matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
master
sonic-buildimage/rules/docker-nat.mk

43 lines
1.4 KiB
Makefile
Raw Permalink Normal View History

Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
# docker image for nat
DOCKER_NAT_STEM = docker-nat
DOCKER_NAT = $(DOCKER_NAT_STEM).gz
DOCKER_NAT_DBG = $(DOCKER_NAT_STEM)-$(DBG_IMAGE_MARK).gz
$(DOCKER_NAT)_PATH = $(DOCKERS_PATH)/$(DOCKER_NAT_STEM)
[redis] Install vanilla redis packages for Buster and Stretch; upgrade Buster to 6.0.5 (#4732) upgrade redis server to 5:6.0.5-1~bpo10+1
2020-06-27 03:17:20 -05:00
$(DOCKER_NAT)_DEPENDS += $(SWSS) $(IPTABLESIP4TC) $(IPTABLESIP6TC) $(IPTABLESIPTC) $(IPXTABLES12) $(IPTABLES)
[nat] Switch to bullseye (#14495) Change references to use bullseye instead of buster Why I did it Almost all daemons in 202211 and master uses bullseye, and NAT seems easy to migrate. How I did it Replaced the references, built with 202211 branch. How to verify it Not sure, it builds and tests pass as far as I can tell but I don't use the feature myself. Signed-off-by: Christian Svensson <blue@cmd.nu>
2023-04-02 16:02:33 -05:00
$(DOCKER_NAT)_DBG_DEPENDS = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_DEPENDS)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
$(DOCKER_NAT)_DBG_DEPENDS += $(SWSS_DBG) $(LIBSWSSCOMMON_DBG)
[nat] Switch to bullseye (#14495) Change references to use bullseye instead of buster Why I did it Almost all daemons in 202211 and master uses bullseye, and NAT seems easy to migrate. How I did it Replaced the references, built with 202211 branch. How to verify it Not sure, it builds and tests pass as far as I can tell but I don't use the feature myself. Signed-off-by: Christian Svensson <blue@cmd.nu>
2023-04-02 16:02:33 -05:00
$(DOCKER_NAT)_DBG_IMAGE_PACKAGES = $($(DOCKER_SWSS_LAYER_BULLSEYE)_DBG_IMAGE_PACKAGES)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
[nat] Switch to bullseye (#14495) Change references to use bullseye instead of buster Why I did it Almost all daemons in 202211 and master uses bullseye, and NAT seems easy to migrate. How I did it Replaced the references, built with 202211 branch. How to verify it Not sure, it builds and tests pass as far as I can tell but I don't use the feature myself. Signed-off-by: Christian Svensson <blue@cmd.nu>
2023-04-02 16:02:33 -05:00
$(DOCKER_NAT)_LOAD_DOCKERS += $(DOCKER_SWSS_LAYER_BULLSEYE)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
[dockers] label SONiC Docker with manifest (#5939) Signed-off-by: Stepan Blyschak stepanb@nvidia.com This PR is part of SONiC Application Extension Depends on #5938 - Why I did it To provide an infrastructure change in order to support SONiC Application Extension feature. - How I did it Label every installable SONiC Docker with a minimal required manifest and auto-generate packages.json file based on installed SONiC images. - How to verify it Build an image, execute the following command: admin@sonic:~$ docker inspect docker-snmp:1.0.0 | jq '.[0].Config.Labels["com.azure.sonic.manifest"]' -r | jq Cat /var/lib/sonic-package-manager/packages.json file to verify all dockers are listed there.
2021-04-26 15:51:50 -05:00
$(DOCKER_NAT)_VERSION = 1.0.0
$(DOCKER_NAT)_PACKAGE_NAME = nat
[SONiC Application Extension] support warm/fast reboot for extension packages (#7286) #### Why I did it I made this change to support warm/fast reboot for SONiC extension packages as per HLD Azure/SONiC#682. #### How I did it I extended manifest.json.j2 with new warm/fast reboot related fields and also extended sonic_debian_extension.j2 script template to generate the shutdown order files for warm and fast reboot.
2021-07-11 08:58:05 -05:00
$(DOCKER_NAT)_WARM_SHUTDOWN_BEFORE = swss
$(DOCKER_NAT)_FAST_SHUTDOWN_BEFORE = swss
[dockers] label SONiC Docker with manifest (#5939) Signed-off-by: Stepan Blyschak stepanb@nvidia.com This PR is part of SONiC Application Extension Depends on #5938 - Why I did it To provide an infrastructure change in order to support SONiC Application Extension feature. - How I did it Label every installable SONiC Docker with a minimal required manifest and auto-generate packages.json file based on installed SONiC images. - How to verify it Build an image, execute the following command: admin@sonic:~$ docker inspect docker-snmp:1.0.0 | jq '.[0].Config.Labels["com.azure.sonic.manifest"]' -r | jq Cat /var/lib/sonic-package-manager/packages.json file to verify all dockers are listed there.
