From 970d01ca72823a63ab9f3a122ac8910aba8c9608 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Wed, 14 Feb 2024 14:17:42 -0800 Subject: [PATCH 01/21] Allow laci, flaci and acctf to use reboot and poweroff --- custom_files/sudoers | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/custom_files/sudoers b/custom_files/sudoers index a5abe50..9dbf631 100644 --- a/custom_files/sudoers +++ b/custom_files/sudoers @@ -1,3 +1 @@ -laci ALL= NOPASSWD: /usr/bin/chrt -flaci ALL= NOPASSWD: /usr/bin/chrt -acctf ALL= NOPASSWD: /usr/bin/chrt +laci, flaci, acctf ALL= NOPASSWD: /usr/bin/chrt, /sbin/reboot, /sbin/poweroff From 0cf691f63c85947c618c474536a1bcb2d310494d Mon Sep 17 00:00:00 2001 From: JJL772 Date: Wed, 10 Apr 2024 14:24:55 -0700 Subject: [PATCH 02/21] Also allow shutdown to be run via sudo --- custom_files/sudoers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/custom_files/sudoers b/custom_files/sudoers index 9dbf631..e798b0c 100644 --- a/custom_files/sudoers +++ b/custom_files/sudoers @@ -1 +1 @@ -laci, flaci, acctf ALL= NOPASSWD: /usr/bin/chrt, /sbin/reboot, /sbin/poweroff +laci, flaci, acctf ALL= NOPASSWD: /usr/bin/chrt, /sbin/reboot, /sbin/poweroff, /sbin/shutdown From d842f760d620b2a9f188468cf3c9654e10acaa7e Mon Sep 17 00:00:00 2001 From: JJL772 Date: Wed, 10 Apr 2024 15:05:58 -0700 Subject: [PATCH 03/21] Add --prod option to run-qemu, and bridge port 22 -> 8022 for SSH testing --- run-qemu.sh | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/run-qemu.sh b/run-qemu.sh index 130d6c7..1bd6eb6 100755 --- a/run-qemu.sh +++ b/run-qemu.sh @@ -2,10 +2,25 @@ cd "$(dirname "${BASH_SOURCE[0]}")" +IMAGE=./output/CentOs7_Lite_dev_$(cat VERSION)_fs.cpio.gz +while test $# -gt 0; do + case $1 in + --prod) + IMAGE=./output/CentOs7_Lite_prod_$(cat VERSION)_fs.cpio.gz + shift + ;; + *) + echo "Unknown arg $1" + exit 1 + ;; + esac +done + qemu-system-x86_64 \ -m size=2048 \ -nographic -no-reboot \ -kernel ./$(find output -iname "vmlinuz-*" | head -n 1) \ - -initrd ./output/CentOs7_Lite_dev_$(cat VERSION)_fs.cpio.gz \ - -append "console=ttyS0 init=/init root=/dev/ram0" + -initrd $IMAGE \ + -append "console=ttyS0 init=/init root=/dev/ram0" \ + -nic user,hostfwd=tcp::8022-:22 From dc8478a0c22ad9fa21827b369337256385ea706d Mon Sep 17 00:00:00 2001 From: JJL772 Date: Wed, 10 Apr 2024 15:06:22 -0700 Subject: [PATCH 04/21] Generate en_US.UTF-8 locale This is the default locale we use on our development machines. Since SSH will forward the user's locale settings (LANG, LC_ALL, etc.) to the remote host, we should ensure this locale is available there too. C and POSIX locales are already available, just need en_US.utf8 --- scripts/generate-image.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index f7c379e..cc6b28f 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -164,12 +164,13 @@ sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/user.c # chroot, set a blank password to root, and create the laci account. laci # account must have UID 8412 and be part of an lcls group with GID 2211. # The IDs are important for accessing NFS directories. -# Activate NTP. +# Activate NTP, generate required locales chroot . \ bash -c '\ /root/scripts/create-users.sh && \ systemctl enable /usr/lib/systemd/system/run_bootfile.service && \ systemctl enable ntpd && \ + localedef -i en_US -f UTF-8 en_US.utf8 && \ exit \ ' From eee046620e5e8d954deb655035177a71b0ea889e Mon Sep 17 00:00:00 2001 From: JJL772 Date: Wed, 10 Apr 2024 15:25:45 -0700 Subject: [PATCH 05/21] Set default locale to en_US.utf8 This matches the default locale that we use on the rest of our machines. --- scripts/generate-image.