in the background.
The scanning results is available operational.
The reason for this is:
1) We want to use the same fetch tool for all operational data, to
avoid having duplicated xpaths scattered across the repo.
2) We want to call this directly from the CLI, which means it need to
be escape safe. A unprivileged user shall be able to use it but not
escape into a shell or do other malicious stuff.
Signed-off-by: Richard Alpe <richard@bit42.se>
There's several reasons for this. The main reason is that it was
developed as an intermediate way of getting system information when
the operational datastore was almost empty. There's not a lot of data
available in the operational datastore and we shall rely on that data
primarily. This command isn't safe to run from a jailed CLI as i
doesn't validate input and run commands directly in the shell, making
it hard to protect against a CLI jail break.
In upcoming patches we will introduce a new show tool that relies
solely on operational data and which sanitize the user input.
Signed-off-by: Richard Alpe <richard@bit42.se>
This silences a bogus warning in the log when runparts is called with no
argument. I.e., when there is no product specific init files available.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When stopping a container that is (stuck) in setup state, e.g., fetching
its container image, we need to send SIGTERM to the container wrapper
script rather than forwarding the 'stop' command to podman.
With this fix, and the Finit upgrade, there is no longer a 10 second
timeout before Finit sends SIGKILL to the PID. Instead, the script now
immediately react to the initial SIGTERM.
Related to issue #980
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Enabled by user enabling IPv6 forwarding on any interface. This change
also enables net.ipv6.conf.all.accept_ra (=2) to accept any IPv6 route
advertisements even when acting as a router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For tasks like upgrade we need, e.g., the image URI. Instead of
guessing where on the container command line the image is, use a
meta-data field in the container shell script.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- More logging when deleting a container
- Update 'exec' and 'shell' commands to support running commands
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Containers in Infix are read-only, any persistent data is either stored
in volumes or content mounts. To prevent lingering containers, as have
been seen on some test systems, we move cleanup stage from confd to use
the Finit cleanup:script mechanism.
The resulting code is simpler, shorter, and easier to debug and use.
As an added benefit, confd no longer prunes "unused" volumes by itself
on (any!) reconfiguration event, which with the new container life cycle
in Infix was quite fragile. Instead the CLI command 'container prune'
is extended with 'podman volume prune', which coincidentally the help
text already alluded to.
This patch requires Finit v4.10-rc1, or later.
Fixes#902
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When updating a container configuration we need to rerun the setup stage
of the container. However, a run/task in Finit only runs once for each
runlevel, meaning changes at runtime of a container was broken.
This is a refactor of the container script to allow it to also run as a
pre:script in the Finit setup stage of a sysv/service. Also included is
a fix to the timeout/retry handling in case the container setup fails.
We must call `read -t 60` *before* calling `ip monitor`, otherwise it
will not be called until `ip monitor` returns.
This patch requires Finit v4.9, or later.
Fixes#930
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Rename local variables
- Extract image name, using basename, for podman image exists
Fixes the following syslog error message:
root@foo:~$ podman image exists docker://ghcr.io/kernelkit/curios:edge
Error: unsupported transport "docker" for looking up local images
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The speed/duplex of a virtio interface is not eenforced in any way. The
driver initializes them to unknown/unkown:
https://github.com/torvalds/linux/blob/dccbe2047a5b0859de24bf463dae9eeea8e01c1e/drivers/net/virtio_net.c#L5375-L5381
It is however possible to set them since there are kernel subsystems
that rely on them, e.g., miimon in the bond driver, which in turn is
required for use with the 802.3ad (lacp) mode.
