From a88bd9142729ee0b0a7527e4a646df2a7cfa3f9a Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 22 Mar 2017 22:12:20 -0600 Subject: [PATCH 1/7] Add files for cloud-init testing Add cloud-config.yml and ssh.cfg to test using cloud-init to customize Docker Engine on CentOS Atomic Host running on AWS Signed-off-by: Scott Lowe --- .../docker-cloudinit/cloud-config.yml | 61 +++++++++++++++++++ centos-atomic/docker-cloudinit/ssh.cfg | 2 + 2 files changed, 63 insertions(+) create mode 100644 centos-atomic/docker-cloudinit/cloud-config.yml create mode 100644 centos-atomic/docker-cloudinit/ssh.cfg diff --git a/centos-atomic/docker-cloudinit/cloud-config.yml b/centos-atomic/docker-cloudinit/cloud-config.yml new file mode 100644 index 0000000..427272d --- /dev/null +++ b/centos-atomic/docker-cloudinit/cloud-config.yml @@ -0,0 +1,61 @@ +#cloud-config +# vim: syntax=yaml + +groups: + - docker: [root,centos] +ssh_authorized_keys: + - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChbmG4wPh/f5CtB5hmepkUHwLKCBXuVX7CcxryMDfXx4W/2ffLO9J/Ek1w58ED3o5/KExduXjwtpMAvOoBffJsaSmm+Tc1NwzyR7GZ75MJYE1/5z5gkBUkZpjmM6qXCpiD6m3jIbaSxxfNEBL64i6H+UL6Ak1LKuYCLutTex+f4Q0NgJvRQyyG2Ms04egWjp91Kbd/cTA3/zfXGI2T3ZvGScvLcUE/neUgBloykuYi0k+VcFK0RAPjqfITaZXs6vtcPLXSX6CR4eHwgM8WpfO3sCEFkMwIhystAFapzSRdfHgtln0XZz84iydcvZVW1o3W8FTiOoNxDoC9ph6XmlU3 scott.lowe@scottlowe.org +write_files: + - content: | + [Unit] + Description=UNIX Socket for the Docker API + PartOf=docker.service + + [Socket] + ListenStream=/var/run/docker.sock + SocketMode=0660 + SocketUser=root + SocketGroup=docker + + [Install] + WantedBy=sockets.target + path: /etc/systemd/system/docker.socket + owner: root:root + permissions: '0644' + - content: | + [Unit] + Description=TCP Socket for the Docker API + + [Socket] + ListenStream=2375 + BindIPv6Only=both + Service=docker.service + + [Install] + WantedBy=sockets.target + path: /etc/systemd/system/docker-tcp.socket + owner: root:root + permissions: '0644' + - content: | + [Service] + ExecStart= + ExecStart=/usr/bin/dockerd-current -H fd:// \ + --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \ + --default-runtime=docker-runc \ + --exec-opt native.cgroupdriver=systemd \ + --userland-proxy-path=/usr/libexec/docker/docker-proxy-current \ + $OPTIONS \ + $DOCKER_STORAGE_OPTIONS \ + $DOCKER_NETWORK_OPTIONS \ + $ADD_REGISTRY \ + $BLOCK_REGISTRY \ + $INSECURE_REGISTRY + path: /etc/systemd/system/docker.service.d/docker-socket.conf + owner: root:root + permissions: '0644' +runcmd: + - systemctl daemon-reload + - systemctl stop docker.service + - systemctl start docker.socket + - systemctl start docker-tcp.socket + - systemctl start docker.service diff --git a/centos-atomic/docker-cloudinit/ssh.cfg b/centos-atomic/docker-cloudinit/ssh.cfg new file mode 100644 index 0000000..b012163 --- /dev/null +++ b/centos-atomic/docker-cloudinit/ssh.cfg @@ -0,0 +1,2 @@ +Host * + PubkeyAuthentication yes From 601ac9f2782e1595650a3f57a8ccf6a84f6013cb Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 29 Mar 2017 23:00:35 -0600 Subject: [PATCH 2/7] Enable new systemd units Modify cloud-config.yml to enable new systemd units after they are copied onto the system Signed-off-by: Scott Lowe --- centos-atomic/docker-cloudinit/cloud-config.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/centos-atomic/docker-cloudinit/cloud-config.yml b/centos-atomic/docker-cloudinit/cloud-config.yml index 427272d..db82cf6 100644 --- a/centos-atomic/docker-cloudinit/cloud-config.yml +++ b/centos-atomic/docker-cloudinit/cloud-config.yml @@ -55,6 +55,9 @@ write_files: permissions: '0644' runcmd: - systemctl daemon-reload + - systemctl enable docker.service + - systemctl enable docker.socket + - systemctl enable docker-tcp.socket - systemctl stop docker.service - systemctl start docker.socket - systemctl start docker-tcp.socket From 6c1f156dbc6f0c2f98c55a8df6c37460b8457e34 Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 22 Mar 2017 22:12:20 -0600 Subject: [PATCH 3/7] Add