summaryrefslogtreecommitdiffstats
path: root/share/doc
diff options
context:
space:
mode:
Diffstat (limited to 'share/doc')
-rw-r--r--share/doc/examples/bookworm.cfg (renamed from share/doc/examples/buster.cfg)10
-rwxr-xr-xshare/doc/examples/container-images.sh30
-rw-r--r--share/doc/examples/graograman-backports.cfg (renamed from share/doc/examples/engywuck-backports.cfg)18
-rw-r--r--share/doc/host-setup.old.txt (renamed from share/doc/HOST-SETUP.txt)58
-rw-r--r--share/doc/host-setup.txt217
5 files changed, 281 insertions, 52 deletions
diff --git a/share/doc/examples/buster.cfg b/share/doc/examples/bookworm.cfg
index cfc8595..1f878f4 100644
--- a/share/doc/examples/buster.cfg
+++ b/share/doc/examples/bookworm.cfg
@@ -1,5 +1,5 @@
-# example for automated Debian 10 (buster) based container creation
-# using: sudo container create -s debian
+# example for automated Debian 12 (bookworm) based container building
+# using: sudo container build -s debian
debconf debconf/priority select critical
debconf debconf/frontend select Noninteractive
@@ -9,16 +9,16 @@ compute-tools container/mode select debian
#compute-tools container/preseed-files string
#compute-tools container/include-preseed-files string
-compute-tools container/distribution select buster
+compute-tools container/distribution select bookworm
#compute-tools container/parent-distribution select
compute-tools container/architecture select auto
-compute-tools container/archives multiselect buster-security, buster-updates
+compute-tools container/archives multiselect bookworm-security, bookworm-updates
#compute-tools container/parent-archives multiselect
compute-tools container/mirror string https://deb.debian.org/debian
-compute-tools container/mirror-security string http://security.debian.org
+compute-tools container/mirror-security string https://security.debian.org
#compute-tools container/parent-mirror string
#compute-tools container/parent-mirror-security string
diff --git a/share/doc/examples/container-images.sh b/share/doc/examples/container-images.sh
index 8f1a2a3..b711048 100755
--- a/share/doc/examples/container-images.sh
+++ b/share/doc/examples/container-images.sh
@@ -1,6 +1,6 @@
#!/bin/sh
-# Copyright (C) 2014-2020 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
@@ -15,16 +15,16 @@
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
-# Description: example for automated Debian base system container image creation
-# Requires: debootstrap plzip xz-utils
-# Usage: sudo ./container-images.sh
+# Description: example for automated Debian base system container image builds
+# Requires: debootstrap plzip xz-utils sudo
+# Usage: ./container-images.sh
set -e
ARCHITECTURES="amd64 i386"
-DISTRIBUTIONS="jessie stretch buster sid"
+DISTRIBUTIONS="buster bullseye bookworm sid"
MIRROR="https://deb.debian.org/debian"
INCLUDE="dbus"
@@ -77,29 +77,29 @@ do
;;
esac
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION}"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION}"
sudo tar ${TAR_OPTIONS} -cf "${SYSTEM}.system.tar.${COMPRESSION}" "${SYSTEM}"
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION}.sha512"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION}.sha512"
sha512sum "${SYSTEM}.system.tar.${COMPRESSION}" > "${SYSTEM}.system.tar.${COMPRESSION}.sha512"
if [ -n "${KEY}" ]
then
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION}.sign"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION}.sig"
gpg -a -b --default-key ${KEY} ${SYSTEM}.system.tar.${COMPRESSION}
- mv "${SYSTEM}.system.tar.${COMPRESSION}.asc" "${SYSTEM}.system.tar.${COMPRESSION}.sign"
+ mv "${SYSTEM}.system.tar.${COMPRESSION}.asc" "${SYSTEM}.system.tar.${COMPRESSION}.sig"
