Skip to content

Commit a723513

Browse files
norio-nomuranorio-nomura
committed
docker{,-rootful}.yaml: apply reviews
- Use `if then else fi` instead of `||` - Use long-from options - Omit double quotes during variable expansion where it is clear that spaces are not included - Use upper case on param variable names - Use wrapper functions instead variable expansion. e.g.(`systemctl_wrapper`) - Assign param variable to shell variable to making it easier to read cloud-init-output.log - Remove `systemctl --user start dbus` since it not required any more - Add some comments to describe the intentions that are difficult to infer from the code Signed-off-by: Norio Nomura <[email protected]>
1 parent cdb7732 commit a723513

File tree

2 files changed

+134
-70
lines changed

2 files changed

+134
-70
lines changed

Diff for: ‎examples/docker-rootful.yaml

+67-35
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ provision:
4545
set -eux -o pipefail
4646
command -v docker >/dev/null 2>&1 && exit 0
4747
readonly override_conf=/etc/systemd/system/docker.socket.d/override.conf
48-
if [ ! -e "$override_conf" ]; then
49-
mkdir -p $(dirname "$override_conf")
48+
if [ ! -e $override_conf ]; then
49+
mkdir -p $(dirname $override_conf)
5050
# Alternatively we could just add the user to the "docker" group, but that requires restarting the user session
51-
cat <<EOF >"$override_conf"
51+
cat <<EOF >$override_conf
5252
[Socket]
5353
SocketUser={{.User}}
5454
EOF
@@ -58,50 +58,81 @@ provision:
5858
- mode: user # configure docker under non-root user
5959
script: |
6060
#!/bin/bash
61-
set -eux -o pipefail
62-
command -v jq &>/dev/null || sudo apt-get install -y jq
63-
readonly rootless_installed=$(systemctl --user list-unit-files docker.service &>/dev/null && echo true || echo false)
61+
set -o errexit -o nounset -o pipefail -o xtrace
6462
65-
if [ "{{.Param.Rootful}}" = "true" ]; then
66-
readonly config_dir="/etc/docker"
67-
readonly systemctl="sudo systemctl"
68-
readonly tee="sudo tee"
63+
if ! command -v jq &>/dev/null; then
64+
sudo apt-get install --assume-yes jq
65+
fi
66+
if systemctl --user list-unit-files docker.service &>/dev/null; then
67+
readonly rootless_installed=true
68+
else
69+
readonly rootless_installed=false
70+
fi
6971
70-
[ "$rootless_installed" != "true" ] || systemctl --user disable --now docker
71-
docker context use default
72+
# Setting shell variable makes it easier to read cloud-init-output.log
73+
readonly ROOTFUL="{{.Param.ROOTFUL}}"
74+
if [ "$ROOTFUL" = true ]; then
75+
if [ $rootless_installed = true ]; then
76+
systemctl --user disable --now docker
77+
fi
7278
79+
readonly config_dir=/etc/docker
80+
readonly context=default
81+
function systemctl_wrapper() { sudo systemctl "$@"; }
82+
function tee_wrapper() { sudo tee "$@"; }
7383
else
74-
readonly config_dir="$HOME/.config/docker"
75-
readonly systemctl="systemctl --user"
76-
readonly tee="tee"
77-
7884
sudo systemctl disable --now docker
79-
if [ "$rootless_installed" != "true" ]; then
80-
sudo apt-get install -y dbus-user-session fuse3 uidmap
81-
$systemctl start dbus
82-
[ ! -S /var/run/docker.sock ] || sudo rm /var/run/docker.sock
85+
if [ $rootless_installed != true ]; then
86+
sudo apt-get install --assume-yes dbus-user-session fuse3 uidmap
87+
if [ -S /var/run/docker.sock ]; then
88+
