In systemd-209 libsystemd-login was merged into libsystemd and a
compatibility libsystemd-login library was created. Unfortunately,
distributions like Fedora don't ship the compatibility libraries so
runningFromUnitFile will always return false.
Fix it by dlopening libsystemd.so instead of libsystemd-login.so.
Ports that were defined in app manifest can be
exposed via --port=name:host-port option on cmd line.
For example, given app manifest with ports entry:
{
"name": "http",
"port": 80,
"protocol": "tcp"
}
rkt run --private-net --port=http:8888 myapp.aci
will forward traffic from host's tcp port 8888 to
container's port 80.
Fixes#624
Since the spec requires AC_METADATA_URL env var,
well known IP is no longer needed. This removes
the iptables manipulation. Instead the IP address of the
host is passed in the AC_METADATA_URL. This host IP
is the address of the host end of the default veth.
If the readOnly field of the volume mounts in pod manifest
is non-nil, then use it to override the image manifest's readOnly field
of the volume mounts.
Currently only systemd is being built from source, toggled from the
top-level build script by setting RKT_STAGE1_USR_FROM=src, e.g:
RKT_STAGE1_USR_FROM=src ./build
The default stage1 continues to be coreos-derived, but may be explicitly
specified via:
RKT_STAGE1_USR_FROM=coreos ./build
The stage1 init program has been modified to introspect the "flavor" of
stage1 at runtime, which influences how it invokes systemd-nspawn.
A small series of patches are included to give systemd-nspawn the
functionalities enabled via LD_PRELOAD of the shim in the coreos-derived
stage1.
The systemd source is cloned at build time the first time an
RKT_STAGE1_USR_FROM=src build is performed, at this time the same version
as the coreos image provided is being used, but this can be bumped in the
future.
By using systemd's Standard{Input,Output,Error} options we set
/dev/console in stage1 as the tty for the app (see systemd.exec(5)).
This makes interactive executables like bash work with rkt run (or
prepare+run-prepared).
This is only supported if the container has only one app.
`rkt run` and `rkt prepare` can now receive arguments on the commandline
which get appended to the default exec arguments of the preceding app
image.
Examples:
Append --foo=bar to the second aci in a two aci invocation:
`rkt run bar.aci foo.aci -- --foo=bar`
Append options to both acis:
`rkt run bar.aci -- --foobar --- foo.aci -- --woot`
or if preparing:
`rkt prepare bar.aci -- --foobar --- foo.aci -- --woot`
Also lays groundwork for general support of CRM overrides, though only argument
appending has been plumbed to the rkt commandline.
Fixes#564
Conflicts:
stage0/run.go
prepare-app runs in stage1, so it knows how to handle dynamic
/dev/console.
It does not change diagexec so it does not break rkt enter.
Bind mount individual /dev entries instead of bind mounting the /dev
directory so rkt run --volume /dev/sda6 (performed in stage0) should
still work.
Do not use a bunch of systemd mount units because they don't create
nonexistent target files. See:
http://lists.freedesktop.org/archives/systemd-devel/2015-February/028657.html
We might revisit this option if systemd mount units automatically create
the nonexistent target files.
Avoid systemd option PrivateDevices to avoid shadowing additional bind
mounts passed with --volume.
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
This change places per-app environment files in stage1/rootfs/rkt/env/$id
The stage1 systemd service files no longer contain Environment directives,
instead they simply supply the env file path to diagexec.
`rkt enter` also uses diagexec and needs to enter the same enviroment of the
app being entered. This commit also modifies the stage1 /enter to supply the
env file to its diagexec invocation, giving `rkt enter` an environment
consistent with the app's.
Dimitri John Ledkov