Merging upstream version 1.12.2.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

4 files changed, 302 insertions, 0 deletions

diff --git a/packaging/docker/Dockerfile b/packaging/docker/Dockerfile
new file mode 100644
index 000000000..8d1205add
--- /dev/null
+++ b/packaging/docker/Dockerfile
@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# author  : paulfantom
+
+# Cross-arch building is achieved by specifying ARCH as a build parameter with `--build-arg` option.
+# It is automated in `build.sh` script
+ARG ARCH=amd64
+# This image contains preinstalled dependecies
+FROM netdata/builder:${ARCH} as builder 
+
+# Copy source
+COPY . /opt/netdata.git
+WORKDIR /opt/netdata.git
+
+# Install from source
+RUN chmod +x netdata-installer.sh && ./netdata-installer.sh --dont-wait --dont-start-it
+
+# files to one directory
+RUN mkdir -p /app/usr/sbin/ \
+             /app/usr/share \
+             /app/usr/libexec \
+             /app/usr/lib \
+             /app/var/cache \
+             /app/var/lib \
+             /app/etc && \
+    mv /usr/share/netdata   /app/usr/share/ && \
+    mv /usr/libexec/netdata /app/usr/libexec/ && \
+    mv /usr/lib/netdata     /app/usr/lib/ && \
+    mv /var/cache/netdata   /app/var/cache/ && \
+    mv /var/lib/netdata     /app/var/lib/ && \
+    mv /etc/netdata         /app/etc/ && \
+    mv /usr/sbin/netdata    /app/usr/sbin/ && \
+    mv packaging/docker/run.sh        /app/usr/sbin/ && \
+    chmod +x /app/usr/sbin/run.sh
+
+#####################################################################
+ARG ARCH
+# This image contains preinstalled dependecies
+FROM netdata/base:${ARCH}
+
+# Conditional subscribiton to Polyverse's Polymorphic Linux repositories
+RUN if [ "$(uname -m)" == "x86_64" ]; then \
+        curl https://sh.polyverse.io | sh -s install gcxce5byVQbtRz0iwfGkozZwy support+netdata@polyverse.io; \
+        apk update; \
+        apk upgrade --available --no-cache; \
+        sed -in 's/^#//g' /etc/apk/repositories; \
+    fi
+
+# Copy files over
+COPY --from=builder /app /
+
+# Configure system
+ARG NETDATA_UID=201
+ARG NETDATA_GID=201
+RUN \
+    # fping from alpine apk is on a different location. Moving it.
+    mv /usr/sbin/fping /usr/local/bin/fping && \
+    chmod 4755 /usr/local/bin/fping && \
+    mkdir -p /var/log/netdata && \
+    # Add netdata user
+    addgroup -g ${NETDATA_GID} -S netdata && \
+    adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G netdata netdata && \
+    # Apply the permissions as described in
+    # https://github.com/netdata/netdata/wiki/netdata-security#netdata-directories
+    chown -R root:netdata /etc/netdata && \
+    chown -R netdata:netdata /var/cache/netdata /var/lib/netdata /usr/share/netdata && \
+    chown -R root:netdata /usr/lib/netdata && \
+    chown -R root:netdata /usr/libexec/netdata/plugins.d/apps.plugin /usr/libexec/netdata/plugins.d/cgroup-network && \
+    chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network /usr/libexec/netdata/plugins.d/apps.plugin && \
+    chmod 0750 /var/lib/netdata /var/cache/netdata && \
+    # Link log files to stdout
+    ln -sf /dev/stdout /var/log/netdata/access.log && \
+    ln -sf /dev/stdout /var/log/netdata/debug.log && \
+    ln -sf /dev/stderr /var/log/netdata/error.log
+
+ENV NETDATA_PORT 19999
+EXPOSE $NETDATA_PORT
+
+ENTRYPOINT ["/usr/sbin/run.sh"]
diff --git a/packaging/docker/README.md b/packaging/docker/README.md
new file mode 100644
index 000000000..dba0fa0e6
--- /dev/null
+++ b/packaging/docker/README.md
@@ -0,0 +1,126 @@
+# Install netdata with Docker
+
+> :warning: As of Sep 9th, 2018 we ship [new docker builds](https://github.com/netdata/netdata/pull/3995), running netdata in docker with an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, not a COMMAND directive. Please adapt your execution scripts accordingly. You can find more information about ENTRYPOINT vs COMMAND is presented by goinbigdata [here](http://goinbigdata.com/docker-run-vs-cmd-vs-entrypoint/) and by docker docs [here](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact).
