Skip to content

Commit 7f972e2

Browse files
author
Tim Bruijnzeels
committed
Merge branch 'master' of github.com:NLnetLabs/krill
2 parents e710452 + 33eae6c commit 7f972e2

File tree

3 files changed

+162
-0
lines changed

3 files changed

+162
-0
lines changed

‎Dockerfile

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#
2+
# -- stage 1: build krilld and krill_admin
3+
# Use Ubuntu 16.04 because this is what the Travis CI Krill build uses.
4+
#
5+
FROM ubuntu:16.04 AS builder
6+
7+
# Install Rust
8+
RUN apt-get update && apt-get install -y --no-install-recommends \
9+
build-essential \
10+
ca-certificates \
11+
curl \
12+
libssl-dev \
13+
pkg-config
14+
15+
RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
16+
ENV PATH "/root/.cargo/bin:$PATH"
17+
18+
# Build the Krill daemon and krill_admin CLI tool
19+
# Due to https://github.com/rust-lang/cargo/issues/2644#issuecomment-526931209
20+
# we do a hacky first step to build dependencies first so that we don't have to
21+
# COPY directories and files individually because COPY . . causes the entire
22+
# build to be repeated if any file is changed, even if it was a docker/ file
23+
# that only affects the second stage of the build.
24+
WORKDIR /tmp/krill
25+
COPY Cargo.toml .
26+
COPY yarn.lock .
27+
COPY client client
28+
COPY commons commons
29+
COPY daemon daemon
30+
COPY pubc pubc
31+
COPY pubd pubd
32+
RUN cargo build --release --bin krilld --bin krill_admin
33+
34+
#
35+
# -- stage 2: create an image containing just the binaries, configs &
36+
# scripts needed to run Krill, and not the things needed to build
37+
# it.
38+
#
39+
FROM ubuntu:16.04
40+
COPY --from=builder /tmp/krill/target/release/krilld /usr/local/bin/
41+
COPY --from=builder /tmp/krill/target/release/krill_admin /usr/local/bin/
42+
43+
# Build variables for uid and guid of user to run container
44+
ARG RUN_USER=krill
45+
ARG RUN_USER_UID=1012
46+
ARG RUN_USER_GID=1012
47+
48+
# Install openssl as Krill depends on it.
49+
# Install uuid-runtime for generating an authorization token on startup.
50+
RUN apt-get update && \
51+
apt-get install -y --no-install-recommends \
52+
ca-certificates \
53+
openssl \
54+
uuid-runtime
55+
56+
RUN groupadd -g ${RUN_USER_GID} ${RUN_USER} && \
57+
useradd -g ${RUN_USER_GID} -u ${RUN_USER_UID} ${RUN_USER}
58+
59+
# Create the data directory structure and install a config file that uses it
60+
WORKDIR /var/krill/data
61+
COPY docker/krill.conf .
62+
RUN chown -R ${RUN_USER}: .
63+
64+
# Install a Docker entrypoint script that will be executed when the container
65+
# runs
66+
COPY docker/entrypoint.sh /opt/
67+
RUN chown ${RUN_USER}: /opt/entrypoint.sh
68+
69+
EXPOSE 3000/tcp
70+
71+
ENTRYPOINT ["/opt/entrypoint.sh"]
72+
CMD ["krilld", "-c", "/var/krill/data/krill.conf"]