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index cc6b28f..21c9aff 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -161,6 +161,7 @@ sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/system sed -i "s/#DefaultLimitMEMLOCK=/DefaultLimitMEMLOCK=infinity/g" etc/systemd/user.conf sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/user.conf + # chroot, set a blank password to root, and create the laci account. laci # account must have UID 8412 and be part of an lcls group with GID 2211. # The IDs are important for accessing NFS directories. @@ -174,6 +175,10 @@ chroot . \ exit \ ' +# Set the default locale. This matches the default on our DEV machines. +echo "LANG=en_US.utf8" > etc/locale.conf + + # Generate ssh keys to avoid generating new ones every time the diskless # system boots, creating annoying RSA key mismatch error messages when # an user wants to connect. From 0f86f49a05702df9ff168ff443bca163be87d9b7 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 29 Apr 2024 09:34:00 -0700 Subject: [PATCH 06/21] sshd_config: Do not accept locale-related env vars --- custom_files/sshd_config | 139 ++++++++++++++++++++++++++++++++++++++ scripts/generate-image.sh | 1 + 2 files changed, 140 insertions(+) create mode 100644 custom_files/sshd_config diff --git a/custom_files/sshd_config b/custom_files/sshd_config new file mode 100644 index 0000000..be929ac --- /dev/null +++ b/custom_files/sshd_config @@ -0,0 +1,139 @@ +# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# If you want to change the port on a SELinux system, you have to tell +# SELinux about this change. +# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER +# +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +SyslogFacility AUTHPRIV +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +PermitRootLogin no +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +PermitEmptyPasswords yes +PasswordAuthentication yes + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no +#KerberosUseKuserok yes + +# GSSAPI options +GSSAPIAuthentication yes +GSSAPICleanupCredentials no +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no +#GSSAPIEnablek5users no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several +# problems. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +#UsePrivilegeSeparation sandbox +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#ShowPatchLevel no +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# SLAC: Do not accept locale-related environment variables +#AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +#AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +#AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS + +# override default of no subsystems +Subsystem sftp /usr/libexec/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index 21c9aff..585ce5a 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -126,6 +126,7 @@ cp -r /custom_files/epics.conf etc/security/limits.d cp -r /custom_files/90-nproc.conf etc/security/limits.d cp -r /custom_files/SLAC_properties etc/SLAC_properties cp -r /custom_files/sudoers etc/sudoers +cp -f /custom_files/sshd_config etc/ssh/sshd_config # Set some important configuration if [ ! -e "init" ]; then From 25d3801019aa8044e3f9384c841bcbf83100be02 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 7 Oct 2024 22:56:52 -0700 Subject: [PATCH 07/21] Use stanford centos7 mirror instead of mirror.centos.org --- docker/Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index ecb99a4..5a1de88 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,7 +1,12 @@ FROM centos:7 +# As of July 1st, 2024, mirrorlist.centos.org is gone and we need to switch to vault.centos.org +RUN sed -i s,mirror.centos.org,mirror.stanford.edu,g /etc/yum.repos.d/CentOS-*.repo; \ + sed -i s,^#.*baseurl=http,baseurl=http,g /etc/yum.repos.d/CentOS-*.repo; \ + sed -i s,^mirrorlist=http,#mirrorlist=http,g /etc/yum.repos.d/CentOS-*.repo + # Install packages we will need in our 'builder' OS -RUN yum -y update && \ +RUN yum -y updateinfo && \ yum install -y \ wget \ yumdownloader \ From 2c5e255b8260350bba9d80171ec8d2f3c071ffff Mon Sep 17 00:00:00 2001 From: JJL772 Date: Tue, 8 Oct 2024 14:20:39 -0700 Subject: [PATCH 08/21] Switch to stanford.edu centos7 mirror --- scripts/generate-image.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index 585ce5a..c1c9c8d 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -70,6 +70,11 @@ fi # centos-release contains things like the yum configs, and is necessary to bootstrap the system rpm --root=/centos7-builder/diskless-root -ivh --nodeps centos-release-7-9.2009.1.el7.centos.x86_64.rpm +# Switch to Stanford mirrors now that mirror.centos.org is offline +sed -i s,mirror.centos.org,mirror.stanford.edu,g /centos7-builder/diskless-root/etc/yum.repos.d/CentOS-*.repo +sed -i s,^#.