Remove the image build and consolidate operational code under scripts
This commit is contained in:
77 files changed
+586
-260607
No files matched your search
@@ -0,0 +1,301 @@
|
||||
"""Verify or install a local Docker Engine and CLI plugins."""
|
||||
from __future__ import annotations
|
||||
|
||||
from contextlib import contextmanager
|
||||
import fcntl
|
||||
from functools import wraps
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
import urllib.request
|
||||
|
||||
|
||||
class DockerError(RuntimeError):
|
||||
"""A required Docker postcondition could not be established."""
|
||||
|
||||
|
||||
def expected_errors(operation):
|
||||
@wraps(operation)
|
||||
def guarded(*args, **kwargs):
|
||||
try:
|
||||
return operation(*args, **kwargs)
|
||||
except (OSError, ValueError) as exc:
|
||||
raise DockerError("Docker filesystem or saved state is invalid; inspect the target before retrying.") from exc
|
||||
return guarded
|
||||
|
||||
|
||||
DOCKER_PACKAGES = ("docker-ce", "docker-ce-cli", "containerd.io",
|
||||
"docker-buildx-plugin", "docker-compose-plugin")
|
||||
DOCKER_CONFLICTS = ("docker.io", "docker-doc", "docker-compose", "docker-buildx",
|
||||
"podman-docker", "containerd", "runc")
|
||||
DOCKER_CONFIG = {"data-root": "/srv/docker", "log-driver": "json-file",
|
||||
"log-opts": {"max-size": "20m", "max-file": "3"}}
|
||||
POLICY = Path("/usr/sbin/policy-rc.d")
|
||||
POLICY_STATE = Path("/usr/sbin/.apex-policy-rc.d")
|
||||
APT = ["apt-get", "-o", "DPkg::Lock::Timeout=60", "-o",
|
||||
"Acquire::Retries=2", "-o", "Acquire::http::Timeout=30", "-o",
|
||||
"Acquire::https::Timeout=30"]
|
||||
|
||||
|
||||
def run(args, *, check=True, timeout=300):
|
||||
try:
|
||||
result = subprocess.run(args, text=True, capture_output=True, timeout=timeout,
|
||||
env={**os.environ, "LC_ALL": "C", "DEBIAN_FRONTEND": "noninteractive"})
|
||||
except (OSError, subprocess.TimeoutExpired) as exc:
|
||||
raise DockerError(f"Cannot complete {args[0]}: {exc}") from exc
|
||||
if check and result.returncode:
|
||||
raise DockerError(f"{args[0]} failed with exit status {result.returncode}; inspect target system logs.")
|
||||
return result
|
||||
|
||||
|
||||
def package_versions():
|
||||
architecture = run(["dpkg", "--print-architecture"]).stdout.strip()
|
||||
result = run(["dpkg-query", "-W", "-f=${binary:Package}\t${Status}\t${Version}\n"])
|
||||
installed = {}
|
||||
for line in result.stdout.splitlines():
|
||||
fields = line.split("\t")
|
||||
if len(fields) == 3 and fields[1].split()[1:] == ["ok", "installed"]:
|
||||
installed[fields[0].removesuffix(":" + architecture)] = fields[2]
|
||||
return installed
|
||||
|
||||
|
||||
def write_managed(path, content, mode=0o644):
|
||||
path = Path(path)
|
||||
for parent in (path, *path.parents):
|
||||
if parent.is_symlink():
|
||||
raise DockerError(f"Refusing managed symlink: {parent}")
|
||||
payload = content.encode() if isinstance(content, str) else content
|
||||
if path.exists() and path.read_bytes() == payload:
|
||||
if path.stat().st_mode & 0o777 != mode:
|
||||
path.chmod(mode)
|
||||
return False
|
||||
path.parent.mkdir(parents=True, exist_ok=True)
|
||||
fd, temporary = tempfile.mkstemp(prefix=".apex-", dir=path.parent)
|
||||
try:
|
||||
with os.fdopen(fd, "wb") as stream:
|
||||
stream.write(payload)
|
||||
stream.flush()
|
||||
os.fsync(stream.fileno())
|
||||
os.chmod(temporary, mode)
|
||||
os.replace(temporary, path)
|
||||
finally:
|
||||
if os.path.exists(temporary):
|
||||
os.unlink(temporary)
|
||||
return True
|
||||
|
||||
|
||||
def restore_service_policy():
|
||||
if not POLICY_STATE.exists():
|
||||
return
|
||||
backup = POLICY_STATE / "original"
|
||||
if (POLICY_STATE.is_symlink() or POLICY_STATE.stat().st_uid != os.geteuid()):
|
||||
raise DockerError("Refusing untrusted service policy recovery state.")
