You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

283 lines
8.0 KiB

  1. #!/bin/sh /etc/rc.common
  2. USE_PROCD=1
  3. START=99
  4. extra_command "uciadd" "<interface> <device> <zone> Add docker bridge configuration to network and firewall uci config"
  5. extra_command "ucidel" "<interface> <device> <zone> Delete docker bridge configuration from network and firewall uci config"
  6. DOCKER_CONF_DIR="/tmp/dockerd"
  7. DOCKERD_CONF="${DOCKER_CONF_DIR}/daemon.json"
  8. uci_quiet() {
  9. uci -q "${@}" >/dev/null
  10. }
  11. json_add_array_string() {
  12. json_add_string "" "${1}"
  13. }
  14. find_network_device() {
  15. local device="${1}"
  16. local device_section=""
  17. check_device() {
  18. local cfg="${1}"
  19. local device="${2}"
  20. local type name
  21. config_get type "${cfg}" type
  22. config_get name "${cfg}" name
  23. [ "${type}" = "bridge" ] && [ "${name}" = "${device}" ] \
  24. && device_section="${cfg}"
  25. }
  26. config_load network
  27. config_foreach check_device device "${device}"
  28. echo "${device_section}"
  29. }
  30. boot() {
  31. uciadd
  32. rc_procd start_service
  33. }
  34. uciadd() {
  35. local iface="${1}"
  36. local device="${2}"
  37. local zone="${3}"
  38. [ -z "${iface}" ] && {
  39. iface="docker"
  40. device="docker0"
  41. zone="docker"
  42. }
  43. /etc/init.d/dockerd running && {
  44. echo "Please stop dockerd service first"
  45. exit 0
  46. }
  47. # Add network interface
  48. if ! uci_quiet get network.${iface}; then
  49. logger -t "dockerd-init" -p notice "Adding interface '${iface}' to network config"
  50. uci_quiet add network interface
  51. uci_quiet rename network.@interface[-1]="${iface}"
  52. uci_quiet set network.@interface[-1].device="${device}"
  53. uci_quiet set network.@interface[-1].proto="none"
  54. uci_quiet set network.@interface[-1].auto="0"
  55. uci_quiet commit network
  56. fi
  57. # Add docker bridge device
  58. if [ "$(find_network_device "$device")" = "" ]; then
  59. logger -t "dockerd-init" -p notice "Adding bridge device '${device}' to network config"
  60. uci_quiet add network device
  61. uci_quiet set network.@device[-1].type="bridge"
  62. uci_quiet set network.@device[-1].name="${device}"
  63. uci_quiet commit network
  64. else
  65. logger -t "dockerd-init" -p notice "Bridge device '${device}' already defined in network config"
  66. fi
  67. # Add firewall zone
  68. if ! uci_quiet get firewall.${zone}; then
  69. logger -t "dockerd-init" -p notice "Adding firewall zone '${zone}' to firewall config"
  70. uci_quiet add firewall zone
  71. uci_quiet rename firewall.@zone[-1]="${zone}"
  72. uci_quiet set firewall.@zone[-1].input="ACCEPT"
  73. uci_quiet set firewall.@zone[-1].output="ACCEPT"
  74. uci_quiet set firewall.@zone[-1].forward="ACCEPT"
  75. uci_quiet set firewall.@zone[-1].name="${zone}"
  76. uci_quiet commit firewall
  77. fi
  78. # Add interface to firewall zone
  79. if uci_quiet get firewall.${zone}; then
  80. uci_quiet del_list firewall.${zone}.network="${iface}"
  81. uci_quiet add_list firewall.${zone}.network="${iface}"
  82. uci_quiet commit firewall
  83. fi
  84. reload_config
  85. }
  86. ucidel() {
  87. local iface="${1}"
  88. local device="${2}"
  89. local zone="${3}"
  90. [ -z "${iface}" ] && {
  91. iface="docker"
  92. device="docker0"
  93. zone="docker"
  94. }
  95. /etc/init.d/dockerd running && {
  96. echo "Please stop dockerd service first"
  97. exit 0
  98. }
  99. # Remove network device
  100. if uci_quiet delete network.$(find_network_device "${device}"); then
  101. logger -t "dockerd-init" -p notice "Deleting bridge device '${device}' from network config"
  102. uci_quiet commit network
  103. fi
  104. # Remove network interface
  105. if uci_quiet get network.${iface}; then
  106. logger -t "dockerd-init" -p notice "Deleting interface '${iface}' from network config"
  107. uci_quiet delete network.${iface}
  108. uci_quiet commit network
  109. fi
  110. # Remove interface from firewall zone
  111. if uci_quiet get firewall.${zone}; then
  112. logger -t "dockerd-init" -p notice "Deleting network interface '${iface}' in zone '${zone}' from firewall config"
  113. uci_quiet del_list firewall.${zone}.network="${iface}"
  114. uci_quiet commit firewall
  115. # Remove Firewall zone if network is empty
  116. if ! uci_quiet get firewall.${zone}.network; then
  117. logger -t "dockerd-init" -p notice "Deleting firewall zone '${zone}' from firewall config"
  118. uci_quiet delete firewall.${zone}
  119. fi
  120. uci_quiet commit firewall