*baseurl=http,baseurl=http,g /centos7-builder/diskless-root/etc/yum.repos.d/CentOS-*.repo +sed -i s,^mirrorlist=http,#mirrorlist=http,g /centos7-builder/diskless-root/etc/yum.repos.d/CentOS-*.repo + # Add Intel network card drivers for Dell R750 servers RPMs="./Intel_LAN_drivers_Dell_R750/*.rpm" for f in $RPMs From a9152d9841aaff4fb8d2b155087fbd041473ece8 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 11 Nov 2024 12:20:06 -0800 Subject: [PATCH 09/21] use vault.centos.org instead of Stanford's mirror --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 5a1de88..1ebe113 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,7 +1,7 @@ FROM centos:7 # As of July 1st, 2024, mirrorlist.centos.org is gone and we need to switch to vault.centos.org -RUN sed -i s,mirror.centos.org,mirror.stanford.edu,g /etc/yum.repos.d/CentOS-*.repo; \ +RUN sed -i s,mirror.centos.org,vault.centos.org,g /etc/yum.repos.d/CentOS-*.repo; \ sed -i s,^#.*baseurl=http,baseurl=http,g /etc/yum.repos.d/CentOS-*.repo; \ sed -i s,^mirrorlist=http,#mirrorlist=http,g /etc/yum.repos.d/CentOS-*.repo From 26e1609e3908b9c70797a75bc5b732c0fae06f31 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 11 Nov 2024 13:35:26 -0800 Subject: [PATCH 10/21] Change ulimit -n to 1024 to fix yum slowness --- docker/Dockerfile | 6 ++++-- generate.sh | 1 + 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 1ebe113..d1f47d6 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -5,8 +5,10 @@ RUN sed -i s,mirror.centos.org,vault.centos.org,g /etc/yum.repos.d/CentOS-*.repo sed -i s,^#.*baseurl=http,baseurl=http,g /etc/yum.repos.d/CentOS-*.repo; \ sed -i s,^mirrorlist=http,#mirrorlist=http,g /etc/yum.repos.d/CentOS-*.repo -# Install packages we will need in our 'builder' OS -RUN yum -y updateinfo && \ +# Install packages we will need in our 'builder' OS. +# NOTE: Default ulimit is insanely high and causes yum to slow to a crawl +RUN ulimit -n 1024 && \ + yum -y update && \ yum install -y \ wget \ yumdownloader \ diff --git a/generate.sh b/generate.sh index 447cae8..e3ad70b 100755 --- a/generate.sh +++ b/generate.sh @@ -5,6 +5,7 @@ cd docker && ./build.sh && cd - # Use the docker image to build the CentOS7 diskless images docker container run -ti --rm \ + --ulimit "nofile=1024:1024" \ --mount src=${PWD}/output,target=/output,type=bind \ --mount src=centos7-builder,target=/centos7-builder,type=volume \ --mount src=${PWD}/scripts,target=/scripts,type=bind \ From 28968e27790b0352375a6a9c681bddc125ef3c68 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Tue, 12 Nov 2024 17:30:18 -0800 Subject: [PATCH 11/21] Update README --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 7b72f12..e804758 100644 --- a/README.md +++ b/README.md @@ -30,3 +30,21 @@ cat /centos7-builder/diskless-root/etc/group ``` Each directory in this repository has a README.md file that you can check to learn more about its contents. + +## Testing with QEMU + +A simple run-qemu.sh script is provided to test the image locally in QEMU. + +`qemu-system-x86_64` must be available in your PATH for this to work. On Debian or Ubuntu, `qemu-system-x86_64` can be installed with `sudo apt install qemu-system`. + + +To boot the image in QEMU: +```sh +./run-qemu.sh +``` + +The script bridges host port 8022 to guest port 22, so you can SSH in with the following command: +``` +ssh -p 8022 laci@localhost +``` + From cf225525d2cfd3cf24e2a9f202ae25711508a7e0 Mon Sep 17 00:00:00 2001 From: An Le Date: Tue, 12 Nov 2024 09:18:24 -0800 Subject: [PATCH 12/21] Force yum to download centos-release version 7.9.2009.1 instead of .2 --- scripts/generate-image.