diff options
Diffstat (limited to '')
| -rw-r--r-- | packaging/docker/Dockerfile (renamed from docker/Dockerfile) | 19 | ||||
| -rw-r--r-- | packaging/docker/README.md (renamed from docker/README.md) | 27 | ||||
| -rwxr-xr-x | packaging/docker/build.sh (renamed from docker/build.sh) | 47 | ||||
| -rw-r--r-- | packaging/docker/run.sh (renamed from docker/run.sh) | 5 |
4 files changed, 65 insertions, 33 deletions
diff --git a/docker/Dockerfile b/packaging/docker/Dockerfile index a852f304..73cd9030 100644 --- a/docker/Dockerfile +++ b/packaging/docker/Dockerfile @@ -6,6 +6,7 @@ ARG ARCH=amd64-v3.8 FROM multiarch/alpine:${ARCH} as builder +ARG OUTPUT="/dev/stdout" # Install prerequisites RUN apk --no-cache add alpine-sdk \ autoconf \ @@ -33,8 +34,7 @@ WORKDIR /opt/netdata.git # Install from source RUN chmod +x netdata-installer.sh && \ - sync && sleep 1 && \ - ./netdata-installer.sh --dont-wait --dont-start-it + ./netdata-installer.sh --dont-wait --dont-start-it &>${OUTPUT} # files to one directory RUN mkdir -p /app/usr/sbin/ \ @@ -51,14 +51,14 @@ RUN mkdir -p /app/usr/sbin/ \ mv /var/lib/netdata /app/var/lib/ && \ mv /etc/netdata /app/etc/ && \ mv /usr/sbin/netdata /app/usr/sbin/ && \ - mv docker/run.sh /app/usr/sbin/ && \ + mv packaging/docker/run.sh /app/usr/sbin/ && \ chmod +x /app/usr/sbin/run.sh ##################################################################### ARG ARCH FROM multiarch/alpine:${ARCH} -# Reinstall some prerequisites +# Install some prerequisites RUN apk --no-cache add curl \ fping \ jq \ @@ -71,6 +71,15 @@ RUN apk --no-cache add curl \ py-yaml \ python +# Conditional subscribiton to Polyverse's Polymorphic Linux repositories +RUN if [ "$(uname -m)" == "x86_64" ]; then \ + curl https://sh.polyverse.io | sh -s install gcxce5byVQbtRz0iwfGkozZwy support+netdata@polyverse.io; \ + apk update; \ + apk upgrade --available --no-cache; \ + sed -in 's/^#//g' /etc/apk/repositories; \ + fi + + # Copy files over COPY --from=builder /app / @@ -86,7 +95,7 @@ RUN \ addgroup -g ${NETDATA_GID} -S netdata && \ adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G netdata netdata && \ # Apply the permissions as described in - # https://github.com/netdata/netdata/tree/master/doc/netdata-security.md#netdata-directories + # https://github.com/netdata/netdata/wiki/netdata-security#netdata-directories chown -R root:netdata /etc/netdata && \ chown -R netdata:netdata /var/cache/netdata /var/lib/netdata /usr/share/netdata && \ chown -R root:netdata /usr/lib/netdata && \ diff --git a/docker/README.md b/packaging/docker/README.md index d624855f..dba0fa0e 100644 --- a/docker/README.md +++ b/packaging/docker/README.md @@ -1,7 +1,6 @@ # Install netdata with Docker -> :warning: As of Sep 9th, 2018 we ship [new docker builds](https://github.com/netdata/netdata/pull/3995), running netdata in docker with an ENTRYPOINT directive, not a COMMAND directive. Please adapt your execution scripts accordingly. -> More information about ENTRYPOINT vs COMMAND is presented by goinbigdata [here](http://goinbigdata.com/docker-run-vs-cmd-vs-entrypoint/) and by docker docs [here](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact). +> :warning: As of Sep 9th, 2018 we ship [new docker builds](https://github.com/netdata/netdata/pull/3995), running netdata in docker with an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, not a COMMAND directive. Please adapt your execution scripts accordingly. You can find more information about ENTRYPOINT vs COMMAND is presented by goinbigdata [here](http://goinbigdata.com/docker-run-vs-cmd-vs-entrypoint/) and by docker docs [here](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact). > > Also, the `latest` is now based on alpine, so **`alpine` is not updated any more** and `armv7hf` is now replaced with `armhf` (to comply with https://github.com/multiarch naming), so **`armv7hf` is not updated** either. @@ -9,6 +8,12 @@ Running netdata in a container for monitoring the whole host, can limit its capabilities. Some data is not accessible or not as detailed as when running netdata on the host. +## Package scrambling in runtime (x86_64 only) + +By default on x86_64 architecture our docker images use Polymorphic Polyverse Linux package scrambling. For increased security you can enable rescrambling of packages during runtime. To do this set environment variable `RESCRAMBLE=true` while starting netdata docker container. + +For more information go to [Polyverse site](https://polyverse.io/how-it-works/) + ## Run netdata with docker command Quickly start netdata with the docker command line. @@ -16,8 +21,6 @@ Netdata is then available at http://host:19999 This is good for an internal network or to quickly analyse a host. -For a permanent installation on a public server, you should [[secure the netdata instance|netdata-security]]. See below for an example of how to install netdata with an SSL reverse proxy and basic authentication. - ```bash docker run -d --name=netdata \ -p 19999:19999 \ @@ -29,7 +32,7 @@ docker run -d --name=netdata \ netdata/netdata ``` -above can be converted to docker-compose file for ease of management: +The above can be converted to docker-compose file for