diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..ec1945a --- /dev/null +++ b/Dockerfile @@ -0,0 +1,201 @@ +# syntax=docker/dockerfile:1 +FROM ghcr.io/linuxserver/baseimage-debian:bookworm + +# set version label +ARG BUILD_DATE +ARG VERSION +LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}" +LABEL maintainer="thelamer" + +# env +ENV DISPLAY=:1 \ + PERL5LIB=/usr/local/bin \ + HOME=/config \ + START_DOCKER=true \ + PULSE_RUNTIME_PATH=/defaults \ + SELKIES_INTERPOSER=/usr/lib/selkies_joystick_interposer.so \ + SDL_JOYSTICK_DEVICE=/dev/input/js0 \ + NVIDIA_DRIVER_CAPABILITIES=all + +RUN \ + echo "**** dev deps ****" && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \ + cmake \ + g++ \ + gcc \ + libjpeg62-turbo-dev \ + libx11-dev \ + libxext-dev \ + libxxhash-dev \ + make \ + python3-dev \ + python3-pip && \ + echo "**** enable locales ****" && \ + sed -i \ + '/locale/d' \ + /etc/dpkg/dpkg.cfg.d/docker && \ + echo "**** install deps ****" && \ + curl -fsSL https://download.docker.com/linux/debian/gpg | tee /usr/share/keyrings/docker.asc >/dev/null && \ + echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list && \ + curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \ + ca-certificates \ + console-data \ + containerd.io \ + docker-ce \ + docker-ce-cli \ + docker-buildx-plugin \ + docker-compose-plugin \ + dbus-x11 \ + dunst \ + file \ + fonts-noto-cjk \ + fonts-noto-color-emoji \ + fonts-noto-core \ + gir1.2-gst-plugins-bad-1.0 \ + gir1.2-gstreamer-1.0 \ + gstreamer1.0-nice \ + gstreamer1.0-plugins-* \ + gstreamer1.0-pulseaudio \ + intel-media-va-driver \ + kbd \ + libfontenc1 \ + libfreetype6 \ + libgbm1 \ + libgcrypt20 \ + libgirepository-1.0-1 \ + libgl1-mesa-dri \ + libglu1-mesa \ + libgnutls30 \ + libgstreamer1.0 \ + libnotify-bin \ + libp11-kit0 \ + libpam0g \ + libtasn1-6 \ + libjpeg62-turbo \ + libvulkan1 \ + libx11-6 \ + libxau6 \ + libxcb1 \ + libxcursor1 \ + libxdmcp6 \ + libxext6 \ + libxfixes3 \ + libxfont2 \ + libxinerama1 \ + libxshmfence1 \ + libxtst6 \ + locales-all \ + mesa-va-drivers \ + mesa-vulkan-drivers \ + nginx \ + openbox \ + openssh-client \ + openssl \ + pciutils \ + procps \ + pulseaudio \ + pulseaudio-utils \ + python3 \ + python3-gi \ + python3-gst-1.0 \ + software-properties-common \ + ssl-cert \ + sudo \ + tar \ + util-linux \ + vulkan-tools \ + x11-apps \ + x11-common \ + x11-utils \ + x11-xkb-utils \ + x11-xserver-utils \ + xauth \ + xdg-utils \ + xfonts-base \ + xkb-data \ + xsel \ + xserver-common \ + xserver-xorg-core \ + xserver-xorg-video-amdgpu \ + xserver-xorg-video-ati \ + xserver-xorg-video-intel \ + xserver-xorg-video-nouveau \ + xserver-xorg-video-qxl \ + xterm \ + xutils \ + xvfb \ + zlib1g && \ + echo "**** install selkies ****" && \ + pip3 install x11-screen-capture --break-system-packages && \ + SELKIES_RELEASE=$(curl -sX GET "https://api.github.com/repos/selkies-project/selkies-gstreamer/releases/latest" \ + | awk '/tag_name/{print $4;exit}' FS='[""]') && \ + mkdir -p \ + /usr/share/selkies/www/ && \ + curl -o \ + /tmp/web.tar.gz -L \ + "https://github.com/selkies-project/selkies-gstreamer/releases/download/${SELKIES_RELEASE}/selkies-gstreamer-web_${SELKIES_RELEASE}.tar.gz" && \ + curl -o \ + /tmp/selkies.tar.gz -L \ + "https://github.com/selkies-project/selkies-gstreamer/archive/refs/heads/main.tar.gz" && \ + tar xf \ + /tmp/web.tar.gz -C \ + /usr/share/selkies/www/ --strip-components=1 && \ + cd /tmp && \ + tar xf selkies.tar.gz && \ + cd selkies-gstreamer-* && \ + pip3 install . --break-system-packages && \ + echo "**** openbox tweaks ****" && \ + sed -i \ + -e 's/NLIMC/NLMC/g' \ + -e '/debian-menu/d' \ + -e 's|| yes\n|' \ + -e 's|| \n|' \ + /etc/xdg/openbox/rc.xml && \ + echo "**** user perms ****" && \ + sed -e 's/%sudo ALL=(ALL:ALL) ALL/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' \ + -i /etc/sudoers && \ + echo "abc:abc" | chpasswd && \ + usermod -s /bin/bash abc && \ + usermod -aG sudo abc && \ + echo "**** proot-apps ****" && \ + mkdir /proot-apps/ && \ + PAPPS_RELEASE=$(curl -sX GET "https://api.github.com/repos/linuxserver/proot-apps/releases/latest" \ + | awk '/tag_name/{print $4;exit}' FS='[""]') && \ + curl -L https://github.com/linuxserver/proot-apps/releases/download/${PAPPS_RELEASE}/proot-apps-x86_64.tar.gz \ + | tar -xzf - -C /proot-apps/ && \ + echo "${PAPPS_RELEASE}" > /proot-apps/pversion && \ + echo "**** dind support ****" && \ + useradd -U dockremap && \ + usermod -G dockremap dockremap && \ + echo 'dockremap:165536:65536' >> /etc/subuid && \ + echo 'dockremap:165536:65536' >> /etc/subgid && \ + curl -o \ + /usr/local/bin/dind -L \ + https://raw.githubusercontent.com/moby/moby/master/hack/dind && \ + chmod +x /usr/local/bin/dind && \ + echo 'hosts: files dns' > /etc/nsswitch.conf && \ + usermod -aG docker abc && \ + echo "**** locales ****" && \ + for LOCALE in $(curl -sL https://raw.githubusercontent.com/thelamer/lang-stash/master/langs); do \ + localedef -i $LOCALE -f UTF-8 $LOCALE.UTF-8; \ + done && \ + echo "**** theme ****" && \ + curl -s https://raw.githubusercontent.com/thelamer/lang-stash/master/theme.tar.gz \ + | tar xzvf - -C /usr/share/themes/Clearlooks/openbox-3/ && \ + echo "**** cleanup ****" && \ + apt-get autoclean && \ + rm -rf \ + /config/.cache \ + /var/lib/apt/lists/* \ + /var/tmp/* \ + /tmp/* + +# add local files +COPY /root / + +# ports and volumes +EXPOSE 3000 3001 +VOLUME /config diff --git a/README.md b/README.md index 246f4f0..abed7d7 100644 --- a/README.md +++ b/README.md @@ -1 +1,3 @@ -#Initial +# Initial + +Nothing to see here yet diff --git a/root/defaults/autostart b/root/defaults/autostart new file mode 100755 index 0000000..db0c341 --- /dev/null +++ b/root/defaults/autostart @@ -0,0 +1 @@ +xterm diff --git a/root/defaults/default.conf b/root/defaults/default.conf new file mode 100644 index 0000000..7b21506 --- /dev/null +++ b/root/defaults/default.conf @@ -0,0 +1,149 @@ +server { + #auth_basic "Login"; + #auth_basic_user_file /etc/nginx/.htpasswd; + listen 3000 default_server; + listen [::]:3000 default_server; + location / { + root /usr/share/selkies/www/; + index index.html index.htm; + } + + location SUBFOLDERhealth { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERturn { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERws { + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERwebrtc/signalling { + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERmetrics { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:9081; + } + error_page 500 502 503 504 /50x.html; + location = SUBFOLDER50x.html { + root /usr/share/selkies/www/; + } +} + +server { + #auth_basic "Login"; + #auth_basic_user_file /etc/nginx/.htpasswd; + listen 3001 ssl; + listen [::]:3001 ssl; + ssl_certificate /config/ssl/cert.pem; + ssl_certificate_key /config/ssl/cert.key; + location / { + root /usr/share/selkies/www/; + index index.html index.htm; + } + + location SUBFOLDERhealth { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERturn { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERws { + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERwebrtc/signalling { + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:8081; + } + location SUBFOLDERmetrics { + proxy_http_version 1.1; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_connect_timeout 3600s; + proxy_buffering off; + client_max_body_size 10M; + proxy_pass http://127.0.0.1:9081; + } + error_page 500 502 503 504 /50x.html; + location = SUBFOLDER50x.html { + root /usr/share/selkies/www/; + } +} + + diff --git a/root/defaults/menu.xml b/root/defaults/menu.xml new file mode 100644 index 0000000..1333076 --- /dev/null +++ b/root/defaults/menu.xml @@ -0,0 +1,6 @@ + + + +/usr/bin/xterm + + diff --git a/root/defaults/startwm.sh b/root/defaults/startwm.sh new file mode 100755 index 0000000..a5e37ce --- /dev/null +++ b/root/defaults/startwm.sh @@ -0,0 +1,10 @@ +#!/usr/bin/env bash + +# Enable Nvidia GPU support if detected +if which nvidia-smi; then + export LIBGL_KOPPER_DRI2=1 + export MESA_LOADER_DRIVER_OVERRIDE=zink + export GALLIUM_DRIVER=zink +fi + +/usr/bin/openbox-session diff --git a/root/etc/s6-overlay/s6-rc.d/init-config/dependencies.d/init-selkies-end b/root/etc/s6-overlay/s6-rc.d/init-config/dependencies.d/init-selkies-end new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-nginx/dependencies.d/init-selkies b/root/etc/s6-overlay/s6-rc.d/init-nginx/dependencies.d/init-selkies new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-nginx/run b/root/etc/s6-overlay/s6-rc.d/init-nginx/run new file mode 100755 index 0000000..6759cd0 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-nginx/run @@ -0,0 +1,35 @@ +#!