feat(controller): add deis build support

Author: Gabriel Monroy

controller/api/models.py

@@ -462,7 +462,7 @@ class Meta:
     def __str__(self):
         return "{0}-v{1}".format(self.app.id, self.version)
 
-    def new(self, user, config=None, build=None, summary=None, source_version=None):
+    def new(self, user, config=None, build=None, summary=None):
         """
         Create a new application release using the provided Build and Config
         on behalf of a user.
@@ -473,24 +473,19 @@ def new(self, user, config=None, build=None, summary=None, source_version=None):
             config = self.config
         if not build:
             build = self.build
-        if not source_version:
-            source_version = 'latest'
-        else:
-            source_version = 'v{}'.format(source_version)
-        # prepare release tag
+        # construct fully-qualified target image
         new_version = self.version + 1
         tag = 'v{}'.format(new_version)
-        image = build.image + ':{tag}'.format(**locals())
+        release_image = self.app.id + ':{tag}'.format(**locals())
+        target_image = '{}:{}/{}'.format(
+            settings.REGISTRY_HOST, settings.REGISTRY_PORT, release_image)
         # create new release and auto-increment version
         release = Release.objects.create(
             owner=user, app=self.app, config=config,
-            build=build, version=new_version, image=image, summary=summary)
+            build=build, version=new_version, image=target_image, summary=summary)
         # publish release to registry as new docker image
         repository_path = self.app.id
-        publish_release(repository_path,
-                        config.values,
-                        tag,
-                        source_tag=source_version)
+        publish_release(build.image, config.values, target_image)
         return release
 
     def previous(self):
@@ -516,7 +511,9 @@ def save(self, *args, **kwargs):
             # compare this build to the previous build
             old_build = prev_release.build if prev_release else None
             # if the build changed, log it and who pushed it
-            if self.build != old_build:
+            if self.version == 1:
+                self.summary += "{} created initial release".format(self.app.owner)
+            elif self.build != old_build:
                 if self.build.sha:
                     self.summary += "{} deployed {}".format(self.build.owner, self.build.sha[:7])
                 else:

controller/api/tasks.py

@@ -71,10 +71,10 @@ def run_command(c, command):
         if rc != 0:
             raise EnvironmentError('Could not pull image: {pull_image}'.format(**locals()))
         # run the command
-        docker_args = ' '.join(['-a', 'stdout', '-a', 'stderr', '--rm', image])
-        env_args = ' '.join(["-e '{k}={v}'".format(**locals())
-                             for k, v in release.config.values.items()])
-        command = "docker run {env_args} {docker_args} {command}".format(**locals())
+        docker_args = ' '.join(['--entrypoint=/bin/bash',
+                                '-a', 'stdout', '-a', 'stderr', '--rm', image])
+        escaped_command = command.replace("'", "'\\''")
+        command = r"docker run {docker_args} -c \'{escaped_command}\'".format(**locals())
         return c.run(command)
     finally:
         c.delete()

controller/api/views.py

@@ -427,11 +427,10 @@ def rollback(self, request, *args, **kwargs):
             request.user,
             build=prev.build,
             config=prev.config,
-            summary=summary,
-            source_version=version)
+            summary=summary)
         app.deploy(new_release)
-        msg = "Rolled back to v{}".format(version)
-        return Response(msg, status=status.HTTP_201_CREATED)
+        response = {'version': new_release.version}
+        return Response(response, status=status.HTTP_201_CREATED)
 
 
 class AppContainerViewSet(OwnerViewSet):

controller/bin/boot

@@ -47,6 +47,18 @@ while grep -q '<no value>' /templates/confd_settings.py; do
        sleep $(($ETCD_TTL/2))  # sleep for half the TTL
 done
 
