diff --git a/acl/SPECS/sdnotify-proxy/sdnotify-proxy.signatures.json b/acl/SPECS/sdnotify-proxy/sdnotify-proxy.signatures.json deleted file mode 100644 index c7513b36533..00000000000 --- a/acl/SPECS/sdnotify-proxy/sdnotify-proxy.signatures.json +++ /dev/null @@ -1,5 +0,0 @@ -{ -"Signatures": { -"sdnotify-proxy-0f8ef1a.tar.gz":"250b0b0e156edee30a8a69d686482c622c4064da25f4bfde3da5693e49f32d0f" -} -} diff --git a/acl/SPECS/sdnotify-proxy/sdnotify-proxy.spec b/acl/SPECS/sdnotify-proxy/sdnotify-proxy.spec deleted file mode 100644 index 5ac29d28136..00000000000 --- a/acl/SPECS/sdnotify-proxy/sdnotify-proxy.spec +++ /dev/null @@ -1,57 +0,0 @@ -%global debug_package %{nil} - -%global goarch %{_arch} -%ifarch x86_64 -%global goarch amd64 -%endif -%ifarch aarch64 -%global goarch arm64 -%endif - -%global commit 0f8ef1aa86c59fc6d54eadaffb248feaccd1018b -%global shortcommit %(c=%{commit}; echo ${c:0:7}) - -Summary: Proxy sd_notify messages between systemd and processes in different cgroups -Name: sdnotify-proxy -Version: 0.1.0 -Release: 1%{?dist} -License: Apache-2.0 -Vendor: Microsoft Corporation -Distribution: Azure Linux -Group: System Environment/Base -URL: https://github.com/flatcar/sdnotify-proxy -Source0: https://github.com/flatcar/sdnotify-proxy/archive/%{commit}.tar.gz#/%{name}-%{shortcommit}.tar.gz - -BuildRequires: golang - -%description -sdnotify-proxy solves the problem of Docker containers running under systemd -and wishing to make use of the sd_notify facility. Because Docker containers -end up running as child processes of the Docker daemon, they are in a cgroup -different from that of the service. systemd will thus not process sd_notify -events from them. - -This utility proxies events between a Docker container and systemd. It is -launched with the name of a proxy socket and a command to execute. - -%prep -%setup -q -n %{name}-%{commit} - -%build -cd %{_builddir}/%{name}-%{commit} -go mod init github.com/coreos/sdnotify-proxy -mkdir -p %{_builddir}/bin -go build -o %{_builddir}/bin/sdnotify-proxy . - -%install -install -d %{buildroot}%{_libexecdir} -install -p -m 0755 %{_builddir}/bin/sdnotify-proxy %{buildroot}%{_libexecdir}/sdnotify-proxy - -%files -%license LICENSE -%doc README.md -%{_libexecdir}/sdnotify-proxy - -%changelog -* Tue Feb 10 2026 Microsoft Corporation - 0.1.0-1 -- Initial ACL package. Proxies sd_notify for Docker-containerized etcd. diff --git a/acl/packages.yaml b/acl/packages.yaml index 7729744cf71..73df0da2614 100644 --- a/acl/packages.yaml +++ b/acl/packages.yaml @@ -19,7 +19,6 @@ packages: # --- Ported from Flatcar ------------------------------------------------ - coreos-init # Init scripts, systemd units, generators (autologin fix) - - sdnotify-proxy # sd_notify proxy for containerized services # --- LISA testing dependencies ------------------------------------------ - stress-ng # Stress test tool diff --git a/acl/tests/kola_enforcing.yaml b/acl/tests/kola_enforcing.yaml index 9687db7283f..2cf675080e9 100644 --- a/acl/tests/kola_enforcing.yaml +++ b/acl/tests/kola_enforcing.yaml @@ -28,21 +28,6 @@ version: 1 tests: - name: acl.basic - - name: acl.etcd-member.discovery - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: 3-node etcd cluster on TCG-emulated arm64 races systemd's DefaultDeviceTimeoutSec for /dev/disk/by-label/OEM; tracked by the OEM fsck conditional dropin work - - platforms: [azure] - reason: Azure version depends on discovery.etcd.io, which is unmaintained. - - imageVariants: [acl-t] - reason: | - The test's etcd server runs in a docker container - (etcd-member.service via etcd-wrapper), and acl-t has no - docker daemon — the standalone `docker` sysext is not carried - and docker has no RPM replacement (same as docker.