files for cloud-init testing Add cloud-config.yml and ssh.cfg to test using cloud-init to customize Docker Engine on CentOS Atomic Host running on AWS Signed-off-by: Scott Lowe --- .../docker-cloudinit/cloud-config.yml | 61 +++++++++++++++++++ centos-atomic/docker-cloudinit/ssh.cfg | 2 + 2 files changed, 63 insertions(+) create mode 100644 centos-atomic/docker-cloudinit/cloud-config.yml create mode 100644 centos-atomic/docker-cloudinit/ssh.cfg diff --git a/centos-atomic/docker-cloudinit/cloud-config.yml b/centos-atomic/docker-cloudinit/cloud-config.yml new file mode 100644 index 0000000..427272d --- /dev/null +++ b/centos-atomic/docker-cloudinit/cloud-config.yml @@ -0,0 +1,61 @@ +#cloud-config +# vim: syntax=yaml + +groups: + - docker: [root,centos] +ssh_authorized_keys: + - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChbmG4wPh/f5CtB5hmepkUHwLKCBXuVX7CcxryMDfXx4W/2ffLO9J/Ek1w58ED3o5/KExduXjwtpMAvOoBffJsaSmm+Tc1NwzyR7GZ75MJYE1/5z5gkBUkZpjmM6qXCpiD6m3jIbaSxxfNEBL64i6H+UL6Ak1LKuYCLutTex+f4Q0NgJvRQyyG2Ms04egWjp91Kbd/cTA3/zfXGI2T3ZvGScvLcUE/neUgBloykuYi0k+VcFK0RAPjqfITaZXs6vtcPLXSX6CR4eHwgM8WpfO3sCEFkMwIhystAFapzSRdfHgtln0XZz84iydcvZVW1o3W8FTiOoNxDoC9ph6XmlU3 scott.lowe@scottlowe.org +write_files: + - content: | + [Unit] + Description=UNIX Socket for the Docker API + PartOf=docker.service + + [Socket] + ListenStream=/var/run/docker.sock + SocketMode=0660 + SocketUser=root + SocketGroup=docker + + [Install] + WantedBy=sockets.target + path: /etc/systemd/system/docker.socket + owner: root:root + permissions: '0644' + - content: | + [Unit] + Description=TCP Socket for the Docker API + + [Socket] + ListenStream=2375 + BindIPv6Only=both + Service=docker.service + + [Install] + WantedBy=sockets.target + path: /etc/systemd/system/docker-tcp.socket + owner: root:root + permissions: '0644' + - content: | + [Service] + ExecStart= + ExecStart=/usr/bin/dockerd-current -H fd:// \ + --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \ + --default-runtime=docker-runc \ + --exec-opt native.cgroupdriver=systemd \ + --userland-proxy-path=/usr/libexec/docker/docker-proxy-current \ + $OPTIONS \ + $DOCKER_STORAGE_OPTIONS \ + $DOCKER_NETWORK_OPTIONS \ + $ADD_REGISTRY \ + $BLOCK_REGISTRY \ + $INSECURE_REGISTRY + path: /etc/systemd/system/docker.service.d/docker-socket.conf + owner: root:root + permissions: '0644' +runcmd: + - systemctl daemon-reload + - systemctl stop docker.service + - systemctl start docker.socket + - systemctl start docker-tcp.socket + - systemctl start docker.service diff --git a/centos-atomic/docker-cloudinit/ssh.cfg b/centos-atomic/docker-cloudinit/ssh.cfg new file mode 100644 index 0000000..b012163 --- /dev/null +++ b/centos-atomic/docker-cloudinit/ssh.cfg @@ -0,0 +1,2 @@ +Host * + PubkeyAuthentication yes From a5d3926f44a3b2b814b59fdbacb4120636c920d3 Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 29 Mar 2017 23:00:35 -0600 Subject: [PATCH 4/7] Enable new systemd units Modify cloud-config.yml to enable new systemd units after they are copied onto the system Signed-off-by: Scott Lowe --- centos-atomic/docker-cloudinit/cloud-config.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/centos-atomic/docker-cloudinit/cloud-config.yml b/centos-atomic/docker-cloudinit/cloud-config.yml index 427272d..db82cf6 100644 --- a/centos-atomic/docker-cloudinit/cloud-config.yml +++ b/centos-atomic/docker-cloudinit/cloud-config.yml @@ -55,6 +55,9 @@ write_files: permissions: '0644' runcmd: - systemctl daemon-reload + - systemctl enable docker.service + - systemctl enable docker.socket + - systemctl enable docker-tcp.socket - systemctl stop docker.service - systemctl start docker.socket - systemctl start docker-tcp.socket From 3bbaef7f04afef3c86b584ef2af16de4f36ad3a1 Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 31 May 2017 16:26:24 -0600 Subject: [PATCH 5/7] Update custom SSH configuration, add instructions Update custom SSH configuration to use directory-specific known hosts file. Add preliminary set of instructions. Not quite ready to merge yet; CentOS Atomic Host on AWS seems to have an issue starting the Docker service. Signed-off-by: Scott Lowe --- centos-atomic/docker-cloudinit/README.md | 38 ++++++++++++++++++++++++ centos-atomic/docker-cloudinit/ssh.cfg | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 centos-atomic/docker-cloudinit/README.md diff --git a/centos-atomic/docker-cloudinit/README.md b/centos-atomic/docker-cloudinit/README.md new file mode 100644 index 0000000..f9d4c8a --- /dev/null +++ b/centos-atomic/docker-cloudinit/README.md @@ -0,0 +1,38 @@ +# Instructions + +1. Capture the VPC ID of your default VPC using this command: + + VPC_ID=$(aws --output text ec2 describe-vpcs \ + --filters Name=isDefault,Values="true" \ + --query 'Vpcs[0].VpcId') + +2. Capture the subnet ID of one of the subnets (the first, by default) in the default VPC using this command (step 1 must be completed first): + + SN_ID=$(aws --output text ec2 describe-subnets \ + --filters Name=vpc-id,Values="$VPC_ID" \ + --query 'sort_by(Images,&AvailabilityZone)[0].SubnetId') + +3. Capture the security group ID of a security group in the default VPC with the name "default" (it is assumed that this security group exists and allows SSH access to the instance; if this is not the case, you must fix this outside of this process): + + SG_ID=$(aws --output text ec2 describe-security-groups \ + --filters Name=group-name,Values="default" \ + Name=vpc-id,Values="$VPC_ID" \ + --query 'SecurityGroups[0].GroupId') + +4. Finally, capture the image ID of the latest version of the CentOS 7 Atomic Host AMI using this command: + + IMAGE_ID=$(aws --output text ec2 describe-images \ + --owners 410186602215 --filter Name=name,Values="*CentOS Atomic*" \ + --query 'sort_by(Images,&CreationDate)[-1].ImageId') + +5. Make sure you have an SSH key available to use with the instance and make note of the name of the SSH key. + +6. Launch an AWS instance using this command: + + aws ec2 run-instances --image-id $IMAGE_ID --instance-type t2.micro \ + --key-name keyname --user-data file://cloud-config.yml \ + --subnet-id $SN_ID --security-group-ids $SG_ID + +7. Connect to the instance using SSH. + +8. Verify that the Docker daemon is listening over a network socket (not the default configuration) by running `ss -lnt` and/or running `docker` commands against the network socket (via `-H tcp://127.0.0.1:2375`). diff --git a/centos-atomic/docker-cloudinit/ssh.cfg b/centos-atomic/docker-cloudinit/ssh.cfg index b012163..22cd4cc 100644 --- a/centos-atomic/docker-cloudinit/ssh.cfg +++ b/centos-atomic/docker-cloudinit/ssh.cfg @@ -1,2 +1,4 @@ +UserKnownHostsFile ./known_hosts + Host * PubkeyAuthentication yes From a3a435aafcddde2782939da7bf500ed69cff1c8d Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Thu, 1 Jun 2017 13:24:20 -0600 Subject: [PATCH 6/7] Update cloud-init configuration, add launch script Update cloud-init configuration per discussion with Dusty Mabe in #atomic on IRC (to fix circular dependency between docker and docker-storage-setup). Add launch script to make it easier. Signed-off-by: Scott Lowe --- .../docker-cloudinit/cloud-config.yml | 24 +++++------ centos-atomic/docker-cloudinit/launch.sh | 41 +++++++++++++++++++ 2 files changed, 53 insertions(+), 12 deletions(-) create mode 100755 centos-atomic/docker-cloudinit/launch.sh diff --git a/centos-atomic/docker-cloudinit/cloud-config.yml b/centos-atomic/docker-cloudinit/cloud-config.yml index db82cf6..49d9836 100644 --- a/centos-atomic/docker-cloudinit/cloud-config.yml +++ b/centos-atomic/docker-cloudinit/cloud-config.yml @@ -2,20 +2,18 @@ # vim: syntax=yaml groups: - - docker: [root,centos] -ssh_authorized_keys: - - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChbmG4wPh/f5CtB5hmepkUHwLKCBXuVX7CcxryMDfXx4W/2ffLO9J/Ek1w58ED3o5/KExduXjwtpMAvOoBffJsaSmm+Tc1NwzyR7GZ75MJYE1/5z5gkBUkZpjmM6qXCpiD6m3jIbaSxxfNEBL64i6H+UL6Ak1LKuYCLutTex+f4Q0NgJvRQyyG2Ms04egWjp91Kbd/cTA3/zfXGI2T3ZvGScvLcUE/neUgBloykuYi0k+VcFK0RAPjqfITaZXs6vtcPLXSX6CR4eHwgM8WpfO3sCEFkMwIhystAFapzSRdfHgtln0XZz84iydcvZVW1o3W8FTiOoNxDoC9ph6XmlU3 scott.lowe@scottlowe.org + - docker: [centos,root] write_files: - content: | [Unit] Description=UNIX Socket for the Docker API - PartOf=docker.service [Socket] ListenStream=/var/run/docker.sock SocketMode=0660 SocketUser=root SocketGroup=docker + Service=docker.service [Install] WantedBy=sockets.target @@ -54,11 +52,13 @@ write_files: owner: root:root permissions: '0644' runcmd: - - systemctl daemon-reload - - systemctl enable docker.service - - systemctl enable docker.socket - - systemctl enable docker-tcp.socket - - systemctl stop docker.service - - systemctl start docker.socket - - systemctl start docker-tcp.socket - - systemctl start docker.service + - [ systemctl, start, docker-storage-setup ] + - [ systemctl, mask, docker-storage-setup ] + - [ systemctl, daemon-reload ] + - [ systemctl, enable, docker.service ] + - [ systemctl, enable, docker.socket ] + - [ systemctl, enable, docker-tcp.socket ] + - [ systemctl, stop, docker.service ] + - [ systemctl, start, docker.socket ] + - [ systemctl, start, docker-tcp.socket ] + - [ systemctl, start, docker.service ] diff --git a/centos-atomic/docker-cloudinit/launch.sh b/centos-atomic/docker-cloudinit/launch.sh new file mode 100755 index 0000000..e657d2c --- /dev/null +++ b/centos-atomic/docker-cloudinit/launch.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bash +# +# This script assumes AWSCLI is installed and configured correctly + +# Set some variables to be used later +TYPE="t2.micro" +KEYNAME="aws_rsa" + +# First, capture the ID of the user's default VPC +VPC_ID=$(aws --output text ec2 describe-vpcs \ + --filters Name=isDefault,Values=true \ + --query 'Vpcs[0].VpcId') + +# Use the captured VPC_ID to get the subnet ID of the first subnet +# in the first (sorted alphabetically) availability zone in the user's +# configured region +SN_ID=$(aws --output text ec2 describe-subnets \ + --filters Name=vpc-id,Values="$VPC_ID" \ + --query 'sort_by(Subnets,&AvailabilityZone)[0].SubnetId') + +# Capture the ID of the security group named "default" in the +# user's default VPC. +SG_ID=$(aws --output text ec2 describe-security-groups \ + --filters Name=group-name,Values="default" \ + Name=vpc-id,Values="$VPC_ID" \ + --query 'SecurityGroups[0].GroupId') + +# Capture the AMI ID for the latest version of CentOS 7 Atomic Host +IMG_ID=$(aws --output text ec2 describe-images \ + --owners 410186602215 \ + --filters Name=name,Values="*CentOS Atomic*" \ + --query 'sort_by(Images,&CreationDate)[-1].ImageId') + +# Launch an instance using the captured information from above (no cloud-init) +#aws ec2 run-instances --image-id $IMG_ID --instance-type $TYPE \ +#--key-name $KEYNAME --subnet-id $SN_ID --security-group-ids $SG_ID + +# Launch an instance using the captured information from above (with cloud-init) +aws ec2 run-instances --image-id $IMG_ID --instance-type $TYPE \ +--key-name $KEYNAME --user-data file://cloud-config.yml \ +--subnet-id $SN_ID --security-group-ids $SG_ID From c5f23fa4982e6ae088e096a59452e9b172822619 Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Thu, 1 Jun 2017 13:49:14 -0600 Subject: [PATCH 7/7] Finalize instructions Finalize the instructions in README.md Signed-off-by: Scott Lowe --- centos-atomic/docker-cloudinit/README.md | 55 +++++++++++++----------- 1 file changed, 30 insertions(+), 25 deletions(-) diff --git a/centos-atomic/docker-cloudinit/README.md b/centos-atomic/docker-cloudinit/README.md index f9d4c8a..f0e8009 100644 --- a/centos-atomic/docker-cloudinit/README.md +++ b/centos-atomic/docker-cloudinit/README.md @@ -1,38 +1,43 @@ -# Instructions +# Using cloud-init to Customize Docker on CentOS Atomic Host -1. Capture the VPC ID of your default VPC using this command: +These files show an example of how to use `cloud-init` on a public cloud provider (AWS is used in this example) to customize the configuration and behavior of the Docker daemon on a CentOS