Merge pull request #40 from cgwalters/doc-logins
docs: Improve login/tryout docs
This commit is contained in:
Colin Walters
GitHub
commit
a42f336f05
|
|
@ -0,0 +1,110 @@
|
|||
text
|
||||
|
||||
# Basic partitioning
|
||||
clearpart --all --initlabel --disklabel=gpt
|
||||
part prepboot --size=4 --fstype=prepboot
|
||||
part biosboot --size=1 --fstype=biosboot
|
||||
part /boot/efi --size=100 --fstype=efi
|
||||
part /boot --size=1000 --fstype=ext4 --label=boot
|
||||
part / --grow --fstype xfs
|
||||
|
||||
ostreecontainer --url quay.io/centos-boot/fedora-tier-1:eln --no-signature-verification
|
||||
|
||||
firewall --disabled
|
||||
services --enabled=sshd
|
||||
|
||||
# Only inject a SSH key for root
|
||||
rootpw --iscrypted locked
|
||||
# Add your example SSH key here!
|
||||
#sshkey --username root "ssh-ed25519 <key> demo@example.com"
|
||||
reboot
|
||||
|
||||
# ONLY SCROLL PAST HERE TO SEE THE TEMPORARY UGLY HACKS
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
# Install via bootupd - TODO change anaconda to auto-detect this
|
||||
bootloader --location=none --disabled
|
||||
%post
|
||||
# Work around anaconda wanting a root password
|
||||
passwd -l root
|
||||
/usr/bin/bootupctl backend install --device /dev/vda /
|
||||
mkdir -p /boot/grub2
|
||||
# Work around https://github.com/coreos/bootupd/pull/536 not being merged yet
|
||||
base64 -d >/boot/grub2/grub.cfg << EOF
|
||||
IyBUaGlzIGZpbGUgaXMgY29waWVkIGZyb20gaHR0cHM6Ly9naXRodWIuY29tL2NvcmVvcy9jb3Jl
|
||||
b3MtYXNzZW1ibGVyL2Jsb2IvbWFpbi9zcmMvZ3J1Yi5jZmcKIyBDaGFuZ2VzOgojICAgLSBEcm9w
|
||||
cGVkIElnbml0aW9uIGdsdWUsIHRoYXQgY2FuIGJlIGluamVjdGVkIGludG8gcGxhdGZvcm0uY2Zn
|
||||
CiMgc2V0IHBhZ2VyPTEKIyBwZXRpdGJvb3QgZG9lc24ndCBzdXBwb3J0IC1lIGFuZCBkb2Vzbid0
|
||||
IHN1cHBvcnQgYW4gZW1wdHkgcGF0aCBwYXJ0CmlmIFsgLWQgKG1kL21kLWJvb3QpL2dydWIyIF07
|
||||
IHRoZW4KICAjIGZjY3QgY3VycmVudGx5IGNyZWF0ZXMgL2Jvb3QgUkFJRCB3aXRoIHN1cGVyYmxv
|
||||
Y2sgMS4wLCB3aGljaCBhbGxvd3MKICAjIGNvbXBvbmVudCBwYXJ0aXRpb25zIHRvIGJlIHJlYWQg
|
||||
ZGlyZWN0bHkgYXMgZmlsZXN5c3RlbXMuICBUaGlzIGlzCiAgIyBuZWNlc3NhcnkgYmVjYXVzZSB0
|
||||
cmFuc3Bvc2VmcyBkb2Vzbid0IHlldCByZXJ1biBncnViMi1pbnN0YWxsIG9uIEJJT1MsCiAgIyBz
|
||||
byBHUlVCIHN0aWxsIGV4cGVjdHMgL2Jvb3QgdG8gYmUgYSBwYXJ0aXRpb24gb24gdGhlIGZpcnN0
|
||||
IGRpc2suCiAgIwogICMgVGhlcmUgYXJlIHR3byBjb25zZXF1ZW5jZXM6CiAgIyAxLiBPbiBCSU9T
|
||||
IGFuZCBVRUZJLCB0aGUgc2VhcmNoIGNvbW1hbmQgbWlnaHQgcGljayBhbiBpbmRpdmlkdWFsIFJB