‎docker/entrypoint.sh

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/bin/bash
2+
# Prepare the environment and config file for the Krill daemon.
3+
# This script supports several scenarios:
4+
# A. The operator wants to run the Krill daemon using the default setup:
5+
# We have to fix a couple of things before running the Krill daemon:
6+
# - Krill doesn't know the FQDN at which it's HTTPS, RSYNC and RRDP
7+
# endpoints are published but needs to include that FQDN in data that
8+
# it produces. Configure it based on env var KRILL_FQDN.
9+
# - Krill doesn't have a default API token value, we have to supply one.
10+
# Generate one and announce it, if no KRILL_AUTH_TOKEN env var was
11+
# supplied by the operator.
12+
#
13+
# B: The operator wants to control the Krill daemon configuration themselves.
14+
# They do this by Docker mounting their own krill.conf over the
15+
# /var/krill/data/krill.conf path.
16+
#
17+
# C: The operator wants to run some other command in the container, e.g.
18+
# krill_admin.
19+
#
20+
set -e
21+
KRILL_CONF=/var/krill/data/krill.conf
22+
KRILL_FQDN="${KRILL_FQDN:-localhost:3000}"
23+
KRILL_AUTH_TOKEN="${KRILL_AUTH_TOKEN:-None}"
24+
KRILL_LOG_LEVEL="${KRILL_LOG_LEVEL:-warn}"
25+
KRILL_USE_TA="${KRILL_USE_TA:-false}"
26+
27+
MAGIC="# DO NOT TOUCH, THIS LINE IS MANAGED BY DOCKER KRILL"
28+
LOG_PREFIX="docker-krill:"
29+
30+
log_warning() {
31+
echo >&2 "${LOG_PREFIX} Warning! $*"
32+
}
33+
34+
log_info() {
35+
echo "${LOG_PREFIX} $*"
36+
}
37+
38+
if [ "$1" == "krilld" ]; then
39+
# Does the opreator want to use their own API token? If so they must
40+
# supply the KRILL_AUTH_TOKEN env var.
41+
if [ "${KRILL_AUTH_TOKEN}" == "None" ]; then
42+
# Generate a unique hard to guess authorisation token and export it
43+
# so that the Krill daemon uses it (unless overriden by the Krill
44+
# daemon config file). Only do this if the operator didn't already
45+
# supply a token when launching the Docker container.
46+
export KRILL_AUTH_TOKEN=$(uuidgen)
47+
fi
48+
49+
# Announce the token in the Docker logs so that clients can obtain it.
50+
log_info "Securing Krill daemon with token ${KRILL_AUTH_TOKEN}"
51+
52+
log_info "Configuring ${KRILL_CONF} .."
53+
# If the config file was persisted and the container was recreated with
54+
# different arguments to docker run there may still be some lines in the
55+
# config file that we added before which are now no longer correct. Remove
56+
# any lines that we added.
57+
if ! sed -i "/.\\+${MAGIC}/d" ${KRILL_CONF} 2>/dev/null; then
58+
log_warning "Cannot write to ${KRILL_CONF}. You can ignore this warning if you mounted your own config file over ${KRILL_CONF}."
59+
else
60+
# Append to the default Krilld config file to direct clients of the
61+
# RSYNC and RRDP endpoints to the correct FQDN. We cannot know know the
62+
# FQDN which clients use to reach us so the operator must inform this
63+
# script via a "-e KRILL_FQDN=some.domain.name" argument to
64+
# "docker run". If KRILL_FQDN is not set assume that the user is
65+
# managing the Krill configuration themselves.
66+
cat << EOF >> ${KRILL_CONF}
67+
rsync_base = "rsync://${KRILL_FQDN}/repo/" ${MAGIC}
68+
service_uri = "https://${KRILL_FQDN}/" ${MAGIC}
69+
log_level = "${KRILL_LOG_LEVEL}" ${MAGIC}
70+
use_ta = ${KRILL_USE_TA} ${MAGIC}
71+
EOF
72+
73+
log_info "Dumping ${KRILL_CONF} config file"
74+
cat ${KRILL_CONF}
75+
log_info "End of dump"
76+
fi
77+
78+
79+
fi
80+
81+
# Launch the command supplied either by the default CMD (krilld) in the
82+
# Dockerfile or that given by the operator when invoking Docker run. Use exec
83+
# to ensure krilld runs as PID 1 as required by Docker for proper signal
84+
# handling. This also allows this Docker image to be used to run krill_admin
85+
# instead of krilld.
86+
exec "$@"

‎docker/krill.conf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
ip = "0.0.0.0"
2+
port = 3000
3+
data_dir = "/var/krill/data"
4+
log_type = "stderr"

0 commit comments

Comments
 (0)