+# remove any pre-existing docker.sock
+test -e /var/run/docker.sock && rm -f /var/run/docker.sock
+
+# spawn a docker daemon to run builds
+docker -d --storage-driver=btrfs --bip=172.20.42.1/16 &
+DOCKER_PID=$!
+
+# wait for docker to start
+while [[ ! -e /var/run/docker.sock ]]; do
+  sleep 1
+done
+
 cd /app
 
 # run an idempotent database migration

controller/bin/entry

@@ -0,0 +1,88 @@
+#!/bin/bash
+set -e
+
+# DinD: a wrapper script which allows docker to be run inside a docker container.
+# Original version by Jerome Petazzoni <jerome@dotcloud.com>
+# See the blog post: http://blog.docker.io/2013/09/docker-can-now-run-within-docker/
+#
+# This script should be executed inside a docker container in privilieged mode
+# ('docker run --privileged', introduced in docker 0.6).
+
+# Usage: dind CMD [ARG...]
+
+# apparmor sucks and Docker needs to know that it's in a container (c) @tianon
+export container=docker
+
+# First, make sure that cgroups are mounted correctly.
+CGROUP=/cgroup
+
+mkdir -p "$CGROUP"
+
+if ! mountpoint -q "$CGROUP"; then
+	mount -n -t tmpfs -o uid=0,gid=0,mode=0755 cgroup $CGROUP || {
+		echo >&2 'Could not make a tmpfs mount. Did you use --privileged?'
+		exit 1
+	}
+fi
+
+if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
+	mount -t securityfs none /sys/kernel/security || {
+		echo >&2 'Could not mount /sys/kernel/security.'
+		echo >&2 'AppArmor detection and -privileged mode might break.'
+	}
+fi
+
+# Mount the cgroup hierarchies exactly as they are in the parent system.
+for SUBSYS in $(cut -d: -f2 /proc/1/cgroup); do
+	mkdir -p "$CGROUP/$SUBSYS"
+	if ! mountpoint -q $CGROUP/$SUBSYS; then
+		mount -n -t cgroup -o "$SUBSYS" cgroup "$CGROUP/$SUBSYS"
+	fi
+
+	# The two following sections address a bug which manifests itself
+	# by a cryptic "lxc-start: no ns_cgroup option specified" when
+	# trying to start containers withina container.
+	# The bug seems to appear when the cgroup hierarchies are not
+	# mounted on the exact same directories in the host, and in the
+	# container.
+
+	# Named, control-less cgroups are mounted with "-o name=foo"
+	# (and appear as such under /proc/<pid>/cgroup) but are usually
+	# mounted on a directory named "foo" (without the "name=" prefix).
+	# Systemd and OpenRC (and possibly others) both create such a
+	# cgroup. To avoid the aforementioned bug, we symlink "foo" to
+	# "name=foo". This shouldn't have any adverse effect.
+	name="${SUBSYS#name=}"
+	if [ "$name" != "$SUBSYS" ]; then
+		ln -s "$SUBSYS" "$CGROUP/$name"
+	fi
+
+	# Likewise, on at least one system, it has been reported that
+	# systemd would mount the CPU and CPU accounting controllers
+	# (respectively "cpu" and "cpuacct") with "-o cpuacct,cpu"
+	# but on a directory called "cpu,cpuacct" (note the inversion
+	# in the order of the groups). This tries to work around it.
+	if [ "$SUBSYS" = 'cpuacct,cpu' ]; then
+		ln -s "$SUBSYS" "$CGROUP/cpu,cpuacct"
+	fi
+done
+
+# Note: as I write those lines, the LXC userland tools cannot setup
+# a "sub-container" properly if the "devices" cgroup is not in its
+# own hierarchy. Let's detect this and issue a warning.
+if ! grep -q :devices: /proc/1/cgroup; then
+	echo >&2 'WARNING: the "devices" cgroup should be in its own hierarchy.'
+fi
+if ! grep -qw devices /proc/1/cgroup; then
+	echo >&2 'WARNING: it looks like the "devices" cgroup is not mounted.'
+fi
+
+# Mount /tmp
+#mount -t tmpfs none /tmp
+
+if [ $# -gt 0 ]; then
+	exec "$@"
+fi
+
+echo >&2 'ERROR: No command specified.'
+echo >&2 'You probably want to run hack/make.sh, or maybe a shell?'