If we do not initialize speed/duplex the miimon will complain in the log
on virtual test systems every second:
Dec 13 22:34:08 laggy kernel: lag0: (slave e1): failed to get link speed/duplex
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- dnsmasq:
- allow listening to all interfaces again to serve DHCP leases
- disable most of the default DHCP options, keep broadcast and
netmask because when dnsmasq can infer these they are better
than breaking networking for clients -- note, they can still
be overridden from global/subnet/host scope -- and for relay
setups they need to be supplied anyway
- confd:
- drop per-interface dnsmasq, although practical for many use-cases,
having a per-subnet focused server means improved integration with
future stand-alone dhcp relay setup
- implement suggested, simplified, yang model
Fixes#703
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By declaring the service as manually configured, we can control it
from dagger (confd) without the indirection via a condition.
This has the benefit of mstpd being in the "stopped", rather than the
somewhat confusing "waiting", state when not running.
Fixes#890
These changes are based on the sysctl recommendations by Frr [1].
Not all recommendations have been incorporated, e.g., ip forwarding is
not enabled per interface, because in Infix this is an opt-in feature.
A readme.txt has been added, documenting the various settings.
New for IPv4:
- Adjust IGMP max memberships: 20 -> 1000
- Use neighbor information on nexthop selection
- Use inbound interface address on ICMP errors
- Ignore routes with link down
- Disable rp_filter
ARP settings have been changed to better fit routers, i.e., systems
with multiple interfaces:
- Always use best local address when sending ARP
- Only reply to ARP if target IP is on the inbound interface
- Generate ARP requests when device is brought up or HW address changes
New for IPv6:
- Keep static global addresses on link down
- Ignore routes with link down
Fixes#829
[1]: https://github.com/FRRouting/frr/blob/master/doc/user/Useful_Sysctl_Settings.md
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
This is a complete redesign of how the system creates/deletes containers
from the running-config. Containers are now removed synchronously from
confd before any interfaces they may be using are removed, and created
in parallel, using a Finit task, well after confd has finished setting
up interfaces.
The logic previously provided by execd to retry container create on any
route/address changes, or periodically every 60 seconds, is now handled
by a new 'setup' command in the container wrapper script.
Additionally, container create is now split in wget/curl/podman pull of
the image and 'podman create'. This to both consolidate image fetching
and improve user feedback since most of the retry logic (above) revolves
around the image download.
Fixes#835
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The -S switch to less seemed at the time a good idea -- chop off too
long lines and allow horizontal scrolling -- however, the -F option, to
skip pager for content that fit the first screen is overridden by the -S
switch. This makes commands like "show containers", and similar that
normally have waaaaay too few lines for a pager to always page.
So let's drop -S to regain the original behavior. This will cause lines
to be wrapped, but with the new raw mode in the CLI this seems to work
without any weird screen artifacts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix lack of syslog messages from Zebra and add support to easily enable
debug logs for common Zebra subsystems.
Same change made to ospfd for symmetry.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a regression in v24.11.0, introduced in 46dd0c7, where line
drawing characters are not properly displayed in the CLI anymore.
admin@infix:/> show interfaces
INTERFACE PROTOCOL STATE DATA
lo ethernet UP 00:00:00:00:00:00
ipv4 127.0.0.1/8 (static)
ipv6 ::1/128 (static)
br0 bridge
<E2><94><82> ethernet UP 02:00:00:00:00:00
<E2><94><82> ipv4 169.254.1.3/16 (random)
<E2><94><82> ipv6 fe80::ff:fe00:0/64 (link-layer)
<E2><94><9C> swp1 bridge FORWARDING
<E2><94><9C> swp2 bridge FORWARDING
<E2><94><9C> swp3 bridge FORWARDING
<E2><94><9C> swp4 bridge FORWARDING
<E2><94><9C> swp5 bridge FORWARDING
<E2><94><9C> swp6 bridge FORWARDING
<E2><94><9C> swp7 bridge FORWARDING
<E2><94><9C> swp8 bridge FORWARDING
<E2><94><9C> swp9 bridge FORWARDING
<E2><94><94> swp10 bridge FORWARDING
This is because the raw tty from klish disables IUTF8 and the fact that
it does not source any environment, e.g., /etc/profile. (We do not have
any locale settings in the enviornment either, but that's a discussion
for another day.)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg