From 61eb829715b5da462ddd680c0410a069bc5c039f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Thu, 3 Sep 2026 22:23:32 +0200 Subject: oci: T9269: mask systemd services for container startup Adjust systemd units for containerized operation - this is what the containerlab documentation asks users to do in their Dockerfile, but as we ship a ready made rootfs there is no build stage where "systemctl" could be run. Masking and disabling is nothing but symlink handling below /etc/systemd, so we can do it offline (and cross-architecture) right here. --- scripts/iso-to-oci | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'scripts') diff --git a/scripts/iso-to-oci b/scripts/iso-to-oci index 86dd8687..2505d3fd 100755 --- a/scripts/iso-to-oci +++ b/scripts/iso-to-oci @@ -69,6 +69,29 @@ sed -i 's/^LANG=.*$/LANG=C.UTF-8/' "${UNSQUASHFS}/etc/default/locale" printf 'Welcome to VyOS - \\n \\l\n\n' > "${UNSQUASHFS}/etc/issue" : > "${UNSQUASHFS}/etc/issue.net" +# adjust systemd units for containerized operation - this is what the +# containerlab documentation asks users to do in their Dockerfile, but as we +# ship a ready made rootfs there is no build stage where "systemctl" could be +# run. Masking and disabling is nothing but symlink handling below /etc/systemd, +# so we can do it offline (and cross-architecture) right here. +# +# masked units: getty(8) would fight with the container console, auditd(8) has +# no business inside a container as it requires the audit netlink socket and +# atopacctd(8) enables BSD process accounting via acct(2) which is global to +# the kernel and not namespaced - the first container to start it wins, every +# other one fails and turns "systemctl is-system-running" into "degraded", +# which is exactly what the containerlab healthcheck looks at +for unit in getty.target auditd.service atopacct.service; do + ln -sf /dev/null "${UNSQUASHFS}/etc/systemd/system/${unit}" +done + +# disabled units: kea-dhcp-ddns-server(8) is started via a "WantedBy" symlink +# and would fail on boot, VyOS enables it on demand from the CLI +for unit in kea-dhcp-ddns-server.service; do + find "${UNSQUASHFS}/etc/systemd/system" -name "${unit}" \ + \( -path '*.wants/*' -o -path '*.requires/*' \) -delete +done + # optional step: Decrease docker image size by deleting not necessary files for container rm -rf "${UNSQUASHFS}/boot" rm -rf "${UNSQUASHFS}/lib/firmware/" -- cgit v1.2.3