Skip to content

Commit c1b17a1

Browse files
author
OpenShift Bot
authored
Merge pull request #12738 from giuseppe/system-containers
Merged by openshift-bot
2 parents 861c5fb + 417a013 commit c1b17a1

15 files changed

+824
-0
lines changed

‎images/node/Dockerfile

+3
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,7 @@ LABEL io.k8s.display-name="OpenShift Origin Node" \
3131
io.k8s.description="This is a component of OpenShift Origin and contains the software for individual nodes when using SDN."
3232
VOLUME /etc/origin/node
3333
ENV KUBECONFIG=/etc/origin/node/node.kubeconfig
34+
35+
COPY system-container/config.json.template system-container/service.template system-containers/tmpfiles.template /exports/
36+
3437
ENTRYPOINT [ "/usr/local/bin/origin-node-run.sh" ]

‎images/node/Dockerfile.centos7

+3
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,7 @@ LABEL io.k8s.display-name="OpenShift Origin Node" \
2626
io.k8s.description="This is a component of OpenShift Origin and contains the software for individual nodes when using SDN."
2727
VOLUME /etc/origin/node
2828
ENV KUBECONFIG=/etc/origin/node/node.kubeconfig
29+
30+
COPY system-container/config.json.template system-container/service.template system-containers/tmpfiles.template /exports/
31+
2932
ENTRYPOINT [ "/usr/local/bin/origin-node-run.sh" ]

