add Phase 2B contained runtime artifacts
This commit is contained in:
parent
a9fec0d83d
commit
82e64cec43
35 changed files with 5177 additions and 40 deletions
|
|
@ -0,0 +1,4 @@
|
|||
# Phase 2B IPv4-only public DNS; no LAN resolver exception.
|
||||
nameserver 9.9.9.9
|
||||
nameserver 149.112.112.112
|
||||
options edns0 trust-ad
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
table inet le_app_codex {
|
||||
set approved_dns4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = { 9.9.9.9, 149.112.112.112 }
|
||||
}
|
||||
|
||||
set operator_host_public4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = { 74.67.173.56 }
|
||||
}
|
||||
|
||||
set denied4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = {
|
||||
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
|
||||
169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
|
||||
192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
|
||||
198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
|
||||
224.0.0.0/4, 240.0.0.0/4
|
||||
}
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy accept;
|
||||
iifname "lecodex-host" ct state established,related accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||
iifname "lecodex-host" counter drop
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
oifname "lecodex-host" ct state established,related accept
|
||||
oifname "lecodex-host" counter drop
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||
iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
|
||||
iifname "lecodex-host" ip daddr @denied4 counter drop
|
||||
iifname "lecodex-host" meta nfproto ipv6 counter drop
|
||||
iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
|
||||
iifname "lecodex-host" tcp dport { 80, 443 } accept
|
||||
iifname "lecodex-host" counter drop
|
||||
}
|
||||
}
|
||||
|
||||
table ip le_app_codex_nat {
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
[Unit]
|
||||
Description=Root-owned IPv4-only namespace for le_app_codex
|
||||
Before=user@1200.service
|
||||
ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/local/libexec/le-app-codex-netns up
|
||||
ExecStop=/usr/local/libexec/le-app-codex-netns down
|
||||
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
[Slice]
|
||||
CPUQuota=600%
|
||||
MemoryHigh=48G
|
||||
MemoryMax=64G
|
||||
MemorySwapMax=16G
|
||||
TasksMax=4096
|
||||
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
[Unit]
|
||||
Requires=le-app-codex-netns.service
|
||||
After=le-app-codex-netns.service
|
||||
|
||||
[Service]
|
||||
NetworkNamespacePath=/run/netns/le-app-codex
|
||||
ProtectSystem=strict
|
||||
PrivateTmp=yes
|
||||
ProtectHome=yes
|
||||
ProtectProc=invisible
|
||||
ProcSubset=all
|
||||
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
|
||||
TemporaryFileSystem=/srv:ro
|
||||
BindPaths=/srv/le-app-codex:/srv/le-app-codex
|
||||
TemporaryFileSystem=/var:ro
|
||||
TemporaryFileSystem=/mnt:ro
|
||||
TemporaryFileSystem=/media:ro
|
||||
TemporaryFileSystem=/opt:ro
|
||||
InaccessiblePaths=/var/www
|
||||
InaccessiblePaths=/root
|
||||
InaccessiblePaths=/home
|
||||
InaccessiblePaths=/boot
|
||||
InaccessiblePaths=/efi
|
||||
InaccessiblePaths=/run/docker.sock
|
||||
InaccessiblePaths=/var/run/docker.sock
|
||||
InaccessiblePaths=/run/containerd/containerd.sock
|
||||
InaccessiblePaths=/run/podman
|
||||
InaccessiblePaths=/run/dbus/system_bus_socket
|
||||
InaccessiblePaths=/run/systemd/private
|
||||
InaccessiblePaths=/var/lib/docker
|
||||
InaccessiblePaths=/var/lib/containerd
|
||||
InaccessiblePaths=/var/lib/containers
|
||||
InaccessiblePaths=/etc/docker
|
||||
InaccessiblePaths=/etc/containers
|
||||
InaccessiblePaths=/etc/ssh
|
||||
InaccessiblePaths=/etc/NetworkManager/system-connections
