6cf5928ff1
The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root
177 lines
5.8 KiB
Django/Jinja
177 lines
5.8 KiB
Django/Jinja
FROM {{ base_distro }}:{{ base_distro_tag }}
|
|
MAINTAINER Kolla Project (https://launchpad.net/kolla)
|
|
|
|
# Early failure for bases and types
|
|
{% if base_distro in ['fedora', 'centos', 'oraclelinux', 'rhel'] %}
|
|
{% if install_type not in ['source', 'binary', 'rdo', 'rhel'] %}
|
|
|
|
RUN echo 'ERROR: {{ install_type }} is unavailable for {{ base_distro }}' \
|
|
&& /bin/false
|
|
|
|
{% endif %}
|
|
{% elif base_distro in ['ubuntu', 'debian'] %}
|
|
{% if install_type not in ['source'] %}
|
|
|
|
RUN echo 'ERROR: {{ install_type }} is unavailable for {{ base_distro }}' \
|
|
&& /bin/false
|
|
|
|
{% endif %}
|
|
{% else %}
|
|
|
|
RUN echo 'ERROR: The specified distro has no Kolla images to build: "{{ base_distro }}"' \
|
|
&& /bin/false
|
|
|
|
{% endif %}
|
|
|
|
|
|
{{ include_header }}
|
|
|
|
ENV KOLLA_BASE_DISTRO {{ base_distro }}
|
|
ENV KOLLA_INSTALL_TYPE {{ install_type }}
|
|
ENV KOLLA_INSTALL_METATYPE {{ install_metatype }}
|
|
|
|
# For RPM Variants, enable the correct repositories - this should all be done
|
|
# in the base image so repos are consistent throughout the system. This also
|
|
# enables to provide repo overrides at a later date in a simple fashion if we
|
|
# desire such functionality. I think we will :)
|
|
|
|
{% if base_distro in ['fedora', 'centos', 'oraclelinux', 'rhel'] %}
|
|
|
|
#### BEGIN REPO ENABLEMENT
|
|
|
|
# Turns on MariaDB repos throughout the RPM build
|
|
COPY mariadb.yum.repo /etc/yum.repos.d/MariaDB.repo
|
|
|
|
COPY ceph.yum.repo /etc/yum.repos.d/ceph.repo
|
|
|
|
RUN yum -y install http://repo.percona.com/release/7/RPMS/x86_64/percona-release-0.1-3.noarch.rpm
|
|
|
|
{% if install_metatype in ['rdo', 'mixed'] %}
|
|
|
|
# These repos provide latest packages built from trunk master into RPMs
|
|
RUN curl http://trunk.rdoproject.org/centos7/current/delorean.repo -o /etc/yum.repos.d/delorean.repo
|
|
RUN curl http://trunk.rdoproject.org/centos7/delorean-deps.repo -o /etc/yum.repos.d/delorean-deps.repo
|
|
|
|
{% endif %}
|
|
# endif for repo setup for all RHEL except RHEL OSP
|
|
|
|
{% if install_metatype == 'rhos' %}
|
|
|
|
# Turn on the RHOS 7.0 repo for RHOS
|
|
RUN yum-config-manager --enable rhel-7-server-rpms \
|
|
&& yum-config-manager --enable rhel-7-server-openstack-7.0-rpms
|
|
|
|
{% endif %}
|
|
|
|
{% if base_distro == 'centos' %}
|
|
|
|
# CentOS 7.1 workaround for conflicting packages with libvirt
|
|
RUN rpm -e --nodeps systemd-container systemd-container-libs \
|
|
&& rpm -e --nodeps yum-plugin-fastestmirror \
|
|
&& yum -y install systemd systemd-libs systemd-devel \
|
|
&& yum install -y epel-release \
|
|
&& yum clean all
|
|
|
|
{% endif %}
|
|
# Endif for base_distro centos
|
|
|
|
{% if base_distro == 'rhel' %}
|
|
|
|
# Enable couple required repositories for all RHEL builds
|
|
# Turn on EPEL throughout the build
|
|
RUN yum install -y \
|
|
https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \
|
|
&& yum clean all \
|
|
&& yum-config-manager --enable rhel-7-server-optional-rpms \
|
