blob: a7ba4966f0c9a088a8e22a0a5a5ee38258be63c5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
#!/bin/bash
module_init() {
local i url sigfile file hash
declare -a apts
[ "$SYS_DISTRIBUTION" = "ubuntu" ] || [ "$SYS_DISTRIBUTION" = "debian" ] || return 0
# Forcefully add docker repo
apts=(
"https://download.docker.com/linux/${SYS_DISTRIBUTION}/gpg deb [arch=$(dpkg --print-architecture) signed-by=%FILE%] https://download.docker.com/linux/$SYS_DISTRIBUTION $(lsb_release -cs) stable"
"https://nvidia.github.io/nvidia-docker/gpgkey https://nvidia.github.io/nvidia-docker/${SYS_DISTRIBUTION}$(lsb_release -rs)/nvidia-docker.list"
)
for i in "${apts[@]}"; do
url="${i%% *}"
hash="$( echo "$i" | md5sum | cut -c1-10 )"
sigfile="/usr/share/keyrings/docker-${hash}.gpg"
[ -s "$sigfile" ] && continue
curl -fsSL "$url" | gpg --dearmor -o "$sigfile" \
|| perror "Could not download docker gpg key from $url"
url="${i#* }"
file="/etc/apt/sources.list.d/docker-${hash}.list"
[ -s "$file" ] && continue
if [[ "${url}" == http* ]]; then
download "$url" "$file"
sed -i "s/^deb/deb [signed-by=${sigfile}]/" "$file"
else
echo "${url//%FILE%/$sigfile}" > "$file"
fi
done
apt-get update
}
build() {
local service
for service in docker containerd; do
systemctl disable "${service}.service" || perror "Could not disable $service"
done
systemctl enable "docker.socket" || perror "Could not enable docker.socket activation"
# Plugin binary
download_untar "https://github.com/ad-freiburg/docker-no-trivial-root/releases/download/v0.1.0/docker-no-trivial-root_x86_64.tar.bz2" \
"$MODULE_WORK_DIR/src"
mkdir -p "$MODULE_BUILD_DIR/usr/sbin"
mv "$MODULE_WORK_DIR/src/docker-no-trivial-root_x86_64/docker-no-trivial-root" \
"$MODULE_BUILD_DIR/usr/sbin/docker-no-trivial-root" \
|| perror "Cannot move docker-no-trivial-root"
chmod +x "$MODULE_BUILD_DIR/usr/sbin/docker-no-trivial-root"
chown 0:0 "$MODULE_BUILD_DIR/usr/sbin/docker-no-trivial-root"
# Patch systemd service
mkdir -p "$MODULE_BUILD_DIR/etc/systemd/system"
sed -r 's/^(ExecStart=.*dockerd) (.*)$/\1 --authorization-plugin=no-trivial-root \2/' \
"/lib/systemd/system/docker.service" > "$MODULE_BUILD_DIR/etc/systemd/system/docker.service" \
|| perror "Could not patch docker.service"
# That weird range stuff
local item
for item in subuid subgid; do
awk -F: 'BEGIN {
max=0
found=0
} {
if ($1=="dockremap")
found=1
if ($2>max)
max=($2)
print $0
} END {
if (!found)
print "dockremap:"max+65536":65536"
}' "/etc/${item}" > "${MODULE_BUILD_DIR}/etc/${item}" \
|| perror "Could not patch /etc/$item"
done
# Workaround for https://github.com/NVIDIA/nvidia-docker/issues/1399
mkdir -p "${MODULE_BUILD_DIR}/etc/nvidia-container-runtime"
sed -r 's#^ldconfig\s*=.*$#ldconfig = "/sbin/ldconfig"#' "/etc/nvidia-container-runtime/config.toml" \
> "${MODULE_BUILD_DIR}/etc/nvidia-container-runtime/config.toml" \
|| perror "Could not patch nvidia-container config.toml"
}
|