public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 13:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add in OS Docs

Browse Source
This commit is contained in:
Denise Schannon
2018-04-16 11:22:27 -07:00
committed by Denise
parent 73d40c5e94
commit 79e4fb76eb
70 changed files with 3797 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/os/about/_index.md
+80
View File
@@ -0,0 +1,80 @@
---
tag: ["rancheros", "os", "faqs"]
category: "os"
layout: list-docs
title: About
weight: 300
---
## Contributing to RancherOS
---
## Developing
Development is easiest done with QEMU on Linux. OS X works too, although QEMU doesn't have KVM support. If you are running Linux in a virtual machine, then we recommend you run VMWare Fusion/Workstation and enable VT-x support. Then, QEMU will have KVM support and run sufficiently fast inside your Linux VM.
### Building
#### Requirements:
* bash
* make
* Docker 1.10.3+
```
$ make
```
The build will run in Docker containers, and when the build is done, the vmlinuz, initrd, and ISO should be in `dist/artifacts`.
If you're building a version of RancherOS used for development and not for a release, you can instead run `make dev`. This will run faster than the standard build by avoiding building the `installer.tar` and `rootfs.tar.gz` artifacts which are not needed by QEMU.
### Testing
Run `make integration-tests` to run the all integration tests in a container, or `./scripts/integration-tests` to run them outside a container (they use QEMU to test the OS.)
To run just one integration test, or a group of them (using regex's like `.*Console.*`, you can set the `RUNTEST` environment variable:
```
$ RUNTEST=TestPreload make integration-test
```
### Running
Prerequisites: QEMU, coreutils, cdrtools/genisoimage/mkisofs.
On OS X, `brew` is recommended to install those. On Linux, use your distro package manager.
To launch RancherOS in QEMU from your dev version, you can either use `make run`, or customise the vm using `./scripts/run` and its options. You can use `--append your.kernel=params here` and `--cloud-config your-cloud-config.yml` to configure the RancherOS instance you're launching.
You can SSH in using `./scripts/ssh`. Your SSH keys should have been populated (if you didn't provide your own cloud-config) so you won't need a password. If you don't have SSH keys, or something is wrong with your cloud-config, then the password is "`rancher`".
If you're on OS X, you can run RancherOS using [_xhyve_](https://github.com/mist64/xhyve) instead of QEMU: just pass `--xhyve` to `./scripts/run` and `./scripts/ssh`.
### Debugging and logging.
You can enable extra log information in the console by setting them using `sudo ros config set`,
or as kernel boot parameters.
Enable all logging by setting `rancher.debug` true
or you can set `rancher.docker.debug`, `rancher.system_docker.debug`, `rancher.bootstrap_docker.debug`, or `rancher.log` individually.
You will also be able to view the debug logging information by running `dmesg` as root.
## Repositories
All of repositories are located within our main GitHub [page](https://github.com/rancher).
[RancherOS Repo](https://github.com/rancher/os): This repo contains the bulk of the RancherOS code.
[RancherOS Services Repo](https://github.com/rancher/os-services): This repo is where any [system-services]({{page.osbaseurl}}/system-services/) can be contributed.
[RancherOS Images Repo](https://github.com/rancher/os-images): This repo is for the corresponding service images.
## Bugs
If you find any bugs or are having any trouble, please contact us by filing an [issue](https://github.com/rancher/os/issues/new).
If you have any updates to our documentation, please make any PRs to our [docs repo](https://github.com/rancher/rancher.github.io).
<br>
<br>
content/os/about/faqs/_index.md
+33
View File
@@ -0,0 +1,33 @@
---
tag: ["rancheros", "os", "faqs"]
category: "os"
layout: list-docs
title: FAQs
weight: 301
---
## Frequently Asked Questions
---
### What is required to run RancherOS?
RancherOS runs on any laptop, physical, or virtual servers.
### What are some commands?
Command | Description
--------|------------
`docker`| Good old Docker, use that to run stuff.
`system-docker` | The Docker instance running the system containers. Must run as root or using `sudo`
`ros` | Control and configure RancherOS
### How can I extend my disk size in Amazon?
Assuming your EC2 instance with RancherOS with more disk space than what's being read, run the following command to extend the disk size. This allows RancherOS to see the disk size.
```
$ docker run --privileged --rm --it debian:jessie resize2fs /dev/xvda1
```
`xvda1` should be the right disk for your own setup. In the future, we will be trying to create a system service that would automatically do this on boot in AWS.
content/os/about/running-rancher-on-rancherOS/_index.md
+104
View File
@@ -0,0 +1,104 @@
---
tag: ["rancheros", "os", "rancher"]
category: "os"
layout: list-docs
title: Running Rancher on RancherOS
weight: 302
---
## Tips on using Rancher with RancherOS
---
RancherOS can be used to launch [Rancher]({{site.baseurl}}/rancher/latest/en/) and be used as the OS to [add hosts]({{site.baseurl}}/rancher/latest/en/hosts/custom) to Rancher.
### Launching Agents using Cloud-Config
You can easily add hosts into Rancher by using [cloud-config]({{page.osbaseurl}}/configuration/#cloud-config) to launch the rancher/agent container.
After Rancher is launched and [host registration]({{site.baseurl}}/rancher/latest/en/configuration/settings/#host-registration) has been saved, you will be able to find the [custom command]({{site.baseurl}}/rancher/latest/en/hosts/custom) in the **Infrastructure** -> **Hosts** -> **Custom** page.
```bash
$ sudo docker run --d --privileged -v /var/run/docker.sock:/var/run/docker.sock \
rancher/agent:v0.8.2 http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
```
<br>
> **Note:** The `rancher/agent` version is correlated to the Rancher server version. You will need to check the custom command to get the appropriate tag for the version to use.
