diff options
Diffstat (limited to 'packaging/docker')
| -rw-r--r-- | packaging/docker/Dockerfile | 79 | ||||
| -rw-r--r-- | packaging/docker/README.md | 158 | ||||
| -rwxr-xr-x | packaging/docker/build-test.sh | 72 | ||||
| -rwxr-xr-x | packaging/docker/build.sh | 63 | ||||
| -rwxr-xr-x | packaging/docker/publish.sh | 105 | ||||
| -rw-r--r-- | packaging/docker/run.sh | 16 |
6 files changed, 493 insertions, 0 deletions
diff --git a/packaging/docker/Dockerfile b/packaging/docker/Dockerfile new file mode 100644 index 00000000..e8dbbd12 --- /dev/null +++ b/packaging/docker/Dockerfile @@ -0,0 +1,79 @@ +# SPDX-License-Identifier: GPL-3.0-or-later +# author : paulfantom + +# Cross-arch building is achieved by specifying ARCH as a build parameter with `--build-arg` option. +# It is automated in `build.sh` script +ARG ARCH=amd64 +# This image contains preinstalled dependecies +FROM netdata/builder:${ARCH} as builder + +# Copy source +COPY . /opt/netdata.git +WORKDIR /opt/netdata.git + +# Install from source +RUN chmod +x netdata-installer.sh && ./netdata-installer.sh --dont-wait --dont-start-it + +# files to one directory +RUN mkdir -p /app/usr/sbin/ \ + /app/usr/share \ + /app/usr/libexec \ + /app/usr/lib \ + /app/var/cache \ + /app/var/lib \ + /app/etc && \ + mv /usr/share/netdata /app/usr/share/ && \ + mv /usr/libexec/netdata /app/usr/libexec/ && \ + mv /usr/lib/netdata /app/usr/lib/ && \ + mv /var/cache/netdata /app/var/cache/ && \ + mv /var/lib/netdata /app/var/lib/ && \ + mv /etc/netdata /app/etc/ && \ + mv /usr/sbin/netdata /app/usr/sbin/ && \ + mv packaging/docker/run.sh /app/usr/sbin/ && \ + chmod +x /app/usr/sbin/run.sh + +##################################################################### +ARG ARCH +# This image contains preinstalled dependecies +FROM netdata/base:${ARCH} + +# Conditional subscribiton to Polyverse's Polymorphic Linux repositories +RUN if [ "$(uname -m)" == "x86_64" ]; then \ + curl https://sh.polyverse.io | sh -s install gcxce5byVQbtRz0iwfGkozZwy support+netdata@polyverse.io; \ + apk update; \ + apk upgrade --available --no-cache; \ + sed -in 's/^#//g' /etc/apk/repositories; \ + apk fix py2-psycopg2; \ + fi + +# Copy files over +COPY --from=builder /app / + +# Configure system +ARG NETDATA_UID=201 +ARG NETDATA_GID=201 +RUN \ + # fping from alpine apk is on a different location. Moving it. + mv /usr/sbin/fping /usr/local/bin/fping && \ + chmod 4755 /usr/local/bin/fping && \ + mkdir -p /var/log/netdata && \ + # Add netdata user + addgroup -g ${NETDATA_GID} -S netdata && \ + adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G netdata netdata && \ + # Apply the permissions as described in + # https://github.com/netdata/netdata/wiki/netdata-security#netdata-directories + chown -R root:netdata /etc/netdata && \ + chown -R netdata:netdata /var/cache/netdata /var/lib/netdata /usr/share/netdata && \ + chown -R root:netdata /usr/lib/netdata && \ + chown -R root:netdata /usr/libexec/netdata/plugins.d/apps.plugin /usr/libexec/netdata/plugins.d/cgroup-network && \ + chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network /usr/libexec/netdata/plugins.d/apps.plugin && \ + chmod 0750 /var/lib/netdata /var/cache/netdata && \ + # Link log files to stdout + ln -sf /dev/stdout /var/log/netdata/access.log && \ + ln -sf /dev/stdout /var/log/netdata/debug.log && \ + ln -sf /dev/stderr /var/log/netdata/error.log + +ENV NETDATA_PORT 19999 +EXPOSE $NETDATA_PORT + +ENTRYPOINT ["/usr/sbin/run.sh"] diff --git a/packaging/docker/README.md b/packaging/docker/README.md new file mode 100644 index 00000000..93272295 --- /dev/null +++ b/packaging/docker/README.md @@ -0,0 +1,158 @@ +# Install netdata with Docker + +> :warning: As of Sep 9th, 2018 we ship [new docker builds](https://github.com/netdata/netdata/pull/3995), running netdata in docker with an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, not a COMMAND directive. Please adapt your execution scripts accordingly. You can find more information about ENTRYPOINT vs COMMAND is presented by goinbigdata [here](http://goinbigdata.com/docker-run-vs-cmd-vs-entrypoint/) and by docker docs [here](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact). +> +> Also, the `latest` is now based on alpine, so **`alpine` is not updated any more** and `armv7hf` is now replaced with `armhf` (to comply with https://github.com/multiarch naming), so **`armv7hf` is not updated** either. + +## Limitations + +Running netdata in a container for monitoring the whole host, can limit its capabilities. Some data is not accessible or not as detailed as when running netdata on the host. + +## Package scrambling in runtime (x86_64 only) + +By default on x86_64 architecture our docker images use Polymorphic Polyverse Linux package scrambling. For increased security you can enable rescrambling of packages during runtime. To do this set environment variable `RESCRAMBLE=true` while starting netdata docker container. + +For more information go to [Polyverse site](https://polyverse.io/how-it-works/) + +## Run netdata with docker command + +Quickly start netdata with the docker command line. +Netdata is then available at http://host:19999 + +This is good for an internal network or to quickly analyse a host. + +```bash +docker run -d --name=netdata \ + -p 19999:19999 \ + -v /proc:/host/proc:ro \ + -v /sys:/host/sys:ro \ + -v /var/run/docker.sock:/var/run/docker.sock:ro \ + --cap-add SYS_PTRACE \ + --security-opt apparmor=unconfined \ + netdata/netdata +``` + +The above can be converted to docker-compose file for ease of management: + +```yaml +version: '3' +services: + netdata: + image: netdata/netdata + hostname: example.com # set to fqdn of host + ports: + - 19999:19999 + cap_add: + - SYS_PTRACE + security_opt: + - apparmor:unconfined + volumes: + - /proc:/host/proc:ro + - /sys:/host/sys:ro + - /var/run/docker.sock:/var/run/docker.sock:ro +``` + +### Docker container names resolution + +If you want to have your container names resolved by netdata it needs to have access to docker group. To achive that just add environment variable `PGID=999` to netdata container, where `999` is a docker group id from your host. This number can be found by running: +```bash +grep docker /etc/group | cut -d ':' -f 3 +``` + +### Pass command line options to Netdata + +Since we use an [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, you can provide [netdata daemon command line options](https://docs.netdata.cloud/daemon/#command-line-options) such as the IP address netdata will be running on, using the [command instruction](https://docs.docker.com/engine/reference/builder/#cmd). + +## Install Netdata using Docker Compose with SSL/TLS enabled http proxy + +For a permanent installation on a public server, you should [secure the netdata instance](../../docs/netdata-security.md). This section contains an example of how to install netdata with an SSL reverse proxy and basic authentication. + +You can use use the following docker-compose.yml and Caddyfile files to run netdata with docker. Replace the Domains and email address for [Letsencrypt](https://letsencrypt.org/) before starting. + +### Prerequisites +* [Docker](https://docs.docker.com/install/#server) +* [Docker Compose](https://docs.docker.com/compose/install/) +* Domain configured in DNS pointing to host. + +### Caddyfile + +This file needs to be placed in /opt with name `Caddyfile`. Here you customize your domain and you need to provide your email address to obtain a Letsencrypt certificate. Certificate renewal will happen automatically and will be executed internally by the caddy server. + +``` +netdata.example.org { + proxy / netdata:19999 + tls admin@example.org +} +``` + +### docker-compose.yml + +After setting Caddyfile run this with `docker-compose up -d` to have fully functioning netdata setup behind HTTP reverse proxy. + +```yaml +version: '3' +volumes: + caddy: + +services: + caddy: + image: abiosoft/caddy + ports: + - 80:80 + - 443:443 + volumes: + - /opt/Caddyfile:/etc/Caddyfile + - caddy:/root/.caddy + environment: + ACME_AGREE: 'true' + netdata: + restart: always + hostname: netdata.example.org + image: netdata/netdata + cap_add: + - SYS_PTRACE + security_opt: + - apparmor:unconfined + volumes: + - /proc:/host/proc:ro + - /sys:/host/sys:ro + - /var/run/docker.sock:/var/run/docker.sock:ro +``` + +### Restrict access with basic auth + +You can restrict access by following [official caddy guide](https://caddyserver.com/docs/basicauth) and adding lines to Caddyfile. + +[]() + +### Publish a test image to your own repository + +The script `packaging/docker/build-test.sh` can be used to create an image and upload it to a repository of your choosing. + +``` +Usage: packaging/docker/build-test.sh -r <REPOSITORY> -v <VERSION> -u <DOCKER_USERNAME> -p <DOCKER_PASSWORD> [-s] + -s skip build, just push the image +Builds an amd64 image and pushes it to the docker hub repository REPOSITORY +``` + +This is especially useful when testing a Pull Request for Kubernetes, since you can set `image` to an immutable repository and tag, set the `imagePullPolicy` to `Always` and just keep uploading new images. + +Example: + +We get a local copy of the Helm chart at https://github.com/netdata/helmchart. We modify `values.yaml` to have the following: + +``` +image: + repository: cakrit/netdata-prs + tag: PR5576 + pullPolicy: Always +``` + +We check out PR5576 and run the following: +``` +./packaging/docker/build-test.sh -r cakrit/netdata-prs -v PR5576 -u cakrit -p 'XXX' +``` + +Then we can run `helm install [path to our helmchart clone]`. + +If we make changes to the code, we execute the same `build-test.sh` command, followed by `helm upgrade [name] [path to our helmchart clone]`
\ No newline at end of file diff --git a/packaging/docker/build-test.sh b/packaging/docker/build-test.sh new file mode 100755 index 00000000..c43dd7bd --- /dev/null +++ b/packaging/docker/build-test.sh @@ -0,0 +1,72 @@ +#!/bin/bash +# Docker build wrapper, for testing manually the docker build process +# TODO: This script should consume build.sh after setting up required parameters +# +# Copyright: SPDX-License-Identifier: GPL-3.0-or-later +# +# Author : Chris Akritidis (chris@netdata.cloud) +# Author : Pavlos Emm. Katsoulakis (paul@netdata.cloud) + +printhelp() { + echo "Usage: packaging/docker/build-test.sh -r <REPOSITORY> -v <VERSION> -u <DOCKER_USERNAME> -p <DOCKER_PASSWORD> [-s] + -s skip build, just push the image +Builds an amd64 image and pushes it to the docker hub repository REPOSITORY" +} + +set -e + +if [ ! -f .gitignore ]; then + echo "Run as ./packaging/docker/$(basename "$0") from top level directory of git repository" + exit 1 +fi + +DOBUILD=1 +while getopts :r:v:u:p:s option +do + case "$option" in + r) + REPOSITORY=$OPTARG + ;; + v) + VERSION=$OPTARG + ;; + u) + DOCKER_USERNAME=$OPTARG + ;; + p) + DOCKER_PASSWORD=$OPTARG + ;; + s) + DOBUILD=0 + ;; + *) + printhelp + exit 1 + ;; + esac +done + +if [ -n "${REPOSITORY}" ] && [ -n "${VERSION}" ] && [ -n "${DOCKER_USERNAME}" ] && [ -n "${DOCKER_PASSWORD}" ] ; then + if [ $DOBUILD -eq 1 ] ; then + echo "Building ${VERSION} of ${REPOSITORY} container" + docker run --rm --privileged multiarch/qemu-user-static:register --reset + + # Build images using multi-arch Dockerfile. + eval docker build --build-arg ARCH="amd64" --tag "${REPOSITORY}:${VERSION}" --file packaging/docker/Dockerfile ./ + + # Create temporary docker CLI config with experimental features enabled (manifests v2 need it) + mkdir -p /tmp/docker + #echo '{"experimental":"enabled"}' > /tmp/docker/config.json + fi + + # Login to docker hub to allow futher operations + echo "Logging into docker" + echo "$DOCKER_PASSWORD" | docker --config /tmp/docker login -u "$DOCKER_USERNAME" --password-stdin + + echo "Pushing ${REPOSITORY}:${VERSION}" + docker --config /tmp/docker push "${REPOSITORY}:${VERSION}" +else + echo "Missing parameter. REPOSITORY=${REPOSITORY} VERSION=${VERSION} DOCKER_USERNAME=${DOCKER_USERNAME} DOCKER_PASSWORD=${DOCKER_PASSWORD}" + printhelp + exit 1 +fi diff --git a/packaging/docker/build.sh b/packaging/docker/build.sh new file mode 100755 index 00000000..3a4bd576 --- /dev/null +++ b/packaging/docker/build.sh @@ -0,0 +1,63 @@ +#!/bin/bash +# Cross-arch docker build helper script +# +# Copyright: SPDX-License-Identifier: GPL-3.0-or-later +# +# Author : Pawel Krupa (paulfantom) +# Author : Pavlos Emm. Katsoulakis (paul@netdata.cloud) + +set -e + +if [ "${BASH_VERSINFO[0]}" -lt "4" ]; then + echo "This mechanism currently can only run on BASH version 4 and above" + exit 1 +fi + +VERSION="$1" +REPOSITORY="${REPOSITORY:-netdata}" +declare -A ARCH_MAP +ARCH_MAP=(["i386"]="386" ["amd64"]="amd64" ["armhf"]="arm" ["aarch64"]="arm64") +DEVEL_ARCHS=(amd64) +ARCHS="${!ARCH_MAP[@]}" + +# When development mode is set, build on DEVEL_ARCHS +if [ ! -z ${DEVEL+x} ]; then + declare -a ARCHS=(${DEVEL_ARCHS[@]}) +fi + +# Ensure there is a version, the most appropriate one +if [ "${VERSION}" == "" ]; then + VERSION=$(git tag --points-at) + if [ "${VERSION}" == "" ]; then + VERSION="latest" + fi +fi + +# If we are not in netdata git repo, at the top level directory, fail +TOP_LEVEL=$(basename "$(git rev-parse --show-toplevel)") +CWD=$(git rev-parse --show-cdup) +if [ ! -z $CWD ] || [ ! "${TOP_LEVEL}" == "netdata" ]; then + echo "Run as ./packaging/docker/$(basename "$0") from top level directory of netdata git repository" + echo "Docker build process aborted" + exit 1 +fi + +echo "Docker image build in progress.." +echo "Version : ${VERSION}" +echo "Repository : ${REPOSITORY}" +echo "Architectures : ${ARCHS[*]}" + +docker run --rm --privileged multiarch/qemu-user-static:register --reset + +# Build images using multi-arch Dockerfile. +for ARCH in ${ARCHS[@]}; do + TAG="${REPOSITORY}:${VERSION}-${ARCH}" + echo "Building tag ${TAG}.." + eval docker build \ + --build-arg ARCH="${ARCH}" \ + --tag "${TAG}" \ + --file packaging/docker/Dockerfile ./ + echo "..Done!" +done + +echo "Docker build process completed!" diff --git a/packaging/docker/publish.sh b/packaging/docker/publish.sh new file mode 100755 index 00000000..36a49283 --- /dev/null +++ b/packaging/docker/publish.sh @@ -0,0 +1,105 @@ +#!