|
&& yum-config-manager --enable rhel-7-server-extras-rpms
|
|
|
|
{% endif %}
|
|
# Endif for base_distro RHEL
|
|
|
|
{% if base_distro == 'oraclelinux' %}
|
|
|
|
RUN yum install -y \
|
|
yum-utils \
|
|
https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm \
|
|
&& yum clean all
|
|
RUN yum-config-manager --enable ol7_optional_latest ol7_addons
|
|
|
|
{% endif %}
|
|
# Endif for base_distro oraclelinux
|
|
|
|
{% if base_distro == 'fedora' %}
|
|
|
|
# Set up repositories
|
|
RUN yum install -y https://rdo.fedorapeople.org/rdo-release.rpm \
|
|
&& yum -y install dnf dnf-plugins-core \
|
|
&& yum clean all
|
|
|
|
{% endif %}
|
|
# Endif for base_distro fedora
|
|
|
|
#### END REPO ENABLEMENT
|
|
|
|
# We are back to the basic if conditional here which is:
|
|
# if base_distro in ['fedora', 'centos', 'oraclelinux', 'rhel']
|
|
|
|
RUN yum update -y \
|
|
&& yum clean all
|
|
|
|
{% if install_type == 'binary' %}
|
|
|
|
# Install base packages
|
|
RUN yum install -y \
|
|
sudo \
|
|
which \
|
|
&& yum clean all
|
|
|
|
{% endif %}
|
|
# Endif for install_type binary
|
|
|
|
{% if install_type == 'source' %}
|
|
|
|
# Update packages
|
|
RUN yum -y install \
|
|
curl \
|
|
sudo \
|
|
tar \
|
|
which \
|
|
&& yum clean all
|
|
|
|
# endif for install type is source for RPM based distros
|
|
{% endif %}
|
|
# endif for base_distro centos,fedora,oraclelinux,rhel
|
|
{% elif base_distro in ['ubuntu', 'debian'] %}
|
|
|
|
# This will prevent questions from being asked during the install
|
|
ENV DEBIAN_FRONTEND noninteractive
|
|
|
|
COPY sources.list /etc/apt/
|
|
|
|
RUN apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 199369E5404BD5FC7D2FE43BCBCB082A1BB943DB \
|
|
&& apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 391A9AA2147192839E9DB0315EDB1B62EC4926EA \
|
|
&& apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 430BDF5C56E7C94E848EE60C1C4CBDCDCD2EFD2A \
|
|
&& apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get dist-upgrade -y \
|
|
&& apt-get install -y --no-install-recommends \
|
|
python \
|
|
curl \
|
|
&& apt-get clean \
|
|
&& sed -i "s|'purelib': '\$base/local/lib/python\$py_version_short/dist-packages',|'purelib': '\$base/lib/python\$py_version_short/dist-packages',|;s|'platlib': '\$platbase/local/lib/python\$py_version_short/dist-packages',|'platlib': '\$platbase/lib/python\$py_version_short/dist-packages',|;s|'headers': '\$base/local/include/python\$py_version_short/\$dist_name',|'headers': '\$base/include/python\$py_version_short/\$dist_name',|;s|'scripts': '\$base/local/bin',|'scripts': '\$base/bin',|;s|'data' : '\$base/local',|'data' : '\$base',|" /usr/lib/python2.7/distutils/command/install.py \
|
|
&& rm -rf /usr/lib/python2.7/site-packages \
|
|
&& ln -s dist-packages /usr/lib/python2.7/site-packages
|
|
|
|
|
|
{% endif %}
|
|
|
|
COPY set_configs.py /usr/local/bin/kolla_set_configs
|
|
COPY start.sh /usr/local/bin/kolla_start
|
|
COPY sudoers /etc/sudoers
|
|
RUN touch /usr/local/bin/kolla_extend_start \
|
|
&& chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs \
|
|
&& chmod 440 /etc/sudoers \
|
|
&& groupadd kolla
|
|
|
|
CMD ["kolla_start"]
|