| #!/bin/sh /etc/rc.common |
| |
| USE_PROCD=1 |
| START=99 |
| |
| extra_command "uciadd" "<interface> <device> <zone> Add docker bridge configuration to network and firewall uci config" |
| extra_command "ucidel" "<interface> <device> <zone> Delete docker bridge configuration from network and firewall uci config" |
| |
| DOCKER_CONF_DIR="/tmp/dockerd" |
| DOCKERD_CONF="${DOCKER_CONF_DIR}/daemon.json" |
| |
| uci_quiet() { |
| uci -q "${@}" >/dev/null |
| } |
| |
| json_add_array_string() { |
| json_add_string "" "${1}" |
| } |
| |
| find_network_device() { |
| local device="${1}" |
| local device_section="" |
| |
| check_device() { |
| local cfg="${1}" |
| local device="${2}" |
| |
| local type name |
| config_get type "${cfg}" type |
| config_get name "${cfg}" name |
| |
| [ "${type}" = "bridge" ] && [ "${name}" = "${device}" ] \ |
| && device_section="${cfg}" |
| } |
| |
| config_load network |
| config_foreach check_device device "${device}" |
| |
| echo "${device_section}" |
| } |
| |
| boot() { |
| uciadd |
| rc_procd start_service |
| } |
| |
| uciadd() { |
| local iface="${1}" |
| local device="${2}" |
| local zone="${3}" |
| |
| [ -z "${iface}" ] && { |
| iface="docker" |
| device="docker0" |
| zone="docker" |
| } |
| |
| /etc/init.d/dockerd running && { |
| echo "Please stop dockerd service first" |
| exit 0 |
| } |
| |
| # Add network interface |
| if ! uci_quiet get network.${iface}; then |
| logger -t "dockerd-init" -p notice "Adding interface '${iface}' to network config" |
| uci_quiet add network interface |
| uci_quiet rename network.@interface[-1]="${iface}" |
| uci_quiet set network.@interface[-1].device="${device}" |
| uci_quiet set network.@interface[-1].proto="none" |
| uci_quiet set network.@interface[-1].auto="0" |
| uci_quiet commit network |
| fi |
| |
| # Add docker bridge device |
| if [ "$(find_network_device "$device")" = "" ]; then |
| logger -t "dockerd-init" -p notice "Adding bridge device '${device}' to network config" |
| uci_quiet add network device |
| uci_quiet set network.@device[-1].type="bridge" |
| uci_quiet set network.@device[-1].name="${device}" |
| uci_quiet commit network |
| else |
| logger -t "dockerd-init" -p notice "Bridge device '${device}' already defined in network config" |
| fi |
| |
| # Add firewall zone |
| if ! uci_quiet get firewall.${zone}; then |
| logger -t "dockerd-init" -p notice "Adding firewall zone '${zone}' to firewall config" |
| uci_quiet add firewall zone |
| uci_quiet rename firewall.@zone[-1]="${zone}" |
| uci_quiet set firewall.@zone[-1].input="ACCEPT" |
| uci_quiet set firewall.@zone[-1].output="ACCEPT" |
| uci_quiet set firewall.@zone[-1].forward="ACCEPT" |
| uci_quiet set firewall.@zone[-1].name="${zone}" |
| uci_quiet commit firewall |
| fi |
| |
| # Add interface to firewall zone |
| if uci_quiet get firewall.${zone}; then |
| uci_quiet del_list firewall.${zone}.network="${iface}" |
| uci_quiet add_list firewall.${zone}.network="${iface}" |
| uci_quiet commit firewall |
| fi |
| |
| reload_config |
| } |
| |
| ucidel() { |
| local iface="${1}" |
| local device="${2}" |
| local zone="${3}" |
| |
| [ -z "${iface}" ] && { |
| iface="docker" |
| device="docker0" |
| zone="docker" |
| } |
| |
| /etc/init.d/dockerd running && { |
| echo "Please stop dockerd service first" |
| exit 0 |
| } |
| |
| # Remove network device |
| if uci_quiet delete network.$(find_network_device "${device}"); then |
| logger -t "dockerd-init" -p notice "Deleting bridge device '${device}' from network config" |
| uci_quiet commit network |
| fi |
| |
| # Remove network interface |
| if uci_quiet get network.${iface}; then |
| logger -t "dockerd-init" -p notice "Deleting interface '${iface}' from network config" |
| uci_quiet delete network.${iface} |
| uci_quiet commit network |
| fi |
| |
| # Remove interface from firewall zone |
| if uci_quiet get firewall.${zone}; then |
| logger -t "dockerd-init" -p notice "Deleting network interface '${iface}' in zone '${zone}' from firewall config" |
| uci_quiet del_list firewall.${zone}.network="${iface}" |
| uci_quiet commit firewall |
| # Remove Firewall zone if network is empty |
| if ! uci_quiet get firewall.${zone}.network; then |
| logger -t "dockerd-init" -p notice "Deleting firewall zone '${zone}' from firewall config" |
| uci_quiet delete firewall.${zone} |
| fi |
| uci_quiet commit firewall |