‎images/node/system-container/config.json.template

+347
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,347 @@
1+
{
2+
"ociVersion": "1.0.0",
3+
"platform": {
4+
"os": "linux",
5+
"arch": "amd64"
6+
},
7+
"process": {
8+
"terminal": false,
9+
"user": {},
10+
"args": [
11+
"/usr/local/bin/system-container-wrapper.sh"
12+
],
13+
"env": [
14+
"HOST=/rootfs",
15+
"HOST_ETC=/host-etc",
16+
"container=docker",
17+
"PKGM=yum",
18+
"NAME=$NAME",
19+
"PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin",
20+
"HOME=/root",
21+
"OPENSHIFT_CONTAINERIZED=true",
22+
"KUBECONFIG=/etc/origin/node/node.kubeconfig",
23+
"TERM=xterm"
24+
],
25+
"cwd": "/var/lib/origin",
26+
"capabilities": [
27+
"CAP_CHOWN",
28+
"CAP_DAC_OVERRIDE",
29+
"CAP_DAC_READ_SEARCH",
30+
"CAP_FOWNER",
31+
"CAP_FSETID",
32+
"CAP_KILL",
33+
"CAP_SETGID",
34+
"CAP_SETUID",
35+
"CAP_SETPCAP",
36+
"CAP_LINUX_IMMUTABLE",
37+
"CAP_NET_BIND_SERVICE",
38+
"CAP_NET_BROADCAST",
39+
"CAP_NET_ADMIN",
40+
"CAP_NET_RAW",
41+
"CAP_IPC_LOCK",
42+
"CAP_IPC_OWNER",
43+
"CAP_SYS_MODULE",
44+
"CAP_SYS_RAWIO",
45+
"CAP_SYS_CHROOT",
46+
"CAP_SYS_PTRACE",
47+
"CAP_SYS_PACCT",
48+
"CAP_SYS_ADMIN",
49+
"CAP_SYS_BOOT",
50+
"CAP_SYS_NICE",
51+
"CAP_SYS_RESOURCE",
52+
"CAP_SYS_TIME",
53+
"CAP_SYS_TTY_CONFIG",
54+
"CAP_MKNOD",
55+
"CAP_LEASE",
56+
"CAP_AUDIT_WRITE",
57+
"CAP_AUDIT_CONTROL",
58+
"CAP_SETFCAP",
59+
"CAP_MAC_OVERRIDE",
60+
"CAP_MAC_ADMIN",
61+
"CAP_SYSLOG",
62+
"CAP_WAKE_ALARM",
63+
"CAP_BLOCK_SUSPEND"
64+
],
65+
"rlimits": [
66+
{
67+
"type": "RLIMIT_NOFILE",
68+
"hard": 1024,
69+
"soft": 1024
70+
}
71+
],
72+
"noNewPrivileges": true
73+
},
74+
"root": {
75+
"path": "rootfs",
76+
"readonly": true
77+
},
78+
"mounts": [
79+
{
80+
"destination": "/dev",
81+
"type": "tmpfs",
82+
"source": "tmpfs",
83+
"options": [
84+
"nosuid",
85+
"strictatime",
86+
"mode=755",
87+
"size=65536k"
88+
]
89+
},
90+
{
91+
"destination": "/dev/pts",
92+
"type": "devpts",
93+
"source": "devpts",
94+
"options": [
95+
"nosuid",
96+
"noexec",
97+
"newinstance",
98+
"ptmxmode=0666",
99+
"mode=0620",
100+
"gid=5"
101+
]
102+
},
103+
{
104+
"destination": "/dev/shm",
105+
"type": "tmpfs",
106+
"source": "shm",
107+
"options": [
108+
"nosuid",
109+
"noexec",
110+
"nodev",
111+
"mode=1777",
112+
"size=65536k"
113+
]
114+
},
115+
{
116+
"destination": "/dev/mqueue",
117+
"type": "mqueue",
118+
"source": "mqueue",
119+
"options": [
120+
"nosuid",
121+
"noexec",
122+
"nodev"
123+
]
124+
},
125+
{
126+
"destination": "/proc",
127+
"type": "proc",
128+
"source": "proc"
129+
},
130+
{
131+
"type": "rbind",
132+
"source": "/sys",
133+
"destination": "/sys",
134+
"options": [
135+
"rbind",
136+
"rw"
137+
]
138+
},
139+
{
140+
"type": "bind",
141+
"source": "/usr/bin/docker-current",
142+
"destination": "/usr/bin/docker-current",
143+
"options": [
144+
"rbind",
145+
"ro"
146+
]
147+
},
148+
{
149+
"type": "bind",
150+
"source": "/etc/localtime",
151+
"destination": "/etc/localtime",
152+
"options": [
153+
"rbind",
154+
"ro"
155+
]
156+
},
157+
{
158+
"type": "bind",
159+
"source": "/usr/bin/docker",
160+
"destination": "/usr/bin/docker",
161+
"options": [
162+
"rbind",
163+
"ro"
164+
]
165+
},
166+
{
167+
"type": "bind",
168+
"source": "/etc/origin/sdn",
169+
"destination": "/etc/openshift-sdn",
170+
"options": [
171+
"rbind",
172+
"rw",
173+
"mode=755"
174+
]
175+
},
176+
{
177+
"type": "bind",
178+
"source": "/run",
179+
"destination": "/run",
180+
"options": [
181+
"rbind",
182+
"rw",
183+
"mode=755"
184+
]
185+
},
186+
{
187+
"type": "bind",
188+
"source": "/etc/systemd/system",
189+
"destination": "/host-etc/systemd/system",
190+
"options": [
191+
"rbind",
192+
"rw",
193+
"mode=755"
194+
]
195+
},
196+
{
197+
"type": "bind",
198+
"source": "/var/run/secrets",
199+
"destination": "/var/run/secrets",
200+
"options": [
201+
"rbind",
202+
"rw",
203+
"mode=755"
204+
]
205+
},
206+
{
207+
"type": "bind",
208+
"source": "/lib/modules",
209+
"destination": "/lib/modules",
210+
"options": [
211+
"rbind",
212+
"rw",
213+
"mode=755"
214+
]
215+
},
216+
{
217+
"type": "bind",
218+
"source": "/etc/origin/openvswitch",
219+
"destination": "/etc/openvswitch",
220+
"options": [
221+
"rbind",
222+
"rw",
223+
"mode=755"
224+
]
225+
},
226+
{
227+
"type": "bind",
228+
"source": "/var/lib/origin",
229+
"destination": "/var/lib/origin",
230+
"options": [
231+
"rbind",
232+
"rslave",
233+
"rw",
234+
"mode=755"
235+
]
236+
},
237+
{
238+
"type": "bind",
239+
"source": "/var/lib/cni",
240+
"destination": "/var/lib/cni",
241+
"options": [
242+
"bind",
243+
"slave",
244+
"rw",
245+
"mode=777"
246+
]
247+
},
248+
{
249+
"type": "bind",
250+
"source": "/etc/machine-id",
251+
"destination": "/etc/machine-id",
252+
"options": [
253+
"rbind",
254+
"ro"
255+
]
256+
},
257+
{
258+
"type": "bind",
259+
"source": "/etc/resolv.conf",
260+
"destination": "/etc/resolv.conf",
261+
"options": [
262+
"bind",
263+
"ro"
264+
]
265+
},
266+
{
267+
"type": "bind",
268+
"source": "/var/lib/docker",
269+
"destination": "/var/lib/docker",
270+
"options": [
271+
"bind",
272+
"rw",
273+
"mode=755"
274+
]
275+
},
276+
{
277+
"type": "bind",
278+
"source": "/var/log",
279+
"destination": "/var/log",
280+
"options": [
281+
"rbind",
282+
"rw",
283+
"mode=755"
284+
]
285+
},
286+
{
287+
"type": "bind",
288+
"source": "/",
289+
"destination": "/rootfs",
290+
"options": [
291+
"rbind",
292+
"rprivate",
293+
"ro"
294+
]
295+
},
296+
{
297+
"type": "bind",
298+
"source": "/etc/origin/node",
299+
"destination": "/etc/origin/node",
300+
"options": [
301+
"rbind",
302+
"rw",
303+
"mode=755"
304+
]
305+
},
306+
{
307+
"destination": "/tmp",
308+
"type": "tmpfs",
309+
"source": "tmpfs",
310+
"options": [
311+
"mode=755",
312+
"size=65536k"
313+
]
314+
}
315+
],
316+
"hooks": {},
317+
"linux": {
318+
"rootfsPropagation" : "rslave",
319+
"resources": {
320+
"devices": [
321+
{
322+
"allow": false,
323+
"access": "rwm"
324+
}
325+
]
326+
},
327+
"namespaces": [
328+
{
329+
"type": "mount"
330+
}
331+
],
332+
"maskedPaths": [
333+
"/proc/kcore",
334+
"/proc/latency_stats",
335+
"/proc/timer_stats",
336+
"/proc/sched_debug"
337+
],
338+
"readonlyPaths": [
339+
"/proc/asound",
340+
"/proc/bus",
341+
"/proc/fs",
342+
"/proc/irq",
343+
"/proc/sysrq-trigger"
344+
]
345+
}
346+
}
347+

