This refactor will make it easier to integrate lkvm support, and also
brings other benefits.
Specifically, with this refactor almost all functionality of stage1
init is flavor independent and can be fully controlled via a manifest
and uses as little hard coded paths as possible.
Thus, e.g. distribution packagers, can create package which will only
have rkt/stage1 provided binaries (gc, waiter, init, etc.) and specify
the rest of things in the manifest (path to nspawn, ld.so, LD LIBRARY
PATH, libfakesdbooted.so, etc). And create fully free-standing
stage1.aci by simply creating basic distribution chroot with
distro-native tools and supplying a matching/correct aci-manifest. By
fully free-standing, I mean similar to current coreos flavor, which is
completely independent of the host OS binaries & load paths and is
truly run everywhere.
Many of these refactors will be useful for future lkvm integration,
e.g. reusing ld.so load paths and similar.
When systemd-nspawn receives a TERM signal it will send it to systemd in
stage1 which will try to run the halt.target. This target was not
present in the current stage1 so the container was not being shut down.
Fix this by adding halt.target which calls reaper.service to shut down
the container cleanly.
To allow systemd inside stage1 to set resource limits for apps we mount
the cgroup controllers hierarchy in rkt. We need this because
systemd-nspawn mounts cgroup controllers as read-only.
We mimic systemd-nspawn cgroup mounts with the difference that we
bind-mount the apps' subdirectories over themselves so they stay
read-write. We leave the mounting of systemd's cgroup hierarchy to
nspawn.
Instead of asking systemd-nspawn to write its "pid" file, rkt can write
the parent pid "ppid". Then, update getPID() to get the pid file from
/proc/$ppid/task/$ppid/children. In this way, we don't need to patch
systemd-nspawn.
getPID() is able to read both the "pid" file and the "ppid" file, in
order to work with alternative stage1s which choose to implement one or
the other method.
coreos/rkt#910
This commit adds the possiblity of passing a comma separated list of network
names to the '-private-net' argument. Only networks with their names specified
are loaded in the pods network stack.
The network documentation has been updated accordingly.
In prepare-app we depend on systemd-journal.service only if journal
linking is supported by systemd in stage1.
This commit generates prepare-app@.service so we can add this dependency
only when it's supported.
If we enable journal linking, there's a race in systemd v215 that makes
(very) short-lived containers not show their output in stdout, making
tests fail. Since the CoreOS image will be updated soon we don't bother
investigating this issue and just disable journal linking in old
versions of systemd
This fixes the compilation for:
RKT_STAGE1_USR_FROM=src RKT_STAGE1_SYSTEMD_VER=v220
By copying the patch from:
stage1/rootfs/usr_from_src/patches/master/0001-nspawn-add-pid-file.patch
to:
stage1/rootfs/usr_from_src/patches/v220/0001-nspawn-add-pid-file.patch
There is ongoing work to build stage1 without patches on systemd but
it's not ready yet.
The ./build script still use v219 by default.
- remove --disable-readahead
- remove --disable-multi-seat-x
- add --disable-selinux
Also, write one option per line for better readability.
I kept the configure --help output order.
When building stage1 from sources with RKT_STAGE1_USR_FROM=src,
it is now possible to choose which systemd tag or branch should be
built:
$ export RKT_STAGE1_USR_FROM=src
$ export RKT_STAGE1_SYSTEMD_SRC=git://anongit.freedesktop.org/systemd/systemd
$ export RKT_STAGE1_SYSTEMD_VER=v215
$ ./build
By default, it still fetch the upstream git repository with tag v215 as
before. So defining the new variables is not necessary.
It is also possible to build against a local systemd repository:
$ export RKT_STAGE1_USR_FROM=src
$ export RKT_STAGE1_SYSTEMD_SRC=/home/user/git/systemd
$ export RKT_STAGE1_SYSTEMD_VER=HEAD
$ ./build
This should help developers to test newer systemd versions.
The patches in stage1/rootfs/usr_from_src/patches/ are versioned: the
subdirectory used is defined by $RKT_STAGE1_SYSTEMD_VER. If "HEAD" is
used, the master patchset will be selected.
- Fixup pod.getPID() to cover race between xToRun() and stage1 getting
around to writing the pid file.
- Rework `rkt enter` to retrieve the pid in rkt/stage0 and supply it to
stage1 enter.
- Rework stage1 enter to consume pid from argv instead of opening it
itself, so as to not have to duplicate the same race coverage.
- Some stage1 enter code cleanups thrown in for good measure, particularly
around the argv forwarding copy which started simple had become unwieldy.
Currently only systemd is being built from source, toggled from the
top-level build script by setting RKT_STAGE1_USR_FROM=src, e.g:
RKT_STAGE1_USR_FROM=src ./build
The default stage1 continues to be coreos-derived, but may be explicitly
specified via:
RKT_STAGE1_USR_FROM=coreos ./build
The stage1 init program has been modified to introspect the "flavor" of
stage1 at runtime, which influences how it invokes systemd-nspawn.
A small series of patches are included to give systemd-nspawn the
functionalities enabled via LD_PRELOAD of the shim in the coreos-derived
stage1.
The systemd source is cloned at build time the first time an
RKT_STAGE1_USR_FROM=src build is performed, at this time the same version
as the coreos image provided is being used, but this can be bumped in the
future.
Moving towards fewer external dependencies, aiming for only systemd being
external so it's the only complicated thing we need to do things like try
pulling from the host or building from source when not deriving stage1 from
a CoreOS image.
Dimitri John Ledkov