Switch to using Debian as a base for our Docker images. (#15823)
* Update Dockerfile to properly work with Debian base images. * add missing setuid plugins * add systemd-journal * disable building ebpf in Docker * Fix docker group handling. * fix "no such user"/" No such file or directory" warning * fix netdata group and rm nut from docs * fix missing systemd-cat-native --------- Co-authored-by: ilyam8 <ilya@netdata.cloud> Co-authored-by: Tasos Katsoulas <12612986+tkatsoulas@users.noreply.github.com>
Austin S. Hemmelgarn committed
Nov 28, 2023 at 07:28 UTC
d8e2aff0aeda820c9603bf63de1c91e65b37811f
4 files changed
+39
-33
netdata-installer.sh
+3
-3
@@ -1104,7 +1104,7 @@ else
1104
NETDATA_USER="${USER}"
1105
ROOT_USER="${USER}"
1106
fi
1107
-NETDATA_GROUP="$(id -g -n "${NETDATA_USER}")"
1107
+NETDATA_GROUP="$(id -g -n "${NETDATA_USER}" 2> /dev/null)"
1108
[ -z "${NETDATA_GROUP}" ] && NETDATA_GROUP="${NETDATA_USER}"
1109
echo >&2 "Netdata user and group set to: ${NETDATA_USER}/${NETDATA_GROUP}"
1110
@@ -1177,7 +1177,7 @@ if [ "$(id -u)" -eq 0 ]; then
1177
# shellcheck disable=SC2086
1178
portable_add_user_to_group ${g} netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} ${g}"
1179
done
1180
- # Netdata must be able to read /etc/pve/qemu-server/* and /etc/pve/lxc/*
1180
+ # Netdata must be able to read /etc/pve/qemu-server/* and /etc/pve/lxc/*
1181
# for reading VMs/containers names, CPU and memory limits on Proxmox.
1182
if [ -d "/etc/pve" ]; then
1183
portable_add_user_to_group "www-data" netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} www-data"
@@ -1344,7 +1344,7 @@ if [ "$(id -u)" -eq 0 ]; then
1344
if ! iscontainer && command -v setcap 1> /dev/null 2>&1; then
1345
run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1346
if run setcap cap_dac_read_search+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"; then
1347
- capabilities=1
1347
+ capabilities=1
1348
fi
1349
fi
1350
packaging/docker/Dockerfile
+21
-20
@@ -3,7 +3,7 @@
3
4
# This image contains preinstalled dependencies
5
# hadolint ignore=DL3007
6
-FROM netdata/builder:v1 as builder
6
+FROM netdata/builder:v2 as builder
7
8
# One of 'nightly' or 'stable'
9
ARG RELEASE_CHANNEL=nightly
@@ -29,7 +29,7 @@ RUN chmod +x netdata-installer.sh && \
29
cp -rp /deps/* /usr/local/ && \
30
/bin/echo -e "INSTALL_TYPE='oci'\nPREBUILT_ARCH='$(uname -m)'" > ./system/.install-type && \
31
CFLAGS="$(packaging/docker/gen-cflags.sh)" LDFLAGS="-Wl,--gc-sections" ./netdata-installer.sh --dont-wait --dont-start-it --use-system-protobuf \
32
- ${EXTRA_INSTALL_OPTS} --one-time-build --enable-lto "$([ "$RELEASE_CHANNEL" = stable ] && echo --stable-channel)"
32
+ ${EXTRA_INSTALL_OPTS} --disable-ebpf --one-time-build --enable-lto "$([ "$RELEASE_CHANNEL" = stable ] && echo --stable-channel)"
33
34
# files to one directory
35
RUN mkdir -p /app/usr/sbin/ \
@@ -49,6 +49,7 @@ RUN mkdir -p /app/usr/sbin/ \
49
mv /usr/sbin/netdata /app/usr/sbin/ && \
50
mv /usr/sbin/netdata-claim.sh /app/usr/sbin/ && \
51
mv /usr/sbin/netdatacli /app/usr/sbin/ && \
52
+ mv /usr/sbin/systemd-cat-native /app/usr/sbin/ && \
53
mv packaging/docker/run.sh /app/usr/sbin/ && \
54
mv packaging/docker/health.sh /app/usr/sbin/ && \
55
mkdir -p /deps/etc && \
@@ -59,7 +60,7 @@ RUN mkdir -p /app/usr/sbin/ \
60
#####################################################################
61
# This image contains preinstalled dependencies
62
# hadolint ignore=DL3007
62
-FROM netdata/base:v1 as base
63
+FROM netdata/base:v2 as base
64
65
LABEL org.opencontainers.image.authors="Netdatabot <bot@netdata.cloud>"
66
LABEL org.opencontainers.image.url="https://netdata.cloud"
@@ -83,7 +84,7 @@ ENV DOCKER_USR netdata
84
ENV NETDATA_LISTENER_PORT 19999
85
EXPOSE $NETDATA_LISTENER_PORT
86
86
-ENV NETDATA_EXTRA_APK_PACKAGES=""
87
+ENV NETDATA_EXTRA_DEB_PACKAGES=""
88
89
RUN mkdir -p /opt/src /var/log/netdata && \
90
ln -sf /dev/stdout /var/log/netdata/access.log && \
@@ -92,16 +93,16 @@ RUN mkdir -p /opt/src /var/log/netdata && \
93
ln -sf /dev/stderr /var/log/netdata/daemon.log && \
94
ln -sf /dev/stdout /var/log/netdata/collector.log && \
95
ln -sf /dev/stdout /var/log/netdata/fluentbit.log && \
95
- ln -sf /dev/stdout /var/log/netdata/health.log && \
96
- addgroup -g ${NETDATA_GID} -S "${DOCKER_GRP}" && \
97
- adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}"
96
+ ln -sf /dev/stdout /var/log/netdata/health.log
97
98
COPY --from=builder /app /
99
101
-# Apply the permissions as described in
100
+# Create netdata user and apply the permissions as described in
101
