Adolfo Delorenzo
39732488ef
Build a custom Tiny Core 17.0 kernel (6.18.2) with missing configs that the stock kernel lacks for container workloads: - CONFIG_CGROUP_BPF=y (cgroup v2 device control via BPF) - CONFIG_DEVTMPFS=y (auto-create /dev device nodes) - CONFIG_DEVTMPFS_MOUNT=y (auto-mount devtmpfs) - CONFIG_MEMCG=y (memory cgroup controller for memory.max) - CONFIG_CFS_BANDWIDTH=y (CPU bandwidth throttling for cpu.max) Also strips unnecessary subsystems (sound, GPU, wireless, Bluetooth, KVM, etc.) for minimal footprint on a headless K8s edge appliance. Init system fixes for successful boot-to-running-pods: - Add switch_root in init.sh to escape initramfs (runc pivot_root) - Add mountpoint guards in 00-early-mount.sh (skip if already mounted) - Create essential device nodes after switch_root (kmsg, console, etc.) - Enable cgroup v2 controller delegation with init process isolation - Mount BPF filesystem for cgroup v2 device control - Add mknod fallback from sysfs in 20-persistent-mount.sh for /dev/vda - Move KubeSolo binary to /usr/bin (avoid /usr/local bind mount hiding) - Generate /etc/machine-id in 60-hostname.sh (kubelet requires it) - Pre-initialize iptables tables before kube-proxy starts - Add nft_reject, nft_fib, xt_nfacct to kernel modules list Build system changes: - New build-kernel.sh script for custom kernel compilation - Dockerfile.builder adds kernel build deps (flex, bison, libelf, etc.) - Selective kernel module install (only modules.list + transitive deps) - Install iptables-nft (xtables-nft-multi) + shared libs in rootfs Tested: ISO boots in QEMU, node reaches Ready in ~35s, CoreDNS and local-path-provisioner pods start and run successfully. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
54 lines
1.1 KiB
Ruby
54 lines
1.1 KiB
Ruby
FROM --platform=linux/amd64 ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Install build tools + kernel build dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
bash \
|
|
bc \
|
|
bison \
|
|
build-essential \
|
|
ca-certificates \
|
|
cpio \
|
|
curl \
|
|
dosfstools \
|
|
dwarves \
|
|
e2fsprogs \
|
|
fdisk \
|
|
file \
|
|
flex \
|
|
genisoimage \
|
|
gzip \
|
|
isolinux \
|
|
iptables \
|
|
kmod \
|
|
libarchive-tools \
|
|
libelf-dev \
|
|
libssl-dev \
|
|
make \
|
|
parted \
|
|
squashfs-tools \
|
|
syslinux \
|
|
syslinux-common \
|
|
syslinux-utils \
|
|
wget \
|
|
xorriso \
|
|
xz-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Go (for building cloud-init and update agent)
|
|
ARG GO_VERSION=1.24.0
|
|
RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
|
|
| tar -C /usr/local -xzf -
|
|
ENV PATH="/usr/local/go/bin:${PATH}"
|
|
|
|
WORKDIR /build
|
|
COPY . /build
|
|
|
|
RUN chmod +x build/scripts/*.sh build/config/*.sh \
|
|
&& chmod +x hack/*.sh 2>/dev/null || true \
|
|
&& chmod +x test/qemu/*.sh test/integration/*.sh test/kernel/*.sh 2>/dev/null || true
|
|
|
|
ENTRYPOINT ["/usr/bin/make"]
|
|
CMD ["iso"]
|