/bin/bash +# Cross-arch docker publish helper script +# Needs docker in version >18.02 due to usage of manifests +# +# Copyright: SPDX-License-Identifier: GPL-3.0-or-later +# +# Author : Pavlos Emm. Katsoulakis (paul@netdata.cloud) + +set -e + +if [ "${BASH_VERSINFO[0]}" -lt "4" ]; then + echo "This mechanism currently can only run on BASH version 4 and above" + exit 1 +fi + +WORKDIR="$(mktemp -d)" # Temporary folder, removed after script is done +VERSION="$1" +REPOSITORY="${REPOSITORY:-netdata}" +declare -A ARCH_MAP +ARCH_MAP=(["i386"]="386" ["amd64"]="amd64" ["armhf"]="arm" ["aarch64"]="arm64") +DEVEL_ARCHS=(amd64) +ARCHS="${!ARCH_MAP[@]}" +DOCKER_CMD="docker --config ${WORKDIR}" + +# When development mode is set, build on DEVEL_ARCHS +if [ ! -z ${DEVEL+x} ]; then + declare -a ARCHS=(${DEVEL_ARCHS[@]}) +fi + +# Ensure there is a version, the most appropriate one +if [ "${VERSION}" == "" ]; then + VERSION=$(git tag --points-at) + if [ "${VERSION}" == "" ]; then + VERSION="latest" + fi +fi +MANIFEST_LIST="${REPOSITORY}:${VERSION}" + +# There is no reason to continue if we cannot log in to docker hub +if [ -z ${DOCKER_USERNAME+x} ] || [ -z ${DOCKER_PASSWORD+x} ]; then + echo "No docker hub username or password found, aborting without publishing" + exit 1 +fi + +# If we are not in netdata git repo, at the top level directory, fail +TOP_LEVEL=$(basename "$(git rev-parse --show-toplevel)") +CWD=$(git rev-parse --show-cdup) +if [ ! -z $CWD ] || [ ! "${TOP_LEVEL}" == "netdata" ]; then + echo "Run as ./packaging/docker/$(basename "$0") from top level directory of netdata git repository" + echo "Docker build process aborted" + exit 1 +fi + +echo "Docker image publishing in progress.." +echo "Version : ${VERSION}" +echo "Repository : ${REPOSITORY}" +echo "Architectures : ${ARCHS[*]}" +echo "Manifest list : ${MANIFEST_LIST}" + +# Create temporary docker CLI config with experimental features enabled (manifests v2 need it) +echo '{"experimental":"enabled"}' > "${WORKDIR}"/config.json + +# Login to docker hub to allow futher operations +echo "$DOCKER_PASSWORD" | $DOCKER_CMD login -u "$DOCKER_USERNAME" --password-stdin + +# Push images to registry +for ARCH in ${ARCHS[@]}; do + TAG="${MANIFEST_LIST}-${ARCH}" + echo "Publishing image ${TAG}.." + $DOCKER_CMD push "${TAG}" & + echo "Image ${TAG} published succesfully!" +done + +echo "Waiting for images publishing to complete" +wait + +# Recreate docker manifest list +echo "Creating manifest list.." +$DOCKER_CMD manifest create --amend "${MANIFEST_LIST}" \ + "${MANIFEST_LIST}-i386" \ + "${MANIFEST_LIST}-armhf" \ + "${MANIFEST_LIST}-aarch64" \ + "${MANIFEST_LIST}-amd64" + +# Annotate manifest with CPU architecture information + +echo "Executing manifest annotate.." +for ARCH in ${ARCHS[@]}; do + TAG="${MANIFEST_LIST}-${ARCH}" + echo "Annotating manifest for $ARCH, with TAG: ${TAG} (Manifest list: ${MANIFEST_LIST})" + $DOCKER_CMD manifest annotate "${MANIFEST_LIST}" "${TAG}" --os linux --arch "${ARCH_MAP[$ARCH]}" +done + +# Push manifest to docker hub +echo "Pushing manifest list to docker.." +$DOCKER_CMD manifest push -p "${MANIFEST_LIST}" + +# Show current manifest (debugging purpose only) +echo "Evaluating manifest list entry" +$DOCKER_CMD manifest inspect "${MANIFEST_LIST}" + +# Cleanup +rm -r "${WORKDIR}" + +echo "Docker publishing process completed!" diff --git a/packaging/docker/run.sh b/packaging/docker/run.sh new file mode 100644 index 00000000..243cae8a --- /dev/null +++ b/packaging/docker/run.sh @@ -0,0 +1,16 @@ +#!/bin/sh + +#set -e + +if [ ${RESCRAMBLE+x} ]; then + echo "Reinstalling all packages to get the latest Polymorphic Linux scramble" + apk upgrade --update-cache --available +fi + +if [ ${PGID+x} ]; then + echo "Adding user netdata to group with id ${PGID}" + addgroup -g "${PGID}" -S hostgroup 2>/dev/null + sed -i "s/${PGID}:$/${PGID}:netdata/g" /etc/group +fi + +exec /usr/sbin/netdata -u netdata -D -s /host -p "${NETDATA_PORT}" "$@" |