|
||||
if (POLICY_STATE / "ready").exists() and POLICY.exists():
|
||||
original_matches = (backup.exists() and not POLICY.is_symlink() and
|
||||
POLICY.read_bytes() == backup.read_bytes())
|
||||
symlink_matches = (backup.is_symlink() and POLICY.is_symlink() and
|
||||
os.readlink(backup) == os.readlink(POLICY))
|
||||
guard_matches = not POLICY.is_symlink() and POLICY.read_bytes() == b"#!/bin/sh\nexit 101\n"
|
||||
if not (original_matches or symlink_matches or guard_matches):
|
||||
raise DockerError("Service policy changed outside APEX; recovery requires explicit reconciliation.")
|
||||
if backup.exists() or backup.is_symlink():
|
||||
# Copy first: an interrupted restoration must retain its recovery copy.
|
||||
temporary = POLICY_STATE / "restoring"
|
||||
if temporary.exists() or temporary.is_symlink():
|
||||
temporary.unlink()
|
||||
shutil.copy2(backup, temporary, follow_symlinks=False)
|
||||
os.replace(temporary, POLICY)
|
||||
elif (POLICY_STATE / "absent").exists():
|
||||
POLICY.unlink(missing_ok=True)
|
||||
elif (POLICY_STATE / "ready").exists():
|
||||
raise DockerError("Service policy recovery is incomplete; inspect /usr/sbin/.apex-policy-rc.d.")
|
||||
shutil.rmtree(POLICY_STATE)
|
||||
|
||||
|
||||
@contextmanager
|
||||
def service_start_guard():
|
||||
lock_path = Path("/run/lock/apex-package-policy.lock")
|
||||
lock_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
with lock_path.open("a") as lock:
|
||||
try:
|
||||
fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
except BlockingIOError:
|
||||
raise DockerError("Another APEX package operation is running.") from None
|
||||
with _service_start_guard():
|
||||
yield
|
||||
|
||||
|
||||
@contextmanager
|
||||
def _service_start_guard():
|
||||
restore_service_policy()
|
||||
POLICY_STATE.mkdir(mode=0o700)
|
||||
try:
|
||||
if POLICY.exists() or POLICY.is_symlink():
|
||||
shutil.copy2(POLICY, POLICY_STATE / "original", follow_symlinks=False)
|
||||
else:
|
||||
(POLICY_STATE / "absent").touch()
|
||||
(POLICY_STATE / "ready").touch()
|
||||
# Replace the path itself, preserving any original symlink in the backup.
|
||||
temporary = POLICY_STATE / "guard"
|
||||
temporary.write_text("#!/bin/sh\nexit 101\n")
|
||||
temporary.chmod(0o755)
|
||||
os.replace(temporary, POLICY)
|
||||
yield
|
||||
finally:
|
||||
restore_service_policy()
|
||||
|
||||
|
||||
def install_missing(packages):
|
||||
installed = package_versions()
|
||||
missing = [package for package in packages if package not in installed]
|
||||
if not missing:
|
||||
return []
|
||||
run([*APT, "update", "--error-on=any"])
|
||||
command = [*APT, "install", "-y", "--no-install-recommends", "--no-upgrade", "--no-remove", *missing]
|
||||
plan = run([*command, "--simulate"]).stdout
|
||||
if any(line.startswith("Remv ") or re.match(r"^Inst \S+ \[", line)
|
||||
for line in plan.splitlines()):
|
||||
raise DockerError("Missing packages require an upgrade/removal; reconcile packages explicitly before retrying.")