|
||||
InaccessiblePaths=/etc/wireguard
|
||||
DevicePolicy=closed
|
||||
DeviceAllow=/dev/fuse rw
|
||||
DeviceAllow=/dev/net/tun rw
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data-root": "/srv/le-app-codex/container-runtime/docker",
|
||||
"storage-driver": "fuse-overlayfs",
|
||||
"live-restore": false,
|
||||
"userland-proxy": false,
|
||||
"ipv6": false,
|
||||
"ip6tables": false,
|
||||
"iptables": true,
|
||||
"hosts": ["unix:///run/user/1200/docker.sock"],
|
||||
"log-driver": "local",
|
||||
"log-opts": {
|
||||
"max-size": "20m",
|
||||
"max-file": "5"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
[Unit]
|
||||
Description=Laser Everything rootless Docker
|
||||
Documentation=https://docs.docker.com/engine/security/rootless/
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
NotifyAccess=all
|
||||
KillMode=mixed
|
||||
Environment=HOME=/srv/le-app-codex/home
|
||||
Environment=XDG_RUNTIME_DIR=/run/user/1200
|
||||
Environment=DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=/run/user/1200/dockerd-rootless
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=true
|
||||
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=false
|
||||
ExecStart=/usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||
ExecReload=/usr/bin/kill -s HUP $MAINPID
|
||||
Restart=always
|
||||
RestartSec=2
|
||||
TimeoutStartSec=0
|
||||
TimeoutStopSec=120
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
LimitCORE=infinity
|
||||
TasksMax=infinity
|
||||
Delegate=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"currentContext": "le-app-codex"
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"Name": "le-app-codex",
|
||||
"Metadata": {},
|
||||
"Endpoints": {
|
||||
"docker": {
|
||||
"Host": "unix:///run/user/1200/docker.sock",
|
||||
"SkipTLSVerify": false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,255 @@
|
|||
#!/bin/sh
|
||||
# dockerd-rootless.sh executes dockerd in rootless mode.
|
||||
#
|
||||
# Usage: dockerd-rootless.sh [DOCKERD_OPTIONS]
|
||||
#
|
||||
# External dependencies:
|
||||
# * newuidmap and newgidmap needs to be installed.
|
||||
# * /etc/subuid and /etc/subgid needs to be configured for the current user.
|
||||
#
|
||||
# Recognized environment variables:
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=DIR: the rootlesskit state dir.
|
||||
# * Defaults to "$XDG_RUNTIME_DIR/dockerd-rootless".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|pasta|gvisor-tap-vsock|lxc-user-nic): the rootlesskit network driver.
|
||||
# * Defaults to "slirp4netns" if slirp4netns (>= v0.4.0) is installed, else "pasta", else "vpnkit", else "gvisor-tap-vsock".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=NUM: the MTU value for the rootlesskit network driver.
|
||||
# * Defaults to 65520 for slirp4netns, pasta, and gvisor-tap-vsock. Defaults to 1500 for other rootlesskit network drivers.
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=(builtin|slirp4netns|implicit|gvisor-tap-vsock): the rootlesskit port driver.
|
||||
# * Defaults to "implicit" for "pasta", "builtin" for other rootlesskit network drivers.
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=(auto|true|false): whether to protect slirp4netns with a dedicated mount namespace.
|
||||
# * Defaults to "auto".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp.
|
||||
# * Defaults to "auto".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=(true|false): prohibit connections to 127.0.0.1 on the host (including via 10.0.2.2, in the case of slirp4netns).
|
||||
# * Defaults to "true".
|
||||
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=(true|false): whether to launch rootlesskit with the "detach-netns" mode.
|
||||
# The "detached-netns" mode accelerates `docker (pull|push|build)` and enables `docker run --net=host`
|
||||
# Defaults to "true". Set this to false only when facing a compatibility issue.
|
||||
|
||||
# To apply an environment variable via systemd, create ~/.config/systemd/user/docker.service.d/override.conf as follows,
|
||||
# and run `systemctl --user daemon-reload && systemctl --user restart docker`:
|
||||
# --- BEGIN ---
|
||||
# [Service]
|
||||
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET=pasta"
|
||||
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
|
||||
# --- END ---
|
||||
|
||||
# Guide to choose the network driver and the port driver:
|
||||
#
|
||||
# Network driver | Port driver | Net throughput | Port throughput | Src IP | No SUID | Note
|
||||
# -----------------|------------------|----------------|-----------------|--------|---------|---------------------------------------------------------
|
||||
# gvisor-tap-vsock | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is not installed
|
||||
# slirp4netns | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is installed
|
||||
# vpnkit | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Legacy
|
||||
# gvisor-tap-vsock | gvisor-tap-vsock | Slow | Slow | ❌ | ✅ | Not recommended. Use `builtin` port driver instead.
|
||||
# slirp4netns | slirp4netns | Slow | Slow | ✅ | ✅ |
|
||||
# pasta | implicit | Slow | Fast ✅ | ✅ | ✅ | Experimental; Needs recent version of pasta (2023_12_04)
|
||||
# lxc-user-nic | builtin | Fast ✅ | Fast ✅ | ✅ (*) | ❌ | Experimental
|
||||
# (bypass4netns) | (bypass4netns) | Fast ✅ | Fast ✅ | ✅ | ✅ | (Not integrated to RootlessKit)
|
||||
#
|
||||
# (*) Applicable since RootlessKit v3.0. Also requires userland-proxy to be disabled.
|
||||
|
||||
# See the documentation for the further information: https://docs.docker.com/go/rootless/
|
||||
|
||||
set -e -x
|
||||
case "$1" in
|
||||
"check" | "install" | "uninstall")
|
||||
echo "Did you mean 'dockerd-rootless-setuptool.sh $@' ?"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
if ! [ -w "$XDG_RUNTIME_DIR" ]; then
|
||||
echo "XDG_RUNTIME_DIR needs to be set and writable"
|
||||
exit 1
|
||||
fi
|
||||
if ! [ -d "$HOME" ]; then
|
||||
echo "HOME needs to be set and exist."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mount_directory() {
|
||||
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||
echo "mount_directory should be called from the child context. Otherwise data loss is at risk" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DIRECTORY="$1"
|
||||
if [ ! -d "$DIRECTORY" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
# Bind mount directory: this makes this directory visible to
|
||||
# Dockerd, even if it is originally a symlink, given Dockerd does
|
||||
# not always follow symlinks. Some directories might also be
|
||||
# "copied-up", meaning that they will also be writable on the child
|
||||
# namespace; this will be the case only if they are provided as
|
||||
# --copy-up to the rootlesskit.
|
||||
DIRECTORY_REALPATH=$(realpath "$DIRECTORY")
|
||||
MOUNT_OPTIONS="${2:---bind}"
|
||||
rm -rf "$DIRECTORY"
|
||||
mkdir -p "$DIRECTORY"
|
||||
mount $MOUNT_OPTIONS "$DIRECTORY_REALPATH" "$DIRECTORY"
|
||||
}
|
||||
|
||||
rootlesskit=""
|
||||
for f in docker-rootlesskit rootlesskit; do
|
||||
if command -v $f > /dev/null 2>&1; then
|
||||
rootlesskit=$f
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ -z "$rootlesskit" ]; then
|
||||
echo "rootlesskit needs to be installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/containerd-rootless}"
|
||||
if [ -e "$CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR" ]; then
|
||||
# https://github.com/moby/moby/issues/52171
|
||||
echo "dockerd-rootless.sh conflicts with containerd-rootless.sh. Stop containerd-rootless.sh if it's running, and remove $CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR if it still exists."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/dockerd-rootless}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK:=}"
|
||||
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS:=true}"
|
||||
net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
|
||||
port_driver=$DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER
|
||||
mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
|
||||
if [ -z "$net" ]; then
|
||||
if command -v slirp4netns > /dev/null 2>&1; then
|
||||
# If --netns-type is present in --help, slirp4netns is >= v0.4.0.
|
||||
if slirp4netns --help | grep -qw -- --netns-type; then
|
||||
net=slirp4netns
|
||||
else
|
||||
echo "slirp4netns found but seems older than v0.4.0. Checking for other network drivers."
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
if command -v pasta > /dev/null 2>&1; then
|
||||
net=pasta
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
if command -v vpnkit > /dev/null 2>&1; then
|
||||
net=vpnkit
|
||||
fi
|
||||
fi
|
||||
if [ -z "$net" ]; then
|
||||
net=gvisor-tap-vsock
|
||||
fi
|
||||
fi
|
||||
if [ "$net" = host ]; then
|
||||
echo "Unsupported RootlessKit network driver: $net"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$mtu" ]; then
|
||||
case "$net" in
|
||||
slirp4netns | pasta | gvisor-tap-vsock)
|
||||
mtu=65520
|
||||
;;
|
||||
*)
|
||||
mtu=1500
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if [ -z "$port_driver" ]; then
|
||||
if [ "$net" = pasta ]; then
|
||||
port_driver=implicit
|
||||
else
|
||||
port_driver=builtin
|
||||
fi
|
||||
fi
|
||||
|
||||
host_loopback="--disable-host-loopback"
|
||||
if [ "$DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK" = "false" ]; then
|
||||
host_loopback=""
|
||||
fi
|
||||
|
||||
dockerd="${DOCKERD:-dockerd}"
|
||||
|
||||
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||
_DOCKERD_ROOTLESS_CHILD=1
|
||||
export _DOCKERD_ROOTLESS_CHILD
|
||||
if [ "$(id -u)" = "0" ]; then
|
||||
echo "This script must be executed as a non-privileged user"
|
||||
exit 1
|
||||
fi
|
||||
# `selinuxenabled` always returns false in RootlessKit child, so we execute `selinuxenabled` in the parent.
|
||||
# https://github.com/rootless-containers/rootlesskit/issues/94
|
||||
if command -v selinuxenabled > /dev/null 2>&1 && selinuxenabled; then
|
||||
_DOCKERD_ROOTLESS_SELINUX=1
|
||||
export _DOCKERD_ROOTLESS_SELINUX
|
||||
fi
|
||||
|
||||
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||
1 | true)
|
||||
DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="--detach-netns $DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS"
|
||||
;;
|
||||
0 | false)
|
||||
# NOP
|
||||
;;
|
||||
*)
|
||||
echo "Unknown DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS value: $DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
|
||||
#
|
||||
# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
|
||||
# * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the
|
||||
# namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
|
||||
# (by either systemd-networkd or NetworkManager)
|
||||
# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
|
||||
exec $rootlesskit \
|
||||
--state-dir=$DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR \
|
||||
--net=$net --mtu=$mtu \
|
||||
--slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \
|
||||
--slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \
|
||||
$host_loopback --port-driver=$port_driver \
|
||||
--copy-up=/etc --copy-up=/run \
|
||||
--propagation=rslave \
|
||||
$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
|
||||
"$0" "$@"
|
||||
else
|
||||
[ "$_DOCKERD_ROOTLESS_CHILD" = 1 ]
|
||||
|
||||
# remove the symlinks for the existing files in the parent namespace if any,
|
||||
# so that we can create our own files in our mount namespace.
|
||||
rm -f /run/docker /run/containerd /run/xtables.lock
|
||||
|
||||
if [ -n "$_DOCKERD_ROOTLESS_SELINUX" ]; then
|
||||
# iptables requires /run in the child to be relabeled. The actual /run in the parent is unaffected.
|
||||
# https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401
|
||||
# https://github.com/moby/moby/issues/41230
|
||||
chcon system_u:object_r:iptables_var_run_t:s0 /run
|
||||
fi
|
||||
|
||||
if [ "$(stat -c %T -f /etc)" = "tmpfs" ] && [ -L "/etc/ssl" ]; then
|
||||
# Workaround for "x509: certificate signed by unknown authority" on openSUSE Tumbleweed.
|
||||
# https://github.com/rootless-containers/rootlesskit/issues/225
|
||||
mount_directory /etc/ssl "--rbind"
|
||||
fi
|
||||
|
||||
netns="/proc/self/ns/net"
|
||||
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||
1 | true)
|
||||
netns="$ROOTLESSKIT_STATE_DIR/netns"
|
||||
;;
|
||||
esac
|
||||
# When running with --firewall-backend=nftables, IP forwarding needs to be enabled
|
||||
# because the daemon won't enable it. IP forwarding is harmless in the rootless
|
||||
# netns, there's only a single external interface and only Docker uses the netns.
|
||||
# So, always enable IPv4 and IPv6 forwarding. But ignore failure to enable IPv6
|
||||
# forwarding, for hosts with IPv6 disabled.
|
||||
nsenter -n"$netns" sysctl -w net.ipv4.ip_forward=1
|
||||
nsenter -n"$netns" sysctl -w net.ipv6.conf.all.forwarding=1 || true
|
||||
|
||||
exec "$dockerd" "$@"
|
||||
fi
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
NS=le-app-codex
|
||||
HOST_IF=lecodex-host
|
||||
NS_IF=lecodex-ns
|
||||
|
||||
down() {
|
||||
/usr/bin/nft delete table inet le_app_codex 2>/dev/null || true
|
||||
/usr/bin/nft delete table ip le_app_codex_nat 2>/dev/null || true
|
||||
/usr/bin/ip link delete "$HOST_IF" 2>/dev/null || true
|
||||
/usr/bin/ip netns delete "$NS" 2>/dev/null || true
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
up)
|
||||
test "$(id -u)" -eq 0
|
||||
test -r /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||
/usr/bin/grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' /etc/nftables.d/50-le-app-codex.nft
|
||||
/usr/bin/grep -q 'elements = { 74\.67\.173\.56 }' /etc/nftables.d/50-le-app-codex.nft
|
||||
test ! -e /run/netns/$NS
|
||||
! /usr/bin/nft list table inet le_app_codex >/dev/null 2>&1
|
||||
! /usr/bin/nft list table ip le_app_codex_nat >/dev/null 2>&1
|
||||
trap down EXIT HUP INT TERM
|
||||
/usr/bin/ip netns add "$NS"
|
||||
/usr/bin/ip link add "$HOST_IF" type veth peer name "$NS_IF"
|
||||
/usr/bin/ip link set "$NS_IF" netns "$NS"
|
||||
/usr/bin/ip address add 10.200.120.1/30 dev "$HOST_IF"
|
||||
/usr/bin/ip link set "$HOST_IF" up
|
||||
/usr/bin/ip -n "$NS" link set lo up
|
||||
/usr/bin/ip -n "$NS" address add 10.200.120.2/30 dev "$NS_IF"
|
||||
/usr/bin/ip -n "$NS" link set "$NS_IF" up
|
||||
/usr/bin/ip -n "$NS" route add default via 10.200.120.1 dev "$NS_IF"
|
||||
/usr/bin/ip netns exec "$NS" /usr/bin/sysctl -q -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
|
||||
/usr/bin/nft -f /etc/nftables.d/50-le-app-codex.nft
|
||||
trap - EXIT HUP INT TERM
|
||||
;;
|
||||
down) down ;;
|
||||
*) echo 'usage: le-app-codex-netns up|down' >&2; exit 64 ;;
|
||||
esac
|
||||
Loading…
Add table
Add a link
Reference in a new issue