*) — so no - etcd server can start for the test to drive. - - name: acl.internet exceptions: - platforms: [qemu] @@ -144,27 +129,6 @@ tests: architectures: [aarch64] reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration. - - name: cl.etcd-member.etcdctlv3 - exceptions: - - imageVariants: [acl-t] - reason: | - The test's etcd server runs in a docker container - (etcd-member.service via etcd-wrapper), and acl-t has no - docker daemon — the standalone `docker` sysext is not carried - and docker has no RPM replacement (same as docker.*) — so no - etcd server can start for the test to drive. - - name: cl.etcd-member.v2-backup-restore - exceptions: - - platforms: [azure] - reason: Azure version depends on discovery.etcd.io, which is unmaintained. - - imageVariants: [acl-t] - reason: | - The test's etcd server runs in a docker container - (etcd-member.service via etcd-wrapper), and acl-t has no - docker daemon — the standalone `docker` sysext is not carried - and docker has no RPM replacement (same as docker.*) — so no - etcd server can start for the test to drive. - - name: cl.filesystem exceptions: - platforms: [azure] @@ -361,115 +325,6 @@ tests: AKS). containerd-native (ctr) replacement tests are tracked as a follow-up. - - name: kubeadm.v1.32.4.calico.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.32.4.cilium.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.32.4.flannel.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.33.0.calico.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.33.0.cilium.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.33.0.flannel.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.34.1.calico.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.34.1.cilium.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: kubeadm.v1.34.1.flannel.base - exceptions: - - platforms: [qemu] - architectures: [aarch64] - reason: kubectl wait timeouts on emulated arm64 QEMU - - imageVariants: [acl-t] - reason: | - The kubeadm cluster provisions an etcd node that runs etcd in - a docker container (etcd-member.service via etcd-wrapper); - acl-t has no docker daemon — the standalone `docker` sysext is - not carried and docker has no RPM replacement (same as - docker.*) — so the control plane cannot bootstrap. - - name: linux.nfs.v3 exceptions: - platforms: [azure] diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index f4ac9acafd7..4564b01d456 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -1036,61 +1036,6 @@ EOF sudo chmod 0644 "${root_fs_dir}/etc/systemd/system/ldconfig.service" } -# ── etcd: remove native server, keep etcdctl, prepare for Docker wrapper ───── -_configure_etcd_rpm() { - local root_fs_dir="$1" - - # Remove etcd server and etcdutl binaries - we only need etcdctl from the etcd RPM. - # The etcd server runs inside a Docker container via etcd-wrapper, not natively. - if [[ -f "${root_fs_dir}/usr/bin/etcd" ]]; then - info "RPM mode: Removing /usr/bin/etcd (etcd server runs in Docker via etcd-wrapper)" - sudo rm -f "${root_fs_dir}/usr/bin/etcd" - fi - if [[ -f "${root_fs_dir}/usr/bin/etcdutl" ]]; then - info "RPM mode: Removing /usr/bin/etcdutl (not needed)" - sudo rm -f "${root_fs_dir}/usr/bin/etcdutl" - fi - # Also remove the native etcd.service - etcd-member.service (Docker-based) is used instead - if [[ -f "${root_fs_dir}/usr/lib/systemd/system/etcd.service" ]]; then - info "RPM mode: Removing native etcd.service (using etcd-member.service instead)" - sudo rm -f "${root_fs_dir}/usr/lib/systemd/system/etcd.service" - fi - # Remove the etcd preset file (refers to the native etcd.service we just removed) - sudo rm -f "${root_fs_dir}/usr/lib/systemd/system-preset/50-etcd.preset" - # Remove