2021-04-26 15:51:50 -05:00
[build]: combine feature and container feature table (#5081) 1. remove container feature table 2. do not generate feature entry if the feature is not included in the image 3. rename ENABLE_* to INCLUDE_* for better clarity 4. rename feature status to feature state 5. [submodule]: update sonic-utilities * 9700e45 2020-08-03 | [show/config]: combine feature and container feature cli (#1015) (HEAD, origin/master, origin/HEAD) [lguohan] * c9d3550 2020-08-03 | [tests]: fix drops_group_test failure on second run (#1023) [lguohan] * dfaae69 2020-08-03 | [lldpshow]: Fix input device is not a TTY error (#1016) [Arun Saravanan Balachandran] * 216688e 2020-08-02 | [tests]: rename sonic-utilitie-tests to tests (#1022) [lguohan] Signed-off-by: Guohan Lu <lguohan@gmail.com>
2020-08-05 15:23:12 -05:00
ifeq ($(INCLUDE_NAT), y)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
SONIC_DOCKER_IMAGES += $(DOCKER_NAT)
SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_NAT)
Made Change to have Configurable option to enable/disable docker image (#4171) * Made Change to have Configurable option to enable/disable docker image * [Submodule-Update] sonic-utilities to latest master
2020-02-21 12:20:07 -06:00
endif
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
[build]: combine feature and container feature table (#5081) 1. remove container feature table 2. do not generate feature entry if the feature is not included in the image 3. rename ENABLE_* to INCLUDE_* for better clarity 4. rename feature status to feature state 5. [submodule]: update sonic-utilities * 9700e45 2020-08-03 | [show/config]: combine feature and container feature cli (#1015) (HEAD, origin/master, origin/HEAD) [lguohan] * c9d3550 2020-08-03 | [tests]: fix drops_group_test failure on second run (#1023) [lguohan] * dfaae69 2020-08-03 | [lldpshow]: Fix input device is not a TTY error (#1016) [Arun Saravanan Balachandran] * 216688e 2020-08-02 | [tests]: rename sonic-utilitie-tests to tests (#1022) [lguohan] Signed-off-by: Guohan Lu <lguohan@gmail.com>
2020-08-05 15:23:12 -05:00
ifeq ($(INCLUDE_NAT), y)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
SONIC_DOCKER_DBG_IMAGES += $(DOCKER_NAT_DBG)
SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_NAT_DBG)
Made Change to have Configurable option to enable/disable docker image (#4171) * Made Change to have Configurable option to enable/disable docker image * [Submodule-Update] sonic-utilities to latest master
2020-02-21 12:20:07 -06:00
endif
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
$(DOCKER_NAT)_CONTAINER_NAME = nat
[docker-nat] limit privileged flag for nat container (#17756) ### Why I did it HLD implementation: Container Hardening (https://github.com/sonic-net/SONiC/pull/1364) ### How I did it Reduce linux capabilities in privileged flag #### How to verify it Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps. ``` admin@vlab-01:~$ docker inspect nat | grep Privi "Privileged": false, admin@vlab-01:~$ docker exec -it nat bash root@vlab-01:/# capsh --print Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep ```
2024-01-26 12:43:35 -06:00
$(DOCKER_NAT)_RUN_OPT += -t --cap-add=NET_ADMIN
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
$(DOCKER_NAT)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
Timezone sync issue between the host and containers (#14000) #### Why I did it To fix the timezone sync issue between the containers and the host. If a certain timezone has been configured on the host (SONIC) then the expectation is to reflect the same across all the containers. This will fix [Issue:13046](https://github.com/sonic-net/sonic-buildimage/issues/13046). For instance, a PST timezone has been set on the host and if the user checks the link flap logs (inside the FRR), it shows the UTC timestamp. Ideally, it should be PST.
2023-06-25 18:36:09 -05:00
$(DOCKER_NAT)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
$(DOCKER_NAT)_RUN_OPT += -v /host/warmboot:/var/warmboot
[Services] Restart NAT service upon unexpected critical process exit. (#4208)
2020-03-05 17:27:21 -06:00
$(DOCKER_NAT)_FILES += $(SUPERVISOR_PROC_EXIT_LISTENER_SCRIPT)
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
[Services] Restart NAT service upon unexpected critical process exit. (#4208)
2020-03-05 17:27:21 -06:00
$(DOCKER_NAT)_BASE_IMAGE_FILES += natctl:/usr/bin/natctl
Add infra to support building Bullseye base image with Buster containers All docker containers will be built as Buster containers, from a Buster slave. The base image and remaining packages that are installed onto the host system will be built for Bullseye, from a Bullseye slave. Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
2021-06-30 14:45:40 -05:00
[nat] Switch to bullseye (#14495) Change references to use bullseye instead of buster Why I did it Almost all daemons in 202211 and master uses bullseye, and NAT seems easy to migrate. How I did it Replaced the references, built with 202211 branch. How to verify it Not sure, it builds and tests pass as far as I can tell but I don't use the feature myself. Signed-off-by: Christian Svensson <blue@cmd.nu>
2023-04-02 16:02:33 -05:00
SONIC_BULLSEYE_DOCKERS += $(DOCKER_NAT)
SONIC_BULLSEYE_DBG_DOCKERS += $(DOCKER_NAT_DBG)
Reference in New Issue Copy Permalink