Merge Official Source
This commit is contained in:
actions-user
266
files/dockerd.init
Executable file
266
files/dockerd.init
Executable file
@@ -0,0 +1,266 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
USE_PROCD=1
|
||||
START=99
|
||||
|
||||
extra_command "uciadd" "<interface> <device> <zone> Add docker bridge configuration to network and firewall uci config"
|
||||
extra_command "ucidel" "<interface> <device> <zone> Delete docker bridge configuration from network and firewall uci config"
|
||||
|
||||
DOCKER_CONF_DIR="/tmp/dockerd"
|
||||
DOCKERD_CONF="${DOCKER_CONF_DIR}/daemon.json"
|
||||
|
||||
uci_quiet() {
|
||||
uci -q "${@}" >/dev/null
|
||||
}
|
||||
|
||||
json_add_array_string() {
|
||||
json_add_string "" "${1}"
|
||||
}
|
||||
|
||||
find_network_device() {
|
||||
local device="${1}"
|
||||
local device_section=""
|
||||
|
||||
check_device() {
|
||||
local cfg="${1}"
|
||||
local device="${2}"
|
||||
|
||||
local type name
|
||||
config_get type "${cfg}" type
|
||||
config_get name "${cfg}" name
|
||||
|
||||
[ "${type}" = "bridge" ] && [ "${name}" = "${device}" ] \
|
||||
&& device_section="${cfg}"
|
||||
}
|
||||
|
||||
config_load network
|
||||
config_foreach check_device device "${device}"
|
||||
|
||||
echo "${device_section}"
|
||||
}
|
||||
|
||||
boot() {
|
||||
uciadd
|
||||
rc_procd start_service
|
||||
}
|
||||
|
||||
uciadd() {
|
||||
local iface="${1}"
|
||||
local device="${2}"
|
||||
local zone="${3}"
|
||||
|
||||
[ -z "${iface}" ] && {
|
||||
iface="docker"
|
||||
device="docker0"
|
||||
zone="docker"
|
||||
}
|
||||
|
||||
/etc/init.d/dockerd running && {
|
||||
echo "Please stop dockerd service first"
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Add network interface
|
||||
if ! uci_quiet get network.${iface}; then
|
||||
logger -t "dockerd-init" -p notice "Adding interface '${iface}' to network config"
|
||||
uci_quiet add network interface
|
||||
uci_quiet rename network.@interface[-1]="${iface}"
|
||||
uci_quiet set network.@interface[-1].device="${device}"
|
||||
uci_quiet set network.@interface[-1].proto="none"
|
||||
uci_quiet set network.@interface[-1].auto="0"
|
||||
uci_quiet commit network
|
||||
fi
|
||||
|
||||
# Add docker bridge device
|
||||
if [ "$(find_network_device "$device")" = "" ]; then
|
||||
logger -t "dockerd-init" -p notice "Adding bridge device '${device}' to network config"
|
||||
uci_quiet add network device
|
||||
uci_quiet set network.@device[-1].type="bridge"
|
||||
uci_quiet set network.@device[-1].name="${device}"
|
||||
uci_quiet commit network
|
||||
else
|
||||
logger -t "dockerd-init" -p notice "Bridge device '${device}' already defined in network config"
|
||||
fi
|
||||
|
||||
# Add firewall zone
|
||||
if ! uci_quiet get firewall.${zone}; then
|
||||
logger -t "dockerd-init" -p notice "Adding firewall zone '${zone}' to firewall config"
|
||||
uci_quiet add firewall zone
|
||||
uci_quiet rename firewall.@zone[-1]="${zone}"
|
||||
uci_quiet set firewall.@zone[-1].input="ACCEPT"
|
||||
uci_quiet set firewall.@zone[-1].output="ACCEPT"
|
||||
uci_quiet set firewall.@zone[-1].forward="ACCEPT"
|
||||
uci_quiet set firewall.@zone[-1].name="${zone}"
|
||||
uci_quiet set firewall.dockerd=forwarding
|
||||
uci_quiet set firewall.@forwarding[-1].src="${zone}"
|
||||
uci_quiet set firewall.@forwarding[-1].dest='wan'
|
||||
uci_quiet commit firewall
|
||||
fi
|
||||
|
||||
# Add interface to firewall zone
|
||||
if uci_quiet get firewall.${zone}; then
|
||||
uci_quiet del_list firewall.${zone}.network="${iface}"
|
||||
uci_quiet add_list firewall.${zone}.network="${iface}"
|
||||
uci_quiet commit firewall
|
||||
fi
|
||||
|
||||
reload_config
|
||||
}
|
||||
|
||||
ucidel() {
|
||||
local iface="${1}"
|
||||
local device="${2}"
|
||||
local zone="${3}"
|
||||
