Name: linuxkit
Owner: LinuxKit
Description: A toolkit for building secure, portable and lean operating systems for containers
Created: 2015-11-26 14:48:52.0
Updated: 2018-01-19 22:38:53.0
Pushed: 2018-01-19 16:21:37.0
Size: 25576
Language: Go
GitHub Committers
User | Most Recent Commit | # Commits |
---|
Other Committers
User | Most Recent Commit | # Commits |
---|
Security Update 17/01/2018: All current LinuxKit x86_64
kernels
have KPTI/KAISER enabled by default. This protects against
Meltdown. Defences against
Spectre are work in progress
upstream and some have been incorporated into 4.14.14/4.9.77 onwards
but work is still ongoing. The kernels 4.14.14/4.9.77 onwards also
include various eBPF and KVM fixes to mitigate some aspects of
Spectre. The arm64
kernels are not yet fixed. See Greg KH's excellent blogpost and
this LWN.net article for
details.
If you run LinuxKit kernels on x86 baremetal we also strongly
recommend to add ucode: intel-ucode.cpio
to the kernel section of
your YAML if you are using Intel CPUs and linuxkit/firmware:<hash>
if
you are using AMD CPUs.
LinuxKit, a toolkit for building custom minimal, immutable Linux distributions.
projects/kubernetes
in this repository).linuxkit
toolLinuxKit uses the linuxkit
tool for building, pushing and running VM images.
Simple build instructions: use make
to build. This will build the tool in bin/
. Add this
to your PATH
or copy it to somewhere in your PATH
eg sudo cp bin/* /usr/local/bin/
. Or you can use sudo make install
.
If you already have go
installed you can use go get -u github.com/linuxkit/linuxkit/src/cmd/linuxkit
to install the linuxkit
tool.
On MacOS there is a brew tap
available. Detailed instructions are at linuxkit/homebrew-linuxkit,
the short summary is
tap linuxkit/linuxkit
install --HEAD linuxkit
Build requirements from source:
make
qemu
Once you have built the tool, use
xkit build linuxkit.yml
to build the example configuration. You can also specify different output formats, eg linuxkit build -format raw-bios linuxkit.yml
to
output a raw BIOS bootable disk image, or linuxkit build -format iso-efi linuxkit.yml
to output an EFI bootable ISO image. See linuxkit build -help
for more information.
Since linuxkit build
is built around the Moby tool the input yml files are described in the Moby tool documentation.
You can use linuxkit run <name>
or linuxkit run <name>.<format>
to execute the image you created with linuxkit build <name>.yml
.
This will use a suitable backend for your platform or you can choose one, for example VMWare.
See linuxkit run --help
.
Currently supported platforms are:
The test suite uses rtf
To
install this you should use make bin/rtf && make install
. You will
also need to install expect
on your system as some tests use it.
To run the test suite:
est
-x run
This will run the tests and put the results in a the _results
directory!
Run control is handled using labels and with pattern matching. To run add a label you may use:
-x -l slow run
To run tests that match the pattern linuxkit.examples
you would use the following command:
-x run linuxkit.examples
To customise, copy or modify the linuxkit.yml
to your own file.yml
or use one of the examples and then run linuxkit build file.yml
to
generate its specified output. You can run the output with linuxkit run file
.
The yaml file specifies a kernel and base init system, a set of containers that are built into the generated image and started at boot time. You can specify the type
of artifact to build with the moby
tool eg linuxkit build -format vhd linuxkit.yml
.
If you want to build your own packages, see this document.
The yaml format specifies the image to be built:
kernel
specifies a kernel Docker image, containing a kernel and a filesystem tarball, eg containing modules. The example kernels are built from kernel/
init
is the base init
process Docker image, which is unpacked as the base system, containing init
, containerd
, runc
and a few tools. Built from pkg/init/
onboot
are the system containers, executed sequentially in order. They should terminate quickly when done.services
is the system services, which normally run for the whole time the system is upfiles
are additional files to add to the imageFor a more detailed overview of the options see yaml documentation
There is an overview of the architecture covering how the system works.
There is an overview of the security considerations and direction covering the security design of the system.
This project was extensively reworked from the code we are shipping in Docker Editions, and the result is not yet production quality. The plan is to return to production quality during Q3 2017, and rebase the Docker Editions on this open source project during this quarter. We plan to start making stable releases on this timescale.
This is an open project without fixed judgements, open to the community to set the direction. The guiding principles are:
There are weekly development reports summarizing work carried out in the week.
See FAQ.
Released under the Apache 2.0 license.