blob: 7d27f7625c49edc1ec0238ff12114a440f0a2215 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
#!/bin/sh /etc/rc.common
USE_PROCD=1
START=25
extra_command "uciadd" "Add default bridge configuration to network and firewall uci config"
extra_command "ucidel" "Delete default bridge configuration from network and firewall uci config"
DOCKERD_CONF="/tmp/dockerd/daemon.json"
uci_quiet() {
uci -q ${@} >/dev/null
}
json_add_array_string() {
json_add_string "" "$1"
}
boot() {
uciadd
rc_procd start_service
}
uciupdate() {
local net="$1"
uci -q get network.docker >/dev/null || {
logger -t "dockerd-init" -p warn "No network uci config section for docker default bridge (docker0) found"
return
}
[ -z "$net" ] && {
logger -t "dockerd-init" -p notice "Removing network uci config options for docker default bridge (docker0)"
uci_quiet delete network.docker.netmask
uci_quiet delete network.docker.ipaddr
uci_quiet commit network
return
}
eval "$(ipcalc.sh "$net")"
logger -t "dockerd-init" -p notice "Updating network uci config option \"$net\" for docker default bridge (docker0)"
uci_quiet set network.docker.netmask="$NETMASK"
uci_quiet set network.docker.ipaddr="$IP"
uci_quiet commit network
}
uciadd() {
/etc/init.d/dockerd running && {
echo "Please stop dockerd service first"
exit 0
}
# Add network interface
if ! uci -q get network.docker >/dev/null; then
logger -t "dockerd-init" -p notice "Adding docker default interface to network uci config (docker)"
uci_quiet add network interface
uci_quiet rename network.@interface[-1]="docker"
uci_quiet set network.docker.ifname="docker0"
uci_quiet set network.docker.proto="static"
uci_quiet set network.docker.auto="0"
uci_quiet commit network
fi
# Add docker bridge device
if ! uci -q get network.docker0 >/dev/null; then
logger -t "dockerd-init" -p notice "Adding docker default bridge device to network uci config (docker0)"
uci_quiet add network device
uci_quiet rename network.@device[-1]="docker0"
uci_quiet set network.docker0.type="bridge"
uci_quiet set network.docker0.name="docker0"
uci_quiet add_list network.docker0.ifname="docker0"
uci_quiet commit network
fi
# Add firewall zone
if ! uci -q get firewall.docker >/dev/null; then
logger -t "dockerd-init" -p notice "Adding docker default firewall zone to firewall uci config (docker)"
uci_quiet add firewall zone
uci_quiet rename firewall.@zone[-1]="docker"
uci_quiet set firewall.docker.network="docker"
uci_quiet set firewall.docker.input="REJECT"
uci_quiet set firewall.docker.output="ACCEPT"
uci_quiet set firewall.docker.forward="REJECT"
uci_quiet set firewall.docker.name="docker"
uci_quiet commit firewall
fi
reload_config
}
ucidel() {
/etc/init.d/dockerd running && {
echo "Please stop dockerd service first"
exit 0
}
logger -t "dockerd-init" -p notice "Deleting docker default bridge device from network uci config (docker0)"
uci_quiet delete network.docker0
uci_quiet commit network
logger -t "dockerd-init" -p notice "Deleting docker default interface from network uci config (docker)"
uci_quiet delete network.docker
uci_quiet commit network
logger -t "dockerd-init" -p notice "Deleting docker firewall zone from firewall uci config (docker)"
uci_quiet delete firewall.docker
uci_quiet commit firewall
reload_config
}
process_config() {
local alt_config_file data_root log_level bip
rm -f "$DOCKERD_CONF"
[ -f /etc/config/dockerd ] || {
# Use the daemon default configuration
DOCKERD_CONF=""
return 0
}
config_load 'dockerd'
config_get alt_config_file globals alt_config_file
[ -n "$alt_config_file" ] && [ -f "$alt_config_file" ] && {
ln -s "$alt_config_file" "$DOCKERD_CONF"
return 0
}
config_get data_root globals data_root "/opt/docker/"
config_get log_level globals log_level "warn"
config_get bip globals bip ""
. /usr/share/libubox/jshn.sh
json_init
json_add_string "data-root" "$data_root"
json_add_string "log-level" "$log_level"
[ -z "$bip" ] || json_add_string "bip" "$bip"
json_add_array "registry-mirrors"
config_list_foreach globals registry_mirrors json_add_array_string
json_close_array
json_add_array "hosts"
config_list_foreach globals hosts json_add_array_string
json_close_array
mkdir -p /tmp/dockerd
json_dump > "$DOCKERD_CONF"
uciupdate "$bip"
}
start_service() {
local nofile=$(cat /proc/sys/fs/nr_open)
process_config
procd_open_instance
procd_set_param stderr 1
if [ -z "$DOCKERD_CONF" ]; then
procd_set_param command /usr/bin/dockerd
else
procd_set_param command /usr/bin/dockerd --config-file="$DOCKERD_CONF"
fi
procd_set_param limits nofile="${nofile} ${nofile}"
procd_close_instance
}
reload_service() {
process_config
procd_send_signal dockerd
}
service_triggers() {
procd_add_reload_trigger 'dockerd'
}
ip4tables_remove_nat() {
iptables -t nat -D OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -F DOCKER
iptables -t nat -X DOCKER
}
ip4tables_remove_filter() {
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -D FORWARD -j DOCKER-USER >/dev/null 2>&1
iptables -t filter -D FORWARD -j DOCKER-ISOLATION-STAGE-1
iptables -t filter -D FORWARD -o docker0 -j DOCKER
iptables -t filter -F DOCKER
iptables -t filter -F DOCKER-ISOLATION-STAGE-1
iptables -t filter -F DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -F DOCKER-USER >/dev/null 2>&1
iptables -t filter -X DOCKER
iptables -t filter -X DOCKER-ISOLATION-STAGE-1
iptables -t filter -X DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables -t filter -X DOCKER-USER >/dev/null 2>&1
}
ip4tables_remove() {
ip4tables_remove_nat
ip4tables_remove_filter
}
stop_service() {
if /etc/init.d/dockerd running; then
service_stop "/usr/bin/dockerd"
ip4tables_remove
fi
}
|
