Giter Club home page Giter Club logo

pot's Introduction

pot

build-badge License

Another container framework based on jails, to run FreeBSD containers on FreeBSD. Every running instance is called pot, like the one that I use to cook all the different type of pasta. It's heavily based on FreeBSD, in particular on jails, ZFS, pf and rctl.

The project's initial goal was to prove that FreeBSD has all the technologies to have a container-alike environment. The project then evolved into something more robust and feature-rich.

The project was presented for the first time at FOSDEM 2018: (talk page)

If you are more interested in jail orchestration, a nomad driver is provided to interact with pot and this work has been presented at FOSDEM 2020 (talk page)

Documentation

The project's documentation is available at https://pot.pizzamig.dev

More in details:

  • A Getting started guide is available here
  • An installation guide, with detailed description is available here

Nomad pot driver integration

A driver to allow nomad to interact with pot has been developed and available here

Ansible Collection

There is pot collection for Ansible provided by github user @zilti available at https://galaxy.ansible.com/zilti/pot.

Online help

pot provide an online help:

# pot help
Usage: pot command [options]

Commands:
	help	-- Show help
	version -- Show the pot version
	config  -- Show pot framework configuration
	ls/list	-- List of the installed pots
	show	-- Show pot information
	info    -- Print minimal information on a pot
	top     -- Run the unix top in the pot
	ps      -- Show running pots
	init	-- Initialize the ZFS layout
	de-init	-- Deinstall pot from your system
	vnet-start -- Start the vnet configuration
	create-base	-- Create a new base image
	create-fscomp -- Create a new fs component
	create-private-bridge -- Create a new private bridge
	create -- Create a new pot (jail)
	clone -- Clone a pot creating a new one
	clone-fscomp - Clone a fscomp
	rename -- Rename a pot
	destroy -- Destroy a pot
	prune   -- Destroy not running prunable pots
	copy-in -- Copy a file or a directory into a pot
	mount-in -- Mount a directory, a zfs dataset or a fscomp into a pot
	add-dep -- Add a dependency
	set-rss -- Set a resource constraint
	get-rss -- Get the current resource usage
	set-cmd -- Set the command to start the pot
	set-env -- Set environment variabls inside a pot
	set-hosts -- Set etc/hosts entries inside a pot
	set-hook -- Set hook scripts for a pot
	set-attr -- Set a pot's attribute
	get-attr -- Get a pot's attribute
	export-ports -- Let export tcp ports
	start -- Start a jail (pot)
	stop -- Stop a jail (pot)
	term -- Start a terminal in a pot
	run -- Start and open a terminal in a pot
	snap/snapshot -- Take a snapshot of a pot
	rollback/revert -- Restore the last snapshot
	purge-snapshots -- Remove old/all snapshots
	export -- Export a pot to a file
	import -- Import a pot from a file or a URL
	prepare -- Import and prepare a pot - designed for jail orchestrator
	update-config -- Update the configuration of a pot

Every command has its own online help as well. For instance:

pot create [-hv] -p potname [-N network-type] [-i ipaddr] [-l lvl] [-f flavour]
  [-b base | -P basepot ] [-d dns] [-t type]
  -h print this help
  -v verbose
  -k keep the pot, if create fails
  -p potname : the pot name (mandatory)
  -l lvl : pot level (only for type multi)
  -b base : the base pot
  -P pot : the pot to be used as reference
  -d dns : one between inherit(default), pot, off or custom:filename
  -f flavour : flavour to be used
  -t type: single or multi (default multi)
         single: the pot is based on a unique ZFS dataset
         multi: the pot is composed by a classical collection of 3 ZFS dataset
  -N network-type: one of those
         inherit: inherit the host network stack (default)
         alias: use a static ip as alias configured directly to the host NIC
         public-bridge: use the internal commonly public bridge
         private-bridge: use an internal private bridge (with option -B)
  -i ipaddr : an ip address or the keyword auto (if compatible with the network-type)
         auto: usable with public-bridge and private-bridge (default)
         ipaddr: mandatory with alias, usable with public-bridge and private-bridge
  -B bridge-name : the name of the bridge to be used (private-bridge only)
  -S network-stack : the network stack (ipv4, ipv6 or dual)

pot's People

Contributors

0mp avatar crest avatar einsiedlerkrebs avatar grembo avatar hxw avatar jmgurney avatar nkfilis avatar pizzamig avatar reezer avatar sirn avatar urosgruber avatar zilti avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

pot's Issues

Static DHCP implementation

Develop or find a tool that can manage/assign network addresses to pots like DHCP, but at creation time

Add support to import single files

A needed features is to be able to import single files to a pot.
It's like add-fscomp, but instead of being a ZFS dataset or a directory, it's just a single file.

Passing the system environment to the jail compromises the isolation

Currently, the environment of a jail is inherited from the system. It shouldn't.
Example:

  • a pot running salt_minion (py27-salt)
  • a system root with bash or zsh as shell

When salt_minion start inside a jail, it tries to spawn commands using $SHELL value, crashing.
The problem is that the system user uses a shell that's not installed in the jail.
In general, the environment inside a jail should be independent of the hosting system.