|
||||
# Let dpkg finish before restoring the service-start policy.
|
||||
run(command, timeout=None)
|
||||
remaining = set(missing) - package_versions().keys()
|
||||
if remaining:
|
||||
raise DockerError("Required packages not installed: " + ", ".join(sorted(remaining)))
|
||||
return missing
|
||||
|
||||
|
||||
def docker_preflight(installed):
|
||||
conflicts = sorted(set(DOCKER_CONFLICTS) & installed.keys())
|
||||
if conflicts:
|
||||
raise DockerError("Conflicting Docker packages require explicit reconciliation: " + ", ".join(conflicts))
|
||||
path = Path("/etc/docker/daemon.json")
|
||||
try:
|
||||
config = json.loads(path.read_text()) if path.exists() else {}
|
||||
except (OSError, ValueError) as exc:
|
||||
raise DockerError("Cannot validate existing Docker daemon configuration.") from exc
|
||||
if not isinstance(config, dict):
|
||||
raise DockerError("Docker daemon configuration must be an object.")
|
||||
for name, value in DOCKER_CONFIG.items():
|
||||
if name in config and config[name] != value:
|
||||
raise DockerError(f"Conflicting Docker {name}; reconcile explicitly before initialization.")
|
||||
old_data = Path("/var/lib/docker")
|
||||
if old_data.exists() and any(old_data.iterdir()):
|
||||
raise DockerError("Existing /var/lib/docker data must be reconciled explicitly; no data migration is automatic.")
|
||||
data = Path("/srv/docker")
|
||||
if data.is_symlink() or data.parent.is_symlink():
|
||||
raise DockerError("Refusing a redirected Docker data-root.")
|
||||
if data.exists() and any(data.iterdir()) and config.get("data-root") != "/srv/docker":
|
||||
raise DockerError("Unmanaged /srv/docker data requires explicit reconciliation.")
|
||||
if "docker-ce" in installed:
|
||||
active = run(["systemctl", "is-active", "--quiet", "docker"], check=False).returncode == 0
|
||||
if active:
|
||||
root = run(["docker", "info", "--format", "{{.DockerRootDir}}"] ).stdout.strip()
|
||||
if root != "/srv/docker" or any(config.get(key) != value for key, value in DOCKER_CONFIG.items()):
|
||||
raise DockerError("Running Docker has incompatible data-root/log policy; reconcile it before retrying.")
|
||||
return {**config, **DOCKER_CONFIG}
|
||||
|
||||
|
||||
DOCKER_KEY_SHA256 = "1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570"
|
||||
LOCAL_DOCKER = ["docker", "--host", "unix:///var/run/docker.sock"]
|
||||
|
||||
|
||||
def _docker_source(arch):
|
||||
key = Path("/etc/apt/keyrings/apex-docker.asc")
|
||||
source = Path("/etc/apt/sources.list.d/apex-docker.sources")
|
||||
content = ("Types: deb\nURIs: https://download.docker.com/linux/debian\nSuites: trixie\n"
|
||||
f"Components: stable\nArchitectures: {arch}\nSigned-By: {key}\n")
|
||||
for path in (key, source):
|
||||
if any(part.is_symlink() for part in (path, *path.parents)):
|
||||
raise DockerError(f"Refusing redirected APT path: {path}")
|
||||
if source.exists() and source.read_text() != content:
|
||||
raise DockerError(f"Reconcile existing Docker repository configuration: {source}")
|
||||
if key.exists():
|
||||
data = key.read_bytes()
|
||||
else:
|
||||
url = "https://download.docker.com/linux/debian/gpg"
|
||||
with urllib.request.urlopen(url, timeout=30) as response: # noqa: S310
|
||||
data = response.read(1024 * 1024)
|
||||
if hashlib.sha256(data).hexdigest() != DOCKER_KEY_SHA256:
|
||||
raise DockerError("Docker repository signing key differs from the pinned release key.")
