Merge pull request #87 from lowescott/docker-cloudinit

Add learning environment demonstrating cloud-init to customize Docker

centos-atomic/docker-cloudinit/README.md

@@ -0,0 +1,43 @@
+# Using cloud-init to Customize Docker on CentOS Atomic Host
+
+These files show an example of how to use `cloud-init` on a public cloud provider (AWS is used in this example) to customize the configuration and behavior of the Docker daemon on a CentOS Atomic Host instance.
+
+## Contents
+
+* **cloud-config.yml**: This is the `cloud-init` configuration file that does the configuration of the Docker daemon on the instance. No modifications to this file should be necessary.
+
+* **launch.sh**: This Bash shell script uses the AWS CLI to gather information from AWS and then launch an instance in your default VPC.
+
+* **README.md**: The file you're currently reading.
+
+## Prerequisites
+
+Before you can use this environment, there are a few things you'll need to do:
+
+1. You'll need to install **and** configure the AWS CLI. The launch script provided in this environment assumes that the AWS CLI is installed, configured, and working as expected.
+
+2. In your default VPC, you'll need to either a) modify the default security group to allow inbound SSH; or b) create a security group called "default" that allows inbound SSH. If you prefer to use a name other than "default", you'll need to modify `launch.sh` with the updated name of the security group to use.
+
+3. You'll need to have a working SSH keypair in AWS.
+
+## Instructions
+
+1. If you are using a security group other than one named "default" (as described in the "Prerequisites" section), edit `launch.sh` and modify the command that looks up the security group ID accordingly.
+
+2. Edit `launch.sh` to specify the correct AWS keypair to use when launching the instance.
+
+3. Launch the instance using `./launch.sh`. This launch script assumes that the AWS CLI is working, and that the `cloud-config.yml` file is in the same directory.
+
+4. Using the AWS CLI or the AWS Console, determine the public IP address assigned to the instance you just created.
+
+5. Use SSH to connect to the instance (use the username "centos" to connect). Once logged into the instance, use `systemctl status docker.service` to verify that the Docker daemon is running and that the systemd drop-in located in `/etc/systemd/system/docker.service.d` has been loaded.
+
+6. While logged into the instance, use `ss -lnt` to show that a process (the Docker daemon) is listening on TCP port 2375.
+
+7. Verify the Docker daemon is working across the network by running `sudo docker -H tcp://127.0.0.1:2375 ps`.
+
+Enjoy!
+
+## License
+
+This content is licensed under the MIT License.

centos-atomic/docker-cloudinit/cloud-config.yml

@@ -0,0 +1,64 @@
+#cloud-config
+# vim: syntax=yaml
+
+groups:
+  - docker: [centos,root]
+write_files:
+  - content: |
+      [Unit]
+      Description=UNIX Socket for the Docker API
+
+      [Socket]
+      ListenStream=/var/run/docker.sock
+      SocketMode=0660
+      SocketUser=root
+      SocketGroup=docker
+      Service=docker.service
+
+      [Install]
+      WantedBy=sockets.target
+    path: /etc/systemd/system/docker.socket
+    owner: root:root
+    permissions: '0644'
+  - content: |
+      [Unit]
+      Description=TCP Socket for the Docker API
+
+      [Socket]
+      ListenStream=2375
+      BindIPv6Only=both
+      Service=docker.service
+
+      [Install]
+      WantedBy=sockets.target
+    path: /etc/systemd/system/docker-tcp.socket
+    owner: root:root
+    permissions: '0644'
+  - content: |
+      [Service]
+      ExecStart=
+      ExecStart=/usr/bin/dockerd-current -H fd:// \
+                --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \
+                --default-runtime=docker-runc \
+                --exec-opt native.cgroupdriver=systemd \
+                --userland-proxy-path=/usr/libexec/docker/docker-proxy-current \
+                $OPTIONS \
+                $DOCKER_STORAGE_OPTIONS \
+                $DOCKER_NETWORK_OPTIONS \
+                $ADD_REGISTRY \
+                $BLOCK_REGISTRY \
+                $INSECURE_REGISTRY
+    path: /etc/systemd/system/docker.service.d/docker-socket.conf
+    owner: root:root
+    permissions: '0644'
+runcmd:
+  - [ systemctl, start, docker-storage-setup ]
+  - [ systemctl, mask, docker-storage-setup ]
+  - [ systemctl, daemon-reload ]
+  - [ systemctl, enable, docker.service ]
+  - [ systemctl, enable, docker.socket ]
+  - [ systemctl, enable, docker-tcp.socket ]
+  - [ systemctl, stop, docker.service ]
+  - [ systemctl, start, docker.socket ]
+  - [ systemctl, start, docker-tcp.socket ]
+  - [ systemctl, start, docker.service ]

centos-atomic/docker-cloudinit/launch.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# This script assumes AWSCLI is installed and configured correctly
+
+# Set some variables to be used later
+TYPE="t2.micro"
+KEYNAME="aws_rsa"
+
+# First, capture the ID of the user's default VPC
+VPC_ID=$(aws --output text ec2 describe-vpcs \
+         --filters Name=isDefault,Values=true \
+         --query 'Vpcs[0].VpcId')
+
+# Use the captured VPC_ID to get the subnet ID of the first subnet
+# in the first (sorted alphabetically) availability zone in the user's
+# configured region
+SN_ID=$(aws --output text ec2 describe-subnets \
+        --filters Name=vpc-id,Values="$VPC_ID" \
+        --query 'sort_by(Subnets,&AvailabilityZone)[0].SubnetId')
+
+# Capture the ID of the security group named "default" in the
+# user's default VPC.
+SG_ID=$(aws --output text ec2 describe-security-groups \
+        --filters Name=group-name,Values="default" \
+        Name=vpc-id,Values="$VPC_ID" \
+        --query 'SecurityGroups[0].GroupId')
+
+# Capture the AMI ID for the latest version of CentOS 7 Atomic Host
+IMG_ID=$(aws --output text ec2 describe-images \
+         --owners 410186602215 \
+         --filters Name=name,Values="*CentOS Atomic*" \
+         --query 'sort_by(Images,&CreationDate)[-1].ImageId')
+
+# Launch an instance using the captured information from above (no cloud-init)
+#aws ec2 run-instances --image-id $IMG_ID --instance-type $TYPE \
+#--key-name $KEYNAME --subnet-id $SN_ID --security-group-ids $SG_ID
+
+# Launch an instance using the captured information from above (with cloud-init)
+aws ec2 run-instances --image-id $IMG_ID --instance-type $TYPE \
+--key-name $KEYNAME --user-data file://cloud-config.yml \
+--subnet-id $SN_ID --security-group-ids $SG_ID

centos-atomic/docker-cloudinit/ssh.cfg

@@ -0,0 +1,4 @@
+UserKnownHostsFile ./known_hosts
+
+Host *
+  PubkeyAuthentication yes