|
||||
SUQKICAjICAgIGNvbXBvbmVudCwgYnV0IHdlIHdhbnQgaXQgdG8gdXNlIHRoZSBmdWxsIFJBSUQg
|
||||
aW4gY2FzZSB0aGVyZSBhcmUgYmFkCiAgIyAgICBzZWN0b3JzIGV0Yy4gIFRoZSB1bmRvY3VtZW50
|
||||
ZWQgLS1oaW50IG9wdGlvbiBpcyBzdXBwb3NlZCB0byBzdXBwb3J0CiAgIyAgICB0aGlzIHNvcnQg
|
||||
b2Ygb3ZlcnJpZGUsIGJ1dCBpdCBkb2Vzbid0IHNlZW0gdG8gd29yaywgc28gd2Ugc2V0ICRib290
|
||||
CiAgIyAgICBkaXJlY3RseS4KICAjIDIuIE9uIEJJT1MsIHRoZSAibm9ybWFsIiBtb2R1bGUgaGFz
|
||||
IGFscmVhZHkgYmVlbiBsb2FkZWQgZnJvbSBhbgogICMgICAgaW5kaXZpZHVhbCBSQUlEIGNvbXBv
|
||||
bmVudCwgYW5kICRwcmVmaXggc3RpbGwgcG9pbnRzIHRoZXJlLiAgV2Ugd2FudAogICMgICAgZnV0
|
||||
dXJlIG1vZHVsZSBsb2FkcyB0byBjb21lIGZyb20gdGhlIFJBSUQsIHNvIHdlIHJlc2V0ICRwcmVm
|
||||
aXguCiAgIyAgICAoT24gVUVGSSwgdGhlIHN0dWIgZ3J1Yi5jZmcgaGFzIGFscmVhZHkgc2V0ICRw
|
||||
cmVmaXggcHJvcGVybHkuKQogIHNldCBib290PW1kL21kLWJvb3QKICBzZXQgcHJlZml4PSgkYm9v
|
||||
dCkvZ3J1YjIKZWxzZQogIGlmIFsgLWYgJHtjb25maWdfZGlyZWN0b3J5fS9ib290dXVpZC5jZmcg
|
||||
XTsgdGhlbgogICAgc291cmNlICR7Y29uZmlnX2RpcmVjdG9yeX0vYm9vdHV1aWQuY2ZnCiAgZmkK
|
||||
ICBpZiBbIC1uICIke0JPT1RfVVVJRH0iIF07IHRoZW4KICAgIHNlYXJjaCAtLWZzLXV1aWQgIiR7
|
||||
Qk9PVF9VVUlEfSIgLS1zZXQgYm9vdCAtLW5vLWZsb3BweQogIGVsc2UKICAgIHNlYXJjaCAtLWxh
|
||||
YmVsIGJvb3QgLS1zZXQgYm9vdCAtLW5vLWZsb3BweQogIGZpCmZpCnNldCByb290PSRib290Cgpp
|
||||
ZiBbIC1mICR7Y29uZmlnX2RpcmVjdG9yeX0vZ3J1YmVudiBdOyB0aGVuCiAgbG9hZF9lbnYgLWYg
|
||||
JHtjb25maWdfZGlyZWN0b3J5fS9ncnViZW52CmVsaWYgWyAtcyAkcHJlZml4L2dydWJlbnYgXTsg
|
||||
dGhlbgogIGxvYWRfZW52CmZpCgppZiBbIHgiJHtmZWF0dXJlX21lbnVlbnRyeV9pZH0iID0geHkg
|
||||
XTsgdGhlbgogIG1lbnVlbnRyeV9pZF9vcHRpb249Ii0taWQiCmVsc2UKICBtZW51ZW50cnlfaWRf
|
||||
b3B0aW9uPSIiCmZpCgpmdW5jdGlvbiBsb2FkX3ZpZGVvIHsKICBpZiBbIHgkZmVhdHVyZV9hbGxf
|
||||
dmlkZW9fbW9kdWxlID0geHkgXTsgdGhlbgogICAgaW5zbW9kIGFsbF92aWRlbwogIGVsc2UKICAg
|
||||
IGluc21vZCBlZmlfZ29wCiAgICBpbnNtb2QgZWZpX3VnYQogICAgaW5zbW9kIGllZWUxMjc1X2Zi
|
||||
CiAgICBpbnNtb2QgdmJlCiAgICBpbnNtb2QgdmdhCiAgICBpbnNtb2QgdmlkZW9fYm9jaHMKICAg
|
||||
IGluc21vZCB2aWRlb19jaXJydXMKICBmaQp9CgojIHRyYWNrZXI6IGh0dHBzOi8vZ2l0aHViLmNv
|
||||
bS9jb3Jlb3MvZmVkb3JhLWNvcmVvcy10cmFja2VyL2lzc3Vlcy84MDUKaWYgWyAtZiAkcHJlZml4
|
||||
L3BsYXRmb3JtLmNmZyBdOyB0aGVuCiAgc291cmNlICRwcmVmaXgvcGxhdGZvcm0uY2ZnCmZpCgpp
|
||||
ZiBbIHgkZmVhdHVyZV90aW1lb3V0X3N0eWxlID0geHkgXSA7IHRoZW4KICBzZXQgdGltZW91dF9z
|
||||
dHlsZT1tZW51CiAgc2V0IHRpbWVvdXQ9MQojIEZhbGxiYWNrIG5vcm1hbCB0aW1lb3V0IGNvZGUg
|
||||