|
||||
write_managed(key, data)
|
||||
write_managed(source, content)
|
||||
|
||||
|
||||
def _docker_capabilities(root, *, complete_plugins=False):
|
||||
capabilities = {"docker_data_root": root}
|
||||
plugins = {"docker-compose-plugin": ("compose", ["compose", "version", "--short"]),
|
||||
"docker-buildx-plugin": ("buildx", ["buildx", "version"])}
|
||||
missing = []
|
||||
for package, (name, args) in plugins.items():
|
||||
result = run([*LOCAL_DOCKER, *args], check=False)
|
||||
if result.returncode or not result.stdout.strip():
|
||||
missing.append(package)
|
||||
else:
|
||||
capabilities[name] = result.stdout.strip()
|
||||
if missing:
|
||||
if complete_plugins and "docker-ce" in package_versions():
|
||||
with service_start_guard():
|
||||
install_missing(missing)
|
||||
return _docker_capabilities(root)
|
||||
raise DockerError("Existing Docker needs functional plugins: " + ", ".join(missing))
|
||||
if not root:
|
||||
raise DockerError("Unable to verify the local Docker data-root.")
|
||||
return capabilities
|
||||
|
||||
|
||||
@expected_errors
|
||||
def apply_docker_policy():
|
||||
if Path("/usr/bin/pveversion").exists():
|
||||
raise DockerError("Docker installation on a Proxmox host requires separate administration.")
|
||||
release = dict(line.split("=", 1) for line in Path("/etc/os-release").read_text().splitlines()
|
||||
if "=" in line and not line.startswith("#"))
|
||||
arch = run(["dpkg", "--print-architecture"]).stdout.strip()
|
||||
if (release.get("ID", "").strip('"') != "debian" or
|
||||
release.get("VERSION_ID", "").strip('"') != "13" or arch not in ("amd64", "arm64")):
|
||||
raise DockerError("Docker installation supports stock Debian 13 amd64 or arm64.")
|
||||
info = [*LOCAL_DOCKER, "info", "--format", "{{.DockerRootDir}}"]
|
||||
if shutil.which("docker"):
|
||||
current = run(info, check=False)
|
||||
if current.returncode == 0:
|
||||
return _docker_capabilities(current.stdout.strip(), complete_plugins=True)
|
||||
installed = package_versions()
|
||||
source = Path("/etc/apt/sources.list.d/apex-docker.sources")
|
||||
if (not source.exists() and
|
||||
(shutil.which("docker") or set(DOCKER_PACKAGES).intersection(installed))):
|
||||
raise DockerError("Existing Docker installation is inactive; reconcile it before retrying.")
|
||||
config = docker_preflight(installed)
|
||||
with service_start_guard():
|
||||
install_missing(("ca-certificates",))
|
||||
_docker_source(arch)
|
||||
write_managed("/etc/docker/daemon.json", json.dumps(config, indent=2) + "\n")
|
||||
install_missing(DOCKER_PACKAGES)
|
||||
ensure_service("containerd")
|
||||
ensure_service("docker")
|
||||
root = run(info).stdout.strip()
|
||||
if root != DOCKER_CONFIG["data-root"]:
|
||||
raise DockerError("Docker started with an unexpected data-root; inspect its configuration.")
|
||||
return _docker_capabilities(root)
|
||||
|
||||
|
||||
def ensure_service(name):
|
||||
if run(["systemctl", "is-enabled", "--quiet", name], check=False).returncode:
|
||||
run(["systemctl", "enable", name])
|
||||
if run(["systemctl", "is-active", "--quiet", name], check=False).returncode:
|
||||
run(["systemctl", "start", name])
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
from .state import ProvisionError, exclusive_lock
|
||||
|
||||
try:
|
||||
if os.geteuid() != 0 or not Path("/etc/debian_version").is_file():
|
||||
raise DockerError("Docker setup requires root on Debian.")
|
||||
with exclusive_lock("/var/lib/apex-init/init.lock"):
|
||||
print(json.dumps(apply_docker_policy(), sort_keys=True))
|
||||
except (DockerError, OSError, ProvisionError) as exc:
|
||||
raise SystemExit(f"Docker setup failed: {exc}") from None
|
||||
Reference in new issue
Block a user