summaryrefslogtreecommitdiff
path: root/docker
AgeCommit message (Collapse)AuthorFilesLines
2015-11-24Added ironic-common to ironic base containerSwapnil Kulkarni (coolsvap)1-0/+1
Change-Id: I5e167fc2e1363eb407016a059acc868e7cf73563 Closes-Bug:#1519409
2015-11-24Add missing usermod for magnumPaul Bourke1-0/+2
Change-Id: I19921f38c858ee7a88830773423d50a1a8162204 Trivial-Fix
2015-11-24Install magnum-common packages for binary buildsPaul Bourke1-2/+6
User magnum is missing from the binary image, install magnum-common to fix this. Closes-Bug: 1519390 Change-Id: I23e1206ab14b02de716374d28be2ef42e75e5beb
2015-11-23Merge "Switch find_disks to use a decent python lib"Jenkins2-2/+77
2015-11-23Drop root for ceilometerSwapnil Kulkarni (coolsvap)8-1/+15
Updates to ensure commands run in the ceilometer containers are done as the 'ceilometer' user rather than root. Change-Id: Ic94b876a002d4413f2038c29ffdb275c68323065 Partially-Implements: blueprint drop-root
2015-11-23Update ceilometer dockerfilesSwapnil Kulkarni (coolsvap)1-1/+10
Updated ceilometer-base dockerfile to include commons package Change-Id: Ieff651f0b7e9716b1b73e2e192f22e2e39dbe5a6 Closes-Bug:#1484002
2015-11-23Merge "Remove hardcoded MAINTAINER in Dockerfiles"Jenkins93-93/+93
2015-11-23Remove hardcoded MAINTAINER in DockerfilesSwapnil Kulkarni (coolsvap)93-93/+93
Added new option in kolla-build.conf Change-Id: I45fe51966bcb59ea19d112281ba3d5a1ba091a56 Closes-Bug:#1514304
2015-11-23Drop root for gnocchiSwapnil Kulkarni (coolsvap)4-1/+7
Updates to ensure commands run in the gnocchi containers are done as the 'gnocchi' user rather than root. Change-Id: I2e24300e05d1b2eeaa52bdc6ed3ec4599791136e Partially-Implements: blueprint drop-root
2015-11-20Switch find_disks to use a decent python libSam Yaple2-2/+77
Now /dev/loop devices will work! Change-Id: Icb8efe4f9bc3a21a72eb04bfd03452c26f13fd70 Closes-Bug: #1518438
2015-11-20Fix udev cinder issueSam Yaple1-12/+2
/run/udev contains the udev information needed for the lvm tools /run and /dev must be bound in for this to work properly Change-Id: Icfe07c4ce3673310cc24591b42c107c9710cd3ac Closes-Bug: #1518454 Closes-Bug: #1487780 Related-Bug: #1487807
2015-11-20Merge "Fix gate"Jenkins1-2/+2
2015-11-20Fix gateSam Yaple1-2/+2
A previous commit [1] removed the glance data container. Although this worked at the time (as evident by it passing the gate) the drop root patches merged after the gate patch causing the glance service to not have the proper permissions to create this needed directory [1] I7f2f5979b01807275908699d1243756cb97d3588 Change-Id: I5044de8d348e401a50970fd77671a79d35d2d595
2015-11-20Fix /etc files location for ironic-base building from sourcesAndrey Shestakov1-1/+1
Ironic config files should be palced to /etc/ironic/* Closes-Bug: #1518433 Change-Id: Ic82dbb9a28ed3adb6bfca2d0f715da3a7bbc4698
2015-11-18Fix missing policy.json in MagnumPaul Bourke1-1/+1
The magnum api falls over on a request without this file in place Change-Id: Ic7ff8af22c3142d93e0dcf2b2ed5455685dec658 Closes-Bug: #1517152
2015-11-18Merge "Fix namespace regression for neutron"Jenkins2-0/+6
2015-11-18Merge "Drop root for Magnum"Jenkins3-1/+5
2015-11-18Merge "Remove old config-external.sh scripts for magnum"Jenkins2-20/+0
2015-11-17Merge "Use pip upper-constraints in magnum-base"Jenkins1-1/+1
2015-11-17Merge "Fix issues in Glance filesystem backend"Jenkins3-1/+7
2015-11-17Drop root for MagnumPaul Bourke3-1/+5
This change ensures commands run in the magnum containers are done as the 'magnum' user rather than root. Change-Id: I18e2febae98aae6d6fc6c61cc2817442f408cb75 Partially-Implements: blueprint drop-root
2015-11-17Remove old config-external.sh scripts for magnumPaul Bourke2-20/+0
These are no longer used. Trivial-Fix Change-Id: Ia4dced3b8ac8512097f5cafbb1b06661c6f3eb88
2015-11-17Use pip upper-constraints in magnum-basePaul Bourke1-1/+1
Change-Id: Ibb5636d897c2b9177c54dfc13f6193e00107776b Closes-Bug: #1517144
2015-11-17Fix issues in Glance filesystem backendPaul Bourke3-1/+7
The drop root change for Glance highlighted the fact that we were binding volumes from glance_data into the wrong container - it was glance_registry whereas it should be glance_api. This would result in all images being lost if the glance_api container happens to restart. Also, we need a sudoers file to chown the file backend dir to the glance user. Change-Id: If04337045bb94b3126e48d1f5bf0ea29e20373ae Closes-Bug: #1516729
2015-11-17Add support for loading kolla config from ENVAngus Salkeld1-10/+27
Implements: blueprint zookeeper Change-Id: Ibabcb5d6d304be9290633338c513f16651d4479a
2015-11-16Fix namespace regression for neutronSam Yaple2-0/+6
