winloong
3 years ago
5 changed files with 429 additions and 0 deletions
@ -0,0 +1,145 @@ |
|||
FROM jenkins/inbound-agent:latest-alpine |
|||
|
|||
USER root |
|||
|
|||
RUN sed -i "s@https://dl-cdn.alpinelinux.org/@https://mirrors.huaweicloud.com/@g" /etc/apk/repositories; \ |
|||
apk add --no-cache \ |
|||
ca-certificates \ |
|||
libc6-compat \ |
|||
openssh-client |
|||
|
|||
RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf |
|||
|
|||
ENV DOCKER_VERSION 20.10.15 |
|||
|
|||
RUN set -eux; \ |
|||
\ |
|||
apkArch="$(apk --print-arch)"; \ |
|||
case "$apkArch" in \ |
|||
'x86_64') \ |
|||
url='https://download.docker.com/linux/static/stable/x86_64/docker-20.10.15.tgz'; \ |
|||
;; \ |
|||
'armhf') \ |
|||
url='https://download.docker.com/linux/static/stable/armel/docker-20.10.15.tgz'; \ |
|||
;; \ |
|||
'armv7') \ |
|||
url='https://download.docker.com/linux/static/stable/armhf/docker-20.10.15.tgz'; \ |
|||
;; \ |
|||
'aarch64') \ |
|||
url='https://download.docker.com/linux/static/stable/aarch64/docker-20.10.15.tgz'; \ |
|||
;; \ |
|||
*) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \ |
|||
esac; \ |
|||
\ |
|||
wget -O docker.tgz "$url"; \ |
|||
\ |
|||
tar --extract \ |
|||
--file docker.tgz \ |
|||
--strip-components 1 \ |
|||
--directory /usr/local/bin/ \ |
|||
; \ |
|||
rm docker.tgz; \ |
|||
\ |
|||
dockerd --version; \ |
|||
docker --version |
|||
|
|||
COPY modprobe.sh /usr/local/bin/modprobe |
|||
COPY docker-entrypoint.sh /usr/local/bin/ |
|||
|
|||
ENV DOCKER_TLS_CERTDIR=/certs |
|||
RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client |
|||
|
|||
#ENTRYPOINT ["docker-entrypoint.sh"] |
|||
#CMD ["sh"] |
|||
|
|||
RUN set -eux; \ |
|||
apk add --no-cache \ |
|||
btrfs-progs \ |
|||
e2fsprogs \ |
|||
e2fsprogs-extra \ |
|||
ip6tables \ |
|||
iptables \ |
|||
openssl \ |
|||
shadow-uidmap \ |
|||
xfsprogs \ |
|||
xz \ |
|||
pigz \ |
|||
; \ |
|||
if zfs="$(apk info --no-cache --quiet zfs)" && [ -n "$zfs" ]; then \ |
|||
apk add --no-cache zfs; \ |
|||
fi |
|||
|
|||
ENV DIND_COMMIT 42b1175eda071c0e9121e1d64345928384a93df1 |
|||
RUN set -eux; \ |
|||
addgroup -S dockremap; \ |
|||
adduser -S -G dockremap dockremap; \ |
|||
echo 'dockremap:165536:65536' >> /etc/subuid; \ |
|||
echo 'dockremap:165536:65536' >> /etc/subgid; \ |
|||
wget -O /usr/local/bin/dind "https://raw.githubusercontent.com/docker/docker/${DIND_COMMIT}/hack/dind"; \ |
|||
chmod +x /usr/local/bin/dind; \ |
|||
sed -i '40i\nohup dockerd-entrypoint.sh > nohup.out 2>&1 &' /usr/local/bin/jenkins-agent; \ |
|||
mkdir -p /root/.docker; \ |
|||
echo $'{ \n\ |
|||
"auths": { \n\ |
|||
"repository.anxinyun.cn": { \n\ |
|||
"auth": "YWRtaW46SGFyYm9yMTIzNDU=" \n\ |
|||
} \n\ |
|||
} \n\ |
|||
}' >> /root/.docker/config.json |
|||
|
|||
COPY dockerd-entrypoint.sh /usr/local/bin/ |
|||
|
|||
VOLUME /var/lib/docker |
|||
EXPOSE 2375 2376 |
|||
|
|||
#ENTRYPOINT ["dockerd-entrypoint.sh"] |
|||
#CMD [] |
|||
|
|||
#RUN apk add --no-cache iproute2 |
|||
# |
|||
#RUN mkdir /run/user && chmod 1777 /run/user |
|||
# |
|||
#RUN set -eux; \ |
|||
# echo 'jenkins:100000:65536' >> /etc/subuid; \ |
|||
