From 23080f19776989a4fb158786f80b967061674689 Mon Sep 17 00:00:00 2001 From: Serge Hallyn Date: Thu, 26 Oct 2023 15:06:37 -0500 Subject: [PATCH] fixes --- layers/install/load-mos-modules | 4 ++++ layers/install/stacker.yaml | 9 ++++++++- layers/install/start-zot | 12 ++++++++++++ layers/install/zot-config.json | 2 +- pkg/mosconfig/mos.go | 19 +++++++++++++++++-- pkg/mosconfig/network.go | 9 ++++++--- pkg/mosconfig/uidmap.go | 4 ++++ 7 files changed, 52 insertions(+), 7 deletions(-) create mode 100644 layers/install/start-zot diff --git a/layers/install/load-mos-modules b/layers/install/load-mos-modules index aa21ac4..64491b0 100644 --- a/layers/install/load-mos-modules +++ b/layers/install/load-mos-modules @@ -9,4 +9,8 @@ mount /bootkit/bootkit/modules.squashfs /lib/modules/ udevadm trigger modprobe virtio-net +modprobe br_netfilter +modprobe iptables_nat +modprobe iptables_mangle +dhclient systemctl start lxc-net diff --git a/layers/install/stacker.yaml b/layers/install/stacker.yaml index ec9e533..0e49333 100644 --- a/layers/install/stacker.yaml +++ b/layers/install/stacker.yaml @@ -44,11 +44,18 @@ demo-zot: tag: install-rootfs-pkg import: - zot-config.json - entrypoint: /usr/bin/zot serve /etc/zot-config.json + - start-zot + - https://github.com/project-zot/zot/releases/download/v${{ZOT_VERSION}}/zot-linux-amd64-minimal + entrypoint: /usr/bin/start-zot run: | #!/bin/sh -ex cp /stacker/imports/zot-config.json /etc/ + cp /stacker/imports/start-zot /usr/bin/start-zot + chmod 755 /usr/bin/start-zot + cp /stacker/imports/zot-linux-amd64-minimal /usr/bin/zot + chmod 755 /usr/bin/zot + # The rootfs which we want to run on the system # Note this is for demo purposes only. No one should ever diff --git a/layers/install/start-zot b/layers/install/start-zot new file mode 100644 index 0000000..6cb8062 --- /dev/null +++ b/layers/install/start-zot @@ -0,0 +1,12 @@ +#!/bin/bash + +if [ -n "$IPV4" ]; then + sed -i "s/0.0.0.0/${IPV4%/*}/" /etc/zot-config.json +elif [ -n "$IPV6" ]; then + sed -i "s/0.0.0.0/${IPV6%/*}/" /etc/zot-config.json +fi + +# Should mos or lxc be doing this for us? +ip route add default via 10.0.3.1 + +exec /usr/bin/zot serve /etc/zot-config.json diff --git a/layers/install/zot-config.json b/layers/install/zot-config.json index 24b9f49..136e43a 100644 --- a/layers/install/zot-config.json +++ b/layers/install/zot-config.json @@ -5,7 +5,7 @@ "gc": false }, "http": { - "address": "127.0.0.1", + "address": "0.0.0.0", "port": "5000" }, "log": { diff --git a/pkg/mosconfig/mos.go b/pkg/mosconfig/mos.go index 5222f93..f5a30ba 100644 --- a/pkg/mosconfig/mos.go +++ b/pkg/mosconfig/mos.go @@ -169,9 +169,20 @@ func (mos *Mos) Current(name string) (*Target, error) { return nil, errors.Errorf("Target %s not found", name) } -// We'll probably want to do a lot more setup here, but for now just -// activate services +// Called at system boot to do basic setup and +// activate all services func (mos *Mos) Boot() error { + // For containers to start, /var/lib/lxc needs to be world-x + // at each point so that subuids can get to their RFS. + p := "" + for _, next := range []string{"/", "var", "lib", "lxc"} { + p = filepath.Join(p, next) + if err := os.Chmod(p, 0755); err != nil { + return errors.Wrapf(err, "Failed making %q world-accessible") + } + } + + // Now start the services return mos.ActivateAll() } @@ -182,6 +193,9 @@ func (mos *Mos) ActivateAll() error { return errors.Wrapf(err, "Failed opening manifest") } for _, t := range m.SysTargets { + if t.Name == "hostfs" || t.Name == "bootkit" { + continue + } if err := mos.Activate(t.Name); err != nil { return errors.Wrapf(err, "Failed starting %s", t.Name) } @@ -405,6 +419,7 @@ func (mos *Mos) writeLxcConfig(t *Target) error { lxcConf = append(lxcConf, "lxc.apparmor.profile = unchanged") lxcConf = append(lxcConf, fmt.Sprintf("lxc.log.file = %s/%s.log", lxclogDir, t.ServiceName)) + lxcConf = append(lxcConf, "lxc.environment = HOME=/root") for _, env := range syst.OCIConfig.Config.Env { lxcConf = append(lxcConf, fmt.Sprintf("lxc.environment = %s", env)) } diff --git a/pkg/mosconfig/network.go b/pkg/mosconfig/network.go index c3ea8e7..e4247e2 100644 --- a/pkg/mosconfig/network.go +++ b/pkg/mosconfig/network.go @@ -91,11 +91,13 @@ func (mos *Mos) setupSimpleNet(t *Target) ([]string, error) { if ipv4 != "" { config = append(config, "lxc.net.0.ipv4.address = "+ipv4) + config = append(config, "lxc.environment = IPV4="+ipv4) mos.Manifest.IpAddrs[ipv4] = t.ServiceName } if ipv6 != "" { config = append(config, "lxc.net.0.ipv6.address = "+ipv6) + config = append(config, "lxc.environment = IPV6="+ipv6) mos.Manifest.IpAddrs[ipv6] = t.ServiceName } @@ -128,7 +130,7 @@ func (mos *Mos) DefaultNic() (string, error) { continue } s := strings.Split(l, " ") - if len(s) < 9 { + if len(s) < 5 { continue } if s[3] != "dev" { @@ -159,10 +161,11 @@ func (mos *Mos) setupPortFwd(t *Target) error { return fmt.Errorf("No usable address for port forward destination") } for _, p := range t.Network.Ports { - destaddr := fmt.Sprintf("%s:%d", ipaddr, p.ContainerPort) + destaddr := strings.Split(ipaddr, "/")[0] // 192.168.2.0/24 + destaddr = fmt.Sprintf("%s:%d", destaddr, p.ContainerPort) cmd := []string{ "iptables", "-t", "nat", "-A", "PREROUTING", "-p", "tcp", - "-i", nic, "--dport", fmt.Sprintf("%d", p.HostPort), + "-m", "tcp", "-i", nic, "--dport", fmt.Sprintf("%d", p.HostPort), "-j", "DNAT", "--to-destination", destaddr} if err := utils.RunCommand(cmd...); err != nil { return errors.Wrapf(err, "Failed setting up port forward for %#v", p) diff --git a/pkg/mosconfig/uidmap.go b/pkg/mosconfig/uidmap.go index 45f631f..9a4d448 100644 --- a/pkg/mosconfig/uidmap.go +++ b/pkg/mosconfig/uidmap.go @@ -97,6 +97,10 @@ func (mos *Mos) GetUIDMapStr(t *Target) (idmap.IdmapSet, []string, error) { } rangedefs := chooseRangeDefaults() + if t.NSGroup == "none" { + return empty, []string{}, nil + } + for _, u := range manifest.UidMaps { if u.Name == t.NSGroup { uidmap := idmap.IdmapEntry{