_Cloud-Config Example_
Here's using the command above and converting it into a cloud-config file to launch the rancher/agent in docker when RancherOS boots up.
```yaml
#cloud-config
rancher:
services:
rancher-agent1:
image: rancher/agent:v0.8.2
command: http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
privileged: true
volumes:
- /var/run/docker.sock:/var/run/docker.sock
```
<br>
> **Note:** You can not name the service `rancher-agent` as this will not allow the rancher/agent container to be launched correctly. Please read more about why [you can't name your container as `rancher-agent`]({{site.baseurl}}/rancher/latest/en/faqs/agents/#adding-in-name-rancher-agent).
### Adding in Host Labels
With each host, you have the ability to add labels to help you organize your hosts. The labels are added as an environment variable when launching the rancher/agent container. The host label in the UI will be a key/value pair and the keys must be unique identifiers. If you added two keys with different values, we'll take the last inputted value to use as the key/value pair.
By adding labels to hosts, you can use these labels when [schedule services/load balancers/services]({{site.baseurl}}/rancher/latest/en/cattle/scheduling/) and create a whitelist or blacklist of hosts for your [services]({{site.baseurl}}/rancher/latest/en/cattle/adding-services/) to run on.
When adding a custom host, you can add the labels using the UI and it will automatically add the environment variable (`CATTLE_HOST_LABELS`) with the key/value pair into the command on the UI screen.
#### Native Docker Commands Example
```bash
# Adding one host label to the rancher/agent command
$ sudo docker run -e CATTLE_HOST_LABELS='foo=bar' -d --privileged \
-v /var/run/docker.sock:/var/run/docker.sock rancher/agent:v0.8.2 \
http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
# Adding more than one host label requires joining the additional host labels with an `&`
$ sudo docker run -e CATTLE_HOST_LABELS='foo=bar&hello=world' -d --privileged \
-v /var/run/docker.sock:/var/run/docker.sock rancher/agent:v0.8.2 \
http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
```
#### Cloud-Config Example
Adding one host label
```yaml
#cloud-config
rancher:
services:
rancher-agent1:
image: rancher/agent:v0.8.2
command: http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
privileged: true
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
CATTLE_HOST_LABELS: foo=bar
```
<br>
Adding more than one host label requires joining the additional host labels with an `&`
```yaml
#cloud-config
rancher:
services:
rancher-agent1:
image: rancher/agent:v0.8.2
command: http://<rancher-server-ip>:8080/v1/projects/1a5/scripts/<registrationToken>
privileged: true
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
CATTLE_HOST_LABELS: foo=bar&hello=world
```
content/os/about/security/_index.md
+40
View File
@@ -0,0 +1,40 @@
---
tag: ["rancheros", "os", "security"]
category: "os"
layout: list-docs
title: RancherOS Security
weight: 303
---
## RancherOS Security
---
<table width="100%">
<tr style="vertical-align: top;">
<td width="30%" style="border: none;">
<h4>Security policy</h4>
<p style="padding: 8px">Rancher Labs supports responsible disclosure, and endeavours to resolve all issues in a reasonable time frame. RancherOS is a minimal Linux distribution, built with entirely using open source components.</p>
</td>
<td width="30%" style="border: none;">
<h4>Reporting process</h4>
<p style="padding: 8px">Please submit possible security issues by emailing <a href="security@rancher.com">security@rancher.com</a></p>
</td>
<td width="30%" style="border: none;">
<h4>Announcments</h4>
<p style="padding: 8px">Subscribe to the <a href="https://forums.rancher.com/c/announcements">Rancher announcements forum</a> for release updates.</p>
</td>
</tr>
</table>
### RancherOS Vulnerabilities
| ID | Description | Date | Resolution |
|----|-------------|------|------------|
| [CVE-2017-6074](http://seclists.org/oss-sec/2017/q1/471) | Local privilege-escalation using a user after free issue in [Datagram Congestion Control Protocol (DCCP)](https://wiki.linuxfoundation.org/networking/dccp). DCCP is built into the RancherOS kernel as a dynamically loaded module, and isn't loaded by default. | 17 Feb 2017 | [RancherOS v0.8.1](https://github.com/rancher/os/releases/tag/v0.8.1) using a [patched 4.9.12 Linux kernel](https://github.com/rancher/os-kernel/releases/tag/v4.9.12-rancher) |
| [CVE-2017-7184](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7184) | Allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability. | 3 April 2017 | [RancherOS v0.9.2-rc1](https://github.com/rancher/os/releases/tag/v0.9.2-rc1) using Linux 4.9.20 |
| [CVE-2017-1000364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000364) | Linux Kernel is prone to a local memory-corruption vulnerability. Attackers may be able to exploit this issue to execute arbitrary code with elevated privileges | 19 June 2017 | [RancherOS v1.0.3](https://github.com/rancher/os/releases/tag/v1.0.3) |
| [CVE-2017-1000366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000366) | glibc contains a vulnerability that allows manipulation of the heap/stack. Attackers may be able to exploit this issue to execute arbitrary code with elevated privileges | 19 June 2017 | [RancherOS v1.0.3](https://github.com/rancher/os/releases/tag/v1.0.3) |
| [CVE-2017-1000405](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000405) | The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. | 10 Dec 2017 | [RancherOS v1.1.1](https://github.com/rancher/os/releases/tag/v1.1.1) |
| [CVE-2017-5754](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754) | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. | 5 Jan 2018 | [RancherOS v1.1.3](https://github.com/rancher/os/releases/tag/v1.1.3) using Linux v4.9.75|
| [CVE-2017-5715](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715) | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis | 6 Feb 2018 | [RancherOS v1.1.4](https://github.com/rancher/os/releases/tag/v1.1.4) using Linux v4.9.78 with the Retpoline support |