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index c1c9c8d..d6fa249 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -64,7 +64,7 @@ cd /centos7-builder # Download centos-release, if needed if [ ! -f "centos-release-7-9.2009.1.el7.centos.x86_64.rpm" ]; then # Get the centos-release RPM - yumdownloader centos-release + yumdownloader centos-release-7-9.2009.1.el7.centos fi # centos-release contains things like the yum configs, and is necessary to bootstrap the system From eabddef833c446882fc929493742a261c1156628 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 18 Nov 2024 09:10:58 -0800 Subject: [PATCH 13/21] Set hard limits for core, mlock and rtprio to unlimited --- custom_files/limits.conf | 59 +++++++++++++++++++++++++++++++++++++++ scripts/generate-image.sh | 1 + 2 files changed, 60 insertions(+) create mode 100644 custom_files/limits.conf diff --git a/custom_files/limits.conf b/custom_files/limits.conf new file mode 100644 index 0000000..7494fd6 --- /dev/null +++ b/custom_files/limits.conf @@ -0,0 +1,59 @@ +# /etc/security/limits.conf +# +#This file sets the resource limits for the users logged in via PAM. +#It does not affect resource limits of the system services. +# +#Also note that configuration files in /etc/security/limits.d directory, +#which are read in alphabetical order, override the settings in this +#file in case the domain is the same or more specific. +#That means for example that setting a limit for wildcard domain here +#can be overriden with a wildcard setting in a config file in the +#subdirectory, but a user specific setting here can be overriden only +#with a user specific setting in the subdirectory. +# +#Each line describes a limit for a user in the form: +# +# +# +#Where: +# can be: +# - a user name +# - a group name, with @group syntax +# - the wildcard *, for default entry +# - the wildcard %, can be also used with %group syntax, +# for maxlogin limit +# +# can have the two values: +# - "soft" for enforcing the soft limits +# - "hard" for enforcing hard limits +# +# can be one of the following: +# - core - limits the core file size (KB) +# - data - max data size (KB) +# - fsize - maximum filesize (KB) +# - memlock - max locked-in-memory address space (KB) +# - nofile - max number of open file descriptors +# - rss - max resident set size (KB) +# - stack - max stack size (KB) +# - cpu - max CPU time (MIN) +# - nproc - max number of processes +# - as - address space limit (KB) +# - maxlogins - max number of logins for this user +# - maxsyslogins - max number of logins on the system +# - priority - the priority to run user process with +# - locks - max number of file locks the user can hold +# - sigpending - max number of pending signals +# - msgqueue - max memory used by POSIX message queues (bytes) +# - nice - max nice priority allowed to raise to values: [-20, 19] +# - rtprio - max realtime priority +# +# +# + +* soft core 0 +* hard core unlimited +* hard memlock unlimited +* soft rtprio 0 +* hard rtprio unlimited + +# End of file diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index d6fa249..51b0137 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -132,6 +132,7 @@ cp -r /custom_files/90-nproc.conf etc/security/limits.d cp -r /custom_files/SLAC_properties etc/SLAC_properties cp -r /custom_files/sudoers etc/sudoers cp -f /custom_files/sshd_config etc/ssh/sshd_config +cp -f /custom_files/limits.conf etc/security/limits.conf # Set some important configuration if [ ! -e "init" ]; then From 28d3d14b8996f96a18324ab98e651bbbc984f623 Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Mon, 18 Nov 2024 09:28:14 -0800 Subject: [PATCH 14/21] Add HAVE_NEW_ULIMITS property to SLAC_properties --- custom_files/SLAC_properties | 1 + 1 file changed, 1 insertion(+) diff --git a/custom_files/SLAC_properties b/custom_files/SLAC_properties index e694a79..3d1b820 100644 --- a/custom_files/SLAC_properties +++ b/custom_files/SLAC_properties @@ -1 +1,2 @@ HAVE_ROOT_PASSWORD=1 +HAVE_NEW_ULIMITS=1 From c6038355ab62aa9eff4d564d35e95ee8a6eabd58 Mon Sep 17 00:00:00 2001 From: JJL772 Date: Wed, 10 Apr 2024 15:49:05 -0700 Subject: [PATCH 15/21] Add GitHub CI/CD configuration This will test builds of both DEV and PROD images, and, if pushing to a tag, it will release artifacts. --- .github/workflows/build.yml | 32 ++++++++++++++++++++++++++++++++ generate.sh | 2 +- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..c7f4227 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,32 @@ +name: Build + Release + +on: + push: + +jobs: + build-release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Generate DEV image + run: ./generate.sh + + - name: Generate PROD image + run: ./generate.sh --prod + + - name: Get Version + id: version + run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT" + + # Create a new draft release