Moving towards fewer external dependencies, aiming for only systemd being
external so it's the only complicated thing we need to do things like try
pulling from the host or building from source when not deriving stage1 from
a CoreOS image.
prepare-app runs in stage1, so it knows how to handle dynamic
/dev/console.
It does not change diagexec so it does not break rkt enter.
Bind mount individual /dev entries instead of bind mounting the /dev
directory so rkt run --volume /dev/sda6 (performed in stage0) should
still work.
Do not use a bunch of systemd mount units because they don't create
nonexistent target files. See:
http://lists.freedesktop.org/archives/systemd-devel/2015-February/028657.html
We might revisit this option if systemd mount units automatically create
the nonexistent target files.
Avoid systemd option PrivateDevices to avoid shadowing additional bind
mounts passed with --volume.
Currently the annotation "coreos.com/rocket/stage1/init" represents the stage1
entrypoint used by `rkt run`. Renaming to "coreos.com/rocket/stage1/run" is
more consistent and self-documenting, aligning with the `rkt enter` entrypoint
annotation "coreos.com/rocket/stage1/enter".
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
This change places per-app environment files in stage1/rootfs/rkt/env/$id
The stage1 systemd service files no longer contain Environment directives,
instead they simply supply the env file path to diagexec.
`rkt enter` also uses diagexec and needs to enter the same enviroment of the
app being entered. This commit also modifies the stage1 /enter to supply the
env file to its diagexec invocation, giving `rkt enter` an environment
consistent with the app's.
One may now specify an alternative stage1 in a style like run and fetch:
rkt run --stage1-image foo.com/rocket/stage1 app
--stage1-image defaults to "stage1.aci" within the same directory as the rkt
binary. This is discovered at runtime via "/proc/self/exe"; as long as the rkt
executable and stage1.aci share a directory it should "just work" regardless of
the directory's location and where rkt is executed from.
* usr/Makefile lacked dependency on manifest.d
* aggregate/Makefile lacked dependency on discrete components:
- Introduce aggregate/install.d registry of ordered component installers
- Add Makefile dependency on aggregate/install.d/*
- Amend discrete component's Makefiles to register their installation
as aggregate/install.d/$prio$component scripts sourced by aggregate.sh
These changes cause aggregate to occur when any discrete component is built
in an incremental rootfs build. Otherwise discrete components would be built
without getting pulled into a (re)built rootfs.
Use /diagexec for launching the container's apps to assist understanding
execution interpreter problems. No substantial overhead is introduced in the
normal/success case, diagnostics are only attempted when execv() of the target
fails.
Examples of the assistance provided:
~# bin/rkt run imgs/nobash.aci # bash script without /bin/bash
Error: Unable to open "/bin/bash": No such file or directory
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Unmounting file systems.
Unmounting /proc/sys/kernel/random/boot_id.
All filesystems unmounted.
Halting system.
~# bin/rkt run imgs/noexec.aci # file with no execute bits
Error: "/noexec.sh" is not executable
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Unmounting file systems.
Unmounting /proc/sys/kernel/random/boot_id.
All filesystems unmounted.
Halting system.
~# bin/rkt run imgs/noldlinux.aci # ELF program without interp
Error: Unable to open "/lib64/ld-linux-x86-64.so.2": No such file or directory
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Unmounting file systems.
Unmounting /proc/sys/kernel/random/boot_id.
All filesystems unmounted.
Halting system.
~# bin/rkt run imgs/noldlinuxbash.aci # script with bash without ELF interp
Error: Unable to open "/lib64/ld-linux-x86-64.so.2": No such file or directory
Sending SIGTERM to remaining processes...
Sending SIGKILL to remaining processes...
Unmounting file systems.
Unmounting /proc/sys/kernel/random/boot_id.
All filesystems unmounted.
Halting system.
Fixes#286
* Move stage1/*.go to stage1/init/
* Split stage1/mkrootfs.sh's logical components into subdirs of
stage1/rootfs:
- Deriving tree from CoreOS image and caching: rootfs/usr
* Cache management in cache.sh
* File extraction and picking in mkbase.sh
* File inclusions split under usr/manifest.d
- Fakesdboot: rootfs/shim/
* Renamed to 'shim' since we've gone past just tricking nspawn
- Root compositing and aggregation of odds and ends: rootfs/aggregate
* Introduction of Makefiles for every component and a simple recursive
parallel-capable make for the rootfs tip.
* Update toplevel build script to invoke make on stage1/rootfs and find
init sources in stage1/init, .gitignore additions as well.
* Removed stage1/mkrootfs.sh
Since the image cache has moved there will be an image download on first build
in the new arrangement. The caching has also been improved to handle CoreOS
image revision changes by naming the cached signature with a hash of the URL.
Brandon Philips