2 # ============LICENSE_START=======================================================
3 # Copyright (C) 2023 Nordix Foundation.
4 # ================================================================================
5 # Licensed under the Apache License, Version 2.0 (the "License");
6 # you may not use this file except in compliance with the License.
7 # You may obtain a copy of the License at
9 # http://www.apache.org/licenses/LICENSE-2.0
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS,
13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 # See the License for the specific language governing permissions and
15 # limitations under the License.
17 # SPDX-License-Identifier: Apache-2.0
18 # ============LICENSE_END=========================================================
20 # Script copied from https://hub.docker.com/r/devopps/kind-cluster-buster
26 # This is copied from official dind script:
27 # https://raw.githubusercontent.com/docker/docker/master/hack/dind
28 if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
29 mount -t securityfs none /sys/kernel/security || {
30 echo >&2 'Could not mount /sys/kernel/security.'
31 echo >&2 'AppArmor detection and --privileged mode might break.'
35 # Mount /tmp (conditionally)
36 if ! mountpoint -q /tmp; then
37 mount -t tmpfs none /tmp
41 # Verify the filesystem.
42 if [ ! -d /sys/fs/cgroup/ ]; then
43 echo >&2 'Cgroupfs is not mounted'
47 # Determine cgroup parent for docker daemon.
48 # We need to make sure cgroups created by the docker daemon do not
49 # interfere with other cgroups on the host, and do not leak after this
50 # container is terminated.
51 if [ -f /sys/fs/cgroup/systemd/release_agent ]; then
52 # This means the user has bind mounted host /sys/fs/cgroup to the
53 # same location in the container (e.g., using the following docker
54 # run flags: `-v /sys/fs/cgroup:/sys/fs/cgroup`). In this case, we
55 # need to make sure the docker daemon in the container does not
56 # pollute the host cgroups hierarchy.
57 # Note that `release_agent` file is only created at the root of a
59 CGROUP_PARENT="$(grep systemd /proc/self/cgroup | cut -d: -f3)/docker"
61 CGROUP_PARENT="/docker"
62 # For each cgroup subsystem, Docker does a bind mount from the
63 # current cgroup to the root of the cgroup subsystem. For instance:
64 # /sys/fs/cgroup/memory/docker/<cid> -> /sys/fs/cgroup/memory
66 # This will confuse some system software that manipulate cgroups
67 # (e.g., kubelet/cadvisor, etc.) sometimes because
68 # `/proc/<pid>/cgroup` is not affected by the bind mount. The
69 # following is a workaround to recreate the original cgroup
70 # environment by doing another bind mount for each subsystem.
71 CURRENT_CGROUP=$(grep systemd /proc/self/cgroup | cut -d: -f3)
72 CGROUP_SUBSYSTEMS=$(findmnt -lun -o source,target -t cgroup | grep "${CURRENT_CGROUP}" | awk '{print $2}')
74 echo "${CGROUP_SUBSYSTEMS}" |
75 while IFS= read -r SUBSYSTEM; do
76 mkdir -p "${SUBSYSTEM}${CURRENT_CGROUP}"
77 mount --bind "${SUBSYSTEM}" "${SUBSYSTEM}${CURRENT_CGROUP}"
82 --cgroup-parent="${CGROUP_PARENT}" \
83 --bip="${DOCKERD_BIP:-172.17.1.1/24}" \
84 --mtu="${DOCKERD_MTU:-1400}" \
86 ${DOCKER_ARGS:-} >/var/log/docker/dockerd.log 2>&1 &
88 # Wait until dockerd is ready.
89 until docker ps >/dev/null 2>&1
91 echo "Waiting for dockerd..."