FROM {{ base_image }}:{{ base_distro_tag }} LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}" {# NOTE(SamYaple): Avoid uid/gid conflicts by creating each user/group up front. #} {# Specifics required such as homedir or shell are configured within the service specific image #} {%- for name, user in users | dictsort() %} {% if loop.first -%}RUN {% else %} && {% endif -%} groupadd --force --gid {{ user.gid }} {{ name }} \ && useradd -l -M --shell /usr/sbin/nologin --uid {{ user.uid }} --gid {{ user.gid }} {{ name }} {%- if not loop.last %} \{% endif -%} {%- endfor %} LABEL kolla_version="{{ kolla_version }}" {% import "macros.j2" as macros with context %} {% block base_header %}{% endblock %} ENV KOLLA_BASE_DISTRO={{ base_distro }} \ KOLLA_INSTALL_TYPE={{ install_type }} \ KOLLA_INSTALL_METATYPE={{ install_metatype }} #### Customize PS1 to be used with bash shell COPY kolla_bashrc /tmp/ RUN cat /tmp/kolla_bashrc >> /etc/skel/.bashrc \ && cat /tmp/kolla_bashrc >> /root/.bashrc # PS1 var when used /bin/sh shell ENV PS1="$(tput bold)($(printenv KOLLA_SERVICE_NAME))$(tput sgr0)[$(id -un)@$(hostname -s) $(pwd)]$ " {% if base_distro in ['centos', 'oraclelinux', 'rhel'] %} # For RPM Variants, enable the correct repositories - this should all be done # in the base image so repos are consistent throughout the system. This also # enables to provide repo overrides at a later date in a simple fashion if we # desire such functionality. I think we will :) RUN CURRENT_DISTRO_RELEASE=$(awk '{match($0, /[0-9]+/,version)}END{print version[0]}' /etc/system-release); \ if [ $CURRENT_DISTRO_RELEASE != "{{ supported_distro_release }}" ]; then \ echo "Only release '{{ supported_distro_release }}' is supported on {{ base_distro }}"; false; \ fi \ && cat /tmp/kolla_bashrc >> /etc/bashrc \ && sed -i 's|^\(override_install_langs=.*\)|# \1|' /etc/yum.conf {% block base_yum_conf %} {% if base_distro in ['oraclelinux'] %} {% set centos_contentdir = 'centos' %} {% if base_arch in ['aarch64', 'ppc64le'] %} {% set centos_contentdir = 'altarch' %} {% endif %} {% endif %} COPY yum.conf /etc/yum.conf RUN echo {{ centos_contentdir }} >> /etc/yum/vars/contentdir {% endblock %} #### BEGIN REPO ENABLEMENT {% set base_yum_repo_files = [ ] %} {% set base_yum_url_packages = [ ] %} {% set base_yum_repo_keys = [ ] %} {% if base_arch == 'x86_64' %} {% set base_yum_repo_files = [ 'crane.repo', 'elasticsearch.repo', 'grafana.repo', 'influxdb.repo', 'nfs_ganesha.repo', 'opendaylight.repo', 'percona-release.repo', 'rabbitmq_rabbitmq-server.repo', 'td.repo' ] %} {% set base_yum_repo_keys = [ 'https://artifacts.elastic.co/GPG-KEY-elasticsearch', 'https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana', 'https://repos.influxdata.com/influxdb.key', 'https://packagecloud.io/gpg.key', 'https://www.percona.com/downloads/RPM-GPG-KEY-percona', 'https://packages.treasuredata.com/GPG-KEY-td-agent' ] %} {% endif %} {%- for repo_file in base_yum_repo_files | customizable('yum_repo_files') %} COPY {{ repo_file }} /etc/yum.repos.d/{{ repo_file }} {%- endfor %} {{ macros.install_packages(base_yum_url_packages | customizable("yum_url_packages")) }} {% for key in base_yum_repo_keys | customizable('yum_repo_keys') %} {%- if loop.first %}RUN {% else %} && {% endif -%} rpm --import {{ key }} {%- if not loop.last %} \{% endif %} {% endfor -%} {% if install_metatype in ['rdo', 'mixed'] %} {% for cmd in rpm_setup %} {{ cmd }} {% endfor %} {% endif %} {# endif for repo setup for all RHEL except RHEL OSP #} {% if install_metatype == 'rhos' %} {% block