enterpriseconnect/agent repository overview

⁠EC OCI Spec

Running the EC agent artifact within a docker image is not recommended due the dependancy of the underlying linux cgroup with docker.

The cgroup lives in the docker core which by design requires a sudoer permission from the guest system. Docker users who wish to level up the security by running a non-sudoer user inside the container should avoid the volume-sharing on the guest host.

Because of this, it is highly recommended to running this image as a rootless/unpriviliged container. Please refer to runc⁠ and linux cgroup man man cgroups⁠ for further study.

The open-source projects adoption flow- cgroup >> runc + nsenter >> moby >> docker

The root permission per se defeats the purpose of EC rootless-connectivity model and ultimately create several security leaks on the guest host. However, it is worth to note that running a standalone agent does NOT require a sudoer/root permission. Please refer to the agent source code repo for the standalone deployment⁠. Users with restrict security environemnt one such as AWS GovCloud should consider using a self-build image based on the spec examples in this repo.

The EC Agent OCI image is currently maintained on public docker hub⁠; the usage spec avaialble in several compute environments. Visit the EC usage examples⁠ or the wiki if new to EC⁠.

OCI (Open Container Initiative) is a contionue trademark of the Open Container Initiative Community⁠ and currently governed by the community charters⁠

⁠Docker Tags

⁠build agent-related artifacts

⁠pull example

docker pull enterpriseconnect/build:v1beta

⁠available tags

• v1⁠, latest
• v1beta⁠
• v1.1beta⁠

⁠tag usage

• v1 refers to the image to build agent #212+-relate releases.
• v1beta refers to the image to build agent #1724+-relate releases.
• v1.1beta refers to the image to build agent #2721+-relate releases.

⁠agent in containers

⁠pull example

docker pull enterpriseconnect/agent:v1beta

⁠avaialble taga

• v1⁠, latest⁠, v1-slim⁠
• v1-python, v1-ci
• v1beta⁠, v1beta-slim⁠
• v1beta-python, v1beta-ci
• v1beta-build⁠
• v1-build⁠

⁠Tag usage

• v1 refers to agent #212 release.
• v1beta include agent #1724 candidate release.
• <tag>-build include the series of tool to build out an agent release.

⁠How to run

In this container spec example, the pre-defined agent image is launched by using docker. The agent flags in this example are converted into several environment variables that are required based on the <path/to/this/repo>/spec/<agent-mode>.yml for a EC usage. For instance, to launch a client-mode agent container, it is required to ingest env vars EC_AID, EC_TID, EC_HST, etc.

The env variables specified in --env-file will need to be replaced by a series of relevant flags as it is shown in the example yaml file.

docker run --env-file client.list \
  enterpriseconnect/agent:v1

For the usage of docker flag -e, please refer to this example⁠

⁠Kubernates Deployment example

When deploy the agent in a k8s instance, the necessary environment variables as specified in the example /path/to/the/repo/k8s/agent-<object>.yml. k8s users may utilise any custom objects such as a configmap plugin to help in its configuration.