etcd config file (native etcd.service config, not used with etcd-wrapper) - sudo rm -f "${root_fs_dir}/etc/etcd/etcd-default-conf.yml" - - # sysusers.d config to create the etcd user/group (needed by etcd-wrapper). - # The etcd RPM doesn't create this user, but etcd-wrapper needs it for: - # - chown etcd:etcd on the data directory - # - id -u/-g to map the user into the Docker container - # This MUST be in the rootfs (not the sysext) so systemd-sysusers creates - # the user before the docker sysext is mounted. - cat <<'SYSUSERS_EOF' | sudo tee "${root_fs_dir}/usr/lib/sysusers.d/etcd.conf" > /dev/null -u etcd - "etcd user" /var/lib/etcd -SYSUSERS_EOF - - # CLC transpiler generates ExecStart=/usr/lib/coreos/etcd-wrapper - # Create compat symlink so /usr/lib/coreos -> flatcar resolves - sudo ln -sfT flatcar "${root_fs_dir}/usr/lib/coreos" - - # etcd-member.service and etcd-wrapper.conf MUST be in the rootfs (not the - # sysext) because Ignition runs before sysext merge. If the unit file only - # exists in the sysext, Ignition cannot read its [Install] WantedBy= section - # to create the multi-user.target.wants symlink, so the service never starts. - local etcd_wrapper_src="${SCRIPT_ROOT}/sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files" - local etcd_version="3.5.16" - if [[ ! -d "${etcd_wrapper_src}" ]]; then - die "etcd-wrapper source not found at ${etcd_wrapper_src}" - fi - # etcd-member.service (substitute image tag) - sed "s|@ETCD_IMAGE_TAG@|v${etcd_version}|g" \ - "${etcd_wrapper_src}/etcd-member.service" \ - | sudo tee "${root_fs_dir}/usr/lib/systemd/system/etcd-member.service" > /dev/null - # etcd-wrapper.conf -> /usr/lib/tmpfiles.d/ (creates /var/lib/etcd 0700 etcd:etcd) - sudo cp "${etcd_wrapper_src}/etcd-wrapper.conf" "${root_fs_dir}/usr/lib/tmpfiles.d/etcd-wrapper.conf" -} - # CIS Level 1 hardening # Addresses CIS Azure Container Linux 4 Level 1 failures without affecting # network connectivity or core system operation. All settings are safe for @@ -1368,7 +1313,6 @@ finish_image_post_tmpfiles_rpm() { _configure_disk_autogrow_rpm "${root_fs_dir}" _remove_unused_systemd_components_rpm "${root_fs_dir}" _configure_pcrlock_rpm "${root_fs_dir}" - _configure_etcd_rpm "${root_fs_dir}" _configure_kdump_rpm "${root_fs_dir}" _configure_misc_rpm "${root_fs_dir}" _configure_cis_hardening_rpm "${root_fs_dir}" diff --git a/build_library/rpm/package_catalog.yaml b/build_library/rpm/package_catalog.yaml index d857ba2c43b..badaa5fb3bc 100644 --- a/build_library/rpm/package_catalog.yaml +++ b/build_library/rpm/package_catalog.yaml @@ -98,9 +98,7 @@ packages: sys-block/open-iscsi: iscsi-initiator-utils # Container runtime - app-containers/docker: - - moby-engine - - sdnotify-proxy + app-containers/docker: moby-engine app-emulation/docker: moby-engine # Alternative package name app-containers/docker-cli: docker-cli app-containers/docker-buildx: docker-buildx @@ -578,9 +576,7 @@ packages: app-misc/c_rehash: SKIP app-misc/pax-utils: SKIP dev-cpp/glog: SKIP - # TODO: we should create a new client package for etcdctl instead of using - # the full package - dev-db/etcdctl: etcd + dev-db/etcdctl: SKIP # No etcd server or client needed in RPM mode dev-libs/jose: SKIP # not used, skipping to not bring "jose" from extended dev-libs/libbsd: SKIP dev-libs/libverto: SKIP @@ -710,4 +706,3 @@ packages: sys-libs/nss-usrfiles: SKIP sys-libs/tevent: SKIP sys-power/acpid: SKIP - diff --git a/build_library/rpm/sysext_mangle_docker-flatcar.sh b/build_library/rpm/sysext_mangle_docker-flatcar.sh deleted file mode 100755 index e7226310896..00000000000 --- a/build_library/rpm/sysext_mangle_docker-flatcar.sh +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash - -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. - -# RPM-specific mangle logic for the docker-flatcar sysext. -# Called from build_library/sysext_mangle_docker-flatcar when PACKAGE_SOURCE_MODE=RPM -# -# Items that must live in the rootfs (etcd native cleanup, sysusers.d/etcd.conf, -# /usr/lib/coreos symlink) are handled by _configure_etcd_rpm in build_image_util.sh. -# This script installs Docker-dependent components into the sysext. - -set -euo pipefail - -rootfs="${1}" -script_root="$(cd "$(dirname "$0")/../../"; pwd)" - -# ── etcd-wrapper: Docker-based etcd with sdnotify-proxy ────────────────────── -# etcd-wrapper runs etcd inside a Docker container, so it belongs in the Docker sysext. -echo ">>> NOTICE: $0: installing etcd-wrapper (Docker-based etcd)" - -# Install etcd-wrapper - runs etcd in a Docker container with sdnotify-proxy. -# These files come from the Flatcar etcd-wrapper package in sdk_container. -etcd_wrapper_src="${script_root}/sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files" -etcd_version="3.5.16" -if [[ ! -d "${etcd_wrapper_src}" ]]; then - echo ">>> ERROR: $0: etcd-wrapper source not found at ${etcd_wrapper_src}" >&2 - exit 1 -fi - -# etcd-wrapper script -> /usr/lib/flatcar/etcd-wrapper -mkdir -p "${rootfs}/usr/lib/flatcar" -cp "${etcd_wrapper_src}/etcd-wrapper" "${rootfs}/usr/lib/flatcar/etcd-wrapper" -chmod 0755 "${rootfs}/usr/lib/flatcar/etcd-wrapper" -# Azure Linux symlinks /etc/ssl/certs -> /etc/pki/tls/certs -> /etc/pki/ca-trust/extracted/pem -# etcd-wrapper bind-mounts /etc/ssl/certs and /usr/share/ca-certificates into the -# Docker container, but the files are symlinks to /etc/pki/ca-trust/extracted/pem/... which -# doesn't exist in the container. Add an extra bind mount so the symlinks resolve. -sed -i 's|-v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|-v /etc/pki/ca-trust/extracted/pem:/etc/pki/ca-trust/extracted/pem:ro -v ${ETCD_SSL_DIR}:/etc/ssl/certs:ro|' \ - "${rootfs}/usr/lib/flatcar/etcd-wrapper" -# NOTE: etcd-member.service and etcd-wrapper.conf are installed in the rootfs -# by _configure_etcd_rpm() in build_image_util.sh. They MUST be in the rootfs -# because Ignition needs to read etcd-member.service's [Install] section to -# create the enable symlink, and Ignition runs before sysext merge. - -# CA certificates compatibility for etcd-wrapper Docker mount. -# etcd-wrapper bind-mounts /usr/share/ca-certificates:/usr/share/ca-certificates:ro -# into the Docker container. On ACL this directory doesn't exist, and Docker -# tries to mkdir it on the read-only /usr partition, causing the container to -# fail with "mkdir /usr/share/ca-certificates: read-only file system". -# Fix: create the directory in the sysext with a symlink to the ACL CA bundle. -# Above we add a bind mount for /etc/pki/ca-trust/extracted/pem so the symlink resolves. -mkdir -p "${rootfs}/usr/share/ca-certificates" -ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ - "${rootfs}/usr/share/ca-certificates/ca-certificates.crt" diff --git a/build_library/sysext_mangle_docker-flatcar b/build_library/sysext_mangle_docker-flatcar index ba0661925c1..00b13d3079c 100755 --- a/build_library/sysext_mangle_docker-flatcar +++ b/build_library/sysext_mangle_docker-flatcar @@ -28,8 +28,3 @@ cp -vdR --preserve=mode,timestamps "${files_dir}/"* "${rootfs}" mkdir -p "${rootfs}/usr/lib/systemd/system/sockets.target.d" { echo "[Unit]"; echo "Upholds=docker.socket"; } > "${rootfs}/usr/lib/systemd/system/sockets.target.d/10-docker-socket.conf" - -# RPM-specific mangle (etcd-wrapper, etc.) -if [[ "${PACKAGE_SOURCE_MODE}" == "RPM" ]]; then - "$(dirname "$0")/rpm/sysext_mangle_docker-flatcar.sh" "${rootfs}" -fi