base_rhos_repo_enablement %} # Turn on the RHOS 7.0 repo for RHOS RUN yum-config-manager --enable rhel-7-server-rpms \ && yum-config-manager --enable rhel-7-server-openstack-7.0-rpms {% endblock %} {% endif %} {% if base_distro == 'centos' %} {% block base_centos_gpg_key_import %} RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7 {% endblock %} {% set base_centos_yum_repo_keys = [ '/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-OpsTools', '/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage', '/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Virtualization' ] %} {% set base_centos_yum_repo_packages = [ 'centos-release-ceph-luminous', 'centos-release-opstools', 'centos-release-qemu-ev', 'epel-release', 'yum-plugin-priorities' ] %} {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages")) }} {% for key in base_centos_yum_repo_keys | customizable('centos_yum_repo_keys') %} {%- if loop.first %}RUN {% else %} && {% endif -%} rpm --import {{ key }} \ {% endfor -%} {%- if base_centos_yum_repo_keys|customizable('centos_yum_repo_keys')|length == 0 %}RUN {% else %} && {% endif -%} yum -y update --security --sec-severity=Important --sec-severity=Critical \ && yum clean all \ && rm -rf /var/cache/yum {% endif %} {# Endif for base_distro centos #} {% if base_distro == 'rhel' %} {% block base_rhel_package_installation %} # Enable couple required repositories for all RHEL builds # Turn on EPEL throughout the build RUN yum-config-manager --enable rhel-7-server-optional-rpms \ && yum -y install \ yum-plugin-priorities \ {% if install_type != 'binary' or install_metatype != 'rdo' %} && yum -y install \ https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \ && rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 \ {% endif %} && yum-config-manager --enable rhel-7-server-extras-rpms \ && yum-config-manager --enable rhel-7-server-rhceph-2-osd-rpms \ && yum-config-manager --enable rhel-7-server-rhceph-2-mon-rpms \ && yum-config-manager --enable rhel-7-server-rhceph-2-tools-rpms \ && yum -y update --security --sec-severity=Important --sec-severity=Critical \ && yum clean all \ && rm -rf /var/cache/yum {% endblock %} {% endif %} {# Endif for base_distro RHEL #} {% if base_distro == 'oraclelinux' %} {% block base_oraclelinux_package_installation %} COPY oraclelinux-extras.repo /etc/yum.repos.d/oraclelinux-extras.repo RUN yum -y install \ tar \ yum-utils \ https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \ && rpm -Uvh --nodeps \ http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-ceph-luminous-1.1-2.el7.centos.noarch.rpm \ http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-opstools-1-8.el7.noarch.rpm \ http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-qemu-ev-1.0-3.el7.centos.noarch.rpm \ http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-virt-common-1-1.el7.centos.noarch.rpm \ http://mirror.centos.org/centos-7/7/extras/x86_64/Packages/centos-release-storage-common-2-2.el7.centos.noarch.rpm \ && sed -i 's/\$releasever/7/g' /etc/yum.repos.d/CentOS-*.repo \ && rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 \ && rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-OpsTools \ && rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage \ && rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Virtualization \ && yum-config-manager --enable ol7_optional_latest ol7_addons \ && yum -y install \ yum-plugin-priorities \ && yum -y update --security --sec-severity=Important --sec-severity=Critical \ && yum clean all \ && rm -rf /var/cache/yum {% endblock %} {% endif %} {# Endif for base_distro oraclelinux #} #### END REPO ENABLEMENT {# We are back to the basic if conditional here which is: if base_distro in ['centos', 'oraclelinux', 'rhel'] #} {% set base_compiler_packages = [ 'gcc', 'glibc-static' ] %} {% block base_redhat_binary_versionlock %}{% endblock %} {% if install_type == 'binary' %} {% set base_centos_binary_packages = [ 'iproute', 'iscsi-initiator-utils', 'lvm2', 'python', 'scsi-target-utils', 'socat', 'sudo', 'which' ] %} # Install base packages {{ macros.install_packages( base_centos_binary_packages | customizable("centos_binary_packages")) }} {% endif %} {# Endif for install_type binary #} {% if install_type == 'source' %} {% set base_centos_source_packages = [ 'curl', 'iproute', 'iscsi-initiator-utils', 'lvm2', 'scsi-target-utils', 'socat', 'sudo', 'tar', 'which' ] %} # Update packages {{ macros.install_packages( base_centos_source_packages | customizable("centos_source_packages")) }} {% endif %} {# endif for install type is source for RPM based distros #} {# endif for base_distro centos,oraclelinux,rhel #} {% elif base_distro in ['debian', 'ubuntu'] %} RUN if [ $(awk -F '=' '/DISTRIB_RELEASE/{print $2}' /etc/lsb-release) != "{{ supported_distro_release }}" ]; then \ echo "Only release '{{ supported_distro_release }}' is supported on {{ base_distro }}"; false; fi # Customize PS1 bash shell RUN cat /tmp/kolla_bashrc >> /etc/bash.bashrc # This will prevent questions from being asked during the install ENV DEBIAN_FRONTEND noninteractive # Reducing disk footprint COPY dpkg_reducing_disk_footprint /etc/dpkg/dpkg.cfg.d/dpkg_reducing_disk_footprint {% block base_ubuntu_package_pre %} # Need apt-transport-https and ca-certificates before replacing sources.list or # apt-get update will not work if any repositories are accessed via HTTPS {% set base_ubuntu_package_pre_packages = [ 'apt-transport-https', 'ca-certificates', 'curl', 'dirmngr', 'gnupg' ] %} {{ macros.install_packages(base_ubuntu_package_pre_packages | customizable("base_ubuntu_package_pre_packages")) }} {% endblock %} {% block base_ubuntu_package_sources_list %} {% if base_distro == 'debian' or ( base_distro == 'ubuntu' and base_arch == 'x86_64' ) %} COPY sources.list.{{ base_distro }} /etc/apt/sources.list {% else %} COPY sources.list.{{ base_distro }}.{{ base_arch }} /etc/apt/sources.list {% endif %} {% endblock %} {% block base_ubuntu_package_apt_preferences %} COPY apt_preferences.{{ base_distro }} /etc/apt/preferences {% endblock %} {% set base_apt_packages = [ 'apt-utils', 'curl', 'gawk', 'iproute2', 'kmod', 'lvm2', 'netbase', 'open-iscsi', 'python', 'socat', 'sudo', 'tgt'] %} {% if base_distro in ['debian'] %} {% set base_apt_packages = base_apt_packages + [ 'udev/stretch-backports' ] %} {% endif %} {% set base_compiler_packages = [ 'build-essential' ] %} {% if base_distro == 'ubuntu' %} {# 05CE15085FC09D18E99EFB22684A14CF2582E0C5 -- InfluxDB Packaging Service #} {# 391A9AA2147192839E9DB0315EDB1B62EC4926EA -- Canonical Cloud Archive Signing Key #} {# 418A7F2FB0E1E6E7EABF6FE8C2E73424D59097AB -- packagecloud ops (production key) #} {# 46095ACC8548582C1A2699A9D27D666CD88E42B4 -- Elasticsearch (Elasticsearch Signing Key) #} {# 49B07274951063870A8B7EAE7B8AA1A344C05248 -- Opendaylight Signing Key #} {# 4D1BB29D63D98E422B2113B19334A25F8507EFA5 -- Percona MySQL Development Team (Packaging key) #} {# 58118E89F3A912897C070ADBF76221572C52609D -- Docker Release Tool (releasedocker) #} {# 4D8EB5FDA37AB55F41A135203BF88A0C6A770882 -- Apache Qpid PPA