+>
+> Also, the `latest` is now based on alpine, so **`alpine` is not updated any more** and `armv7hf` is now replaced with `armhf` (to comply with https://github.com/multiarch naming), so **`armv7hf` is not updated** either.
+
+## Limitations
+
+Running netdata in a container for monitoring the whole host, can limit its capabilities. Some data is not accessible or not as detailed as when running netdata on the host.
+
+## Package scrambling in runtime (x86_64 only)
+
+By default on x86_64 architecture our docker images use Polymorphic Polyverse Linux package scrambling. For increased security you can enable rescrambling of packages during runtime. To do this set environment variable `RESCRAMBLE=true` while starting netdata docker container.
+
+For more information go to [Polyverse site](https://polyverse.io/how-it-works/)
+
+## Run netdata with docker command
+
+Quickly start netdata with the docker command line.
+Netdata is then available at http://host:19999
+
+This is good for an internal network or to quickly analyse a host.
+
+```bash
+docker run -d --name=netdata \
+  -p 19999:19999 \
+  -v /proc:/host/proc:ro \
+  -v /sys:/host/sys:ro \
+  -v /var/run/docker.sock:/var/run/docker.sock:ro \
+  --cap-add SYS_PTRACE \
+  --security-opt apparmor=unconfined \
+  netdata/netdata
+```
+
+The above can be converted to docker-compose file for ease of management:
+
+```yaml
+version: '3'
+services:
+  netdata:
+    image: netdata/netdata
+    hostname: example.com # set to fqdn of host
+    ports:
+      - 19999:19999
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - apparmor:unconfined
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+```
+
+### Docker container names resolution
+
+If you want to have your container names resolved by netdata it needs to have access to docker group. To achive that just add environment variable `PGID=999` to netdata container, where `999` is a docker group id from your host. This number can be found by running:
+```bash
+grep docker /etc/group | cut -d ':' -f 3
+```
+
+### Pass command line options to Netdata 
+
+Since we use an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, you can provide [netdata daemon command line options](https://docs.netdata.cloud/daemon/#command-line-options) such as the IP address netdata will be running on, using the [command instruction](https://docs.docker.com/engine/reference/builder/#cmd). 
+
+## Install Netdata using Docker Compose with SSL/TLS enabled http proxy
+
+For a permanent installation on a public server, you should [secure the netdata instance](../../docs/netdata-security.md). This section contains an example of how to install netdata with an SSL reverse proxy and basic authentication.
+
+You can use use the following docker-compose.yml and Caddyfile files to run netdata with docker. Replace the Domains and email address for [Letsencrypt](https://letsencrypt.org/) before starting.
+
+### Prerequisites
+* [Docker](https://docs.docker.com/install/#server)
+* [Docker Compose](https://docs.docker.com/compose/install/)
+* Domain configured in DNS pointing to host.
+
+### Caddyfile
+
+This file needs to be placed in /opt with name `Caddyfile`. Here you customize your domain and you need to provide your email address to obtain a Letsencrypt certificate. Certificate renewal will happen automatically and will be executed internally by the caddy server.
+
+```
+netdata.example.org {
+  proxy / netdata:19999
+  tls admin@example.org
+}
+```
+
+### docker-compose.yml
+
+After setting Caddyfile run this with `docker-compose up -d` to have fully functioning netdata setup behind HTTP reverse proxy.
+
+```yaml
+version: '3'
+volumes:
+  caddy:
+
+services:
+  caddy:
+    image: abiosoft/caddy
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - /opt/Caddyfile:/etc/Caddyfile
+      - caddy:/root/.caddy
+    environment:
+      ACME_AGREE: 'true'
+  netdata:
+    restart: always
+    hostname: netdata.example.org
+    image: netdata/netdata
+    cap_add:
+      - SYS_PTRACE
+    security_opt:
+      - apparmor:unconfined
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+```
+
+### Restrict access with basic auth
+
+You can restrict access by following [official caddy guide](https://caddyserver.com/docs/basicauth) and adding lines to Caddyfile.
