2017-02-06 10:40:57 -06:00
|
|
|
# Docker image for DHCP relay
|
2017-01-24 00:18:53 -06:00
|
|
|
|
2019-04-29 00:51:46 -05:00
|
|
|
DOCKER_DHCP_RELAY_STEM = docker-dhcp-relay
|
|
|
|
|
DOCKER_DHCP_RELAY = $(DOCKER_DHCP_RELAY_STEM).gz
|
|
|
|
|
DOCKER_DHCP_RELAY_DBG = $(DOCKER_DHCP_RELAY_STEM)-$(DBG_IMAGE_MARK).gz
|
|
|
|
|
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_PATH = $(DOCKERS_PATH)/$(DOCKER_DHCP_RELAY_STEM)
|
|
|
|
|
|
2022-11-13 23:41:33 -06:00
|
|
|
$(DOCKER_DHCP_RELAY)_DEPENDS += $(ISC_DHCP_RELAY) $(SONIC_DHCPMON) $(SONIC_DHCPRELAY) $(LIBSWSSCOMMON) $(SONIC_RSYSLOG_PLUGIN)
|
First cut image update for kubernetes support. (#5421)
* First cut image update for kubernetes support.
With this,
1) dockers dhcp_relay, lldp, pmon, radv, snmp, telemetry are enabled
for kube management
init_cfg.json configure set_owner as kube for these
2) Each docker's start.sh updated to call container_startup.py to register going up
As part of this call, it registers the current owner as local/kube and its version
The images are built with its version ingrained into image during build
3) Update all docker's bash script to call 'container start/stop/wait' instead of 'docker start/stop/wait'.
For all locally managed containers, it calls docker commands, hence no change for locally managed.
4) Introduced a new ctrmgrd service, that helps with transition between owners as kube & local and carry over any labels update from STATE-DB to API server
5) hostcfgd updated to handle owner change
6) Reboot scripts are updatd to tag kube running images as local, so upon reboot they run the same image.
7) Added kube_commands.py to handle all updates with Kubernetes API serrver -- dedicated for k8s interaction only.
2020-12-22 10:01:33 -06:00
|
|
|
|
2024-03-21 11:27:51 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_DBG_DEPENDS = $($(DOCKER_CONFIG_ENGINE_BOOKWORM)_DBG_DEPENDS)
|
2022-11-13 23:41:33 -06:00
|
|
|
$(DOCKER_DHCP_RELAY)_DBG_DEPENDS += $(ISC_DHCP_RELAY_DBG) $(SONIC_DHCPRELAY_DBG) $(SONIC_DHCPMON_DBG) $(SONIC_RSYSLOG_PLUGIN)
|
2019-07-04 00:13:55 -05:00
|
|
|
|
2024-03-21 11:27:51 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_DBG_IMAGE_PACKAGES = $($(DOCKER_CONFIG_ENGINE_BOOKWORM)_DBG_IMAGE_PACKAGES)
|
2019-04-29 00:51:46 -05:00
|
|
|
|
2024-03-21 11:27:51 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_LOAD_DOCKERS = $(DOCKER_CONFIG_ENGINE_BOOKWORM)
|
2019-04-29 00:51:46 -05:00
|
|
|
|
2021-07-15 12:35:56 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_INSTALL_PYTHON_WHEELS = $(SONIC_UTILITIES_PY3)
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_INSTALL_DEBS = $(PYTHON3_SWSSCOMMON)
|
2023-11-28 15:28:16 -06:00
|
|
|
$(DOCKER_DHCP_RELAY)_PYTHON_WHEELS += $(SONIC_DHCP_UTILITIES_PY3)
|
2021-07-15 12:35:56 -05:00
|
|
|
|
2021-04-26 15:51:50 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_VERSION = 1.0.0
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_PACKAGE_NAME = dhcp-relay
|
2021-07-15 12:35:56 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_PACKAGE_DEPENDS = database^1.0.0
|
2021-04-26 15:51:50 -05:00
|
|
|
|
2024-03-14 15:12:26 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_SERVICE_REQUIRES = config-setup
|
2021-07-15 12:35:56 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_SERVICE_AFTER = swss syncd teamd
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_SERVICE_BEFORE = ntp-config
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_SERVICE_DEPENDENT_OF = swss
|
2017-01-24 00:18:53 -06:00
|
|
|
|
2021-07-15 12:35:56 -05:00
|
|
|
SONIC_DOCKER_IMAGES += $(DOCKER_DHCP_RELAY)
|
2019-04-29 00:51:46 -05:00
|
|
|
SONIC_DOCKER_DBG_IMAGES += $(DOCKER_DHCP_RELAY_DBG)
|
2021-07-15 12:35:56 -05:00
|
|
|
|
|
|
|
|
ifeq ($(INCLUDE_KUBERNETES),y)
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_DEFAULT_FEATURE_OWNER = kube
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_DEFAULT_FEATURE_STATE_ENABLED = y
|
|
|
|
|
|
|
|
|
|
ifeq ($(INCLUDE_DHCP_RELAY),y)
|
|
|
|
|
ifeq ($(INSTALL_DEBUG_TOOLS),y)
|
|
|
|
|
SONIC_PACKAGES_LOCAL += $(DOCKER_DHCP_RELAY_DBG)
|
|
|
|
|
else
|
|
|
|
|
SONIC_PACKAGES_LOCAL += $(DOCKER_DHCP_RELAY)
|
|
|
|
|
endif
|
|
|
|
|
endif
|
2017-02-06 10:40:57 -06:00
|
|
|
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_NAME = dhcp_relay
|
[docker-dhcp-relay] limit privileged flag for dhcp_relay container (#16817)
### Why I did it
HLD implementation: Container Hardening (https://github.com/sonic-net/SONiC/pull/1364)
##### Work item tracking
- Microsoft ADO **(number only)**: 14807420
#### How I did it
Reduce linux capabilities in privileged flag
#### How to verify it
Run dhcprelay sonic-mgmt tests
Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.
```
admin@vlab-05:~$ docker inspect dhcp_relay | grep Privilege
"Privileged": false,
admin@vlab-05:~$ docker exec -it dhcp_relay bash
root@vlab-05:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
```
2023-10-13 12:05:54 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_PRIVILEGED = false
|
2021-07-15 12:35:56 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_VOLUMES += /etc/sonic:/etc/sonic:ro
|
2023-06-25 18:36:09 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_VOLUMES += /etc/timezone:/etc/timezone:ro
|
2021-07-15 12:35:56 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_TMPFS += /tmp/
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_CONTAINER_TMPFS += /var/tmp/
|
|
|
|
|
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_CLI_CONFIG_PLUGIN = /cli/config/plugins/dhcp_relay.py
|
|
|
|
|
$(DOCKER_DHCP_RELAY)_CLI_SHOW_PLUGIN = /cli/show/plugins/show_dhcp_relay.py
|
2021-09-24 00:01:26 -05:00
|
|
|
$(DOCKER_DHCP_RELAY)_CLI_CLEAR_PLUGIN = /cli/clear/plugins/clear_dhcp6relay_counter.py
|
2021-07-15 12:35:56 -05:00
|
|
|
|
2019-11-05 20:32:14 -06:00
|
|
|
$(DOCKER_DHCP_RELAY)_FILES += $(SUPERVISOR_PROC_EXIT_LISTENER_SCRIPT)
|
