diff --git a/source/bdl-containers-basic.rst b/source/bdl-containers-basic.rst new file mode 100644 index 00000000..253df17e --- /dev/null +++ b/source/bdl-containers-basic.rst @@ -0,0 +1,85 @@ +.. _bdl-containers-basic: + +containers-basic +################ + +This bundle provides container applications + +Multiple runtime support for Docker +=================================== + +Docker\* 1.12+ provides a way to execute containers using different **"oci +runtimes"**. An **"oci runtime"** is software compatible with :abbr:`OCI +(Open Containers Initiative)` specification that is responsible to create +a container. + +.. note:: Docker in Clear Linux is configured to use 2 runtimes: + +**cc-oci-runtime**: This is the default runtime used by docker in Clear Linux (if +Vt-x support is enabled). This runtime provides the capability to create secure +containers using Clear Containers (based VM containers). + +**runc**: This runtime is used to spawn and run containers using namespaces and +cgroups (this is the traditional way to create containers used by docker). + +In Clear Linux, each time a container is created it uses cc-oci-runtime (*A.K.A* +**cor**). + +To start a secure container with cc-oci-runtime aka cor:: + + docker run -ti debian sh + +In the case you want to start a non secure container. You can +use the option **--runtime=runc** in the docker command **"run"** + +To start an non-secure container using runc runtime:: + + docker run --runtime=runc -ti debian sh + +Change default runtime +====================== + +To modify the default runtime you can override +the stateless docker daemon configuration +creating the file :file:`/etc/systemd/system/docker-cor.service.d/docker.conf` +and adding **--default-runtinme=runc**:: + + [Service] + ExecStart=/usr/bin/dockerd -H fd:// --storage-driver=overlay --add runtime cor=cc-oci-runtime --default-runtime=runc + +HTTP proxy +========== + +If you are behind an HTTP proxy server, for example in corporate settings, you +will need to add this configuration in the Docker systemd service file. + +First, create a systemd drop-in directory for the docker service:: + + mkdir /etc/systemd/system/docker-cor.service.d + +Now create a file called :file:`/etc/systemd/system/docker-cor.service.d/http-proxy.conf` +that adds the HTTP_PROXY environment variable:: + + [Service] + Environment="HTTP_PROXY=http://proxy.example.com:80/" + +If you have internal Docker registries that you need to contact without proxying +you can specify them via the NO_PROXY environment variable:: + + Environment="HTTP_PROXY=http://proxy.example.com:80/" "NO_PROXY=localhost,127.0.0.1,docker-registry.somecorporation.com" + +Flush changes:: + + $ sudo systemctl daemon-reload + +Verify that the configuration has been loaded:: + + $ systemctl show --property=Environment docker-cor + Environment=HTTP_PROXY=http://proxy.example.com:80/ + +Restart Docker:: + + $ sudo systemctl restart docker-cor + +To get more info you can view https://docs.docker.com/engine/admin/systemd/ + diff --git a/source/bdl-openssh-server.rst b/source/bdl-openssh-server.rst new file mode 100644 index 00000000..23fcf8dd --- /dev/null +++ b/source/bdl-openssh-server.rst @@ -0,0 +1,40 @@ +.. _bdl-openssh-server: + +openssh-server +############## + +This bundle provides an ssh server. + +SFTP +==== + +Clear Linux *disables* sftp subsystem by default for security reasons. +To enable sftp subsystem you will need to add this configuration in the sshd +service file. + +First, create a systemd drop-in directory for the sshd service:: + + # mkdir /etc/systemd/system/sshd@.service.d + +Now create a file called :file:`/etc/systemd/system/sshd@.service.d/sftp.conf` +that adds the OPTIONS environment variable:: + + [Service] + Environment="OPTIONS=-o Subsystem=\"sftp /usr/libexec/sftp-server\"" + +Now, sftp subsystem is enabled. + +Root login +========== + +To enable root login via ssh, you should do the following: + +#. Create a *ssh* directory in /etc (if not exist):: + + # mkdir /etc/ssh + +#. Set config variable:: + + # echo "PermitRootLogin yes" >> /etc/ssh/sshd_config + + diff --git a/source/bdl-os-core.rst b/source/bdl-os-core.rst new file mode 100644 index 00000000..2b477906 --- /dev/null +++ b/source/bdl-os-core.rst @@ -0,0 +1,83 @@ +.. _bdl-os-core: + +os-core +####### + +This bundle contains the basic core OS components. + +Static IP +========= + +To configure a static IP you should follow the next steps: + +#. Create file :file:`/etc/systemd/network/50-static.network`. If a directory + does not exist, please create it. + +#. The minimum lines the :file:`50-static.network` file should contain are:: + + [Match] + Name= + + [Network] + Address= + Gateway= + + The ** is your network device name (i.e. enp1s0 or enp0s25). + +#. If you want to add more options you can consult the + `systemd network configuration`_ manual. + +#. Restart *systemd-networkd* service using:: + + # systemctl restart systemd-networkd + + or restart Clear Linux. + +#. Check new IP with:: + + # ip addr + + +Setting Time +============ + +Clear Linux utilizes **systemd-timesyncd.service** to sync time. +Default :abbr:`NTP (Network Time Protocol)` servers are +configured as *time1.google.com, time2.google.com, time3.google.com, and +time4.google.com*. It is not possible to set the time manually, via +*timedatectl* +or to use RTC mode. In the event that those servers cannot be reached and the +time is incorrect on your system, try these steps: + +#. Make sure that you've set your timezone: + + * If you at Pacific time:: + + timedatectl set-timezone America/Los_Angeles + + or you can choose a preferred timezone + + * To see a list of timezones, do:: + + timedatectl list-timezones | grep + +#. Create :file:`/etc/systemd/` directory + +#. Open your chosen editor and type into the + :file:`/etc/systemd/timesyncd.conf` file:: + + [Time] + NTP= + FallbackNTP= + +#. Restart timesync daemon:: + + # systemctl restart systemd-timesyncd + +.. note:: Check to make sure your time is correctly set: date + + + + + +.. _systemd network configuration: https://www.freedesktop.org/software/systemd/man/systemd.network.html diff --git a/source/index_bundles.rst b/source/index_bundles.rst index 01a2ea94..768ba61f 100644 --- a/source/index_bundles.rst +++ b/source/index_bundles.rst @@ -5,3 +5,6 @@ Bundles :maxdepth: 2 bundles_overview + bdl-containers-basic + bdl-openssh-server + bdl-os-core