|
||||
[ -z "${iface}" ] && {
|
||||
iface="docker"
|
||||
device="docker0"
|
||||
zone="docker"
|
||||
}
|
||||
|
||||
/etc/init.d/dockerd running && {
|
||||
echo "Please stop dockerd service first"
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Remove network device
|
||||
if uci_quiet delete network.$(find_network_device "${device}"); then
|
||||
logger -t "dockerd-init" -p notice "Deleting bridge device '${device}' from network config"
|
||||
uci_quiet commit network
|
||||
fi
|
||||
|
||||
# Remove network interface
|
||||
if uci_quiet get network.${iface}; then
|
||||
logger -t "dockerd-init" -p notice "Deleting interface '${iface}' from network config"
|
||||
uci_quiet delete network.${iface}
|
||||
uci_quiet commit network
|
||||
fi
|
||||
|
||||
# Remove interface from firewall zone
|
||||
if uci_quiet get firewall.${zone}; then
|
||||
logger -t "dockerd-init" -p notice "Deleting network interface '${iface}' in zone '${zone}' from firewall config"
|
||||
uci_quiet del_list firewall.${zone}.network="${iface}"
|
||||
uci_quiet commit firewall
|
||||
# Remove Firewall zone if network is empty
|
||||
if ! uci_quiet get firewall.${zone}.network; then
|
||||
logger -t "dockerd-init" -p notice "Deleting firewall zone '${zone}' from firewall config"
|
||||
uci_quiet delete firewall.${zone}
|
||||
fi
|
||||
uci_quiet commit firewall
|
||||
fi
|
||||
|
||||
reload_config
|
||||
}
|
||||
|
||||
process_config() {
|
||||
local alt_config_file data_root log_level nftables bip
|
||||
|
||||
[ -f /etc/config/dockerd ] || {
|
||||
# Use the daemon default configuration
|
||||
DOCKERD_CONF=""
|
||||
return 0
|
||||
}
|
||||
|
||||
# reset configuration
|
||||
rm -fr "${DOCKER_CONF_DIR}"
|
||||
mkdir -p "${DOCKER_CONF_DIR}"
|
||||
|
||||
config_load 'dockerd'
|
||||
config_get alt_config_file globals alt_config_file
|
||||
[ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && {
|
||||
ln -s "${alt_config_file}" "${DOCKERD_CONF}"
|
||||
return 0
|
||||
}
|
||||
|
||||
config_get data_root globals data_root "/opt/docker/"
|
||||
config_get log_level globals log_level "warn"
|
||||
config_get_bool nftables globals nftables "1"
|
||||
|
||||
# Don't add these options by default
|
||||
# omission == docker defaults
|
||||
config_get log_driver globals log_driver ""
|
||||
config_get bip globals bip ""
|
||||
config_get registry_mirrors globals registry_mirrors ""
|
||||
config_get hosts globals hosts ""
|
||||
config_get dns globals dns ""
|
||||
config_get_bool ipv6 globals ipv6 ""
|
||||
config_get ip globals ip ""
|
||||
config_get fixed_cidr globals fixed_cidr ""
|
||||
config_get fixed_cidr_v6 globals fixed_cidr_v6 ""
|
||||
# Use the *_proxy environment variable as the default value
|
||||
config_get http_proxy proxies http_proxy "${http_proxy}"
|
||||
config_get https_proxy proxies https_proxy "${https_proxy}"
|
||||
config_get no_proxy proxies no_proxy "${no_proxy}"
|
||||
config_get storage_driver globals storage_driver ""
|
||||
config_get buildkit globals buildkit "0"
|
||||
config_get experimental globals experimental "0"
|
||||
|
||||
. /usr/share/libubox/jshn.sh
|
||||
json_init
|
||||
json_add_string "data-root" "${data_root}"
|
||||
json_add_string "log-level" "${log_level}"
|
||||
[ "${nftables}" = "1" ] && {
|
||||
json_add_string "firewall-backend" "nftables"
|
||||
}
|
||||
[ "${buildkit}" = "1" ] && {
|
||||
json_add_object 'features'
|
||||
json_add_boolean "buildkit" "${buildkit}"
|
||||
json_close_object
|
||||
}
|
||||
[ "${experimental}" = "1" ] && json_add_boolean "experimental" "${experimental}"
|
||||
[ -z "${log_driver}" ] || json_add_string "log-driver" "${log_driver}"
|
||||
[ -z "${bip}" ] || json_add_string "bip" "${bip}"
|
||||
[ -z "${registry_mirrors}" ] || json_add_array "registry-mirrors"
|
||||
