From 82e36d66566b922c0c1f30c7af186f54590fc931 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 25 Jun 2023 00:09:10 +0000
Subject: [PATCH] feat: include ubuntu_dind Dockerfile
---
.gitlab-ci.yml | 16 ++++++
containers/dind/Dockerfile | 56 ++++++++++++++++++
containers/dind/wrapdocker | 113 +++++++++++++++++++++++++++++++++++++
3 files changed, 185 insertions(+)
create mode 100644 containers/dind/Dockerfile
create mode 100644 containers/dind/wrapdocker
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 70f4f1a4b..987b63a49 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -46,6 +46,7 @@ variables:
stages:
- config
+ - dind
- base ## base OS image
- jug ## jug container images
- deploy ## build/deploy singularity images
@@ -158,6 +159,21 @@ version:
## TODO
## oneapi_runtime + jug_xl --> oneapi_prod
+## Docker-in-docker image
+dind:
+ parallel:
+ matrix:
+ - BUILD_IMAGE: dind
+ extends: .build
+ stage: dind
+ needs:
+ - version
+ script:
+ - docker buildx build --push
+ --tag ${CI_REGISTRY}/${CI_PROJECT_PATH}/${BUILD_IMAGE}:${INTERNAL_TAG}
+ --file containers/dind/Dockerfile
+ containers/dind
+
base:
parallel:
matrix:
diff --git a/containers/dind/Dockerfile b/containers/dind/Dockerfile
new file mode 100644
index 000000000..d85dd985f
--- /dev/null
+++ b/containers/dind/Dockerfile
@@ -0,0 +1,56 @@
+FROM ubuntu:22.04
+LABEL maintainer="Whitney Armstrong <warmstrong@anl.gov>" \
+ name="ubuntu_dind" \
+ group="ubuntu_dind" \
+ march="native" \
+ base="ubuntu" \
+ version="22.04"
+
+RUN apt-get update && \
+ DEBIAN_FRONTEND=noninteractive apt-get install -y \
+ apt-transport-https \
+ binfmt-support \
+ build-essential \
+ ca-certificates \
+ cryptsetup \
+ curl \
+ gettext \
+ git \
+ iptables \
+ libgpgme11-dev \
+ libseccomp-dev \
+ libssl-dev \
+ lxc \
+ make \
+ pkg-config \
+ qemu \
+ qemu-user-static \
+ uuid-dev \
+ squashfs-tools \
+ wget
+
+RUN cd /tmp \
+ && export VERSION=1.15.6 OS=linux ARCH=amd64 && \
+ wget https://dl.google.com/go/go$VERSION.$OS-$ARCH.tar.gz && \
+ tar -C /usr/local -xzvf go$VERSION.$OS-$ARCH.tar.gz && \
+ rm go$VERSION.$OS-$ARCH.tar.gz
+
+RUN cd /tmp \
+ && export PATH=/usr/local/go/bin:$PATH \
+ && export VERSION=3.7.4 && \
+ wget https://github.com/sylabs/singularity/releases/download/v${VERSION}/singularity-${VERSION}.tar.gz && \
+ tar -xzf singularity-${VERSION}.tar.gz && \
+ cd singularity \
+ && ./mconfig && \
+ make -C builddir && \
+ make -C builddir install
+
+# Install Docker from Docker Inc. repositories.
+RUN export VERSION=20.10.17 \
+ && curl -sSL https://get.docker.com/ | sh
+# Install the magic wrapper.
+ADD ./wrapdocker /usr/local/bin/wrapdocker
+RUN chmod +x /usr/local/bin/wrapdocker
+# Define additional metadata for our image.
+VOLUME /var/lib/docker
+CMD ["wrapdocker"]
diff --git a/containers/dind/wrapdocker b/containers/dind/wrapdocker
new file mode 100644
index 000000000..ac927a389
--- /dev/null
+++ b/containers/dind/wrapdocker
@@ -0,0 +1,113 @@
+#!/bin/bash
+
+# Ensure that all nodes in /dev/mapper correspond to mapped devices currently loaded by the device-mapper kernel driver
+dmsetup mknodes
+
+# First, make sure that cgroups are mounted correctly.