Signing Key #} {# 901F9177AB97ACBE -- Treasure Data, Inc (Treasure Agent Official Signing key) #} {# A20F259AEB9C94BB -- Sensuapp (Freight) #} {% set base_apt_keys = [ '05CE15085FC09D18E99EFB22684A14CF2582E0C5', '391A9AA2147192839E9DB0315EDB1B62EC4926EA', '418A7F2FB0E1E6E7EABF6FE8C2E73424D59097AB', '46095ACC8548582C1A2699A9D27D666CD88E42B4', '49B07274951063870A8B7EAE7B8AA1A344C05248', '4D1BB29D63D98E422B2113B19334A25F8507EFA5', '58118E89F3A912897C070ADBF76221572C52609D', '4D8EB5FDA37AB55F41A135203BF88A0C6A770882', '901F9177AB97ACBE', 'A20F259AEB9C94BB' ] %} {% set remote_apt_keys = [ 'https://packagecloud.io/rabbitmq/rabbitmq-server/gpgkey' ] %} {% elif base_distro == 'debian' %} {% set base_apt_keys = [ '46095ACC8548582C1A2699A9D27D666CD88E42B4', '418A7F2FB0E1E6E7EABF6FE8C2E73424D59097AB', ] %} {% set remote_apt_keys = [ 'http://obs.linaro.org/ERP:/18.06/Debian_9/Release.key', 'https://download.docker.com/linux/debian/gpg', ] %} {% set base_apt_packages = base_apt_packages + ['sudo',] %} {% endif %} {% block base_ubuntu_package_installation %} {%- block base_ubuntu_package_key_installation %} {% for key in base_apt_keys | customizable('apt_keys') %} {%- if loop.first %}RUN {% else %} && {% endif %}apt-key adv --no-tty --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 {{ key }} {%- if not loop.last %} \ {% endif -%} {% endfor %} {% for key in remote_apt_keys | customizable('remote_apt_keys') %} {%- if loop.first %} RUN {% else %} && {% endif %}curl -L {{ key }} | apt-key add - {%- if not loop.last %} \ {% endif -%} {% endfor %} {% endblock %} RUN apt-get update \ && apt-get -y upgrade \ && apt-get -y dist-upgrade \ && apt-get -y install --no-install-recommends \ {%- for package in base_apt_packages | customizable('apt_packages') %} {{ package }} \ {%- endfor %} && apt-get clean \ && rm -rf /var/lib/apt/lists/* {% endblock %} {% if base_distro == 'ubuntu' %} RUN sed -i \ -e "s|\('purelib': '\$base/\)local/\(lib/python\$py_version_short/dist-packages',\)|\1\2|" \ -e "s|\('platlib': '\$platbase/\)local/\(lib/python\$py_version_short/dist-packages',\)|\1\2|" \ -e "s|\('headers': '\$base/\)local/\(include/python\$py_version_short/\$dist_name',\)|\1\2|" \ -e "s|\('scripts': '\$base/\)local/\(bin',\)|\1\2|" \ -e "s|\('data' : '\$base\)/local\(',\)|\1\2|" \ /usr/lib/python2.7/distutils/command/install.py \ && rm -rf /usr/lib/python2.7/site-packages \ && ln -s dist-packages /usr/lib/python2.7/site-packages {% endif %} {# endif for base_distro debian, ubuntu #} {% endif %} COPY set_configs.py /usr/local/bin/kolla_set_configs COPY start.sh /usr/local/bin/kolla_start COPY sudoers /etc/sudoers COPY curlrc /root/.curlrc {% block dumb_init_installation %} {% if base_arch == 'x86_64' %} RUN curl -sSL https://github.com/Yelp/dumb-init/releases/download/v1.1.3/dumb-init_1.1.3_amd64 -o /usr/local/bin/dumb-init \ && chmod +x /usr/local/bin/dumb-init {% else %} {{ macros.install_packages(base_compiler_packages) }} RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py \ && python get-pip.py \ && rm get-pip.py \ && pip --no-cache-dir install --prefix='/usr/local' dumb-init==1.1.3 \ && chmod +x /usr/local/bin/dumb-init {% endif %} ENTRYPOINT ["dumb-init", "--single-child", "--"] {% endblock %} RUN touch /usr/local/bin/kolla_extend_start \ && chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs \ && chmod 440 /etc/sudoers \ && mkdir -p /var/log/kolla \ && chown :kolla /var/log/kolla \ && chmod 2775 /var/log/kolla \ && rm -f /tmp/kolla_bashrc {% block base_footer %}{% endblock %} CMD ["kolla_start"]