Skip to content
Snippets Groups Projects
Commit fe9c7e4b authored by Wouter Deconinck's avatar Wouter Deconinck
Browse files

feat: rm unused dind files

parent 0f0cbf52
No related branches found
No related tags found
1 merge request!714feat: rm unused dind files
FROM ubuntu:22.04
LABEL maintainer="Whitney Armstrong <warmstrong@anl.gov>" \
name="ubuntu_dind" \
group="ubuntu_dind" \
march="native" \
base="ubuntu" \
version="22.04"
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y \
apt-transport-https \
binfmt-support \
build-essential \
ca-certificates \
cryptsetup \
curl \
gettext \
git \
iptables \
libglib2.0-dev \
libgpgme11-dev \
libseccomp-dev \
libssl-dev \
lxc \
make \
pkg-config \
qemu \
qemu-user-static \
uuid-dev \
squashfs-tools \
wget
# Install Go
ARG GO_OS=linux
ARG GO_ARCH=amd64
ARG GO_VERSION=1.20.5
ARG GO_URL=https://dl.google.com/go/go${GO_VERSION}.${GO_OS}-${GO_ARCH}.tar.gz
RUN curl -L ${GO_URL} | tar -C /usr/local -xzvf -
# Install Singularity CE
ARG SINGULARITY_VERSION=3.11.4
ARG SINGULARITY_URL=https://github.com/sylabs/singularity/releases/download/v${SINGULARITY_VERSION}/singularity-ce-${SINGULARITY_VERSION}.tar.gz
RUN curl -L ${SINGULARITY_URL} | tar -C /tmp -xzf - \
&& cd /tmp/singularity-ce-${SINGULARITY_VERSION} \
&& export PATH=/usr/local/go/bin:$PATH \
&& ./mconfig \
&& make -C builddir \
&& make -C builddir install \
&& rm -rf /tmp/singularity-ce-${SINGULARITY_VERSION}
# Install Docker
ARG DOCKER_VERSION=24
ADD https://get.docker.com/ /tmp/get-docker.sh
RUN bash /tmp/get-docker.sh --version ${DOCKER_VERSION}
# Install the magic wrapper.
ADD --chmod=0755 wrapdocker /usr/local/bin/wrapdocker
# Define additional metadata for our image.
VOLUME /var/lib/docker
CMD ["wrapdocker"]
#!/bin/bash
# Ensure that all nodes in /dev/mapper correspond to mapped devices currently loaded by the device-mapper kernel driver
dmsetup mknodes
# First, make sure that cgroups are mounted correctly.
CGROUP=/sys/fs/cgroup
: {LOG:=stdio}
[ -d $CGROUP ] ||
mkdir $CGROUP
mountpoint -q $CGROUP ||
mount -n -t tmpfs -o uid=0,gid=0,mode=0755 cgroup $CGROUP || {
echo "Could not make a tmpfs mount. Did you use --privileged?"
exit 1
}
if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security
then
mount -t securityfs none /sys/kernel/security || {
echo "Could not mount /sys/kernel/security."
echo "AppArmor detection and --privileged mode might break."
}
fi
# Mount the cgroup hierarchies exactly as they are in the parent system.
for SUBSYS in $(cut -d: -f2 /proc/1/cgroup)
do
[ -d $CGROUP/$SUBSYS ] || mkdir $CGROUP/$SUBSYS
mountpoint -q $CGROUP/$SUBSYS ||
mount -n -t cgroup -o $SUBSYS cgroup $CGROUP/$SUBSYS
# The two following sections address a bug which manifests itself
# by a cryptic "lxc-start: no ns_cgroup option specified" when
# trying to start containers withina container.
# The bug seems to appear when the cgroup hierarchies are not
# mounted on the exact same directories in the host, and in the
# container.
# Named, control-less cgroups are mounted with "-o name=foo"
# (and appear as such under /proc/<pid>/cgroup) but are usually
# mounted on a directory named "foo" (without the "name=" prefix).
# Systemd and OpenRC (and possibly others) both create such a
# cgroup. To avoid the aforementioned bug, we symlink "foo" to
# "name=foo". This shouldn't have any adverse effect.
echo $SUBSYS | grep -q ^name= && {
NAME=$(echo $SUBSYS | sed s/^name=//)
ln -s $SUBSYS $CGROUP/$NAME
}
# Likewise, on at least one system, it has been reported that
# systemd would mount the CPU and CPU accounting controllers
# (respectively "cpu" and "cpuacct") with "-o cpuacct,cpu"
# but on a directory called "cpu,cpuacct" (note the inversion
# in the order of the groups). This tries to work around it.
[ $SUBSYS = cpuacct,cpu ] && ln -s $SUBSYS $CGROUP/cpu,cpuacct
done
# Note: as I write those lines, the LXC userland tools cannot setup
# a "sub-container" properly if the "devices" cgroup is not in its
# own hierarchy. Let's detect this and issue a warning.
grep -q :devices: /proc/1/cgroup ||
echo "WARNING: the 'devices' cgroup should be in its own hierarchy."
grep -qw devices /proc/1/cgroup ||
echo "WARNING: it looks like the 'devices' cgroup is not mounted."
# Now, close extraneous file descriptors.
pushd /proc/self/fd >/dev/null
for FD in *
do
case "$FD" in
# Keep stdin/stdout/stderr
[012])
;;
# Nuke everything else
*)
eval exec "$FD>&-"
;;
esac
done
popd >/dev/null
# If a pidfile is still around (for example after a container restart),
# delete it so that docker can start.
rm -rf /var/run/docker.pid
# If we were given a PORT environment variable, start as a simple daemon;
# otherwise, spawn a shell as well
if [ "$PORT" ]
then
exec dockerd -H 0.0.0.0:$PORT -H unix:///var/run/docker.sock \
$DOCKER_DAEMON_ARGS
else
if [ "$LOG" == "file" ]
then
dockerd $DOCKER_DAEMON_ARGS &>/var/log/docker.log &
else
dockerd $DOCKER_DAEMON_ARGS &
fi
(( timeout = 60 + SECONDS ))
until docker info >/dev/null 2>&1
do
if (( SECONDS >= timeout )); then
echo 'Timed out trying to connect to internal docker host.' >&2
break
fi
sleep 1
done
[[ $1 ]] && exec "$@"
exec bash --login
fi
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment