-
Notifications
You must be signed in to change notification settings - Fork 262
/
Copy pathDockerfile.fedora-rawhide
109 lines (85 loc) · 5.81 KB
/
Dockerfile.fedora-rawhide
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# Clone from the Fedora rawhide image
FROM registry.fedoraproject.org/fedora:rawhide
# Workaround https://bugzilla.redhat.com/show_bug.cgi?id=1941142
COPY resolv.conf hostname /etc/
RUN groupadd -g 288 kdcproxy ; useradd -u 288 -g 288 -c 'IPA KDC Proxy User' -r -d / -s '/sbin/nologin' kdcproxy
RUN groupadd -g 289 ipaapi; useradd -u 289 -g 289 -c 'IPA Framework User' -r -d / -s '/sbin/nologin' ipaapi
RUN groupadd -g 285 sssd; useradd -u 285 -g 285 -c 'User for sssd' -r -d /run/sssd/ -s '/sbin/nologin' sssd
# Workaround 1615948
RUN ln -s /bin/false /usr/local/bin/systemd-machine-id-setup
RUN rpm --eval '%_install_script_path' | sed 's#^#%_install_script_path /usr/local/bin:# ' > /usr/lib/rpm/macros.d/macros.usr-local-bin
RUN sed -i 's!%_install_langs.*!%_install_langs all!' /etc/rpm/macros.image-language-conf
RUN dnf upgrade -y --setopt=install_weak_deps=False \
&& dnf install --allowerasing -y --setopt=install_weak_deps=False freeipa-server freeipa-server-dns freeipa-server-trust-ad freeipa-healthcheck freeipa-client-epn patch \
&& dnf clean all
RUN rm -f /usr/lib/rpm/macros.d/macros.usr-local-bin
# debug: RUN test $( getent passwd | grep -E "^(dirsrv:x:389|ipaapi:x:289|kdcproxy:x:288|pkiuser:x:17|sssd:x:285):" | wc -l ) -eq 5
# var-lib-nfs-rpc_pipefs.mount would run (and fail) nondeterministically
RUN systemctl mask rpc-gssd.service
RUN mkdir /usr/lib/systemd/system/sssd.service.d
# Workaround https://bugzilla.redhat.com/show_bug.cgi?id=2334087
RUN ( echo '[Service]' ; sed '/^CapabilityBoundingSet=/!d; s/CAP_DAC_READ_SEARCH/& CAP_DAC_OVERRIDE/' /usr/lib/systemd/system/sssd.service ) > /usr/lib/systemd/system/sssd.service.d/capabilities.conf
RUN setcap cap_dac_override+ep /usr/libexec/sssd/ldap_child
# Stop the sssd.service from changing the /etc/sssd symlink
RUN ( echo '[Service]' ; echo 'ExecStartPre=' ; sed '/ExecStartPre/!d; s/-R/-R -H/g' /usr/lib/systemd/system/sssd.service ) > /usr/lib/systemd/system/sssd.service.d/avoid-chown-chmod-on-image.conf
# Container image which runs systemd
# debug: RUN test -f /etc/machine-id && ! test -s /etc/machine-id
# debug: RUN test "$container" = oci
# Establish reasonably low open files limit in the container
COPY DefaultLimitNOFILE.conf /usr/lib/systemd/system.conf.d/DefaultLimitNOFILE.conf
ENTRYPOINT [ "/usr/sbin/init" ]
STOPSIGNAL RTMIN+3
# test: systemd-container-failed.sh
# Minimize the systemd setup
RUN find /etc/systemd/system /usr/lib/systemd/system/{basic,multi-user,sysinit}.target.wants -type l \! -lname /dev/null | xargs rm -v
RUN systemctl mask systemd-logind.service
COPY patches/minimal-fedora-42.patch /root/
RUN patch --verbose -p0 --fuzz=0 < /root/minimal-fedora-42.patch
# debug: RUN ! find /etc/systemd/system /usr/lib/systemd/system/{basic,multi-user,sysinit}.target.wants /etc/tmpfiles.d -type f | grep .
RUN ln -s /usr/lib/systemd/system/dbus-broker.service /usr/lib/systemd/system/dbus.service
COPY container-ipa.target /usr/lib/systemd/system/
RUN systemctl set-default container-ipa.target
RUN rmdir -v /etc/systemd/system/multi-user.target.wants \
&& mkdir /etc/systemd/system/container-ipa.target.wants \
&& ln -s /etc/systemd/system/container-ipa.target.wants /etc/systemd/system/multi-user.target.wants
RUN systemd-sysusers
RUN systemd-tmpfiles --remove --create
# debug: RUN test -d /var/log/journal
# debug: RUN ! test -f /var/lib/systemd/random-seed
# test-addon: VOLUME [ "/var/tmp" ]
# test: systemd-container-diff.sh list-dependencies-fedora-38.out /dev/null docker-diff-minimal-fedora-23.out
# Prepare for basic ipa-server-install in container
# Address failing nis-domainname.service in the ipa-client-install step
RUN mv /usr/bin/nisdomainname /usr/bin/nisdomainname.orig
ADD hostnamectl-wrapper /usr/bin/nisdomainname
## # test: systemd-container-ipa-server-install.sh
# Move configuration and data to data volume
COPY patches/ipa-data-fedora-42.patch /root
RUN set -o pipefail ; patch --verbose -p0 --fuzz=0 < /root/ipa-data-fedora-42.patch | sed -n 's/^patching file //;T;/\.py$/p' | xargs python3 -m compileall
COPY ipaplatform-fedora.conf /usr/lib/systemd/system.conf.d/ipaplatform-override.conf
ENV IPAPLATFORM_OVERRIDE=fedora_container
COPY journald-storage.conf /usr/lib/systemd/journald.conf.d/storage.conf
RUN authselect select sssd with-sudo --force
COPY utils/prepare-volume-template utils/populate-volume-from-template utils/extract-rpm-upgrade-scriptlets /usr/local/bin/
COPY volume-data-list volume-tmp-list volume-data-autoupdate /etc/
RUN /usr/local/bin/prepare-volume-template /etc/volume-data-list /data
RUN /usr/local/bin/prepare-volume-template /etc/volume-tmp-list /tmp
RUN /usr/local/bin/extract-rpm-upgrade-scriptlets
RUN echo 2.0 > /etc/volume-version
VOLUME [ "/tmp", "/run", "/data" ]
COPY init-data-minimal /usr/local/sbin/init
ENTRYPOINT [ "/usr/local/sbin/init" ]
# test: systemd-container-ipa-server-install-data.sh /dev/null
# Configure master/replica upon the first invocation
COPY init-data /usr/local/sbin/init
COPY ipa-server-configure-first systemctl-exit-with-status ipa-volume-upgrade-* /usr/sbin/
COPY ipa-server-configure-first.service ipa-server-upgrade.service ipa-server-update-self-ip-address.service /usr/lib/systemd/system/
COPY service-success-poweroff.conf /usr/lib/systemd/system/ipa-server-configure-first.service.d/service-success-poweroff.conf.template
RUN ln -sv /usr/lib/systemd/system/ipa-server-configure-first.service /data-template/etc/systemd/system/container-ipa.target.wants/ipa-server-configure-first.service
COPY exit-status.conf /usr/lib/systemd/system/systemd-poweroff.service.d/
EXPOSE 53/udp 53 80 443 389 636 88 464 88/udp 464/udp 123/udp
RUN uuidgen > /data-template/build-id
# Invocation:
# docker run -ti -v /opt/ipa-data:/data:Z -h ipa.example.test ${NAME} [ options ]
LABEL org.opencontainers.image.title="FreeIPA server"
LABEL org.opencontainers.image.authors="FreeIPA Developers <[email protected]>"