fi
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION} symlink"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION} symlink"
ln -sf "${SYSTEM}.system.tar.${COMPRESSION}" "$(echo ${SYSTEM}.system.tar.${COMPRESSION} | sed -e "s|${DATE}|current|")"
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION}.sha512 copy"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION}.sha512 copy"
sed -e "s|${DATE}|current|" "${SYSTEM}.system.tar.${COMPRESSION}.sha512" > "$(echo ${SYSTEM}.system.tar.${COMPRESSION}.sha512 | sed -e "s|${DATE}|current|")"
- if [ -e "${SYSTEM}.system.tar.${COMPRESSION}.sign" ]
+ if [ -e "${SYSTEM}.system.tar.${COMPRESSION}.sig" ]
then
- echo "Creating ${SYSTEM}.system.tar.${COMPRESSION}.sign copy"
- cp "${SYSTEM}.system.tar.${COMPRESSION}.sign" "$(echo ${SYSTEM}.system.tar.${COMPRESSION}.sign | sed -e "s|${DATE}|current|")"
+ echo "Building ${SYSTEM}.system.tar.${COMPRESSION}.sig copy"
+ cp "${SYSTEM}.system.tar.${COMPRESSION}.sig" "$(echo ${SYSTEM}.system.tar.${COMPRESSION}.sig | sed -e "s|${DATE}|current|")"
fi
done
diff --git a/share/doc/examples/engywuck-backports.cfg b/share/doc/examples/graograman-backports.cfg
index 392c40d..d1d2640 100644
--- a/share/doc/examples/engywuck-backports.cfg
+++ b/share/doc/examples/graograman-backports.cfg
@@ -1,5 +1,5 @@
-# example for automated Progress Linux 5+ (engywuck-backports) container creation
-# using: sudo container create -s progress-linux
+# example for automated Progress Linux 7.99 (graograman-backports) container building
+# using: sudo container build -s progress-linux
debconf debconf/priority select critical
debconf debconf/frontend select Noninteractive
@@ -9,22 +9,22 @@ compute-tools container/mode select progress-linux
#compute-tools container/preseed-files string
#compute-tools container/include-preseed-files string
-compute-tools container/distribution select engywuck-backports
+compute-tools container/distribution select graograman-backports
#compute-tools container/parent-distribution select
compute-tools container/architecture select auto
-compute-tools container/archives multiselect engywuck-security, engywuck-updates, engywuck-extras, engywuck-backports, engywuck-backports-extras
+compute-tools container/archives multiselect graograman-security, graograman-updates, graograman-extras, graograman-backports, graograman-backports-extras
#compute-tools container/parent-archives multiselect
-compute-tools container/mirror string https://cdn.deb.progress-linux.org/packages
-compute-tools container/mirror-security string https://cdn.deb.progress-linux.org/packages
+compute-tools container/mirror string https://deb.progress-linux.org/packages
+compute-tools container/mirror-security string https://deb.progress-linux.org/packages
compute-tools container/parent-mirror string https://deb.debian.org/debian
-compute-tools container/parent-mirror-security string http://security.debian.org
+compute-tools container/parent-mirror-security string https://security.debian.org
-compute-tools container/archive-areas multiselect main, contrib, non-free
-compute-tools container/parent-archive-areas multiselect main, contrib, non-free
+compute-tools container/archive-areas multiselect main, contrib, non-free, non-free-firmware
+compute-tools container/parent-archive-areas multiselect main, contrib, non-free, non-free-firmware
compute-tools container/packages string knot-resolver openssh-server
diff --git a/share/doc/HOST-SETUP.txt b/share/doc/host-setup.old.txt
index d0a2395..69368d1 100644
--- a/share/doc/HOST-SETUP.txt
+++ b/share/doc/host-setup.old.txt
@@ -1,5 +1,5 @@
-compute-tools: Host Setup
-=========================
