Commit Graph

19 Commits

Author SHA1 Message Date
Radosław Piliszek 2daf4331a6 Fix writable rootwrap/privsep config
Fixes a hypothetical security issue related to privilege escalation via
rootwrap/privsep. A potential vulnerable service could previously allow
writes to its rootwrap/privsep config and thus allow for more commands
to be run with root privileges via rootwrap/privsep. For a succesful
attack, this would also require the service to allow to run arbitrary
commands via rootwrap/privsep. Thus far, no such vulnerabilities have
been reported and thus this fix is simply strengthening the container
images against such an issue in the future.

Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a
Closes-Bug: #1874298
2022-10-10 15:06:05 +00:00
Marcin Juszkiewicz 016c5ed30c adjust permissions on _extend_start files (part II)
Tim Shearer started it in 1d96a2bbe1.

Since all extend_start files are sourced rather than executed, the executable
bits are now cleared throughout the project.

Change-Id: Ia1797c32fc6a35f9f077c673abf4d8e16e51a760
2022-04-22 11:34:55 +02:00
Marcin Juszkiewicz e21aeb5ae9 flatten images a bit
As we have one type of images now some RUN calls could be merged so we
will have less layers in resulting images.

Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0
2022-04-21 18:53:14 +00:00
Tim Shearer 1d96a2bbe1 Adjust permissions on _extend_start files.
Explicitly set the permissions on the kolla-toolbox kolla_extend_start
file. Also, since all extend_start files are sourced rather than
executed, the executable bits are now cleared throughout the project.

Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0
2022-04-11 17:22:24 +02:00
Marcin Juszkiewicz 1749da2fbf docker: drop binary parts
Big patch drops all mentions of binary images support. Suggestions are
welcome how to split it into parts or handle better.

Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3
2022-04-09 17:44:26 +02:00
Marcin Juszkiewicz 38fcd184e8 centos: enable repos where needed
With RDO use we did not disabled some repositories. This patch disable
them and enable where needed.

Change-Id: Ia9d537fe9c1ad54789d2bfb4027254fbb3defe7e
2021-04-13 11:21:39 +00:00
Marcin Juszkiewicz 53443c5c71 Remove support for CentOS 7
With the move to RHEL/CentOS 8 we no longer have Python 2 in our images
so there is no need for checking which Python version (2.x or 3.x) is
used inside of containers.

We also no longer have to support yum as a value for
distro_package_manager.

Partially-Implements: blueprint centos-rhel-8

Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9
2020-04-15 09:32:06 +00:00
Christian Berendt 861f55fbfd Add block labels to all Dockerfiles
Change-Id: I9692dda817ef134d647247431565e1b58cf9da41
2020-03-01 17:25:58 +00:00
Alex Schultz 3e5d8e2653 Add python3 packages for RHEL systems
RDO is currently working on python3 support for the next version of
CentOS/RHEL based systems.  This package uses the distro_python3 flag
that was added as part of I4028991bad92c0e8e21066cc4173c06ce5eba393 to
use the python3 specific package names.  This change only adds python3
package names for RHEL systems.

Conflicts-With: https://review.openstack.org/#/c/636457/
Change-Id: Iad6b70b433a0dd1b0f8ae6790fd280594517661a
Related-Blueprint: python3-support
2019-03-12 17:48:18 +00:00
Alex Schultz ae1322ec10 Use base_package_type
This change updates the docker files to use base_package_type instead
of doing specific distro checks for the rhel/deb generic cases. The
base_distro is still available and is used when a specific distro needs
a customization but if the differences are purely rpm vs deb, then the
base_package_type can be used.

Change-Id: I8d720bb185df65a0178061ccf20b1ab2265da2c5
2019-01-17 08:23:41 -07:00
Eduardo Gonzalez 9342ed6b6f Add networking-sfc package to tacker images
Tacker need networking-sfc package to allow creation
of SFC flows in neutron.

Change-Id: I825fa9f67cfadb99d6bd90d7bc322747bd44fca4
2018-01-05 15:11:57 +01:00
Eduardo Gonzalez 7b2dea5506 Implement tacker-conductor image, rework all tacker
Tacker is broken in pike without conductor images.
Conductor is needed to communicate with mistral for
VIM monitoring
This change rework tacker image to allow tacker-conductor
service image.
Split tacker global image into tacker-server and tacker-conductor.

Closes-Bug: #1710874
Change-Id: I52778e86e4f2c297ead8d4b09983e5e38ca88c70
2017-08-20 09:58:27 +00:00
Jenkins 3a1d525f3d Merge "Add tacker binary for rpm based distros" 2017-05-09 11:12:07 +00:00
Jawon Choo 31259fa595 Override image's meta info.
centos based images have wrong label info,
these changes fix own image's name and build-date.

Change-Id: I1d13f8f386c8db12b5fbe5f8ecbbf9e3fbb4ba1c
Closes-Bug: #1680341
2017-05-03 11:08:17 +09:00
Chen 8c463a47a9 Use LABEL instead of MAINTAINER (deprecated) in all Dockerfile.j2
Use LABEL instruction instead of MAINTAINER (deprecated) instruc-
tion as suggested by Docker's official dockerfile guide.
docs.docker.com/engine/reference/builder/#maintainer-deprecated

Closes-Bug: #1683652

Change-Id: Ie87a1ddf31aefcd0b623fd2837d78de420e76898
2017-04-20 16:50:05 +09:00
Eduardo Gonzalez 8d76b269c2 Add tacker binary for rpm based distros
Tacker rpm is present in RDO repositories.
Now images can be built for binary installations.

Change-Id: I50203644ae0cc61fe87f2c7af11ff6ea3ef6df8d
2017-04-06 13:08:22 +01:00
Chao Guo 961224c6cf Use install-pip macro in most source images
1. Enable customization of pip packages in source
branch of most images
2. All pip packages install uniformly through
install-pip macro, user can easily customize his
own pip command (For example using a mirror)

Co-Authored-By: Mauricio Lima <mauriciolimab@gmail.com>
Change-Id: If09582039f690fa4136e8f33200d5da15e092da7
2017-02-17 08:49:32 -03:00
Sam Yaple 58eee09c15 use static uid/gid in images
This centralizes all user and group creation into a single source. This
will fix any current and furture uid/gid mismatches (such as with
nova-libvirt).

In the process, we also unify users between the distros in a standard
way. The users in the following containers change from thier defaults:

Ubuntu: _chrony user is now chrony
Ubuntu: memcache user is now memcached
All: qemu user is used for ownership and socket permissions

All uid and gid numbers are customizable via kolla-build.conf

Co-Authored-By: Kris Lindgren <klindgren@godaddy.com>
Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543
Partially-Implements: blueprint static-uid-gid
2017-01-17 09:02:21 -03:00
Eduardo Gonzalez e9b78fc2d2 Tacker Docker configuration
Add necessary Docker configuration for Tacker NFV service.

Change-Id: I9a5750d4616551828c0fa0e51302fd80fa4d33f7
Partially-Implements: blueprint tacker-support
2016-12-05 16:37:39 +00:00