sudo rm /var/run/docker.sock
89+
fi
8390
dockerd-rootless-setuptool.sh install
8491
fi
85-
docker context use rootless
92+
93+
readonly config_dir="$HOME/.config/docker"
94+
readonly context=rootless
95+
function systemctl_wrapper() { systemctl --user "$@"; }
96+
function tee_wrapper() { tee "$@"; }
8697
fi
87-
$systemctl enable --now docker
98+
99+
systemctl_wrapper enable --now docker
100+
docker context use $context
88101
89102
readonly config="$config_dir/daemon.json"
90-
needs_restart=
103+
function print_config() {
104+
if [ -s "$config" ]; then
105+
cat "$config"
106+
else
107+
# print empty JSON object instead of empty string for jq to work
108+
echo "{}"
109+
fi
110+
}
111+
needs_restart=false
91112
function set_docker_daemon_json() {
92-
function cat_config() { test -s "$config" && cat "$config" || echo "{}" ; }
93-
local -r current=$(cat_config | jq -r "$1 // empty")
113+
local -r current=$(print_config | jq --raw-output "$1 // empty")
94114
[ "$current" = "$2" ] && return 0
95-
mkdir -p "$config_dir" && cat_config | jq "$1 = ${2:-empty}" | (sleep 0 && $tee "$config") && needs_restart=1
115+
mkdir -p "$config_dir"
116+
# sleep 0 is a trick to avoid tee_wrapper overwriting the file before reading it
117+
if print_config | jq "$1 = ${2:-empty}" | (sleep 0 && tee_wrapper "$config"); then
118+
needs_restart=true
119+
fi
96120
}
97121
122+
# Setting shell variable makes it easier to read cloud-init-output.log
123+
readonly CONTAINERD_IMAGE_STORE="{{.Param.CONTAINERD_IMAGE_STORE}}"
98124
# enable containerd image store
99-
set_docker_daemon_json '.features."containerd-snapshotter"' "$(
100-
[ "{{.Param.ContainerdImageStore}}" = "true" ] && echo 'true'
101-
)"
125+
if [ "$CONTAINERD_IMAGE_STORE" = true ]; then
126+
set_docker_daemon_json '.features."containerd-snapshotter"' 'true'
127+
else
128+
# passing empty string to remove the key and use the default value
129+
set_docker_daemon_json '.features."containerd-snapshotter"' ''
130+
fi
102131
103132
# restart docker to apply the new configuration
104-
[ -z "$needs_restart" ] || $systemctl restart docker
133+
if [ $needs_restart = true ]; then
134+
systemctl_wrapper restart docker
135+
fi
105136
probes:
106137
- script: |
107138
#!/bin/bash
@@ -110,9 +141,10 @@ probes:
110141
echo >&2 "docker is not installed yet"
111142
exit 1
112143
fi
113-
if [ "{{.Param.Rootful}}" = "true" ]; then
144+
readonly ROOTFUL="{{.Param.ROOTFUL}}"
145+
if [ "$ROOTFUL" = true ]; then
114146
target=dockerd
115-
target_description="dockerd"
147+
target_description=dockerd
116148
else
117149
target=rootlesskit
118150
target_description="rootlesskit (used by rootless docker)"
@@ -128,7 +160,7 @@ hostResolver:
128160
hosts:
129161
host.docker.internal: host.lima.internal
130162
portForwards:
131-
- guestSocket: "{{if eq .Param.Rootful \"true\"}}/var/run{{else}}/run/user/{{.UID}}{{end}}/docker.sock"
163+
- guestSocket: "{{if eq .Param.ROOTFUL \"true\"}}/var/run{{else}}/run/user/{{.UID}}{{end}}/docker.sock"
132164
hostSocket: "{{.Dir}}/sock/docker.sock"
133165
message: |
134166
To run `docker` on the host (assumes docker-cli is installed), run the following commands:
@@ -138,5 +170,5 @@ message: |
138170
docker run hello-world
139171
------
140172
param:
141-
ContainerdImageStore: false
142-
Rootful: true
173+
CONTAINERD_IMAGE_STORE: false
174+
ROOTFUL: true