[ -z "${registry_mirrors}" ] || config_list_foreach globals registry_mirrors json_add_array_string
|
||||
[ -z "${registry_mirrors}" ] || json_close_array
|
||||
[ -z "${hosts}" ] || json_add_array "hosts"
|
||||
[ -z "${hosts}" ] || config_list_foreach globals hosts json_add_array_string
|
||||
[ -z "${hosts}" ] || json_close_array
|
||||
[ -z "${dns}" ] || json_add_array "dns"
|
||||
[ -z "${dns}" ] || config_list_foreach globals dns json_add_array_string
|
||||
[ -z "${dns}" ] || json_close_array
|
||||
[ -z "${ipv6}" ] || json_add_boolean "ipv6" "${ipv6}"
|
||||
[ -z "${ip}" ] || json_add_string "ip" "${ip}"
|
||||
[ -z "${fixed_cidr}" ] || json_add_string "fixed-cidr" "${fixed_cidr}"
|
||||
[ -z "${fixed_cidr_v6}" ] || json_add_string "fixed-cidr-v6" "${fixed_cidr_v6}"
|
||||
if [ -n "${http_proxy}" ] || [ -n "${https_proxy}" ] || [ -n "${no_proxy}" ]; then
|
||||
json_add_object "proxies"
|
||||
[ -z "${http_proxy}" ] || json_add_string "http-proxy" "${http_proxy}"
|
||||
[ -z "${https_proxy}" ] || json_add_string "https-proxy" "${https_proxy}"
|
||||
[ -z "${no_proxy}" ] || json_add_string "no-proxy" "${no_proxy}"
|
||||
json_close_object
|
||||
fi
|
||||
[ -z "${storage_driver}" ] || json_add_string "storage-driver" "${storage_driver}"
|
||||
json_dump > "${DOCKERD_CONF}"
|
||||
}
|
||||
|
||||
start_service() {
|
||||
local nofile=$(cat /proc/sys/fs/nr_open)
|
||||
|
||||
process_config
|
||||
|
||||
procd_open_instance
|
||||
procd_set_param stderr 1
|
||||
if [ -z "${DOCKERD_CONF}" ]; then
|
||||
procd_set_param command /usr/bin/dockerd
|
||||
else
|
||||
procd_set_param command /usr/bin/dockerd --config-file="${DOCKERD_CONF}"
|
||||
fi
|
||||
procd_set_param limits nofile="${nofile} ${nofile}"
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
process_config
|
||||
procd_send_signal dockerd
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger 'dockerd'
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
if /etc/init.d/dockerd running; then
|
||||
service_stop "/usr/bin/dockerd"
|
||||
fi
|
||||
}
|
||||
37
files/etc/config/dockerd
Normal file
37
files/etc/config/dockerd
Normal file
@@ -0,0 +1,37 @@
|
||||
# The following settings require a restart of docker to take full effect, A reload will only have partial or no effect:
|
||||
# log_driver
|
||||
# bip
|
||||
# blocked_interfaces
|
||||
# extra_iptables_args
|
||||
# device
|
||||
|
||||
config globals 'globals'
|
||||
# option alt_config_file '/etc/docker/daemon.json'
|
||||
option data_root '/opt/docker/'
|
||||
# option log_driver 'local'
|
||||
option log_level 'warn'
|
||||
option nftables '1'
|
||||
# list hosts 'unix:///var/run/docker.sock'
|
||||
# option bip '172.18.0.1/24'
|
||||
# option fixed_cidr '172.17.0.0/16'
|
||||
# option fixed_cidr_v6 'fc00:1::/80'
|
||||
# option ipv6 '1'
|
||||
# option ip '::ffff:0.0.0.0'
|
||||
# list dns '172.17.0.1'
|
||||
# list registry_mirrors 'https://<my-docker-mirror-host>'
|
||||
# list registry_mirrors 'https://hub.docker.com'
|
||||
option buildkit '0'
|
||||
option experimental '0'
|
||||
|
||||
# If your organization uses a proxy server to connect to the internet, you may need to configure the proxy.
|
||||
# See https://docs.docker.com/engine/daemon/proxy/ for more details
|
||||
config proxies 'proxies'
|
||||
# option http_proxy 'http://proxy.example.com:3128'
|
||||
# option https_proxy 'https://proxy.example.com:3129'
|
||||
# option no_proxy '*.test.example.com,.example.org,127.0.0.0/8'
|
||||
|
||||
# firewall config changes are only additive i.e firewall will need to be restarted first to clear old changes,
|
||||
# then docker restarted to load in new changes.
|
||||
config firewall 'firewall'
|
||||
option device 'docker0'
|
||||
# list blocked_interfaces 'wan'
|
||||
Reference in New Issue
Block a user