mgodshall/highball-slave repository overview

docker run --name highball-slave-container --privileged --net host -d -v $HOME/.ssh:/home/jenkins/.ssh -v /var/lib/docker:/var/lib/docker:rw mgodshall/highball-slave

FROM ubuntu:14.04
MAINTAINER Matt Godshall "[email protected]"

RUN dpkg-divert --local --rename --add /sbin/initctl && ln -sf /bin/true/ /sbin/initctl
RUN apt-get update && apt-get clean
RUN apt-get -y install openssh-server sudo wget git apt-transport-https ftp zip unzip qemu-utils uuid nfs-common

RUN echo deb https://get.docker.io/ubuntu docker main >> /etc/apt/sources.list
RUN apt-get update && apt-get clean
RUN apt-get install -q -y --force-yes lxc-docker lxc supervisor

RUN useradd -U -m -s /bin/bash jenkins
RUN echo 'jenkins:jenkins-slave' | chpasswd
RUN usermod -aG docker jenkins
RUN usermod -aG sudo jenkins

RUN sed -ri 's/UsePAM yes/#UsePAM yes/g' /etc/ssh/sshd_config
RUN sed -ri 's/#UsePAM no/UsePAM no/g' /etc/ssh/sshd_config
RUN mkdir -p -m0755 /var/run/sshd

ADD ./supervisor-highball-slave.conf /etc/supervisor/conf.d/

ADD ./wrapdocker /usr/bin/wrapdocker
RUN chmod +x /usr/bin/wrapdocker

RUN su - jenkins -c "git clone https://bitbucket.org/WarheadsSE/dockbake.git /home/jenkins/dockbake"
ADD ./local.conf /home/jenkins/dockbake/conf/local.conf
RUN chown jenkins:jenkins /home/jenkins/dockbake/conf/local.conf

RUN apt-get -y -q install openjdk-7-jre-headless
RUN su - jenkins -c "wget -O /home/jenkins/swarm-client-1.9-jar-with-dependencies.jar http://maven.jenkins-ci.org/content/repositories/releases/org/jenkins-ci/plugins/swarm-client/1.9/swarm-client-1.9-jar-with-dependencies.jar"

EXPOSE 22

CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]

#!/bin/bash
# Originally from https://github.com/jpetazzo/dind

# First, make sure that cgroups are mounted correctly.
CGROUP=/sys/fs/cgroup

[ -d $CGROUP ] || 
    mkdir $CGROUP


# XXX Since this is run by supervisor, check if everything is already set up in
#     case we're restarting the process.
if [ -z "$(ls $CGROUP)" ];
then
    mountpoint -q $CGROUP || 
        mount -n -t tmpfs -o uid=0,gid=0,mode=0755 cgroup $CGROUP || {
            echo "Could not make a tmpfs mount. Did you use -privileged?"
            exit 0
        }
    
    if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security
    then
        mount -t securityfs none /sys/kernel/security || {
            echo "Could not mount /sys/kernel/security."
            echo "AppArmor detection and -privileged mode might break."
        }
    fi
    
    # Mount the cgroup hierarchies exactly as they are in the parent system.
    for SUBSYS in $(cut -d: -f2 /proc/1/cgroup)
    do
            [ -d $CGROUP/$SUBSYS ] || mkdir $CGROUP/$SUBSYS
            mountpoint -q $CGROUP/$SUBSYS || 
                    mount -n -t cgroup -o $SUBSYS cgroup $CGROUP/$SUBSYS
    
            # The two following sections address a bug which manifests itself
            # by a cryptic "lxc-start: no ns_cgroup option specified" when
            # trying to start containers withina container.
            # The bug seems to appear when the cgroup hierarchies are not
            # mounted on the exact same directories in the host, and in the
            # container.
    
            # Named, control-less cgroups are mounted with "-o name=foo"
            # (and appear as such under /proc/<pid>/cgroup) but are usually
            # mounted on a directory named "foo" (without the "name=" prefix).
            # Systemd and OpenRC (and possibly others) both create such a
            # cgroup. To avoid the aforementioned bug, we symlink "foo" to
            # "name=foo". This shouldn't have any adverse effect.
            echo $SUBSYS | grep -q ^name= && {
                    NAME=$(echo $SUBSYS | sed s/^name=//)
                    ln -s $SUBSYS $CGROUP/$NAME
            }
    
            # Likewise, on at least one system, it has been reported that
            # systemd would mount the CPU and CPU accounting controllers
            # (respectively "cpu" and "cpuacct") with "-o cpuacct,cpu"
            # but on a directory called "cpu,cpuacct" (note the inversion
            # in the order of the groups). This tries to work around it.
            [ $SUBSYS = cpuacct,cpu ] && ln -s $SUBSYS $CGROUP/cpu,cpuacct
    done
    
    # Note: as I write those lines, the LXC userland tools cannot setup
    # a "sub-container" properly if the "devices" cgroup is not in its
    # own hierarchy. Let's detect this and issue a warning.
    grep -q :devices: /proc/1/cgroup ||
        echo "WARNING: the 'devices' cgroup should be in its own hierarchy."
    grep -qw devices /proc/1/cgroup ||
        echo "WARNING: it looks like the 'devices' cgroup is not mounted."
fi

/usr/bin/docker -d

[program:docker]
command=/usr/bin/wrapdocker
numprocs=1
autostart=true
autorestart=true

[program:sshd]
command=/usr/sbin/sshd -D
numprocs=1
autostart=true
autorestart=true