# echo 'jenkins:100000:65536' >> /etc/subgid |
|||
# |
|||
#RUN set -eux; \ |
|||
# \ |
|||
# apkArch="$(apk --print-arch)"; \ |
|||
# case "$apkArch" in \ |
|||
# 'x86_64') \ |
|||
# url='https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-20.10.15.tgz'; \ |
|||
# ;; \ |
|||
# 'aarch64') \ |
|||
# url='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-20.10.15.tgz'; \ |
|||
# ;; \ |
|||
# *) echo >&2 "error: unsupported architecture ($apkArch)"; exit 1 ;; \ |
|||
# esac; \ |
|||
# \ |
|||
# wget -O rootless.tgz "$url"; \ |
|||
# \ |
|||
# tar --extract \ |
|||
# --file rootless.tgz \ |
|||
# --strip-components 1 \ |
|||
# --directory /usr/local/bin/ \ |
|||
# 'docker-rootless-extras/rootlesskit' \ |
|||
# 'docker-rootless-extras/rootlesskit-docker-proxy' \ |
|||
# 'docker-rootless-extras/vpnkit' \ |
|||
# ; \ |
|||
# rm rootless.tgz; \ |
|||
# \ |
|||
# rootlesskit --version; \ |
|||
# vpnkit --version |
|||
# |
|||
## pre-create "/var/lib/docker" for our rootless user |
|||
#RUN set -eux; \ |
|||
# mkdir -p /home/jenkins/.local/share/docker; \ |
|||
# chown -R jenkins:jenkins /home/jenkins/.local/share/docker; \ |
|||
# sed -i '40i\nohup dockerd-entrypoint.sh > nohup.out 2>&1 &' /usr/local/bin/jenkins-agent |
|||
#VOLUME /home/jenkins/.local/share/docker |
|||
|
|||
|
|||
|
|||
#USER jenkins |
|||
|
|||
|
|||
@ -0,0 +1,61 @@ |
|||
#!/bin/sh |
|||
set -eu |
|||
|
|||
# first arg is `-f` or `--some-option` |
|||
if [ "${1#-}" != "$1" ]; then |
|||
set -- docker "$@" |
|||
fi |
|||
|
|||
# if our command is a valid Docker subcommand, let's invoke it through Docker instead |
|||
# (this allows for "docker run docker ps", etc) |
|||
if docker help "$1" > /dev/null 2>&1; then |
|||
set -- docker "$@" |
|||
fi |
|||
|
|||
_should_tls() { |
|||
[ -n "${DOCKER_TLS_CERTDIR:-}" ] \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/client/ca.pem" ] \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/client/cert.pem" ] \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/client/key.pem" ] |
|||
} |
|||
|
|||
# if we have no DOCKER_HOST but we do have the default Unix socket (standard or rootless), use it explicitly |
|||
if [ -z "${DOCKER_HOST:-}" ] && [ -S /var/run/docker.sock ]; then |
|||
export DOCKER_HOST=unix:///var/run/docker.sock |
|||
elif [ -z "${DOCKER_HOST:-}" ] && XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}" && [ -S "$XDG_RUNTIME_DIR/docker.sock" ]; then |
|||
export DOCKER_HOST="unix://$XDG_RUNTIME_DIR/docker.sock" |
|||
fi |
|||
|
|||
# if DOCKER_HOST isn't set (no custom setting, no default socket), let's set it to a sane remote value |
|||
if [ -z "${DOCKER_HOST:-}" ]; then |
|||
if _should_tls || [ -n "${DOCKER_TLS_VERIFY:-}" ]; then |
|||
export DOCKER_HOST='tcp://docker:2376' |
|||
else |
|||
export DOCKER_HOST='tcp://docker:2375' |
|||
fi |
|||
fi |
|||
if [ "${DOCKER_HOST#tcp:}" != "$DOCKER_HOST" ] \ |
|||
&& [ -z "${DOCKER_TLS_VERIFY:-}" ] \ |
|||
&& [ -z "${DOCKER_CERT_PATH:-}" ] \ |
|||
&& _should_tls \ |
|||
; then |
|||
export DOCKER_TLS_VERIFY=1 |
|||
export DOCKER_CERT_PATH="$DOCKER_TLS_CERTDIR/client" |
|||
fi |
|||
|
|||