FOSDEM Talk Video

Thank you for the talk at FOSDEM 2018.

Creating this issue as a placeholder for people who get pointed to the repo but may have missed your talk, please link to it when it is available?

Levels are more than two.

Pot supported 2 levels.
But I want to test:

  • two pots: nginx and apache - first level;
  • two pots: mysql and postgresql - second level;
  • three pots CMS-s: drupal, joomla, wordpess - third level;
  • nine pots whit three sites on each CMS: 1dp,2dp,3dp,1jm,2jm,3jm,1wp,2wp,3wp - fourth level.

Is it possible to solve such a problem with the possibilities of pot?

Grazie!

Add support for the IPFW and/or IPF firewalls OR make pot firewall-agnostic

The one thing missing from pot, I think, is making pot either capable of using either or both IPFW and IPF, since both have people who actively use and maintain them.

Another option which is arguably better but may involve more work (and changing ABI/KBI and would thus probably involve a major version bump?) would be to adopt a principle similar to that of blacklistd.
It uses a firewall-agnostic API where the sysadmin supplies the commands necessary for certain functions, and then that command is simply executed.
This would have the added benefit that if, say, npf (NetBSD Packet Filter by rmind@netbsd) was ever ported to FreeBSD, or another 4th firewall was added, it would be trivial to add support for these.

pot config -g salt-work

# cat /opt/pot/jails/salt-work/conf/pot.conf 
pot.level=2
pot.type=multi
pot.base=11.1
pot.potbase=salt-base
pot.dns=inherit
pot.cmd=sh /etc/rc
host.hostname="salt-work.pots11.fbsd"
osrelease="11.1-RELEASE"
ip4=inherit
vnet=false

but

# pot config -g salt-work
###>  NO salt-work is not a valid name
pot config [-h][-v][-q] [-g name ]
  -h -- print this help
  -v verbose
  -q quiet
  -g name : get name value
    possible names are fs_root zfs_root gateway syslogd

or

# pot start salt-work
ELF ldconfig path: /lib /usr/lib /usr/lib/compat
32-bit compatibility ldconfig path: /usr/lib32
/etc/rc: WARNING: $hostname is not set -- see rc.conf(5).
Creating and/or trimming log files.
Starting syslogd.
syslogd: child pid 3179 exited with return code 1
/etc/rc: WARNING: failed to start syslogd
Clearing /tmp (X related).
Updating motd:.
Starting sendmail_submit.
Starting sendmail_msp_queue.
Starting cron.

Sat Jun 30 22:06:02 UTC 2018
===>  The pot salt-work started

# pot config -g salt-work
###>  NO salt-work is not a valid name
pot config [-h][-v][-q] [-g name ]
  -h -- print this help
  -v verbose
  -q quiet
  -g name : get name value
    possible names are fs_root zfs_root gateway syslogd

Thanks.

Resource limitations

It should be possible to provide resource limits to pot.
For instance, how much memory or CPU.
It should be based on rctl.

sed: /opt/pot/jails/base-11_1/custom/etc/crontab: No such file or directory

Hi,

I'm trying out pot for the first time and I got the following error:

$ sudo pkg install pot
$ sudo pkg init
$ sudo pot create-base -r 11.1
===>  Create a base with release 11.1
/tmp/11.1_base.txz                            100% of   99 MB  741 kBps 02m18s
===>  Create the zfs datasets for base release zroot/pot/bases/11.1
sed: /opt/pot/jails/base-11_1/custom/etc/crontab: No such file or directory
sed: /opt/pot/jails/base-11_1/custom/etc/crontab: No such file or directory

Then I tried to run create-base again:

$ sudo pot create-base -r 11.1
===>  Create a base with release 11.1
===>  Create the zfs datasets for base release zroot/pot/bases/11.1
./sbin/init: Can't restore time
./lib/libcrypt.so.5: Can't restore time
./lib/libthr.so.3: Can't restore time
./lib/libc.so.7: Can't restore time
./usr/lib/librt.so.1: Can't restore time
./usr/bin/crontab: Can't restore time
./usr/bin/su: Can't restore time
./usr/bin/chpass: Can't restore time
./usr/bin/passwd: Can't restore time
./usr/bin/opieinfo: Can't restore time
./usr/bin/login: Can't restore time
./usr/bin/opiepasswd: Can't restore time
./libexec/ld-elf.so.1: Can't restore time
tar: Error exit delayed from previous errors.
cp: cannot overwrite directory opt/custom/etc/unbound with non-directory etc/unbound
cp: symlink: ../usr/sbin/rmt: File exists
cp: utimensat: opt/custom/var/empty: Operation not permitted
cp: symlink: ../usr/sbin/rmt: File exists
cp: symlink: ../var/unbound: File exists
cp: cannot overwrite directory opt/custom/var/db/etcupdate/current/usr/share/man/en.ISO8859-15 with non-directory var/db/etcupdate/current/usr/share/man/en.ISO8859-15
cp: symlink: ../man4: File exists
cp: symlink: ../man9: File exists
cp: symlink: ../man3: File exists
cp: symlink: ../man7: File exists
cp: symlink: ../man2: File exists
cp: symlink: ../man8: File exists
cp: symlink: ../man5: File exists
cp: symlink: ../man1: File exists
cp: symlink: ../man6: File exists
cp: symlink: ../man6: File exists
cp: symlink: ../man1: File exists
cp: symlink: ../man5: File exists
cp: symlink: ../man8: File exists
cp: symlink: ../man2: File exists
cp: symlink: ../man7: File exists
cp: symlink: ../man3: File exists
cp: symlink: ../man9: File exists
cp: symlink: ../man4: File exists
cp: symlink: C: File exists
cp: symlink: C: File exists
cp: cannot overwrite directory opt/custom/var/db/etcupdate/current/usr/share/openssl/man/en.ISO8859-15 with non-directory var/db/etcupdate/current/usr/share/openssl/man/en.ISO8859-15
cp: symlink: ../man3: File exists
cp: symlink: ../man1: File exists
cp: symlink: usr/src/sys: File exists

