blob: 577c7ebd59233117c1a1c6fdf0c133f0df712c5d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
#!/bin/sh
# Recreate the kukuri build worker with --network=host.
#
# WHY host networking: the CNI bridge path on this FreeBSD host returns EACCES
# on EVERY outbound connect (verified against 10.88.0.1, 192.168.3.110, 8.8.8.8
# and 1.1.1.1 alike, from a fresh container with no volumes). ocijail blocks it.
# --network=host was measured to work for all four destinations. The worker only
# needs outbound TCP (master:9989, github, ftp), so host networking is sufficient
# and loses nothing.
#
# WHY the caches are bind-mounted: the original container kept GRADLE_USER_HOME
# (/var/jenkins_home/.gradle, 6.3G) and .konan (1.7G) in its WRITABLE LAYER, with
# no named volume. `podman rm` would destroy them. They were extracted to
# /ROM/worker-cache first (podman commit was attempted and FAILED: buildah stages
# into /var/tmp on the root fs, which has only 1.5G free).
set -e
T=/ROM/tmp_probe
mkdir -p "$T"
export TMPDIR="$T"
NAME=kukuri-worker
IMAGE=localhost/kukuri-worker:latest
CACHE=/ROM/worker-cache
echo "== preflight: secrets readable by container uid1000 =="
for f in worker_pass git_pass github_token; do
p=/root/buildbot/secrets/$f
if [ ! -s "$p" ]; then echo "!! missing/empty $p"; exit 1; fi
chmod 644 "$p"
echo " $f: $(wc -c < "$p") bytes"
done
echo "== preflight: worker root writable by 1000 =="
mkdir -p /ROM/worker
chown -R 1000:1000 /ROM/worker
chown -R 1000:1000 "$CACHE"
echo "== cache contents =="
du -sh "$CACHE"/.gradle "$CACHE"/.konan 2>/dev/null
echo "== stop + remove old container (layer already extracted) =="
podman stop "$NAME" 2>/dev/null || true
sleep 1
podman rm "$NAME" 2>/dev/null || true
echo "== run with --network=host =="
podman --tmpdir "$T" run -d --name "$NAME" \
--network=host \
-e MASTER=192.168.3.110:9989 \
-e GRADLE_USER_HOME=/var/jenkins_home/.gradle \
-v /ROM/worker:/worker:z \
-v "$CACHE/.gradle":/var/jenkins_home/.gradle:z \
-v "$CACHE/.konan":/var/jenkins_home/.konan:z \
-v /root/buildbot/secrets/worker_pass:/run/secrets/worker_pass:ro \
-v /root/buildbot/secrets/git_pass:/run/secrets/git_pass:ro \
-v /root/buildbot/secrets/github_token:/run/secrets/github_token:ro \
"$IMAGE"
echo "== wait for attach =="
sleep 20
podman ps --format '{{.Names}} | {{.Status}}'
echo "== worker log =="
podman logs --tail 15 "$NAME" 2>&1 || true
echo "RECREATE_DONE"
|