+compute-tools: Host Setup (with ifupdown)
+=========================================
1. Debian Packages
@@ -11,27 +11,27 @@ apt install bridge-utils ifenslave vlan
2. Boot Parameters
------------------
-2.1 CGroup Memory Controller
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+2.1 CGroup Memory Controller (optional)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In order to enable the memory controller the following boot parameter needs to be used:
cgroup_enable=memory
-2.2 CGroup Swap Controller
-~~~~~~~~~~~~~~~~~~~~~~~~~~
+2.2 CGroup Swap Controller (optional)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In order to enable the swap controller the following boot parameter needs to be used:
swapaccount=1
-2.3 vsyscall
-~~~~~~~~~~~~
+2.3 vsyscall (legacy)
+~~~~~~~~~~~~~~~~~~~~~
In order to be able to execute binaries linked to older libc versions
-(<= wheezy) newer linux versions (>= buster), add the following boot parameter
-(see #881813 for more information):
+(<= wheezy) on newer linux versions (>= buster), add the following boot
+parameter (see #881813 for more information):
vsyscall=emulate
@@ -39,18 +39,10 @@ In order to be able to execute binaries linked to older libc versions
3. Networking
~~~~~~~~~~~~~
-3.1 Enable IPv4 Forwarding
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-apt install procps
-echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/ip_foward.conf
-sysctl -p
-
-
-3.2 Configure Network Bridge
+3.1 Configure Network Bridge
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-3.2.1 Bridge: 1 Interface, standalone, DHCP
+3.1.1 Bridge: 1 Interface, standalone, DHCP
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cat > /etc/network/interfaces << EOF
@@ -72,7 +64,7 @@ iface bridge0 inet dhcp
EOF
-3.2.2 Bridge: 1 Interface, standalone, static
+3.1.2 Bridge: 1 Interface, standalone, static
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cat > /etc/network/interfaces << EOF
@@ -101,7 +93,7 @@ iface bridge0 inet static
EOF
-3.2.3 Bridge: 2 logical Interfaces, subnet, static
+3.1.3 Bridge: 2 logical Interfaces, subnet, static
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cat > /etc/network/interfaces << EOF
@@ -129,7 +121,7 @@ iface bridge0 inet static
EOF
-3.2.4 Bridge: 3 physical Interfaces, vlan, bonding, static
+3.1.4 Bridge: 3 physical Interfaces, vlan, bonding, static
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cat > /etc/network/interfaces << EOF
@@ -216,3 +208,23 @@ IPv6 addresses and netmasks.
In order to use dual-stack, bridges must have a IPv4 address assigned
(can be a dummy one from a privacy range or 127.0.0.0/8).
+
+Let me repeat: dual-stack only works when you assign a primary IPv6 address
+(private or public, doesn't matter) *and* add an additional IPv4 address.
+Yes, the IPv4 address can be a private address, the containers can still
+have a public IPv4 address.
+
+A complete example looks like this:
+
+auto bridge0
+iface bridge0 inet6 static
+ address 2a07:6b47:4::4:1
+ netmask 48
+
+ up ip addr add 127.4.4.1 dev $IFACE
+ down ip addr del 127.4.4.1 dev $IFACE
+
+ bridge_fd 0
+ bridge_maxwait 0
+ bridge_stp 0
+ bridge-mcquerier 1
diff --git a/share/doc/host-setup.txt b/share/doc/host-setup.txt
new file mode 100644
index 0000000..083e1aa
--- /dev/null
+++ b/share/doc/host-setup.txt
@@ -0,0 +1,217 @@
+compute-tools: Host Setup (with systemd-networkd)
+=================================================
+
+
+1. Debian Packages
+-------------------
+
+apt install systemd-networkd bridge-utils
+
+Make sure to enable networkd (sudo systemctl enable systemd-networkd)
+and convert /etc/network/interfaces (see systemd-networkd documentation).