controller/deis/settings.py

@@ -278,7 +278,9 @@
 
 # registry settings
 REGISTRY_MODULE = 'registry.mock'
-REGISTRY_URL = os.environ.get('DEIS_REGISTRY_URL', None)
+REGISTRY_URL = None
+REGISTRY_HOST = 'localhost'
+REGISTRY_PORT = 5000
 
 # check if we can register users with `deis register`
 REGISTRATION_ENABLED = True

controller/registry/docker.py

@@ -0,0 +1,55 @@
+import os.path
+import shutil
+import subprocess
+import tempfile
+
+
+def publish_release(src_image, config, target_image):
+    """
+    Publish a new release as a Docker image
+
+    Given a source image and dictionary of last-mile configuration,
+    create a target Docker image on the registry.
+
+    For example publish_release('registry.local:5000/gabrtv/myapp:<sha>',
+                                {'ENVVAR': 'values'},
+                                'registry.local:5000/gabrtv/myapp:v23',
+    results in a new Docker image at 'registry.local:5000/gabrtv/myapp:v23' which
+    contains the new configuration as ENV entries.
+    """
+    # write out dockerfile
+    dockerfile = _build_dockerfile(src_image, config)
+    tempdir = tempfile.mkdtemp()
+    dockerfile_path = os.path.join(tempdir, 'Dockerfile')
+    with open(dockerfile_path, 'w') as f:
+        f.write(dockerfile)
+    try:
+        # pull the source image to ensure we have latest
+        p = subprocess.Popen(['docker', 'pull', src_image])
+        rc = p.wait()
+        if rc != 0:
+            raise RuntimeError('Failed to pull source image')
+        # build the new image with last-mile configuration
+        p = subprocess.Popen(['docker', 'build', '-t', target_image, tempdir])
+        rc = p.wait()
+        if rc != 0:
+            raise RuntimeError('Failed to build release image')
+        # push the target image
+        p = subprocess.Popen(['docker', 'push', target_image])
+        rc = p.wait()
+        if rc != 0:
+            raise RuntimeError('Failed to push release image')
+    finally:
+        shutil.rmtree(tempdir)
+        # cleanup the temporary image
+        p = subprocess.Popen(['docker', 'rmi', '-f', target_image])
+        rc = p.wait()
+        if rc != 0:
+            print('warning: failed to delete temporary images')
+
+
+def _build_dockerfile(image, config):
+    dockerfile = ["FROM "+image]
+    for k, v in config.items():
+        dockerfile.append("ENV {} {}".format(k.upper(), v))
+    return '\n'.join(dockerfile)

controller/scheduler/fleetrun.sh

@@ -7,4 +7,4 @@ SSH_OPTIONS="-i $FLEETW_KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/d
 [[ $DEBUG ]] && set -x
 
 # run the fleetctl command remotely
-ssh $SSH_OPTIONS core@$FLEETW_HOST $@
+ssh $SSH_OPTIONS core@$FLEETW_HOST "$@"

controller/templates/confd_settings.py

@@ -3,8 +3,10 @@
 BUILDER_KEY = '{{ .deis_controller_builderKey }}'
 
 # use the private registry module
-REGISTRY_MODULE = 'registry.private'
+REGISTRY_MODULE = 'registry.docker'
 REGISTRY_URL = '{{ .deis_registry_protocol }}://{{ .deis_registry_host }}:{{ .deis_registry_port }}'  # noqa
+REGISTRY_HOST = '{{ .deis_registry_host }}'
+REGISTRY_PORT = '{{ .deis_registry_port }}'
 
 # default to sqlite3, but allow postgresql config through envvars
 DATABASES = {