if [ "$1" = 'dockerd' ]; then |
|||
cat >&2 <<-'EOW' |
|||
|
|||
������ Hey there! It looks like you're trying to run a Docker daemon. |
|||
|
|||
You probably should use the "dind" image variant instead, something like: |
|||
|
|||
docker run --privileged --name some-docker ... docker:dind ... |
|||
|
|||
See https://hub.docker.com/_/docker/ for more documentation and usage examples. |
|||
|
|||
EOW |
|||
sleep 3 |
|||
fi |
|||
|
|||
exec "$@" |
|||
@ -0,0 +1,198 @@ |
|||
#!/bin/sh |
|||
set -eu |
|||
|
|||
_tls_ensure_private() { |
|||
local f="$1"; shift |
|||
[ -s "$f" ] || openssl genrsa -out "$f" 4096 |
|||
} |
|||
_tls_san() { |
|||
{ |
|||
ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }' |
|||
{ |
|||
cat /etc/hostname |
|||
echo 'docker' |
|||
echo 'localhost' |
|||
hostname -f |
|||
hostname -s |
|||
} | sed 's/^/DNS:/' |
|||
[ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN" |
|||
} | sort -u | xargs printf '%s,' | sed "s/,\$//" |
|||
} |
|||
_tls_generate_certs() { |
|||
local dir="$1"; shift |
|||
|
|||
# if ca/key.pem || !ca/cert.pem, generate CA public if necessary |
|||
# if ca/key.pem, generate server public |
|||
# if ca/key.pem, generate client public |
|||
# (regenerating public certs every startup to account for SAN/IP changes and/or expiration) |
|||
|
|||
# https://github.com/FiloSottile/mkcert/issues/174 |
|||
local certValidDays='825' |
|||
|
|||
if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then |
|||
# if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA |
|||
mkdir -p "$dir/ca" |
|||
_tls_ensure_private "$dir/ca/key.pem" |
|||
openssl req -new -key "$dir/ca/key.pem" \ |
|||
-out "$dir/ca/cert.pem" \ |
|||
-subj '/CN=docker:dind CA' -x509 -days "$certValidDays" |
|||
fi |
|||
|
|||
if [ -s "$dir/ca/key.pem" ]; then |
|||
# if we have a CA private key, we should create/manage a server key |
|||
mkdir -p "$dir/server" |
|||
_tls_ensure_private "$dir/server/key.pem" |
|||
openssl req -new -key "$dir/server/key.pem" \ |
|||
-out "$dir/server/csr.pem" \ |
|||
-subj '/CN=docker:dind server' |
|||
cat > "$dir/server/openssl.cnf" <<-EOF |
|||
[ x509_exts ] |
|||
subjectAltName = $(_tls_san) |
|||
EOF |
|||
openssl x509 -req \ |
|||
-in "$dir/server/csr.pem" \ |
|||
-CA "$dir/ca/cert.pem" \ |
|||
-CAkey "$dir/ca/key.pem" \ |
|||
-CAcreateserial \ |
|||
-out "$dir/server/cert.pem" \ |
|||
-days "$certValidDays" \ |
|||
-extfile "$dir/server/openssl.cnf" \ |
|||
-extensions x509_exts |
|||
cp "$dir/ca/cert.pem" "$dir/server/ca.pem" |
|||
openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem" |
|||
fi |
|||
|
|||
if [ -s "$dir/ca/key.pem" ]; then |
|||
# if we have a CA private key, we should create/manage a client key |
|||
mkdir -p "$dir/client" |
|||
_tls_ensure_private "$dir/client/key.pem" |
|||
chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts |
|||
openssl req -new \ |
|||
-key "$dir/client/key.pem" \ |
|||
-out "$dir/client/csr.pem" \ |
|||
-subj '/CN=docker:dind client' |
|||
cat > "$dir/client/openssl.cnf" <<-'EOF' |
|||
[ x509_exts ] |
|||
extendedKeyUsage = clientAuth |
|||
EOF |
|||
openssl x509 -req \ |
|||