aW4gY2FzZSB0aGUgdGltZW91dF9zdHlsZSBmZWF0dXJlIGlzCiMgdW5hdmFpbGFibGUuCmVsc2UK
|
||||
ICBzZXQgdGltZW91dD0xCmZpCgojIEltcG9ydCB1c2VyIGRlZmluZWQgY29uZmlndXJhdGlvbgoj
|
||||
IHRyYWNrZXI6IGh0dHBzOi8vZ2l0aHViLmNvbS9jb3Jlb3MvZmVkb3JhLWNvcmVvcy10cmFja2Vy
|
||||
L2lzc3Vlcy84MDUKaWYgWyAtZiAkcHJlZml4L3VzZXIuY2ZnIF07IHRoZW4KICBzb3VyY2UgJHBy
|
||||
ZWZpeC91c2VyLmNmZwpmaQoKYmxzY2ZnCgo=
|
||||
EOF
|
||||
%end
|
||||
|
|
@ -4,6 +4,67 @@
|
|||
nav_order: 2
|
||||
---
|
||||
|
||||
## Operating system state (users, ssh keys)
|
||||
|
||||
It's absolutely crucial to understand that the container image *is* the
|
||||
operating system content. Notably the default `tier-1` image
|
||||
[does not include cloud-init](cloud-agents.md) or Ignition or any default
|
||||
recommended mechanism for provisioning user accountson its own.
|
||||
|
||||
Commonly then you will want to build your own container image derived from e.g.
|
||||
`quay.io/centos-boot/fedora-tier-1:eln` that adds a login mechanism. For
|
||||
example, you could
|
||||
[add cloud-init](https://gitlab.com/CentOS/cloud/sagano-examples/-/blob/main/cloud-init-base/Containerfile).
|
||||
|
||||
However, it's also possible to embed SSH login configuration in the image, or
|
||||
configure any login mechanism you desire in general! For example, you could set
|
||||
up a VPN configuration in your operating system and ensure logins are only
|
||||
possible over the VPN, etc.
|
||||
|
||||
## Installation using Anaconda
|
||||
|
||||
Tools like
|
||||
[Anaconda](https://anaconda-installer.readthedocs.io/en/latest/intro.html)
|
||||
support injecting configuration at image installation time, such as SSH keys and
|
||||
passwords. This means that in contrast to what was said just before, it's
|
||||
possible to directly install (and update from) an "unconfigured base image"
|
||||
provided by this project.
|
||||
|
||||
This hinges on the
|
||||
[ostreecontainer](https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#ostreecontainer)
|
||||
kickstart verb, which is new in Fedora 38; for example, there is a
|
||||
[netinst.iso](https://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/iso/)
|
||||
which can be scripted with kickstart. Because a current development target for
|
||||
this project is [Fedora ELN](https://docs.fedoraproject.org/en-US/eln/), it's
|
||||
also supported to use the ISO generated by that project.