sudo pot create -p shield -b 11.1 worked just fine, however, and now I'm in jail's shell.


Details:

  • FreeBSD 12.0-CURRENT r333659 amd64
  • pot: 0.5.5
  • ZFS

Support for pre/post start and stop

I'm new here and didn't have time to review the code but is there any support to attach sort of a pre, post hooks during start and stop commands? If so how can this be done.

And second question how can I pass a list of env variables to the script as well as inside pot container?

###> no snapshot found for zroot/pot/jails/salt-base/custom

I was playing on the pot_slides.pdf file on page 15:

pot init
pot create-base -r 11.1
pot create-fscomp -f repository
pot create -p saltmaster -b 11.1
pot add-fscomp -p saltmaster -f repository -m /mnt
pot create-fscomp -f repo-work
pot create-fscomp -f repo-home
pot create -p salt-base -b 11.1
pot create -p salt-work -P salt-base -l 2
###>  no snapshot found for zroot/pot/jails/salt-base/custom

VBox FreeBSD both 11.1 and 12

๐Ÿ˜•

pot can have dependencies

a pot can need a service provided by another pot
the dependency could be automatically fulfilled by pot start

mount_nullfs says "No such file or directory" and fails to mount when starting a pot

Here's what I've done:

sudo pot init
sudo pot create-base -r 11.2
sudo pot create -p committer-pot -b 11.2
sudo pot create-fscomp -f svn-ports
sudo pot create-fscomp -f svn-src
sudo pot create-fscomp -f svn-doc
sudo pot add-fscomp -p committer-pot -f svn-src -m ~/freebsd/svn/src/
sudo pot add-fscomp -p committer-pot -f svn-ports -m ~/freebsd/svn/ports/
sudo pot add-fscomp -p committer-pot -f svn-doc -m ~/freebsd/svn/doc/
sudo pot snapshot -p committer-pot
sudo pot start committer-pot

As a result of the last command I got:

mount_nullfs: /opt/pot/jails/committer-pot/m/home: No such file or directory
###>  Error mounting /opt/pot/fscomp/svn-src
ifconfig: interface destroy does not exist
###>  Mount failed

It happens every time I try to run sudo pot start committer-pot.

pot revert

Implementation of the revert command, to restore a previous snapshot of a pot

log unification

Configure syslog to not log locally, but on the hosting machine.
Put the pot name before every log entry

dns pot support

Add an option to create a pot the will uses the internal consul-dns pot instead of copy the resolv.conf from the host

pot stop prints "pfctl: /dev/pf: No such file or directory"

I get:

pfctl: /dev/pf: No such file or directory

as an output of pot stop mypot.

I didn't configure anything in particular, just pot init and pot create.

Also, the pf kernel module is not loaded (which is most likely the reason for this warning to be printed).

Promote a cloned pot, to substitute another one

Write a promote command, where a "beta" cloned pot take the place of a "stable" pot

pot snapshot -p stable
pot clone -p beta -P stable
[ beta is good ]
pot promote -p beta -P stable -n old-stable

  • stable renamed as old-stable
  • beta renamed as stable

pot create-base uses inconsistent file names

Trying to create-base -r 12.0, exploded

===>  Automatically use 12.0 as base name
===>  Create a base with release 12.0
===>  Create the zfs datasets for base release zroot/pot/bases/12.0
tar: Error opening archive: Failed to open '/tmp/12.0_base.txz'
cp: root: No such file or directory
cp: etc: No such file or directory
cp: var: No such file or directory
chflags: var/empty: No such file or directory
cd: ../../opt/custom/var/db: No such file or directory
===>  Create the related pot [base-12_0]
getopt: invalid option -- F

renaming the txz in /tmp to from 12.0-RELEASE_base.txz to 12.0_base.txz worked on the second run (after manually destroying the datasets that were created before the unpacking failed)

on boot start flag for pot

Would it be possible to set a flag on a pot so that it will start at boot time.
If one has many pots, a line in /etc/rc.conf with pot_list=" " would become a little messy.
A on boot flag on a pot is a nicer option in my opinion.

Thanks for all your work on pot.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.