ease of management: ```yaml version: '3' @@ -56,10 +59,15 @@ If you want to have your container names resolved by netdata it needs to have ac grep docker /etc/group | cut -d ':' -f 3 ``` +### Pass command line options to Netdata + +Since we use an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, you can provide [netdata daemon command line options](https://docs.netdata.cloud/daemon/#command-line-options) such as the IP address netdata will be running on, using the [command instruction](https://docs.docker.com/engine/reference/builder/#cmd). + ## Install Netdata using Docker Compose with SSL/TLS enabled http proxy -You can use use the following docker-compose.yml and Caddyfile files to run netdata with docker. -Replace the Domains and email address for Letsencrypt before starting. +For a permanent installation on a public server, you should [secure the netdata instance](../../docs/netdata-security.md). This section contains an example of how to install netdata with an SSL reverse proxy and basic authentication. + +You can use use the following docker-compose.yml and Caddyfile files to run netdata with docker. Replace the Domains and email address for [Letsencrypt](https://letsencrypt.org/) before starting. ### Prerequisites * [Docker](https://docs.docker.com/install/#server) @@ -68,8 +76,7 @@ Replace the Domains and email address for Letsencrypt before starting. ### Caddyfile -This file needs to be placed in /opt with nams Caddyfile. Here you customize your domain and you need to provide your email address to obtain Letsencrypt certificate. -Certificate renewal will happen automatically and will be executed internally by caddy server. +This file needs to be placed in /opt with name `Caddyfile`. Here you customize your domain and you need to provide your email address to obtain a Letsencrypt certificate. Certificate renewal will happen automatically and will be executed internally by the caddy server. ``` netdata.example.org { @@ -115,3 +122,5 @@ services: ### Restrict access with basic auth You can restrict access by following [official caddy guide](https://caddyserver.com/docs/basicauth) and adding lines to Caddyfile. + +[]() diff --git a/docker/build.sh b/packaging/docker/build.sh index faaa2db7..6958f05e 100755 --- a/docker/build.sh +++ b/packaging/docker/build.sh @@ -6,6 +6,11 @@ set -e +if [ ! -f .gitignore ]; then + echo "Run as ./packaging/docker/$(basename "$0") from top level directory of git repository" + exit 1 +fi + if [ "$1" == "" ]; then VERSION=$(git tag --points-at) else @@ -15,36 +20,41 @@ if [ "${VERSION}" == "" ]; then VERSION="latest" fi -REPOSITORY="${REPOSITORY:-netdata}" - -echo "Building $VERSION of netdata container" - declare -A ARCH_MAP ARCH_MAP=( ["i386"]="386" ["amd64"]="amd64" ["armhf"]="arm" ["aarch64"]="arm64") +if [ -z ${DEVEL+x} ]; then + declare -a ARCHITECTURES=(i386 armhf aarch64 amd64) +else + declare -a ARCHITECTURES=(amd64) + unset DOCKER_PASSWORD + unset DOCKER_USERNAME +fi -docker run --rm --privileged multiarch/qemu-user-static:register --reset +REPOSITORY="${REPOSITORY:-netdata}" +echo "Building ${VERSION} of ${REPOSITORY} container" -if [ -f Dockerfile ]; then - cd ../ || exit 1 -fi +docker run --rm --privileged multiarch/qemu-user-static:register --reset # Build images using multi-arch Dockerfile. -for ARCH in i386 armhf aarch64 amd64; do - docker build --build-arg ARCH="${ARCH}-v3.8" \ - --tag "${REPOSITORY}:${VERSION}-${ARCH}" \ - --file docker/Dockerfile ./ & +for ARCH in "${ARCHITECTURES[@]}"; do + eval docker build \ + --build-arg ARCH="${ARCH}-v3.8" \ + --build-arg OUTPUT=/dev/null \ + --tag "${REPOSITORY}:${VERSION}-${ARCH}" \ + --file packaging/docker/Dockerfile ./ done -wait + +# There is no reason to continue if we cannot log in to docker hub +if [ -z ${DOCKER_USERNAME+x} ] || [ -z ${DOCKER_PASSWORD+x} ]; then + echo "No docker hub username or password specified. Exiting without pushing images to registry" + exit 0 +fi # Create temporary docker CLI config with experimental features enabled (manifests v2 need it) mkdir -p /tmp/docker echo '{"experimental":"enabled"}' > /tmp/docker/config.json -# Login to docker hub to allow for futher operations -if [ -z ${DOCKER_USERNAME+x} ] || [ -z ${DOCKER_PASSWORD+x} ]; then - echo "No docker hub username or password specified. Exiting without pushing images to registry" - exit 1 -fi +# Login to docker hub to allow futher operations echo "$DOCKER_PASSWORD" | docker --config /tmp/docker login -u "$DOCKER_USERNAME" --password-stdin # Push images to registry @@ -71,4 +81,3 @@ docker --config /tmp/docker manifest push -p "${REPOSITORY}:${VERSION}" # Show current manifest (debugging purpose only) docker --config /tmp/docker manifest inspect "${REPOSITORY}:${VERSION}" - diff --git a/docker/run.sh b/packaging/docker/run.sh index b4cf52c7..243cae8a 100644 --- a/docker/run.sh +++ b/packaging/docker/run.sh @@ -2,6 +2,11 @@ #set -e +if [ ${RESCRAMBLE+x} ]; then + echo "Reinstalling all packages to get the latest Polymorphic Linux scramble" + apk upgrade --update-cache --available +fi + if [ ${PGID+x} ]; then echo "Adding user netdata to group with id ${PGID}" addgroup -g "${PGID}" -S hostgroup 2>/dev/null |