* Remove Supervisor lockfile cleanup SIGTERM listener
* Modify lockfile.getLocksTaken to read files from the filesystem
* Remove in-memory tracking of locks taken in favor of filesystem
* Require both `(resin-)updates.lock` to be locked with `nobody` UID
for service to count as locked by the Supervisor
Signed-off-by: Christina Ying Wang <christina@balena.io>
Rsync (v2) deltas have been broken since [Supervisor v14](460c3ba0aa). While considered legacy,
they are still used by a few customers with devices running OS < 2.47.1.
This should fix v2 delta support for those devices until we can
completely remove rsync deltas from the supervisor
Change-type: patch
As the Supervisor is a privileged container, it has access to host /dev, and therefore has access
to boot, data, and state balenaOS partitions. This commit sets up the framework for the following:
- Finds the /dev partition that corresponds to each partition based on partition label
- Mounts the partitions into set mountpoints in the device
- Removes reliance on env vars and mountpoints provided by host's start-balena-supervisor script
- Simplifies host path querying by centralizing these queries through methods in lib/host-utils.ts
This particular changes env vars for and mounts the boot partition.
Since the Supervisor would no longer rely on container `run` arguments provided by a host script,
this change moves Supervisor closer to being able to start itself (Supervisor-as-an-app).
Change-type: minor
Signed-off-by: Christina Ying Wang <christina@balena.io>
v14.4.5 introduced a new way to retrieve the host logs by symlinking the
log directories into the host /run/log/journal and using a local copy of
the journalctl binary instead of chrooting into the host. This failed to
account for the location of persistent logs when that option is turned
on (/var/log/journal instead of /run/log/journal). This fixes the checks
consider this case and also makes sure to remove the original symlink to
avoid having nested links `/run/log/journal/journal/journal`, which was a
bug in the previous implementation.
Change-type: patch
The supervisor had to chroot into the host root in order to read the
journal logs. This won't be possible anymore once the supervisor becomes
an app. This commit copies the journalctl binary and necessary libraries
from a debian image into the supervisor image in order to be able to use
the tool on runtime.
Change-type: patch
This allows to test that the supervisor build actually runs and opens up the
possibility of running more exhaustive API tests against a working supervisor.
Change-type: patch
The linked issue describes the Supervisor not cleaning up locks it creates due
to crashing at just the wrong time. After internal discussion we decided to
differentiate Supervisor-created lockfiles from user-created lockfiles by using
the `nobody` UID (65534) for Supervisor-created lockfiles.
As the existing NPM lockfile lib does not allow creating lockfiles atomically
with different UIDs, we move to using the lockfile binary, which is part of the
procmail package. To allow nonroot users to write to lock directories, permissions
are changed to allow write access by nonroot users.
See: https://www.flowdock.com/app/rulemotion/r-resinos/threads/gWMgK5hmR26TzWGHux62NpgJtVl
Change-type: minor
Closes: #1758
Signed-off-by: Christina Wang <christina@balena.io>
Due to switching to Alpine the ability to resolve mDNS
hostnames was lost. This patch overrides the lookup and
manually resolves the names.
Change-type: patch
Signed-off-by: Rich Bayliss <rich@balena.io>
We move the old sync.js script to tools/, and delete the now-broken
sync-debug.js.
We add a command `npm run sync`, which starts a livepush process
with the supervisor on a device.
Change-type: minor
Signed-off-by: Cameron Diver <cameron@balena.io>
We also remove the Makefile to go to a simpler build system, as long with
the retry_docker_push.sh file. We remove the rest of the automation tools
as they're no longer used and update the circle.yml file.
We also remove debug builds, as these aren't needed moving forward, and were
only to enable livepush builds.
Change-type: major
Signed-off-by: Cameron Diver <cameron@balena.io>
Removes default 'example' service definitions that
are included by Avahi 0.7+. These conflict with
our balenaOS advertised services, causing potential
issues.
Connects-to: #957
Change-type: patch
Signed-off-by: Heds Simons <heds@balena.io>
If the kernel was built with support for ip6tables, there's no need to load the module. This is the case when running
balenaOS in a container in Mac OS, which also can't do modprobes easily.
Change-type: patch
Signed-off-by: Pablo Carranza Velez <pablo@balena.io>
The introduction of these flags correlates with OOM issues on the
supervisor. More investigation is needed into these features
before adding them back into production.
Change-type: patch
Signed-off-by: Cameron Diver <cameron@balena.io>
We change the lockfile to /tmp/balena/updates.lock, and the resin-kill-me file to /tmp/balena/handover-complete.
In the host, we change to use /tmp/balena-supervisor instead of /tmp/resin-supervisor.
We add BALENA_ env vars in addition to the RESIN_ env vars.
We keep backwards compatibility by using both paths for the lockfile and handover, and keeping the RESIN_ env vars.
Changelog-entry: Move the handover and lock files to /tmp/balena, rename them, and add BALENA_ env vars
Change-type: minor
Signed-off-by: Pablo Carranza Velez <pablo@resin.io>
This requires the initialisation of both DBus and
Avahi in the `entry.sh` script to allow resolution
via libc.
Due to issues with Avahi's `init.d` script, the previous
PIDfile is explicitly removed.
Connects-to: #712
Change-type: minor
Signed-off-by: Heds Simons <heds@resin.io>
Fixes issues on systems where mount files if the target doesn't exist (seems to happen on
boards that run docker on overlayfs).
Change-Type: patch
Signed-off-by: Pablo Carranza Velez <pablo@resin.io>
The lock is now located at `/tmp/resin-supervisor/<appId>/` on the host, and `/tmp/resin/`
on the user container. The old lock location is supported only in Resin OS 1.X (and both locks are
taken in that case).
This fixes the race condition when the app is started before the supervisor, and takes a lock that is
cleared on supervisor startup.
Change-Type: major
Signed-off-by: Pablo Carranza Velez <pablo@resin.io>
busybox's init uses /etc/inittab for configuration just like sysvinit,
however it doesn't use any runlevels.
the tty part of inittab is appended to "/dev/", and it becomes connected
to the stdout of the spawned process
Signed-off-by: Petros Angelatos <petrosagg@gmail.com>
docker-delta uses the docker API to query the docker root location.
However, docker returns the path in the host, not the path that it
happens to be bind mounted in the supervisor container. So in order for
the deltas to work properly, these paths must be the same.
Signed-off-by: Petros Angelatos <petrosagg@gmail.com>
* More work on the integration test
* Correctly get supervisor IP
* Use Fatal for test errors
* test-integration working separate from run-supervisor
* Use jenkins' JOB_NAME to identify and remove containers with their volumes
* Document testing procedure
* Document the assume-unchanged tip
* Use /mnt/root for data path
* Nicer secret assignment
* Restart app when purging
* Use log.Fatal to exit with status 1
* Quotes in entry.sh
* Use JSON for request body
* Handle errors for parseJsonBody
* Better error printing in main
* First attempt at testing nodesuper from Go
* Cleaner build
* Use ARCH to differentiate concurrent tests/builds
* Use --rm to autoremove containers