| fi |
| |
| reload_config |
| } |
| |
| process_config() { |
| local alt_config_file data_root log_level iptables bip |
| |
| [ -f /etc/config/dockerd ] || { |
| # Use the daemon default configuration |
| DOCKERD_CONF="" |
| return 0 |
| } |
| |
| # reset configuration |
| rm -fr "${DOCKER_CONF_DIR}" |
| mkdir -p "${DOCKER_CONF_DIR}" |
| |
| config_load 'dockerd' |
| config_get alt_config_file globals alt_config_file |
| [ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && { |
| ln -s "${alt_config_file}" "${DOCKERD_CONF}" |
| return 0 |
| } |
| |
| config_get data_root globals data_root "/opt/docker/" |
| config_get log_level globals log_level "warn" |
| config_get_bool iptables globals iptables "1" |
| |
| # Don't add these options by default |
| # omission == docker defaults |
| config_get bip globals bip "" |
| config_get registry_mirrors globals registry_mirrors "" |
| config_get hosts globals hosts "" |
| config_get dns globals dns "" |
| config_get_bool ipv6 globals ipv6 "" |
| config_get ip globals ip "" |
| config_get fixed_cidr globals fixed_cidr "" |
| config_get fixed_cidr_v6 globals fixed_cidr_v6 "" |
| |
| . /usr/share/libubox/jshn.sh |
| json_init |
| json_add_string "data-root" "${data_root}" |
| json_add_string "log-level" "${log_level}" |
| json_add_boolean "iptables" "${iptables}" |
| [ -z "${bip}" ] || json_add_string "bip" "${bip}" |
| [ -z "${registry_mirrors}" ] || json_add_array "registry-mirrors" |
| [ -z "${registry_mirrors}" ] || config_list_foreach globals registry_mirrors json_add_array_string |
| [ -z "${registry_mirrors}" ] || json_close_array |
| [ -z "${hosts}" ] || json_add_array "hosts" |
| [ -z "${hosts}" ] || config_list_foreach globals hosts json_add_array_string |
| [ -z "${hosts}" ] || json_close_array |
| [ -z "${dns}" ] || json_add_array "dns" |
| [ -z "${dns}" ] || config_list_foreach globals dns json_add_array_string |
| [ -z "${dns}" ] || json_close_array |
| [ -z "${ipv6}" ] || json_add_boolean "ipv6" "${ipv6}" |
| [ -z "${ip}" ] || json_add_string "ip" "${ip}" |
| [ -z "${fixed_cidr}" ] || json_add_string "fixed-cidr" "${fixed_cidr}" |
| [ -z "${fixed_cidr_v6}" ] || json_add_string "fixed-cidr-v6" "${fixed_cidr_v6}" |
| json_dump > "${DOCKERD_CONF}" |
| |
| [ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall |
| } |
| |
| start_service() { |
| local nofile=$(cat /proc/sys/fs/nr_open) |
| |
| process_config |
| |
| procd_open_instance |
| procd_set_param stderr 1 |
| if [ -z "${DOCKERD_CONF}" ]; then |
| procd_set_param command /usr/bin/dockerd |
| else |
| procd_set_param command /usr/bin/dockerd --config-file="${DOCKERD_CONF}" |
| fi |
| procd_set_param limits nofile="${nofile} ${nofile}" |
| procd_close_instance |
| } |
| |
| reload_service() { |
| process_config |
| procd_send_signal dockerd |
| } |
| |
| service_triggers() { |
| procd_add_reload_trigger 'dockerd' |
| } |
| |
| iptables_add_blocking_rule() { |
| local cfg="${1}" |
| |
| local device="" |
| local extra_iptables_args="" |
| |
| handle_iptables_rule() { |
| local interface="${1}" |
| local outbound="${2}" |
| local extra_iptables_args="${3}" |
| |
| local inbound="" |
| |
| . /lib/functions/network.sh |
| network_get_physdev inbound "${interface}" |
| |
| [ -z "${inbound}" ] && { |
| logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}" |
| return |
| } |
| |
| # Wait for a maximum of 10 second per command, retrying every millisecond |
| local iptables_wait_args="--wait 10 --wait-interval 1000" |
| |
| # Ignore errors as it might already be present |
| iptables ${iptables_wait_args} --table filter --new DOCKER-USER 2>/dev/null |
| if ! iptables ${iptables_wait_args} --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then |
| logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}" |
| iptables ${iptables_wait_args} --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT |
| fi |
| } |
| |
| config_get device "${cfg}" device |
| |
| [ -z "${device}" ] && { |
| logger -t "dockerd-init" -p notice "No device configured for ${cfg}" |
| return |
| } |
| |
| config_get extra_iptables_args "${cfg}" extra_iptables_args |
| config_list_foreach "${cfg}" blocked_interfaces handle_iptables_rule "${device}" "${extra_iptables_args}" |
| } |
| |
| stop_service() { |
| if /etc/init.d/dockerd running; then |
| service_stop "/usr/bin/dockerd" |
| fi |
| } |