+CGROUP=/sys/fs/cgroup
+: {LOG:=stdio}
+
+[ -d $CGROUP ] ||
+ mkdir $CGROUP
+
+mountpoint -q $CGROUP ||
+ mount -n -t tmpfs -o uid=0,gid=0,mode=0755 cgroup $CGROUP || {
+ echo "Could not make a tmpfs mount. Did you use --privileged?"
+ exit 1
+ }
+
+if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security
+then
+ mount -t securityfs none /sys/kernel/security || {
+ echo "Could not mount /sys/kernel/security."
+ echo "AppArmor detection and --privileged mode might break."
+ }
+fi
+
+# Mount the cgroup hierarchies exactly as they are in the parent system.
+for SUBSYS in $(cut -d: -f2 /proc/1/cgroup)
+do
+ [ -d $CGROUP/$SUBSYS ] || mkdir $CGROUP/$SUBSYS
+ mountpoint -q $CGROUP/$SUBSYS ||
+ mount -n -t cgroup -o $SUBSYS cgroup $CGROUP/$SUBSYS
+
+ # The two following sections address a bug which manifests itself
+ # by a cryptic "lxc-start: no ns_cgroup option specified" when
+ # trying to start containers withina container.
+ # The bug seems to appear when the cgroup hierarchies are not
+ # mounted on the exact same directories in the host, and in the
+ # container.
+
+ # Named, control-less cgroups are mounted with "-o name=foo"
+ # (and appear as such under /proc/<pid>/cgroup) but are usually
+ # mounted on a directory named "foo" (without the "name=" prefix).
+ # Systemd and OpenRC (and possibly others) both create such a
+ # cgroup. To avoid the aforementioned bug, we symlink "foo" to
+ # "name=foo". This shouldn't have any adverse effect.
+ echo $SUBSYS | grep -q ^name= && {
+ NAME=$(echo $SUBSYS | sed s/^name=//)
+ ln -s $SUBSYS $CGROUP/$NAME
+ }
+
+ # Likewise, on at least one system, it has been reported that
+ # systemd would mount the CPU and CPU accounting controllers
+ # (respectively "cpu" and "cpuacct") with "-o cpuacct,cpu"
+ # but on a directory called "cpu,cpuacct" (note the inversion
+ # in the order of the groups). This tries to work around it.
+ [ $SUBSYS = cpuacct,cpu ] && ln -s $SUBSYS $CGROUP/cpu,cpuacct
+done
+
+# Note: as I write those lines, the LXC userland tools cannot setup
+# a "sub-container" properly if the "devices" cgroup is not in its
+# own hierarchy. Let's detect this and issue a warning.
+grep -q :devices: /proc/1/cgroup ||
+ echo "WARNING: the 'devices' cgroup should be in its own hierarchy."
+grep -qw devices /proc/1/cgroup ||
+ echo "WARNING: it looks like the 'devices' cgroup is not mounted."
+
+# Now, close extraneous file descriptors.
+pushd /proc/self/fd >/dev/null
+for FD in *
+do
+ case "$FD" in
+ # Keep stdin/stdout/stderr
+ [012])
+ ;;
+ # Nuke everything else
+ *)
+ eval exec "$FD>&-"
+ ;;
+ esac
+done
+popd >/dev/null
+
+
+# If a pidfile is still around (for example after a container restart),
+# delete it so that docker can start.
+rm -rf /var/run/docker.pid
+
+# If we were given a PORT environment variable, start as a simple daemon;
+# otherwise, spawn a shell as well
+if [ "$PORT" ]
+then
+ exec dockerd -H 0.0.0.0:$PORT -H unix:///var/run/docker.sock \
+ $DOCKER_DAEMON_ARGS
+else
+ if [ "$LOG" == "file" ]
+ then
+ dockerd $DOCKER_DAEMON_ARGS &>/var/log/docker.log &
+ else
+ dockerd $DOCKER_DAEMON_ARGS &
+ fi
+ (( timeout = 60 + SECONDS ))
+ until docker info >/dev/null 2>&1
+ do
+ if (( SECONDS >= timeout )); then
+ echo 'Timed out trying to connect to internal docker host.' >&2
+ break
+ fi
+ sleep 1
+ done
+ [[ $1 ]] && exec "$@"
+ exec bash --login
+fi
--
GitLab