Diff for: ‎examples/docker.yaml

+67-35
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ provision:
4545
set -eux -o pipefail
4646
command -v docker >/dev/null 2>&1 && exit 0
4747
readonly override_conf=/etc/systemd/system/docker.socket.d/override.conf
48-
if [ ! -e "$override_conf" ]; then
49-
mkdir -p $(dirname "$override_conf")
48+
if [ ! -e $override_conf ]; then
49+
mkdir -p $(dirname $override_conf)
5050
# Alternatively we could just add the user to the "docker" group, but that requires restarting the user session
51-
cat <<EOF >"$override_conf"
51+
cat <<EOF >$override_conf
5252
[Socket]
5353
SocketUser={{.User}}
5454
EOF
@@ -58,50 +58,81 @@ provision:
5858
- mode: user # configure docker under non-root user
5959
script: |
6060
#!/bin/bash
61-
set -eux -o pipefail
62-
command -v jq &>/dev/null || sudo apt-get install -y jq
63-
readonly rootless_installed=$(systemctl --user list-unit-files docker.service &>/dev/null && echo true || echo false)
61+
set -o errexit -o nounset -o pipefail -o xtrace
6462
65-
if [ "{{.Param.Rootful}}" = "true" ]; then
66-
readonly config_dir="/etc/docker"
67-
readonly systemctl="sudo systemctl"
68-
readonly tee="sudo tee"
63+
if ! command -v jq &>/dev/null; then
64+
sudo apt-get install --assume-yes jq
65+
fi
66+
if systemctl --user list-unit-files docker.service &>/dev/null; then
67+
readonly rootless_installed=true
68+
else
69+
readonly rootless_installed=false
70+
fi
6971
70-
[ "$rootless_installed" != "true" ] || systemctl --user disable --now docker
71-
docker context use default
72+
# Setting shell variable makes it easier to read cloud-init-output.log
73+
readonly ROOTFUL="{{.Param.ROOTFUL}}"
74+
if [ "$ROOTFUL" = true ]; then
75+
if [ $rootless_installed = true ]; then
76+
systemctl --user disable --now docker
77+
fi
7278
79+
readonly config_dir=/etc/docker
80+
readonly context=default
81+
function systemctl_wrapper() { sudo systemctl "$@"; }
82+
function tee_wrapper() { sudo tee "$@"; }
7383
else
74-
readonly config_dir="$HOME/.config/docker"
75-
readonly systemctl="systemctl --user"
76-
readonly tee="tee"
77-
7884
sudo systemctl disable --now docker
79-
if [ "$rootless_installed" != "true" ]; then
80-
sudo apt-get install -y dbus-user-session fuse3 uidmap
81-
$systemctl start dbus
82-
[ ! -S /var/run/docker.sock ] || sudo rm /var/run/docker.sock
85+
if [ $rootless_installed != true ]; then
86+
sudo apt-get install --assume-yes dbus-user-session fuse3 uidmap
87+
if [ -S /var/run/docker.sock ]; then
88+
sudo rm /var/run/docker.sock
89+
fi
8390
dockerd-rootless-setuptool.sh install
8491
fi
85-
docker context use rootless
92+
93+
readonly config_dir="$HOME/.config/docker"
94+
readonly context=rootless
95+
function systemctl_wrapper() { systemctl --user "$@"; }
96+
function tee_wrapper() { tee "$@"; }
8697
fi
87-
$systemctl enable --now docker
98+
99+
systemctl_wrapper enable --now docker
100+
docker context use $context
88101
89102
readonly config="$config_dir/daemon.json"
90-
needs_restart=
103+
function print_config() {
104+
if [ -s "$config" ]; then
105+
cat "$config"
106+
else
107+
# print empty JSON object instead of empty string for jq to work
108+
echo "{}"
109+
fi
110+
}
111+
needs_restart=false
91112
function set_docker_daemon_json() {
92-
function cat_config() { test -s "$config" && cat "$config" || echo "{}" ; }
93-
local -r current=$(cat_config | jq -r "$1 // empty")
113+
local -r current=$(print_config | jq --raw-output "$1 // empty")
94114
[ "$current" = "$2" ] && return 0
95-
mkdir -p "$config_dir" && cat_config | jq "$1 = ${2:-empty}" | (sleep 0 && $tee "$config") && needs_restart=1
115+
mkdir -p "$config_dir"
116+
# sleep 0 is a trick to avoid tee_wrapper overwriting the file before reading it
117+
if print_config | jq "$1 = ${2:-empty}" | (sleep 0 && tee_wrapper "$config"); then
118+
needs_restart=true
119+
fi
96120
}
97121
122+
# Setting shell variable makes it easier to read cloud-init-output.log
123+
readonly CONTAINERD_IMAGE_STORE="{{.Param.CONTAINERD_IMAGE_STORE}}"
98124
# enable containerd image store
99-
set_docker_daemon_json '.features."containerd-snapshotter"' "$(
100-
[ "{{.Param.ContainerdImageStore}}" = "true" ] && echo 'true'
101-
)"
125+
if [ "$CONTAINERD_IMAGE_STORE" = true ]; then
126+
set_docker_daemon_json '.features."containerd-snapshotter"' 'true'
127+
else
128+
# passing empty string to remove the key and use the default value
129+
set_docker_daemon_json '.features."containerd-snapshotter"' ''
130+
fi
102131
103132
# restart docker to apply the new configuration
104-
[ -z "$needs_restart" ] || $systemctl restart docker
133+
if [ $needs_restart = true ]; then
134+
systemctl_wrapper restart docker
135+
fi
105136
probes:
106137
- script: |
107138
#!/bin/bash
@@ -110,9 +141,10 @@ probes:
110141
echo >&2 "docker is not installed yet"
111142
exit 1
112143
fi
113-
if [ "{{.Param.Rootful}}" = "true" ]; then
144+
readonly ROOTFUL="{{.Param.ROOTFUL}}"
145+
if [ "$ROOTFUL" = true ]; then
114146
target=dockerd
115-
target_description="dockerd"
147+
target_description=dockerd
116148
else
117149
target=rootlesskit
118150
target_description="rootlesskit (used by rootless docker)"
@@ -128,7 +160,7 @@ hostResolver:
128160
hosts:
129161
host.docker.internal: host.lima.internal
130162
portForwards:
131-
- guestSocket: "{{if eq .Param.Rootful \"true\"}}/var/run{{else}}/run/user/{{.UID}}{{end}}/docker.sock"
163+
- guestSocket: "{{if eq .Param.ROOTFUL \"true\"}}/var/run{{else}}/run/user/{{.UID}}{{end}}/docker.sock"
132164
hostSocket: "{{.Dir}}/sock/docker.sock"
133165
message: |
134166
To run `docker` on the host (assumes docker-cli is installed), run the following commands:
@@ -138,5 +170,5 @@ message: |
138170
docker run hello-world
139171
------
140172
param:
141-
ContainerdImageStore: false
142-
Rootful: false
173+
CONTAINERD_IMAGE_STORE: false
174+
ROOTFUL: false

0 commit comments

Comments
 (0)