oci: T9269: mask systemd services for container startup

Adjust systemd units for containerized operation - this is what the containerlab
documentation asks users to do in their Dockerfile, but as we ship a ready made
rootfs there is no build stage where "systemctl" could be run.

Masking and disabling is nothing but symlink handling below /etc/systemd, so we
can do it offline (and cross-architecture) right here.

1 files changed, 23 insertions, 0 deletions

diff --git a/scripts/iso-to-oci b/scripts/iso-to-oci
index 86dd8687..2505d3fd 100755
--- a/scripts/iso-to-oci
+++ b/scripts/iso-to-oci
@@ -69,6 +69,29 @@ sed -i 's/^LANG=.*$/LANG=C.UTF-8/' "${UNSQUASHFS}/etc/default/locale"
 printf 'Welcome to VyOS - \\n \\l\n\n' > "${UNSQUASHFS}/etc/issue"
 : > "${UNSQUASHFS}/etc/issue.net"
 
+# adjust systemd units for containerized operation - this is what the
+# containerlab documentation asks users to do in their Dockerfile, but as we
+# ship a ready made rootfs there is no build stage where "systemctl" could be
+# run. Masking and disabling is nothing but symlink handling below /etc/systemd,
+# so we can do it offline (and cross-architecture) right here.
+#
+# masked units: getty(8) would fight with the container console, auditd(8) has
+# no business inside a container as it requires the audit netlink socket and
+# atopacctd(8) enables BSD process accounting via acct(2) which is global to
+# the kernel and not namespaced - the first container to start it wins, every
+# other one fails and turns "systemctl is-system-running" into "degraded",
+# which is exactly what the containerlab healthcheck looks at
+for unit in getty.target auditd.service atopacct.service; do
+    ln -sf /dev/null "${UNSQUASHFS}/etc/systemd/system/${unit}"
+done
+
+# disabled units: kea-dhcp-ddns-server(8) is started via a "WantedBy" symlink
+# and would fail on boot, VyOS enables it on demand from the CLI
+for unit in kea-dhcp-ddns-server.service; do
+    find "${UNSQUASHFS}/etc/systemd/system" -name "${unit}" \
+        \( -path '*.wants/*' -o -path '*.requires/*' \) -delete
+done
+
 # optional step: Decrease docker image size by deleting not necessary files for container
 rm -rf "${UNSQUASHFS}/boot"
 rm -rf "${UNSQUASHFS}/lib/firmware/"