/usr/bin/with-contenv bash + +# nginx Path +NGINX_CONFIG=/etc/nginx/sites-available/default + +# user passed env vars +CPORT="${CUSTOM_PORT:-3000}" +CHPORT="${CUSTOM_HTTPS_PORT:-3001}" +CUSER="${CUSTOM_USER:-abc}" +SFOLDER="${SUBFOLDER:-/}" + +# create self signed cert +if [ ! -f "/config/ssl/cert.pem" ]; then + mkdir -p /config/ssl + openssl req -new -x509 \ + -days 3650 -nodes \ + -out /config/ssl/cert.pem \ + -keyout /config/ssl/cert.key \ + -subj "/C=US/ST=CA/L=Carlsbad/O=Linuxserver.io/OU=LSIO Server/CN=*" + chmod 600 /config/ssl/cert.key + chown -R abc:abc /config/ssl +fi + +# modify nginx config +cp /defaults/default.conf ${NGINX_CONFIG} +sed -i "s/3000/$CPORT/g" ${NGINX_CONFIG} +sed -i "s/3001/$CHPORT/g" ${NGINX_CONFIG} +sed -i "s|SUBFOLDER|$SFOLDER|g" ${NGINX_CONFIG} +if [ ! -z ${DISABLE_IPV6+x} ]; then + sed -i '/listen \[::\]/d' ${NGINX_CONFIG} +fi +if [ ! -z ${PASSWORD+x} ]; then + printf "${CUSER}:$(openssl passwd -apr1 ${PASSWORD})\n" > /etc/nginx/.htpasswd + sed -i 's/#//g' ${NGINX_CONFIG} +fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-nginx/type b/root/etc/s6-overlay/s6-rc.d/init-nginx/type new file mode 100644 index 0000000..bdd22a1 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-nginx/type @@ -0,0 +1 @@ +oneshot diff --git a/root/etc/s6-overlay/s6-rc.d/init-nginx/up b/root/etc/s6-overlay/s6-rc.d/init-nginx/up new file mode 100644 index 0000000..b3b5b49 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-nginx/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-nginx/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-config/dependencies.d/init-nginx b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/dependencies.d/init-nginx new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-config/run b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/run new file mode 100755 index 0000000..04622ef --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/run @@ -0,0 +1,74 @@ +#!/usr/bin/with-contenv bash + +# default file copies first run +if [[ ! -f /config/.config/openbox/autostart ]]; then + mkdir -p /config/.config/openbox + cp /defaults/autostart /config/.config/openbox/autostart + chown -R abc:abc /config/.config/openbox +fi +if [[ ! -f /config/.config/openbox/menu.xml ]]; then + mkdir -p /config/.config/openbox && \ + cp /defaults/menu.xml /config/.config/openbox/menu.xml && \ + chown -R abc:abc /config/.config +fi + +# XDG Home +printf "${HOME}/.XDG" > /run/s6/container_environment/XDG_RUNTIME_DIR +if [ ! -d "${HOME}/.XDG" ]; then + mkdir -p ${HOME}/.XDG + chown abc:abc ${HOME}/.XDG +fi + +# Locale Support +if [ ! -z ${LC_ALL+x} ]; then + printf "${LC_ALL%.UTF-8}" > /run/s6/container_environment/LANGUAGE + printf "${LC_ALL}" > /run/s6/container_environment/LANG +fi + +# Remove window borders +if [[ ! -z ${NO_DECOR+x} ]] && [[ ! -f /decorlock ]]; then + sed -i \ + 's|| no \n|' \ + /etc/xdg/openbox/rc.xml + touch /decorlock +fi + +# Fullscreen everything in openbox unless the user explicitly disables it +if [[ ! -z ${NO_FULL+x} ]] && [[ ! -f /fulllock ]]; then + sed -i \ + '/yes<\/maximized><\/application>/d' \ + /etc/xdg/openbox/rc.xml + touch /fulllock +fi + +# Add proot-apps +if [ ! -f "${HOME}/.local/bin/proot-apps" ]; then + mkdir -p ${HOME}/.local/bin/ + cp /proot-apps/* ${HOME}/.local/bin/ + echo 'export PATH="$HOME/.local/bin:$PATH"' >> $HOME/.bashrc + chown abc:abc \ + ${HOME}/.bashrc \ + ${HOME}/.local/ \ + ${HOME}/.local/bin \ + ${HOME}/.local/bin/{ncat,proot-apps,proot,jq,pversion} +elif ! diff -q /proot-apps/pversion ${HOME}/.local/bin/pversion > /dev/null; then + cp /proot-apps/* ${HOME}/.local/bin/ + chown abc:abc ${HOME}/.local/bin/{ncat,proot-apps,proot,jq,pversion} +fi + + + +# set env based on vars +#printf "${SELKIES_INTERPOSER}${LD_PRELOAD:+:${LD_PRELOAD}}" > /run/s6/container_environment/LD_PRELOAD +printf "${GST_DEBUG:-*:2}" > /run/s6/container_environment/GST_DEBUG +printf "${SELKIES_ENCODER:-x264enc}" > /run/s6/container_environment/SELKIES_ENCODER +printf "${SELKIES_VIDEO_BITRATE:-8000}" > /run/s6/container_environment/SELKIES_VIDEO_BITRATE +printf "${SELKIES_FRAMERATE:-30}" > /run/s6/container_environment/SELKIES_FRAMERATE +printf "${SELKIES_AUDIO_BITRATE:-128000}" > /run/s6/container_environment/SELKIES_AUDIO_BITRATE +printf "${SELKIES_ENABLE_RESIZE:-true}" > /run/s6/container_environment/SELKIES_ENABLE_RESIZE +printf "${DISPLAY_SIZEW:-1024}" > /run/s6/container_environment/DISPLAY_SIZEW +printf "${DISPLAY_SIZEH:-768}" > /run/s6/container_environment/DISPLAY_SIZEH +printf "${DISPLAY_REFRESH:-30}" > /run/s6/container_environment/DISPLAY_REFRESH +printf "${DISPLAY_DPI:-30}" > /run/s6/container_environment/DISPLAY_DPI +printf "${DISPLAY_CDEPTH:-24}" > /run/s6/container_environment/DISPLAY_CDEPTH +printf "unix:path=${XDG_RUNTIME_DIR:-/tmp}/dbus-system-bus" > /run/s6/container_environment/DBUS_SYSTEM_BUS_ADDRESS diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-config/type b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/type new file mode 100644 index 0000000..bdd22a1 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/type @@ -0,0 +1 @@ +oneshot diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-config/up b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/up new file mode 100644 index 0000000..2dcf2f5 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies-config/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-selkies-config/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-end/dependencies.d/init-video b/root/etc/s6-overlay/s6-rc.d/init-selkies-end/dependencies.d/init-video new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-end/type b/root/etc/s6-overlay/s6-rc.d/init-selkies-end/type new file mode 100644 index 0000000..3d92b15 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies-end/type @@ -0,0 +1 @@ +oneshot \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies-end/up b/root/etc/s6-overlay/s6-rc.d/init-selkies-end/up new file mode 100644 index 0000000..a2dcf94 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies-end/up @@ -0,0 +1 @@ +# This file doesn't do anything, it's just the end of the selkies init process diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies/dependencies.d/init-os-end b/root/etc/s6-overlay/s6-rc.d/init-selkies/dependencies.d/init-os-end new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies/type b/root/etc/s6-overlay/s6-rc.d/init-selkies/type new file mode 100644 index 0000000..3d92b15 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies/type @@ -0,0 +1 @@ +oneshot \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/init-selkies/up b/root/etc/s6-overlay/s6-rc.d/init-selkies/up new file mode 100644 index 0000000..2124cce --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-selkies/up @@ -0,0 +1 @@ +# This file doesn't do anything, it's just the beginning of the selkies init process diff --git a/root/etc/s6-overlay/s6-rc.d/init-video/dependencies.d/init-selkies-config b/root/etc/s6-overlay/s6-rc.d/init-video/dependencies.d/init-selkies-config new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-video/run b/root/etc/s6-overlay/s6-rc.d/init-video/run new file mode 100755 index 0000000..aaf9dfd --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-video/run @@ -0,0 +1,35 @@ +#!/usr/bin/with-contenv bash + +FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null) + +for i in $FILES +do + VIDEO_GID=$(stat -c '%g' "${i}") + VIDEO_UID=$(stat -c '%u' "${i}") + # check if user matches device + if id -u abc | grep -qw "${VIDEO_UID}"; then + echo "**** permissions for ${i} are good ****" + else + # check if group matches and that device has group rw + if id -G abc | grep -qw "${VIDEO_GID}" && [ $(stat -c '%A' "${i}" | cut -b 5,6) = "rw" ]; then + echo "**** permissions for ${i} are good ****" + # check if device needs to be added to video group + elif ! id -G abc | grep -qw "${VIDEO_GID}"; then + # check if video group needs to be created + VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}') + if [ -z "${VIDEO_NAME}" ]; then + VIDEO_NAME="video$(head /dev/urandom | tr -dc 'a-z0-9' | head -c4)" + groupadd "${VIDEO_NAME}" + groupmod -g "${VIDEO_GID}" "${VIDEO_NAME}" + echo "**** creating video group ${VIDEO_NAME} with id ${VIDEO_GID} ****" + fi + echo "**** adding ${i} to video group ${VIDEO_NAME} with id ${VIDEO_GID} ****" + usermod -a -G "${VIDEO_NAME}" abc + fi + # check if device has group rw + if [ $(stat -c '%A' "${i}" | cut -b 5,6) != "rw" ]; then + echo -e "**** The device ${i} does not have group read/write permissions, attempting to fix inside the container.If it doesn't work, you can run the following on your docker host: ****\nsudo chmod g+rw ${i}\n" + chmod g+rw "${i}" + fi + fi +done diff --git a/root/etc/s6-overlay/s6-rc.d/init-video/type b/root/etc/s6-overlay/s6-rc.d/init-video/type new file mode 100644 index 0000000..bdd22a1 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-video/type @@ -0,0 +1 @@ +oneshot diff --git a/root/etc/s6-overlay/s6-rc.d/init-video/up b/root/etc/s6-overlay/s6-rc.d/init-video/up new file mode 100644 index 0000000..01141b1 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-video/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-video/run diff --git a/root/etc/s6-overlay/s6-rc.d/svc-dbus/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-dbus/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-dbus/dependencies.d/svc-xorg b/root/etc/s6-overlay/s6-rc.d/svc-dbus/dependencies.d/svc-xorg new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-dbus/run b/root/etc/s6-overlay/s6-rc.d/svc-dbus/run new file mode 100755 index 0000000..d6f5914 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-dbus/run @@ -0,0 +1,15 @@ +#!/usr/bin/with-contenv bash + +# Folder setup +mkdir -pm700 "${XDG_RUNTIME_DIR}" +chown -f "${PUID}:${PGID}" "${XDG_RUNTIME_DIR}" +chmod -f 700 "${XDG_RUNTIME_DIR}" + +# Run dbus +exec s6-setuidgid abc \ + dbus-daemon \ + --system \ + --nofork \ + --nosyslog \ + --nopidfile \ + --address="${DBUS_SYSTEM_BUS_ADDRESS}" diff --git a/root/etc/s6-overlay/s6-rc.d/svc-dbus/type b/root/etc/s6-overlay/s6-rc.d/svc-dbus/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-dbus/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/svc-nginx b/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/svc-nginx new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/svc-xorg b/root/etc/s6-overlay/s6-rc.d/svc-de/dependencies.d/svc-xorg new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-de/run b/root/etc/s6-overlay/s6-rc.d/svc-de/run new file mode 100755 index 0000000..14c12e7 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-de/run @@ -0,0 +1,5 @@ +#!/usr/bin/with-contenv bash + +cd $HOME +exec s6-setuidgid abc \ + /bin/bash /defaults/startwm.sh diff --git a/root/etc/s6-overlay/s6-rc.d/svc-de/type b/root/etc/s6-overlay/s6-rc.d/svc-de/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-de/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-docker/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-docker/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-docker/dependencies.d/svc-de b/root/etc/s6-overlay/s6-rc.d/svc-docker/dependencies.d/svc-de new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-docker/run b/root/etc/s6-overlay/s6-rc.d/svc-docker/run new file mode 100755 index 0000000..efe3cf4 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-docker/run @@ -0,0 +1,15 @@ +#!/usr/bin/with-contenv bash + +# We need to wait for kclient to be full up as docker init breaks audio +sleep 5 + +# Make sure this is a priv container +if [ -e /dev/cpu_dma_latency ]; then + if [ "${START_DOCKER}" == "true" ]; then + exec /usr/local/bin/dockerd-entrypoint.sh -l error + else + sleep infinity + fi +fi +# if anything goes wrong with Docker don't loop +sleep infinity diff --git a/root/etc/s6-overlay/s6-rc.d/svc-docker/type b/root/etc/s6-overlay/s6-rc.d/svc-docker/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-docker/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-nginx/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-nginx/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-nginx/run b/root/etc/s6-overlay/s6-rc.d/svc-nginx/run new file mode 100755 index 0000000..521a47d --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-nginx/run @@ -0,0 +1,16 @@ +#!