Atomic Host instance. - VPC_ID=$(aws --output text ec2 describe-vpcs \ - --filters Name=isDefault,Values="true" \ - --query 'Vpcs[0].VpcId') +## Contents -2. Capture the subnet ID of one of the subnets (the first, by default) in the default VPC using this command (step 1 must be completed first): +* **cloud-config.yml**: This is the `cloud-init` configuration file that does the configuration of the Docker daemon on the instance. No modifications to this file should be necessary. - SN_ID=$(aws --output text ec2 describe-subnets \ - --filters Name=vpc-id,Values="$VPC_ID" \ - --query 'sort_by(Images,&AvailabilityZone)[0].SubnetId') +* **launch.sh**: This Bash shell script uses the AWS CLI to gather information from AWS and then launch an instance in your default VPC. -3. Capture the security group ID of a security group in the default VPC with the name "default" (it is assumed that this security group exists and allows SSH access to the instance; if this is not the case, you must fix this outside of this process): +* **README.md**: The file you're currently reading. - SG_ID=$(aws --output text ec2 describe-security-groups \ - --filters Name=group-name,Values="default" \ - Name=vpc-id,Values="$VPC_ID" \ - --query 'SecurityGroups[0].GroupId') +## Prerequisites -4. Finally, capture the image ID of the latest version of the CentOS 7 Atomic Host AMI using this command: +Before you can use this environment, there are a few things you'll need to do: - IMAGE_ID=$(aws --output text ec2 describe-images \ - --owners 410186602215 --filter Name=name,Values="*CentOS Atomic*" \ - --query 'sort_by(Images,&CreationDate)[-1].ImageId') +1. You'll need to install **and** configure the AWS CLI. The launch script provided in this environment assumes that the AWS CLI is installed, configured, and working as expected. -5. Make sure you have an SSH key available to use with the instance and make note of the name of the SSH key. +2. In your default VPC, you'll need to either a) modify the default security group to allow inbound SSH; or b) create a security group called "default" that allows inbound SSH. If you prefer to use a name other than "default", you'll need to modify `launch.sh` with the updated name of the security group to use. -6. Launch an AWS instance using this command: +3. You'll need to have a working SSH keypair in AWS. - aws ec2 run-instances --image-id $IMAGE_ID --instance-type t2.micro \ - --key-name keyname --user-data file://cloud-config.yml \ - --subnet-id $SN_ID --security-group-ids $SG_ID +## Instructions -7. Connect to the instance using SSH. +1. If you are using a security group other than one named "default" (as described in the "Prerequisites" section), edit `launch.sh` and modify the command that looks up the security group ID accordingly. -8. Verify that the Docker daemon is listening over a network socket (not the default configuration) by running `ss -lnt` and/or running `docker` commands against the network socket (via `-H tcp://127.0.0.1:2375`). +2. Edit `launch.sh` to specify the correct AWS keypair to use when launching the instance. + +3. Launch the instance using `./launch.sh`. This launch script assumes that the AWS CLI is working, and that the `cloud-config.yml` file is in the same directory. + +4. Using the AWS CLI or the AWS Console, determine the public IP address assigned to the instance you just created. + +5. Use SSH to connect to the instance (use the username "centos" to connect). Once logged into the instance, use `systemctl status docker.service` to verify that the Docker daemon is running and that the systemd drop-in located in `/etc/systemd/system/docker.service.d` has been loaded. + +6. While logged into the instance, use `ss -lnt` to show that a process (the Docker daemon) is listening on TCP port 2375. + +7. Verify the Docker daemon is working across the network by running `sudo docker -H tcp://127.0.0.1:2375 ps`. + +Enjoy! + +## License + +This content is licensed under the MIT License.