if we're pushing to a tag + - name: Create Release + uses: softprops/action-gh-release@v2 + # Only run this when we push to a tag + if: startsWith(github.ref, 'refs/tags/') + with: + files: | + output/*.gz + output/vmlinuz* + draft: true + diff --git a/generate.sh b/generate.sh index e3ad70b..0e6d7a7 100755 --- a/generate.sh +++ b/generate.sh @@ -4,7 +4,7 @@ cd docker && ./build.sh && cd - # Use the docker image to build the CentOS7 diskless images -docker container run -ti --rm \ +docker container run -i --rm \ --ulimit "nofile=1024:1024" \ --mount src=${PWD}/output,target=/output,type=bind \ --mount src=centos7-builder,target=/centos7-builder,type=volume \ From 859dc648891e65c18b429fc036ead8efe74cff8d Mon Sep 17 00:00:00 2001 From: Jeremy Lorelli Date: Fri, 21 Mar 2025 00:17:26 -0700 Subject: [PATCH 16/21] Add DOE code link to README --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index e804758..8f2686e 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # CentOS 7 Lite for diskless systems +[DOE Code](https://www.osti.gov/doecode/biblio/75992) + ## Description This repository contains the code used to generate CentOS 7 diskless images, which can be boot using IPXE. From 03fff799ce82a579fac99aaa885e6c0dae43d661 Mon Sep 17 00:00:00 2001 From: Marcio Donadio Date: Thu, 31 Jul 2025 13:25:39 -0700 Subject: [PATCH 17/21] Fixed wrong instruction in README --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8f2686e..1e96831 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ You need to run this script in a host with the docker engine installed in it. In order to generate the CentOS 7 diskless images, you just need to run the [generate.sh](generate.sh) script. The resulting files will be located in the [output](output) directory. generate.sh can be run using optional parameters: -If --prod is not passed as argument, the image will be built for production environment. Otherwise, it will build for dev environment. +If --prod is passed as argument, the image will be built for production environment. Otherwise, it will build for dev environment. Optional arguments: -h, --help Show this help message and exit From 9d2ce1f0a4471e1b23650016ee494f1b32de2ebe Mon Sep 17 00:00:00 2001 From: Marcio Donadio Date: Thu, 31 Jul 2025 13:26:08 -0700 Subject: [PATCH 18/21] Changes to mount the transition area in S3DF instead of AFS --- scripts/generate-image.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index 51b0137..9e0bb4c 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -62,14 +62,15 @@ fi cd /centos7-builder # Download centos-release, if needed -if [ ! -f "centos-release-7-9.2009.1.el7.centos.x86_64.rpm" ]; then +if [ ! -f "centos-release-7-9.2009.0.el7.centos.x86_64.rpm" ]; then # Get the centos-release RPM - yumdownloader centos-release-7-9.2009.1.el7.centos + #yumdownloader centos-release-7-9.2009.1.el7.centos + wget ftp.cs.stanford.edu/centos/centos/7/os/x86_64/Packages/centos-release-7-9.2009.0.el7.centos.x86_64.rpm fi # centos-release contains things like the yum configs, and is necessary to bootstrap the system -rpm --root=/centos7-builder/diskless-root -ivh --nodeps centos-release-7-9.2009.1.el7.centos.x86_64.rpm - +rpm --root=/centos7-builder/diskless-root -ivh --nodeps centos-release-7-9.2009.0.el7.centos.x86_64.rpm +ls /centos7-builder/diskless-root #/etc/yum.repos.d/ # Switch to Stanford mirrors now that mirror.centos.org is offline sed -i s,mirror.centos.org,mirror.stanford.edu,g /centos7-builder/diskless-root/etc/yum.repos.d/CentOS-*.repo sed -i s,^#.*baseurl=http,baseurl=http,g /centos7-builder/diskless-root/etc/yum.repos.d/CentOS-*.repo @@ -154,7 +155,8 @@ else mkdir -p afs/slac.stanford.edu fi if [ -d "afs/slac.stanford.edu" ]; then - echo "172.23.66.102:/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab +# echo "172.23.66.102:/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab + echo "s3dflclsdevnfs001:/sdf/group/ad/transition/afs/slac.stanford.edu:/afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab fi fi From 6514a899c6c3bd1ecde882375e9b50f503df45cb Mon Sep 17 00:00:00 2001 From: Marcio Donadio Date: Mon, 29 Sep 2025 13:28:27 -0700 Subject: [PATCH 19/21] Fixed typo on the fstab entry --- scripts/generate-image.