  121. fi
  122. reload_config
  123. }
  124. process_config() {
  125. local alt_config_file data_root log_level iptables bip
  126. [ -f /etc/config/dockerd ] || {
  127. # Use the daemon default configuration
  128. DOCKERD_CONF=""
  129. return 0
  130. }
  131. # reset configuration
  132. rm -fr "${DOCKER_CONF_DIR}"
  133. mkdir -p "${DOCKER_CONF_DIR}"
  134. config_load 'dockerd'
  135. config_get alt_config_file globals alt_config_file
  136. [ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && {
  137. ln -s "${alt_config_file}" "${DOCKERD_CONF}"
  138. return 0
  139. }
  140. config_get data_root globals data_root "/opt/docker/"
  141. config_get log_level globals log_level "warn"
  142. config_get_bool iptables globals iptables "1"
  143. # Don't add these options by default
  144. # omission == docker defaults
  145. config_get bip globals bip ""
  146. config_get registry_mirrors globals registry_mirrors ""
  147. config_get hosts globals hosts ""
  148. config_get dns globals dns ""
  149. config_get_bool ipv6 globals ipv6 ""
  150. config_get ip globals ip ""
  151. config_get fixed_cidr globals fixed_cidr ""
  152. config_get fixed_cidr_v6 globals fixed_cidr_v6 ""
  153. . /usr/share/libubox/jshn.sh
  154. json_init
  155. json_add_string "data-root" "${data_root}"
  156. json_add_string "log-level" "${log_level}"
  157. json_add_boolean "iptables" "${iptables}"
  158. [ -z "${bip}" ] || json_add_string "bip" "${bip}"
  159. [ -z "${registry_mirrors}" ] || json_add_array "registry-mirrors"
  160. [ -z "${registry_mirrors}" ] || config_list_foreach globals registry_mirrors json_add_array_string
  161. [ -z "${registry_mirrors}" ] || json_close_array
  162. [ -z "${hosts}" ] || json_add_array "hosts"
  163. [ -z "${hosts}" ] || config_list_foreach globals hosts json_add_array_string
  164. [ -z "${hosts}" ] || json_close_array
  165. [ -z "${dns}" ] || json_add_array "dns"
  166. [ -z "${dns}" ] || config_list_foreach globals dns json_add_array_string
  167. [ -z "${dns}" ] || json_close_array
  168. [ -z "${ipv6}" ] || json_add_boolean "ipv6" "${ipv6}"
  169. [ -z "${ip}" ] || json_add_string "ip" "${ip}"
  170. [ -z "${fixed_cidr}" ] || json_add_string "fixed-cidr" "${fixed_cidr}"
  171. [ -z "${fixed_cidr_v6}" ] || json_add_string "fixed-cidr-v6" "${fixed_cidr_v6}"
  172. json_dump > "${DOCKERD_CONF}"
  173. [ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall
  174. }
  175. start_service() {
  176. local nofile=$(cat /proc/sys/fs/nr_open)
  177. process_config
  178. procd_open_instance
  179. procd_set_param stderr 1
  180. if [ -z "${DOCKERD_CONF}" ]; then
  181. procd_set_param command /usr/bin/dockerd
  182. else
  183. procd_set_param command /usr/bin/dockerd --config-file="${DOCKERD_CONF}"
  184. fi
  185. procd_set_param limits nofile="${nofile} ${nofile}"
  186. procd_close_instance
  187. }
  188. reload_service() {
  189. process_config
  190. procd_send_signal dockerd
  191. }
  192. service_triggers() {
  193. procd_add_reload_trigger 'dockerd'
  194. }
  195. iptables_add_blocking_rule() {
  196. local cfg="${1}"
  197. local device=""
  198. local extra_iptables_args=""
  199. handle_iptables_rule() {
  200. local interface="${1}"
  201. local outbound="${2}"
  202. local extra_iptables_args="${3}"
  203. local inbound=""
  204. . /lib/functions/network.sh
  205. network_get_physdev inbound "${interface}"
  206. [ -z "${inbound}" ] && {
  207. logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}"
  208. return
  209. }
  210. # Wait for a maximum of 10 second per command, retrying every millisecond
  211. local iptables_wait_args="--wait 10 --wait-interval 1000"
  212. # Ignore errors as it might already be present
  213. iptables ${iptables_wait_args} --table filter --new DOCKER-USER 2>/dev/null
  214. if ! iptables ${iptables_wait_args} --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then
  215. logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
  216. iptables ${iptables_wait_args} --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT
  217. fi
  218. }
  219. config_get device "${cfg}" device
  220. [ -z "${device}" ] && {
  221. logger -t "dockerd-init" -p notice "No device configured for ${cfg}"
  222. return
  223. }
  224. config_get extra_iptables_args "${cfg}" extra_iptables_args
  225. config_list_foreach "${cfg}" blocked_interfaces handle_iptables_rule "${device}" "${extra_iptables_args}"
  226. }
  227. stop_service() {
  228. if /etc/init.d/dockerd running; then
  229. service_stop "/usr/bin/dockerd"
  230. fi
  231. }