mirror of
https://github.com/tommytran732/Fedora-CoreOS-Ignition
synced 2024-11-08 03:11:33 -05:00
Use gVisor
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
parent
30196a1409
commit
0826c5962c
File diff suppressed because one or more lines are too long
@ -144,6 +144,28 @@ storage:
|
||||
ExecStart=/usr/bin/docker-compose up -d
|
||||
Type=oneshot
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
- path: /etc/systemd/system/gvisor-updater.service
|
||||
contents:
|
||||
inline: |
|
||||
[Unit]
|
||||
Description=gVisor Update
|
||||
Require=network-online.target
|
||||
Before=docker.service
|
||||
|
||||
[Service]
|
||||
WorkingDirectory=/var/roothome
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
|
||||
ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
|
||||
ExecStart=/usr/bin/rm -f *.sha512
|
||||
ExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1
|
||||
ExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
- path: /etc/unbound/unbound.conf
|
||||
@ -210,6 +232,26 @@ storage:
|
||||
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
|
||||
RestrictNamespaces=yes
|
||||
LockPersonality=yes
|
||||
- path: /etc/docker/daemon.json
|
||||
contents:
|
||||
inline: |
|
||||
{
|
||||
"default-runtime": "runsc-ptrace",
|
||||
"runtimes": {
|
||||
"runsc-ptrace": {
|
||||
"path": "/var/usrlocal/bin/runsc",
|
||||
"runtimeArgs": [
|
||||
"--platform=ptrace"
|
||||
]
|
||||
},
|
||||
"runsc-kvm": {
|
||||
"path": "/var/usrlocal/bin/runsc",
|
||||
"runtimeArgs": [
|
||||
"--platform=kvm"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
links:
|
||||
- path: /etc/localtime
|
||||
target: ../usr/share/zoneinfo/America/New_York
|
||||
|
File diff suppressed because one or more lines are too long
42
Generic.yml
42
Generic.yml
@ -144,6 +144,28 @@ storage:
|
||||
inline: |
|
||||
GSSAPIAuthentication no
|
||||
VerifyHostKeyDNS yes
|
||||
- path: /etc/systemd/system/gvisor-updater.service
|
||||
contents:
|
||||
inline: |
|
||||
[Unit]
|
||||
Description=gVisor Update
|
||||
Require=network-online.target
|
||||
Before=docker.service
|
||||
|
||||
[Service]
|
||||
WorkingDirectory=/var/roothome
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
|
||||
ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
|
||||
ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
|
||||
ExecStart=/usr/bin/rm -f *.sha512
|
||||
ExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1
|
||||
ExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
- path: /etc/unbound/unbound.conf
|
||||
overwrite: true
|
||||
contents:
|
||||
@ -208,6 +230,26 @@ storage:
|
||||
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources
|
||||
RestrictNamespaces=yes
|
||||
LockPersonality=yes
|
||||
- path: /etc/docker/daemon.json
|
||||
contents:
|
||||
inline: |
|
||||
{
|
||||
"default-runtime": "runsc-ptrace",
|
||||
"runtimes": {
|
||||
"runsc-ptrace": {
|
||||
"path": "/var/usrlocal/bin/runsc",
|
||||
"runtimeArgs": [
|
||||
"--platform=ptrace"
|
||||
]
|
||||
},
|
||||
"runsc-kvm": {
|
||||
"path": "/var/usrlocal/bin/runsc",
|
||||
"runtimeArgs": [
|
||||
"--platform=kvm"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
links:
|
||||
- path: /etc/localtime
|
||||
target: ../usr/share/zoneinfo/America/New_York
|
||||
|
Loading…
Reference in New Issue
Block a user