/usr/bin/with-contenv bash +# shellcheck shell=bash + +if pgrep -f "[n]ginx:" >/dev/null; then + echo "Zombie nginx processes detected, sending SIGTERM" + pkill -ef [n]ginx: + sleep 1 +fi + +if pgrep -f "[n]ginx:" >/dev/null; then + echo "Zombie nginx processes still active, sending SIGKILL" + pkill -9 -ef [n]ginx: + sleep 1 +fi + +exec /usr/sbin/nginx -g 'daemon off;' diff --git a/root/etc/s6-overlay/s6-rc.d/svc-nginx/type b/root/etc/s6-overlay/s6-rc.d/svc-nginx/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-nginx/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/run b/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/run new file mode 100755 index 0000000..3ebebc8 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/run @@ -0,0 +1,7 @@ +#!/usr/bin/with-contenv bash + +exec s6-setuidgid abc \ + /usr/bin/pulseaudio \ + --log-level=0 \ + --log-target=stderr \ + --exit-idle-time=-1 > /dev/null 2>&1 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/type b/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-pulseaudio/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-dbus b/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-dbus new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-nginx b/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-nginx new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-pulseaudio b/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-pulseaudio new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-xorg b/root/etc/s6-overlay/s6-rc.d/svc-selkies/dependencies.d/svc-xorg new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/run b/root/etc/s6-overlay/s6-rc.d/svc-selkies/run new file mode 100755 index 0000000..9beba89 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-selkies/run @@ -0,0 +1,13 @@ +#!/usr/bin/with-contenv bash + +# Clear the cache registry +rm -rf "${HOME}/.cache/gstreamer-1.0" + +# Start the Selkies-GStreamer WebRTC HTML5 remote desktop application +exec s6-setuidgid abc \ + selkies-gstreamer \ + --addr="localhost" \ + --port="8081" \ + --enable_basic_auth="false" \ + --enable_metrics_http="true" \ + --metrics_http_port="9081" diff --git a/root/etc/s6-overlay/s6-rc.d/svc-selkies/type b/root/etc/s6-overlay/s6-rc.d/svc-selkies/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-selkies/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/svc-xorg/dependencies.d/init-services b/root/etc/s6-overlay/s6-rc.d/svc-xorg/dependencies.d/init-services new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/svc-xorg/run b/root/etc/s6-overlay/s6-rc.d/svc-xorg/run new file mode 100755 index 0000000..80698bb --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-xorg/run @@ -0,0 +1,22 @@ +#!/usr/bin/with-contenv bash + +# Run Xvfb server with required extensions +exec s6-setuidgid abc \ + /usr/bin/Xvfb \ + "${DISPLAY}" \ + -screen 0 "8192x4096x${DISPLAY_CDEPTH}" \ + -dpi "${DISPLAY_DPI}" \ + +extension "COMPOSITE" \ + +extension "DAMAGE" \ + +extension "GLX" \ + +extension "RANDR" \ + +extension "RENDER" \ + +extension "MIT-SHM" \ + +extension "XFIXES" \ + +extension "XTEST" \ + +iglx \ + +render \ + -nolisten "tcp" \ + -ac \ + -noreset \ + -shmem diff --git a/root/etc/s6-overlay/s6-rc.d/svc-xorg/type b/root/etc/s6-overlay/s6-rc.d/svc-xorg/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/svc-xorg/type @@ -0,0 +1 @@ +longrun diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-config b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-config new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-nginx b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-nginx new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies-config b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies-config new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies-end b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-selkies-end new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-video b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-video