‎images/node/system-container/service.template

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[Unit]
2+
After=atomic-openshift-master.service
3+
After=docker.service
4+
After=openvswitch.service
5+
PartOf=docker.service
6+
Requires=docker.service
7+
Requires=openvswitch.service
8+
Requires=$NAME-dep.service
9+
After=$NAME-dep.service
10+
11+
[Service]
12+
EnvironmentFile=/etc/sysconfig/$NAME
13+
EnvironmentFile=/etc/sysconfig/$NAME-dep
14+
ExecStartPre=/bin/bash -c 'export -p > /run/$NAME-env'
15+
ExecStart=$EXEC_START
16+
ExecStop=$EXEC_STOP
17+
SyslogIdentifier=$NAME
18+
Restart=always
19+
RestartSec=5s
20+
WorkingDirectory=$DESTDIR
21+
RuntimeDirectory=${NAME}
22+
23+
[Install]
24+
WantedBy=docker.service

‎images/node/system-container/system-container-wrapper.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
source /run/$NAME-env
3+
4+
exec /usr/local/bin/origin-node-run.sh

‎images/node/system-container/tmpfiles.template

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
d /var/lib/origin - - - - -
2+
d /var/lib/cni - - - - -
3+
d /var/run/secrets - - - - -
4+
d /etc/origin/sdn - - - - -

0 commit comments

Comments
 (0)