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index 9e0bb4c..7881fcd 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -156,7 +156,7 @@ else fi if [ -d "afs/slac.stanford.edu" ]; then # echo "172.23.66.102:/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab - echo "s3dflclsdevnfs001:/sdf/group/ad/transition/afs/slac.stanford.edu:/afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab + echo "s3dflclsdevnfs001:/sdf/group/ad/transition/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab fi fi From 0d78364ca2d5d3f1d5f3567312c6b5f681d52de6 Mon Sep 17 00:00:00 2001 From: Marcio Donadio Date: Tue, 30 Sep 2025 08:02:42 -0700 Subject: [PATCH 20/21] All NICs that are disconnected from the network must be disabled on boot --- custom_files/disable_disconnected_nics.service | 10 ++++++++++ custom_files/disable_disconnected_nics.sh | 11 +++++++++++ scripts/generate-image.sh | 10 ++++++---- 3 files changed, 27 insertions(+), 4 deletions(-) create mode 100644 custom_files/disable_disconnected_nics.service create mode 100755 custom_files/disable_disconnected_nics.sh diff --git a/custom_files/disable_disconnected_nics.service b/custom_files/disable_disconnected_nics.service new file mode 100644 index 0000000..f7ffeb4 --- /dev/null +++ b/custom_files/disable_disconnected_nics.service @@ -0,0 +1,10 @@ +[Unit] +Description=Disable disconnected network interfaces on boot +After=network.target + +[Service] +Type=oneshot +ExecStart=/root/scripts/disable_disconnected_nics.sh + +[Install] +WantedBy=multi-user.target diff --git a/custom_files/disable_disconnected_nics.sh b/custom_files/disable_disconnected_nics.sh new file mode 100755 index 0000000..745df23 --- /dev/null +++ b/custom_files/disable_disconnected_nics.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +# Get a list of all network interfaces (excluding loopback) +interfaces=$(ls /sys/class/net | grep -v lo) + +for iface in $interfaces; do + # Check if the interface is disconnected (carrier detected) + if [[ -f "/sys/class/net/$iface/carrier" ]] && [[ "$(cat /sys/class/net/$iface/carrier)" == "0" ]]; then + ip link set dev $iface down + fi +done diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh index 7881fcd..52a6a10 100755 --- a/scripts/generate-image.sh +++ b/scripts/generate-image.sh @@ -123,6 +123,8 @@ fi cp -r /custom_files/run_bootfile_dev.sh root/scripts cp -r /custom_files/run_bootfile_prod.sh root/scripts cp -r /custom_files/create-users.sh root/scripts +cp -r /custom_files/disable_disconnected_nics.sh root/scripts +cp -r /custom_files/disable_disconnected_nics.service usr/lib/systemd/system/ if [ -n "$prod_flag" ]; then cp -r /custom_files/run_bootfile_prod.service usr/lib/systemd/system/run_bootfile.service else @@ -155,7 +157,6 @@ else mkdir -p afs/slac.stanford.edu fi if [ -d "afs/slac.stanford.edu" ]; then -# echo "172.23.66.102:/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab echo "s3dflclsdevnfs001:/sdf/group/ad/transition/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab fi fi @@ -170,17 +171,18 @@ sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/system sed -i "s/#DefaultLimitMEMLOCK=/DefaultLimitMEMLOCK=infinity/g" etc/systemd/user.conf sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/user.conf - # chroot, set a blank password to root, and create the laci account. laci # account must have UID 8412 and be part of an lcls group with GID 2211. # The IDs are important for accessing NFS directories. +# Deactivate all NICs that are disconnected from a network. # Activate NTP, generate required locales chroot . \ bash -c '\ /root/scripts/create-users.sh && \ systemctl enable /usr/lib/systemd/system/run_bootfile.service && \ - systemctl enable ntpd && \ - localedef -i en_US -f UTF-8 en_US.utf8 && \ + systemctl enable ntpd && \ + systemctl enable disable_disconnected_nics.service && \ + localedef -i en_US -f UTF-8 en_US.utf8 && \ exit \ ' From a2cb3f20e5aecc8a007f39e2a167312ce2946fbd Mon Sep 17 00:00:00 2001 From: Marcio Donadio Date: Wed, 19 Nov 2025 11:58:40 -0800 Subject: [PATCH 21/21] Updated VERSION file --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 5df58d4..c7e9775 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -R1.5.0 +R1.6.0