This refactor will make it easier to integrate lkvm support, and also
brings other benefits.
Specifically, with this refactor almost all functionality of stage1
init is flavor independent and can be fully controlled via a manifest
and uses as little hard coded paths as possible.
Thus, e.g. distribution packagers, can create package which will only
have rkt/stage1 provided binaries (gc, waiter, init, etc.) and specify
the rest of things in the manifest (path to nspawn, ld.so, LD LIBRARY
PATH, libfakesdbooted.so, etc). And create fully free-standing
stage1.aci by simply creating basic distribution chroot with
distro-native tools and supplying a matching/correct aci-manifest. By
fully free-standing, I mean similar to current coreos flavor, which is
completely independent of the host OS binaries & load paths and is
truly run everywhere.
Many of these refactors will be useful for future lkvm integration,
e.g. reusing ld.so load paths and similar.
--link-journal=host fails if the host system doesn't have persistent
journaling enabled. Fix that by using "try-host"; if the system has
persistent journaling enabled it links the journal, otherwise it skips
the linking without exiting with a failure.
In 969a57c6 (stage1: use --link-journal=host instead of try-host) we
switched from "try-host" to "host" to support journal linking in systemd
versions <219 but now we don't support it on them anymore.
Some controller cgroup knob files can be disabled in kernel. If the
file we want doesn't exist, just ignore it when we bind-mount knobs over
themselves.
Instead of bind-mounting the whole controller subcgroup directory RW we
only bind-mount the files we need to set isolators. This reduces the
cgroup attack surface.
To allow systemd inside stage1 to set resource limits for apps we mount
the cgroup controllers hierarchy in rkt. We need this because
systemd-nspawn mounts cgroup controllers as read-only.
We mimic systemd-nspawn cgroup mounts with the difference that we
bind-mount the apps' subdirectories over themselves so they stay
read-write. We leave the mounting of systemd's cgroup hierarchy to
nspawn.
Instead of asking systemd-nspawn to write its "pid" file, rkt can write
the parent pid "ppid". Then, update getPID() to get the pid file from
/proc/$ppid/task/$ppid/children. In this way, we don't need to patch
systemd-nspawn.
getPID() is able to read both the "pid" file and the "ppid" file, in
order to work with alternative stage1s which choose to implement one or
the other method.
coreos/rkt#910
This commit adds the possiblity of passing a comma separated list of network
names to the '-private-net' argument. Only networks with their names specified
are loaded in the pods network stack.
The network documentation has been updated accordingly.
When registering a pod to the metadata service, if individual app
registrations failed then an error object was being instantiated but not
actually returned. This fixes it to return the error and also to make a
best-effort attempt to unregister the pod in this scenario.
Also tweaks the file operations to close manifests more immediately
after they've been used.
Also fixes minor typo in rkt/metadata_service error message.
In prepare-app we depend on systemd-journal.service only if journal
linking is supported by systemd in stage1.
This commit generates prepare-app@.service so we can add this dependency
only when it's supported.
If we enable journal linking, there's a race in systemd v215 that makes
(very) short-lived containers not show their output in stdout, making
tests fail. Since the CoreOS image will be updated soon we don't bother
investigating this issue and just disable journal linking in old
versions of systemd
Since we check if we're running systemd before appending --link-journal
to systemd-nspawn we can use host instead of try-host.
This allows connecting a pod's journal to the host's journal with
systemd version <219.
This commit links the journal to the host passing the option
--link-journal=try-host to systemd-nspawn.
We also populate pod's /etc/machine-id with its UUID before running
systemd-nspawn because nspawn will try to read it.
Example of output:
| $ rkt --debug --insecure-skip-verify run docker://redis
| Failed to generate nspawn args: no volume for mountpoint "volume-/data" in app "redis".
| You can inspect the volumes with:
| sudo rkt image cat-manifest --pretty-print sha512-f95f15ce81345214328fdbe9407fdac3e46de0c11ceb69e8da5b0d1aa3158dfc
| App "redis" requires the following volumes:
| --volume volume-/data,kind=host,source=/some/path
Fixes: https://github.com/coreos/rkt/issues/943
In systemd-209 libsystemd-login was merged into libsystemd and a
compatibility libsystemd-login library was created. Unfortunately,
distributions like Fedora don't ship the compatibility libraries so
runningFromUnitFile will always return false.
Fix it by dlopening libsystemd.so instead of libsystemd-login.so.
Ports that were defined in app manifest can be
exposed via --port=name:host-port option on cmd line.
For example, given app manifest with ports entry:
{
"name": "http",
"port": 80,
"protocol": "tcp"
}
rkt run --private-net --port=http:8888 myapp.aci
will forward traffic from host's tcp port 8888 to
container's port 80.
Fixes#624
Dimitri John Ledkov