-in "$dir/client/csr.pem" \ |
|||
-CA "$dir/ca/cert.pem" \ |
|||
-CAkey "$dir/ca/key.pem" \ |
|||
-CAcreateserial \ |
|||
-out "$dir/client/cert.pem" \ |
|||
-days "$certValidDays" \ |
|||
-extfile "$dir/client/openssl.cnf" \ |
|||
-extensions x509_exts |
|||
cp "$dir/ca/cert.pem" "$dir/client/ca.pem" |
|||
openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem" |
|||
fi |
|||
} |
|||
|
|||
# no arguments passed |
|||
# or first arg is `-f` or `--some-option` |
|||
if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then |
|||
# set "dockerSocket" to the default "--host" *unix socket* value (for both standard or rootless) |
|||
uid="$(id -u)" |
|||
if [ "$uid" = '0' ]; then |
|||
dockerSocket='unix:///var/run/docker.sock' |
|||
else |
|||
# if we're not root, we must be trying to run rootless |
|||
: "${XDG_RUNTIME_DIR:=/run/user/$uid}" |
|||
dockerSocket="unix://$XDG_RUNTIME_DIR/docker.sock" |
|||
fi |
|||
case "${DOCKER_HOST:-}" in |
|||
unix://*) |
|||
dockerSocket="$DOCKER_HOST" |
|||
;; |
|||
esac |
|||
|
|||
# add our default arguments |
|||
if [ -n "${DOCKER_TLS_CERTDIR:-}" ] \ |
|||
&& _tls_generate_certs "$DOCKER_TLS_CERTDIR" \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/server/ca.pem" ] \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/server/cert.pem" ] \ |
|||
&& [ -s "$DOCKER_TLS_CERTDIR/server/key.pem" ] \ |
|||
; then |
|||
# generate certs and use TLS if requested/possible (default in 19.03+) |
|||
set -- dockerd \ |
|||
--host="$dockerSocket" \ |
|||
--host=tcp://0.0.0.0:2376 \ |
|||
--tlsverify \ |
|||
--tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ |
|||
--tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ |
|||
--tlskey "$DOCKER_TLS_CERTDIR/server/key.pem" \ |
|||
"$@" |
|||
DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2376:2376/tcp" |
|||
else |
|||
# TLS disabled (-e DOCKER_TLS_CERTDIR='') or missing certs |
|||
set -- dockerd \ |
|||
--host="$dockerSocket" \ |
|||
--host=tcp://0.0.0.0:2375 \ |
|||
"$@" |
|||
DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" |
|||
fi |
|||
fi |
|||
|
|||
if [ "$1" = 'dockerd' ]; then |
|||
# explicitly remove Docker's default PID file to ensure that it can start properly if it was stopped uncleanly (and thus didn't clean up the PID file) |
|||
find /run /var/run -iname 'docker*.pid' -delete || : |
|||
|
|||
if dockerd --version | grep -qF ' 20.10.'; then |
|||
# XXX inject "docker-init" (tini) as pid1 to workaround https://github.com/docker-library/docker/issues/318 (zombie container-shim processes) |
|||
set -- docker-init -- "$@" |
|||
fi |
|||
|
|||
if ! iptables -nL > /dev/null 2>&1; then |
|||
# if iptables fails to run, chances are high the necessary kernel modules aren't loaded (perhaps the host is using nftables with the translating "iptables" wrappers, for example) |
|||
# https://github.com/docker-library/docker/issues/350 |
|||
# https://github.com/moby/moby/issues/26824 |
|||
modprobe ip_tables || : |
|||
fi |
|||
|
|||
uid="$(id -u)" |
|||
if [ "$uid" != '0' ]; then |
|||
# if we're not root, we must be trying to run rootless |
|||
if ! command -v rootlesskit > /dev/null; then |