# https://docs.netdata.cloud/docs/netdata-security/#netdata-directories, but own everything by root group due to https://github.com/netdata/netdata/pull/6543
102
# hadolint ignore=DL3013
104
-RUN chown -R root:root \
103
+RUN addgroup --gid ${NETDATA_GID} --system "${DOCKER_GRP}" && \
104
+ adduser --system --no-create-home --shell /usr/sbin/nologin --uid ${NETDATA_UID} --home /etc/netdata --group "${DOCKER_USR}" && \
105
+ chown -R root:root \
106
/etc/netdata \
107
/usr/share/netdata \
108
/usr/libexec/netdata && \
@@ -113,17 +114,17 @@ RUN chown -R root:root \
114
chown -R netdata:netdata /var/lib/netdata/cloud.d && \
115
chmod 0700 /var/lib/netdata/cloud.d && \
116
chmod 0755 /usr/libexec/netdata/plugins.d/*.plugin && \
116
- chmod 4755 \
117
- /usr/libexec/netdata/plugins.d/cgroup-network \
118
- /usr/libexec/netdata/plugins.d/local-listeners \
119
- /usr/libexec/netdata/plugins.d/apps.plugin \
120
- /usr/libexec/netdata/plugins.d/debugfs.plugin && \
121
- if [ -f /usr/libexec/netdata/plugins.d/freeipmi.plugin ]; then \
122
- chmod 4755 /usr/libexec/netdata/plugins.d/freeipmi.plugin; \
123
- fi && \
124
- if [ -f /usr/libexec/netdata/plugins.d/go.d.plugin ]; then \
125
- chmod 4755 /usr/libexec/netdata/plugins.d/go.d.plugin; \
126
- fi && \
117
+ for name in cgroup-network \
118
+ local-listeners \
119
+ apps.plugin \
120
+ debugfs.plugin \
121
+ freeipmi.plugin \
122
+ go.d.plugin \
123
+ perf.plugin \
124
+ slabinfo.plugin \
125
+ systemd-journal.plugin; do \
126
+ [ -f "/usr/libexec/netdata/plugins.d/$name" ] && chmod 4755 "/usr/libexec/netdata/plugins.d/$name"; \
127
+ done && \
128
# Group write permissions due to: https://github.com/netdata/netdata/pull/6543
129
find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
130
find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
packaging/docker/README.md
+2
-4
@@ -460,15 +460,13 @@ reading `- /etc/hostname:/host/etc/hostname:ro`.
460
## Adding extra packages at runtime
461
462
By default, the official Netdata container images do not include a number of optional runtime dependencies. You
463
-can add these dependencies, or any other APK packages, at runtime by listing them in the environment variable
464
-`NETDATA_EXTRA_APK_PACKAGES`.
463
+can add these dependencies, or any other APT packages, at runtime by listing them in the environment variable
464
+`NETDATA_EXTRA_DEB_PACKAGES`.
465
466
Commonly useful packages include:
467
468
- `apcupsd`: For monitoring APC UPS devices.
469
-- `libvirt-daemon`: For resolving cgroup names for libvirt domains.
469
- `lm-sensors`: For monitoring hardware sensors.
471
-- `msmtp`: For email alert support.
470
- `netcat-openbsd`: For IRC alert support.
471
472
## Health Checks
packaging/docker/run.sh
+13
-6
@@ -41,9 +41,9 @@ export DOCKER_HOST
41
42
if [ -n "${PGID}" ]; then
43
echo "Creating docker group ${PGID}"
44
- addgroup -g "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
44
+ addgroup --gid "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
45
echo "Assign netdata user to docker group ${PGID}"
46
- usermod -a -G "${PGID}" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
46
+ usermod --append --groups "docker" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
47
fi
48
49
# Needed to read Proxmox VMs and (LXC) containers configuration files (name resolution + CPU and memory limits)
@@ -98,13 +98,20 @@ if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /v
98
fi
99
100
if [ -n "${NETDATA_EXTRA_APK_PACKAGES}" ]; then
101
- echo "Fetching APK repository metadata."
102
- if ! apk update; then
103
- echo "Failed to fetch APK repository metadata."
101
+ echo >&2 "WARNING: Netdata’s Docker images have switched from Alpine to Debian as a base platform. Supplementary package support is now handled through the NETDATA_EXTRA_DEB_PACKAGES variable instead of NETDATA_EXTRA_APK_PACKAGES."
102
+ echo >&2 "WARNING: The container will still run, but supplementary packages listed in NETDATA_EXTRA_APK_PACKAGES will not be installed."
103
+ echo >&2 "WARNING: To remove these messages, either undefine NETDATA_EXTRA_APK_PACKAGES, or define it to an empty string."
104
+fi
105
+
106
+if [ -n "${NETDATA_EXTRA_DEB_PACKAGES}" ]; then
107
+ echo "Fetching APT repository metadata."
108
+ if ! apt-get update; then
109
+ echo "Failed to fetch APT repository metadata."
110
else
111
echo "Installing supplementary packages."
112
+ export DEBIAN_FRONTEND="noninteractive"
113
# shellcheck disable=SC2086
107
- if ! apk add --no-cache ${NETDATA_EXTRA_APK_PACKAGES}; then
114
+ if ! apt-get install -y --no-install-recommends ${NETDATA_EXTRA_DEB_PACKAGES}; then
115
echo "Failed to install supplementary packages."
116
fi
117
fi