+
+[![analytics](https://www.google-analytics.com/collect?v=1&aip=1&t=pageview&_s=1&ds=github&dr=https%3A%2F%2Fgithub.com%2Fnetdata%2Fnetdata&dl=https%3A%2F%2Fmy-netdata.io%2Fgithub%2Fpackaging%2Fdocker%2FREADME&_u=MAC~&cid=5792dfd7-8dc4-476b-af31-da2fdb9f93d2&tid=UA-64295674-3)]()
diff --git a/packaging/docker/build.sh b/packaging/docker/build.sh
new file mode 100755
index 000000000..0d6caaa6f
--- /dev/null
+++ b/packaging/docker/build.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Author  : Pawel Krupa (paulfantom)
+# Cross-arch docker build helper script
+# Needs docker in version >18.02 due to usage of manifests
+
+set -e
+
+if [ ! -f .gitignore ]; then
+	echo "Run as ./packaging/docker/$(basename "$0") from top level directory of git repository"
+	exit 1
+fi
+
+if [ "$1" == "" ]; then
+    VERSION=$(git tag --points-at)
+else
+    VERSION="$1"
+fi
+if [ "${VERSION}" == "" ]; then
+    VERSION="latest"
+fi
+
+declare -A ARCH_MAP
+ARCH_MAP=( ["i386"]="386" ["amd64"]="amd64" ["armhf"]="arm" ["aarch64"]="arm64")
+if [ -z ${DEVEL+x} ]; then
+    declare -a ARCHITECTURES=(i386 armhf aarch64 amd64)
+else
+    declare -a ARCHITECTURES=(amd64)
+    unset DOCKER_PASSWORD
+    unset DOCKER_USERNAME
+fi
+
+REPOSITORY="${REPOSITORY:-netdata}"
+echo "Building ${VERSION} of ${REPOSITORY} container"
+
+docker run --rm --privileged multiarch/qemu-user-static:register --reset
+
+# Build images using multi-arch Dockerfile.
+for ARCH in "${ARCHITECTURES[@]}"; do
+     eval docker build \
+     		--build-arg ARCH="${ARCH}" \
+     		--tag "${REPOSITORY}:${VERSION}-${ARCH}" \
+     		--file packaging/docker/Dockerfile ./
+done
+
+# There is no reason to continue if we cannot log in to docker hub
+if [ -z ${DOCKER_USERNAME+x} ] || [ -z ${DOCKER_PASSWORD+x} ]; then
+    echo "No docker hub username or password specified. Exiting without pushing images to registry"
+    exit 0
+fi
+
+# Create temporary docker CLI config with experimental features enabled (manifests v2 need it)
+mkdir -p /tmp/docker
+echo '{"experimental":"enabled"}' > /tmp/docker/config.json
+
+# Login to docker hub to allow futher operations
+echo "$DOCKER_PASSWORD" | docker --config /tmp/docker login -u "$DOCKER_USERNAME" --password-stdin
+
+# Push images to registry
+for ARCH in amd64 i386 armhf aarch64; do
+    docker --config /tmp/docker push "${REPOSITORY}:${VERSION}-${ARCH}" &
+done
+wait
+
+# Recreate docker manifest
+docker --config /tmp/docker manifest create --amend \
+                       "${REPOSITORY}:${VERSION}" \
+                       "${REPOSITORY}:${VERSION}-i386" \
+                       "${REPOSITORY}:${VERSION}-armhf" \
+                       "${REPOSITORY}:${VERSION}-aarch64" \
+                       "${REPOSITORY}:${VERSION}-amd64"
+
+# Annotate manifest with CPU architecture information
+for ARCH in i386 armhf aarch64 amd64; do
+     docker --config /tmp/docker manifest annotate "${REPOSITORY}:${VERSION}" "${REPOSITORY}:${VERSION}-${ARCH}" --os linux --arch "${ARCH_MAP[$ARCH]}"
+done
+
+# Push manifest to docker hub
+docker --config /tmp/docker manifest push -p "${REPOSITORY}:${VERSION}"
+
+# Show current manifest (debugging purpose only)
+docker --config /tmp/docker manifest inspect "${REPOSITORY}:${VERSION}"
diff --git a/packaging/docker/run.sh b/packaging/docker/run.sh
new file mode 100644
index 000000000..243cae8a2
--- /dev/null
+++ b/packaging/docker/run.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+#set -e
+
+if [ ${RESCRAMBLE+x} ]; then
+    echo "Reinstalling all packages to get the latest Polymorphic Linux scramble"
+    apk upgrade --update-cache --available
+fi
+
+if [ ${PGID+x} ]; then
+  echo "Adding user netdata to group with id ${PGID}"
+  addgroup -g "${PGID}" -S hostgroup 2>/dev/null
+  sed -i "s/${PGID}:$/${PGID}:netdata/g" /etc/group
+fi
+
+exec /usr/sbin/netdata -u netdata -D -s /host -p "${NETDATA_PORT}" "$@"