+
+
+2. Boot Parameters
+------------------
+
+2.1 CGroup Memory Controller (optional)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In order to enable the memory controller the following boot parameter needs to be used:
+
+ cgroup_enable=memory
+
+
+2.2 CGroup Swap Controller (optional)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In order to enable the swap controller the following boot parameter needs to be used:
+
+ swapaccount=1
+
+2.3 vsyscall (legacy)
+~~~~~~~~~~~~~~~~~~~~~
+
+In order to be able to execute binaries linked to older libc versions
+(<= wheezy) on newer linux versions (>= buster), add the following boot
+parameter (see #881813 for more information):
+
+ vsyscall=emulate
+
+
+3. Networking
+~~~~~~~~~~~~~
+
+3.1 Configure Network Bridge
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+3.1.1 Bridge: 1 Interface, standalone, DHCP
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+cat > /etc/systemd/network/bridge0.netdev << EOF
+[NetDev]
+Name=bridge0
+Kind=bridge
+EOF
+
+cat > /etc/systemd/network/bridge0.network << EOF
+[Match]
+Name=bridge-0
+
+[Network]
+DHCP=yes
+EOF
+
+
+3.1.2 Bridge: 1 Interface, standalone, static
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+cat > /etc/systemd/network/bridge0.netdev << EOF
+[NetDev]
+Name=bridge0
+Kind=bridge
+EOF
+
+cat > /etc/systemd/network/bridge0.network << EOF
+[Match]
+Name=bridge-0
+
+[Network]
+Address=10.0.0.2/24
+Gateway=10.0.0.1
+EOF
+
+
+3.1.3 Bridge: 3 physical Interfaces, vlan, bonding, static
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+cat > /etc/systemd/network/eno2.network<< EOF
+[Match]
+Name=eno2
+
+[Network]
+Bond=bond0
+EOF
+
+cat > /etc/systemd/network/eno3.network<< EOF
+[Match]
+Name=eno3
+
+[Network]
+Bond=bond0
+EOF
+
+cat > /etc/systemd/network/bond0.netdev << EOF
+[NetDev]
+Name=bond0
+Kind=bond
+
+[Bond]
+Mode=802.3ad
+TransmitHashPolicy=layer3+4
+MIIMonitorSec=0.1
+UpDelaySec=0.2
+DownDelaySec=0.2
+EOF
+
+cat > /etc/systemd/network/bond0.network << EOF
+[Match]
+Name=bond0
+
+[Network]
+VLAN=100
+EOF
+
+cat > /etc/systemd/network/vlan-100.netdev << EOF
+[NetDev]
+Name=vlan-100
+Kind=vlan
+
+[VLAN]
+Id=100
+EOF
+
+cat > /etc/systemd/network/vlan-100.netdev << EOF
+[Match]
+Name=vlan-100
+
+[Network]
+Bridge=bridge-100
+EOF
+
+cat > /etc/systemd/network/bridge-100.netdev << EOF
+[NetDev]
+Name=bridge-100
+Kind=bridge
+EOF
+
+cat > /etc/systemd/network/bridge-100.network << EOF
+[Match]
+Name=bridge-100
+
+[Network]
+Address=10.100.0.2/24
+Gateway=10.100.0.1
+EOF
+
+
+4. Enabling user namespace for unprivileged containers
+------------------------------------------------------
+
+Linux supports unprivileged containers with the user namespace.
+By default the user namespace is disabled on Debian systems (see #898446).
+To enable user namespace, edit the following file for a permant change:
+
+ /etc/sysctl.d/zz-compute-tools.conf
+ sysctl -p
+
+or enable it manually with:
+
+ echo 1 > /proc/sys/kernel/unprivileged_userns_clone
+
+Note that containers need to be started with the correct
+configuration in /etc/compute-tools/container/config to run unpriviled
+(private-users option).
+
+
+5. Enabling container-shell
+---------------------------
+
+Managing privileged containers requires root privileges. In order to allow
+unprivileged users to manage privileged containers without granting them
+privileges or accounts, the container-shell can be used together with sudo
+and a container user.
+
+ sudo adduser --gecos "compute-tools,,," \
+ --home /var/lib/open-infrastructure/container-shell \
+ --shell /usr/bin/container-shell
+
+
+6. IPv4 and IPv6 dual-stack
+---------------------------
+
+Examples for /etc/network/interfaces above work for IPv6 too when using correct
+IPv6 addresses and netmasks.
+
+In order to use dual-stack, bridges must have a IPv4 address assigned
+(can be a dummy one from a privacy range or 127.0.0.0/8).
+
+Let me repeat: dual-stack only works when you assign a primary IPv6 address
+(private or public, doesn't matter) *and* add an additional IPv4 address.
+Yes, the IPv4 address can be a private address, the containers can still
+have a public IPv4 address.
+
+A complete example looks like this:
+
+auto bridge0
+iface bridge0 inet6 static
+ address 2a07:6b47:4::4:1
+ netmask 48
+
+ up ip addr add 127.4.4.1 dev $IFACE
+ down ip addr del 127.4.4.1 dev $IFACE
+
+ bridge_fd 0
+ bridge_maxwait 0
+ bridge_stp 0
+ bridge-mcquerier 1
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 15:02:10 +0000