new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-dbus b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-dbus new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-de b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-de new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-docker b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-docker new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-nginx b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-nginx new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-pulseaudio b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-pulseaudio new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-selkies b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-selkies new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-xorg b/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-xorg new file mode 100644 index 0000000..e69de29 diff --git a/root/usr/local/bin/dockerd-entrypoint.sh b/root/usr/local/bin/dockerd-entrypoint.sh new file mode 100755 index 0000000..0f843e0 --- /dev/null +++ b/root/usr/local/bin/dockerd-entrypoint.sh @@ -0,0 +1,196 @@ +#!/bin/sh +set -eu + +_tls_ensure_private() { + local f="$1"; shift + [ -s "$f" ] || openssl genrsa -out "$f" 4096 +} +_tls_san() { + { + ip -oneline address | awk '{ gsub(/\/.+$/, "", $4); print "IP:" $4 }' + { + cat /etc/hostname + echo 'docker' + echo 'localhost' + hostname -f + hostname -s + } | sed 's/^/DNS:/' + [ -z "${DOCKER_TLS_SAN:-}" ] || echo "$DOCKER_TLS_SAN" + } | sort -u | xargs printf '%s,' | sed "s/,\$//" +} +_tls_generate_certs() { + local dir="$1"; shift + + # if ca/key.pem || !ca/cert.pem, generate CA public if necessary + # if ca/key.pem, generate server public + # if ca/key.pem, generate client public + # (regenerating public certs every startup to account for SAN/IP changes and/or expiration) + + # https://github.com/FiloSottile/mkcert/issues/174 + local certValidDays='825' + + if [ -s "$dir/ca/key.pem" ] || [ ! -s "$dir/ca/cert.pem" ]; then + # if we either have a CA private key or do *not* have a CA public key, then we should create/manage the CA + mkdir -p "$dir/ca" + _tls_ensure_private "$dir/ca/key.pem" + openssl req -new -key "$dir/ca/key.pem" \ + -out "$dir/ca/cert.pem" \ + -subj '/CN=docker:dind CA' -x509 -days "$certValidDays" + fi + + if [ -s "$dir/ca/key.pem" ]; then + # if we have a CA private key, we should create/manage a server key + mkdir -p "$dir/server" + _tls_ensure_private "$dir/server/key.pem" + openssl req -new -key "$dir/server/key.pem" \ + -out "$dir/server/csr.pem" \ + -subj '/CN=docker:dind server' + cat > "$dir/server/openssl.cnf" <<-EOF + [ x509_exts ] + subjectAltName = $(_tls_san) + EOF + openssl x509 -req \ + -in "$dir/server/csr.pem" \ + -CA "$dir/ca/cert.pem" \ + -CAkey "$dir/ca/key.pem" \ + -CAcreateserial \ + -out "$dir/server/cert.pem" \ + -days "$certValidDays" \ + -extfile "$dir/server/openssl.cnf" \ + -extensions x509_exts + cp "$dir/ca/cert.pem" "$dir/server/ca.pem" + openssl verify -CAfile "$dir/server/ca.pem" "$dir/server/cert.pem" + fi + + if [ -s "$dir/ca/key.pem" ]; then + # if we have a CA private key, we should create/manage a client key + mkdir -p "$dir/client" + _tls_ensure_private "$dir/client/key.pem" + chmod 0644 "$dir/client/key.pem" # openssl defaults to 0600 for the private key, but this one needs to be shared with arbitrary client contexts + openssl req -new \ + -key "$dir/client/key.pem" \ + -out "$dir/client/csr.pem" \ + -subj '/CN=docker:dind client' + cat > "$dir/client/openssl.cnf" <<-'EOF' + [ x509_exts ] + extendedKeyUsage = clientAuth + EOF + openssl x509 -req \ + -in "$dir/client/csr.pem" \ + -CA "$dir/ca/cert.pem" \ + -CAkey "$dir/ca/key.pem" \ + -CAcreateserial \ + -out "$dir/client/cert.pem" \ + -days "$certValidDays" \ + -extfile "$dir/client/openssl.cnf" \ + -extensions x509_exts + cp "$dir/ca/cert.pem" "$dir/client/ca.pem" + openssl verify -CAfile "$dir/client/ca.pem" "$dir/client/cert.pem" + fi +} + +# no arguments passed +# or first arg is `-f` or `--some-option` +if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then + # set "dockerSocket" to the default "--host" *unix socket* value (for both standard or rootless) + uid="$(id -u)" + if [ "$uid" = '0' ]; then + dockerSocket='unix:///var/run/docker.sock' + else + # if we're not root, we must be trying to run rootless + : "${XDG_RUNTIME_DIR:=/run/user/$uid}" + dockerSocket="unix://$XDG_RUNTIME_DIR/docker.sock" + fi + case "${DOCKER_HOST:-}" in + unix://*) + dockerSocket="$DOCKER_HOST" + ;; + esac + + # add our default arguments + if [ -n "${DOCKER_TLS_CERTDIR:-}" ] \ + && _tls_generate_certs "$DOCKER_TLS_CERTDIR" \ + && [ -s "$DOCKER_TLS_CERTDIR/server/ca.pem" ] \ + && [ -s "$DOCKER_TLS_CERTDIR/server/cert.pem" ] \ + && [ -s "$DOCKER_TLS_CERTDIR/server/key.pem" ] \ + ; then + # generate certs and use TLS if requested/possible (default in 19.03+) + set -- dockerd \ + --host="$dockerSocket" \ + --host=tcp://0.0.0.0:2376 \ + --tlsverify \ + --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ + --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ + --tlskey "$DOCKER_TLS_CERTDIR/server/key.pem" \ + "$@" + DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2376:2376/tcp" + else + # TLS disabled (-e DOCKER_TLS_CERTDIR='') or missing certs + set -- dockerd \ + --host="$dockerSocket" \ + "$@" + DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" + fi +fi + +if [ "$1" = 'dockerd' ]; then + # explicitly remove Docker's default PID file to ensure that it can start properly if it was stopped uncleanly (and thus didn't clean up the PID file) + find /run /var/run -iname 'docker*.pid' -delete || : + + if dockerd --version | grep -qF ' 20.10.'; then + set -- docker-init -- "$@" + fi + + if ! iptables -nL > /dev/null 2>&1; then + # if iptables fails to run, chances are high the necessary kernel modules aren't loaded (perhaps the host is using nftables with the translating "iptables" wrappers, for example) + # https://github.com/docker-library/docker/issues/350 + # https://github.com/moby/moby/issues/26824 + modprobe ip_tables || : + fi + + uid="$(id -u)" + if [ "$uid" != '0' ]; then + # if we're not root, we must be trying to run rootless + if ! command -v rootlesskit > /dev/null; then + echo >&2 "error: attempting to run rootless dockerd but missing 'rootlesskit' (perhaps the 'docker:dind-rootless' image variant is intended?)" + exit 1 + fi + user="$(id -un 2>/dev/null || :)" + if ! grep -qE "^($uid${user:+|$user}):" /etc/subuid || ! grep -qE "^($uid${user:+|$user}):" /etc/subgid; then + echo >&2 "error: attempting to run rootless dockerd but missing necessary entries in /etc/subuid and/or /etc/subgid for $uid" + exit 1 + fi + : "${XDG_RUNTIME_DIR:=/run/user/$uid}" + export XDG_RUNTIME_DIR + if ! mkdir -p "$XDG_RUNTIME_DIR" || [ ! -w "$XDG_RUNTIME_DIR" ] || ! mkdir -p "$HOME/.local/share/docker" || [ ! -w "$HOME/.local/share/docker" ]; then + echo >&2 "error: attempting to run rootless dockerd but need writable HOME ($HOME) and XDG_RUNTIME_DIR ($XDG_RUNTIME_DIR) for user $uid" + exit 1 + fi + if [ -f /proc/sys/kernel/unprivileged_userns_clone ] && unprivClone="$(cat /proc/sys/kernel/unprivileged_userns_clone)" && [ "$unprivClone" != '1' ]; then + echo >&2 "error: attempting to run rootless dockerd but need 'kernel.unprivileged_userns_clone' (/proc/sys/kernel/unprivileged_userns_clone) set to 1" + exit 1 + fi + if [ -f /proc/sys/user/max_user_namespaces ] && maxUserns="$(cat /proc/sys/user/max_user_namespaces)" && [ "$maxUserns" = '0' ]; then + echo >&2 "error: attempting to run rootless dockerd but need 'user.max_user_namespaces' (/proc/sys/user/max_user_namespaces) set to a sufficiently large value" + exit 1 + fi + # TODO overlay support detection? + exec rootlesskit \ + --net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \ + --mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \ + --disable-host-loopback \ + --port-driver=builtin \ + --copy-up=/etc \ + --copy-up=/run \ + ${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \ + "$@" + elif [ -x '/usr/local/bin/dind' ]; then + # if we have the (mostly defunct now) Docker-in-Docker wrapper script, use it + set -- '/usr/local/bin/dind' "$@" + fi +else + # if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too + set -- docker-entrypoint.sh "$@" +fi + +exec "$@"