|
||||
|
||||
See [example.ks](example.ks) for an example Kickstart file. The
|
||||
[virt-install --initrd-inject](https://github.com/virt-manager/virt-manager/blob/main/man/virt-install.rst#--initrd-inject)
|
||||
helps inject kickstart for installation to virtual machines.
|
||||
|
||||
## Using `bootc install-to-filesystem --replace=alongside` with a cloud image
|
||||
|
||||
A toplevel goal of this project is that the "source of truth" for Linux
|
||||
operating system management is a container image registry - as opposed to e.g. a
|
||||
set of qcow2 OpenStack images or AMIs, etc. You should not need to maintain
|
||||
infrastructure to e.g. manage garbage collection or versioning of cloud (IaaS)
|
||||
VM images.
|
||||
|
||||
The latest releases of `bootc` have support for
|
||||
`bootc install-to-filesystem --replace=alongside`. More about this core mechanic
|
||||
in the
|
||||
[bootc install docs](https://github.com/containers/bootc/blob/main/docs/install.md).
|
||||
|
||||
Here's an example set of steps to execute; this could be done via e.g.
|
||||
[cloud-init](https://cloudinit.readthedocs.io/en/latest/reference/index.html)
|
||||
configuration.
|
||||
|
||||
```shell
|
||||
dnf -y install podman skopeo
|
||||
podman run --rm --privileged --pid=host -v /:/target --security-opt label=type:unconfined_t <yourimage> bootc install-to-filesystem --target-no-signature-verification --karg=console=ttyS0,115200n8 --replace=alongside /target
|
||||
reboot
|
||||
```
|
||||
|
||||
<!--
|
||||
## Booting directly from KVM guest image
|
||||
|
||||
|
|
@ -31,41 +92,6 @@ rpm-ostree rebase ostree-unverified-registry:quay.io/centos-boot/fedora-tier-1:e
|
|||
systemctl reboot
|
||||
```
|
||||
|
||||
See also [this pull request][1] for more information.
|
||||
|
||||
## TODO: Use osbuild
|
||||
|
||||
Document the ongoing work to materialize a disk image from a container.
|
||||
|
||||
## Using `bootc install-to-filesystem --replace=alongside` with a cloud image
|
||||
|
||||
A toplevel goal of this project is that the "source of truth" for Linux
|
||||
operating system management is a container image registry - as opposed to e.g. a
|
||||
set of qcow2 OpenStack images or AMIs, etc.
|
||||
|
||||
The latest development builds of `bootc` have support for
|
||||
`bootc install-to-filesystem --replace=alongside`. More about this core
|
||||
mechanic in the [bootc install docs](https://github.com/containers/bootc/blob/main/docs/install.md).
|
||||
|
||||
Here's an example set of steps to execute; this could be done via e.g.
|
||||
[cloud-init](https://cloudinit.readthedocs.io/en/latest/reference/index.html)
|
||||
configuration.
|
||||
|
||||
```shell
|
||||
dnf -y install podman skopeo
|
||||
podman run --rm --privileged --pid=host -v /:/target --security-opt label=type:unconfined_t quay.io/centos-boot/fedora-tier-1:eln bootc install-to-filesystem --target-no-signature-verification --karg=console=ttyS0,115200n8 --replace=alongside /target
|
||||
reboot
|
||||
```
|
||||
|
||||
## Generating a derived container image
|
||||
|
||||
These examples just use a "stock" container image, and in the first case rely on
|
||||
user state being preserved by the `rpm-ostree rebase`.
|
||||
|
||||
What's much more interesting is to generate a custom derived container image,
|
||||
and target that instead. For more information, see
|
||||
|
||||
- <https://github.com/coreos/layering-examples>
|
||||
- <https://github.com/openshift/rhcos-image-layering-examples>
|
||||
|
||||
[1]: https://github.com/coreos/fedora-coreos-docs/pull/540
|
||||
|
|
|
|||
Loading…
Reference in New Issue