Due the to way network namespaces work, they will not survive a container restart. This is not an issue related to Kolla or Neutron but rather an issue with how network namespaces work. This is putting back into place a workaround that was in correctly removed in the past. We simply cleanup the namespace cruft when the neutron-agents container restarts thus avoiding this issue. Change-Id: Ic16f2f766b4fa46347ea14a1ece5a4653c69d779 Closes-Bug: #1511216
2015-11-14Add usermod to Zaqar containerBritt Houser1-1/+2
When we dropped root, we forgot the usermod. Updated. Change-Id: I72a452c9b3b6a9aac0a8edd073887a1b79c34e8e
2015-11-14Merge "drop root on memcached"Jenkins1-2/+8
2015-11-14drop root on memcachedBritt Houser1-2/+8
This patch add the USER directive to the memcached container. It also removes the -u from the command line to launch memcached, since it will already be run as that use. Change-Id: I87d782a424df99fe1b5694debafa3c0c4a9aba27 Partially-Implements: blueprint drop-root
2015-11-13Merge "Revert "Drop root for Horizon service""Jenkins1-19/+1
2015-11-13Merge "Drop root for Zaqar service"Jenkins2-1/+3
2015-11-13Merge "Add ZooKeeper support in kolla-ansible"Jenkins1-0/+66
2015-11-13Drop root for Zaqar serviceJosh Lothian2-1/+3
Change-Id: I59797a8539406e478f6953a9aa0c933e73eb5892 Partially-Implements: blueprint drop-root
2015-11-13Add ZooKeeper support in kolla-ansibleMichal Rostecki1-0/+66
In kolla-mesos, ZK will be used for storing information about actions done in bootstrap. Change-Id: Id7067a493b457cf7b73eb007852df7b13f4363b3 Partially-Implements: blueprint zookeeper
2015-11-13Merge "Add Ansible support for Magnum"Jenkins1-1/+1
2015-11-13Add Ansible support for MagnumMichal Rostecki1-1/+1
Change-Id: Idb25ac4d3148c9b9400cf675ac2e47d35cce6224 Implements: blueprint ansible-magnum
2015-11-13Revert "Drop root for Horizon service"Sam Yaple1-19/+1
This reverts commit f9ccb1c8829cef551b875c7c387530e7980414a7. There are many issues with this patch that prevents it from working under numerous circumstances. The implementation is entirely busted on Ubuntu. Additionally, best practice for apache is to run as root. Apache itself does the privlege dropping. Change-Id: I4395debb7d32223fb3752a6d3e7c4d7672d29916
2015-11-13Merge "Drop root privileges for rabbitmq"Jenkins3-2/+9
2015-11-12Drop root privileges for rabbitmqRyan Hallisey3-2/+9
Drop root privileges for rabbitmq. Only the rabbitmq user will be able to execute chown of /var/lib/rabbitmq. Change-Id: I546e6b475a8462bfbc75972854e1fee64f96d9cb Partially-Implements: blueprint drop-root
2015-11-12Move USER operation after footerSam Yaple14-28/+27
The USER operation affects all docker commands after it. This causes a problem with our {{ include_footer }} implementation since commands in that footer may require elevated permissions to perform. In the current implementation I can no longer remove my proxy settings once the USER has been changed. Change-Id: I9b2bab5a15f595f6d52a46c64ddf59ba5608b938 Partially-Implements: blueprint drop-root
2015-11-12Drop root privileges for mariadbSteven Dake4-5/+15
Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root
2015-11-11Move the mariadb expect code to a scriptSteven Dake3-21/+25
Atleast in a script, sudo can be made to only allow the script to run from the mysql process in the future, versus all the proceesses being able to be executed as root presently. Change-Id: I030b57086e37e4dc8f668f98c04335d94ab9d2b0 Partially-Implements: blueprint drop-root
2015-11-11Drop root for Horizon serviceSteven Dake1-1/+19
Drop root privileges for Horizon service. It is necesssary to set a capability on the filesystem to allow binding to port 80 as a non-root user. I have tested this works correctly from a registry on both CentOS and Ubuntu. Change-Id: I4c26f28bb28b6633784e6842f3423a2425332c27 Partially-Implements: blueprint drop-root
2015-11-11Merge "Install keystoneauthv1 in openstack-base image"Jenkins2-1/+1
2015-11-11Merge "Drop root for kolla-ansible"Jenkins2-2/+8
2015-11-11Merge "Clean up horizon httpd pid files for RPM distros"Jenkins1-0/+7
2015-11-11Install keystoneauthv1 in openstack-base imageSteven Dake2-1/+1
Lots of tools rqeuire keystoneeauthv1 not just horizon TrivialFix Change-Id: I35eb958e35500b04657679371019f2e6f3c2f2dd
2015-11-11Drop root for heatSteven Dake5-1/+9
Drop root user for heat containers. Change-Id: Ib07c0193f97bb18cc6154b4015b4056fd983f6c1 Partially-Implements: blueprint drop-root
2015-11-11install openstack-heat-common in heat-baseSteven Dake1-1/+9
the openstack-heat-common package installs the Heat UID/GID. This is necessary pre-work for drop-root for heat services. Change-Id: I247b0209248de144d20f5245973833be5cd8f14f Partially-Implements: blueprint drop-root
2015-11-11Merge "Drop root for designate"Jenkins8-1/+15
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-07 11:46:51 +0000