|||
echo >&2 "error: attempting to run rootless dockerd but missing 'rootlesskit' (perhaps the 'docker:dind-rootless' image variant is intended?)" |
|||
exit 1 |
|||
fi |
|||
user="$(id -un 2>/dev/null || :)" |
|||
if ! grep -qE "^($uid${user:+|$user}):" /etc/subuid || ! grep -qE "^($uid${user:+|$user}):" /etc/subgid; then |
|||
echo >&2 "error: attempting to run rootless dockerd but missing necessary entries in /etc/subuid and/or /etc/subgid for $uid" |
|||
exit 1 |
|||
fi |
|||
: "${XDG_RUNTIME_DIR:=/run/user/$uid}" |
|||
export XDG_RUNTIME_DIR |
|||
if ! mkdir -p "$XDG_RUNTIME_DIR" || [ ! -w "$XDG_RUNTIME_DIR" ] || ! mkdir -p "$HOME/.local/share/docker" || [ ! -w "$HOME/.local/share/docker" ]; then |
|||
echo >&2 "error: attempting to run rootless dockerd but need writable HOME ($HOME) and XDG_RUNTIME_DIR ($XDG_RUNTIME_DIR) for user $uid" |
|||
exit 1 |
|||
fi |
|||
if [ -f /proc/sys/kernel/unprivileged_userns_clone ] && unprivClone="$(cat /proc/sys/kernel/unprivileged_userns_clone)" && [ "$unprivClone" != '1' ]; then |
|||
echo >&2 "error: attempting to run rootless dockerd but need 'kernel.unprivileged_userns_clone' (/proc/sys/kernel/unprivileged_userns_clone) set to 1" |
|||
exit 1 |
|||
fi |
|||
if [ -f /proc/sys/user/max_user_namespaces ] && maxUserns="$(cat /proc/sys/user/max_user_namespaces)" && [ "$maxUserns" = '0' ]; then |
|||
echo >&2 "error: attempting to run rootless dockerd but need 'user.max_user_namespaces' (/proc/sys/user/max_user_namespaces) set to a sufficiently large value" |
|||
exit 1 |
|||
fi |
|||
# TODO overlay support detection? |
|||
exec rootlesskit \ |
|||
--net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \ |
|||
--mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \ |
|||
--disable-host-loopback \ |
|||
--port-driver=builtin \ |
|||
--copy-up=/etc \ |
|||
--copy-up=/run \ |
|||
${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \ |
|||
"$@" |
|||
elif [ -x '/usr/local/bin/dind' ]; then |
|||
# if we have the (mostly defunct now) Docker-in-Docker wrapper script, use it |
|||
set -- '/usr/local/bin/dind' "$@" |
|||
fi |
|||
else |
|||
# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too |
|||
set -- docker-entrypoint.sh "$@" |
|||
fi |
|||
|
|||
exec "$@" |
|||
@ -0,0 +1,5 @@ |
|||
#!/bin/sh |
|||
|
|||
nohup dockerd-entrypoint.sh > nohup.out 2>&1 & |
|||
/usr/local/bin/jenkins-agent |
|||
|
|||
@ -0,0 +1,20 @@ |
|||
#!/bin/sh |
|||
set -eu |
|||
|
|||
# "modprobe" without modprobe |
|||
# https://twitter.com/lucabruno/status/902934379835662336 |
|||
|
|||
# this isn't 100% fool-proof, but it'll have a much higher success rate than simply using the "real" modprobe |
|||
|
|||
# Docker often uses "modprobe -va foo bar baz" |
|||
# so we ignore modules that start with "-" |
|||
for module; do |
|||
if [ "${module#-}" = "$module" ]; then |
|||
ip link show "$module" || true |
|||
lsmod | grep "$module" || true |
|||
fi |
|||
done |
|||
|
|||
# remove /usr/local/... from PATH so we can exec the real modprobe as a last resort |
|||
export PATH='/usr/sbin:/usr/bin:/sbin:/bin' |
|||
exec modprobe "$@" |
|||
Reference in new issue