Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Docker rootless #451

Merged
merged 18 commits into from
Aug 27, 2024
Merged

Conversation

jakeiotechsys
Copy link
Contributor

@jakeiotechsys jakeiotechsys commented Aug 13, 2024

Closes #452

Feat: Run Edgex in a rootless docker environment for added security

PR Checklist

Please check if your PR fulfills the following requirements:

  • I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
  • I have fully tested (add details below) this the new feature or bug fix (if not, why?)
  • I have opened a PR for the related docs change (if not, why?)
    Docs updates are to come soon

Testing Instructions

Test on ubuntu linux with both a rootless docker environment, and a rootful docker environment. Start edgex using make run, and start portainer with make portainer from within the compose-builder folder.

Get the auth token

token=$(make get-token)

Ping Core-Data for Connection Testing

curl -k -H "Authorization: Bearer $token" https://localhost:8443/core-data/api/v3/ping

Get Event Values for Virtual Device

curl -H "Authorization: Bearer $token" http://localhost:59880/api/v3/event/device/name/Random-Integer-Device

Check Core Command for Available Commands

curl -H "Authorization: Bearer $token" http://localhost:59882/api/v3/device/name/Random-Integer-Device

Get Current Value for Int16 Device

curl -H "Authorization: Bearer $token" http://localhost:59882/api/v3/device/name/Random-Integer-Device/Int16

Set the Value of WriteInt16

curl -H "Authorization: Bearer $token" -X PUT -d '{"Int16":"42", "EnableRandomization_Int16":"false"}' http://localhost:59882/api/v3/device/name/Random-Integer-Device/WriteInt16Value

Verify the Updated Value of Int16

curl -H "Authorization: Bearer $token" http://localhost:59882/api/v3/device/name/Random-Integer-Device/Int16

Run Modbus Simulator Container using edge-central docs

docker run --rm -d -e RUN_MODE=RTU -p 50103:50103 --name modbus-sim iotechsys/modbus-sim:1.0

Map TCP to TTY Port File

sudo socat -dd pty,link=/dev/virtualport,raw,echo=0,mode=666 tcp:localhost:50103

Upload Device Profile

curl -H "Authorization: Bearer $token" http://localhost:59881/api/v3/deviceprofile/uploadfile -F "file=@/home/vagrant/edgex-compose/compose-builder/modbus.rtu.demo.profile.yml"

Create Device Entity

curl http://localhost:59881/api/v3/device -H "Authorization: Bearer $token" -H "Content-Type:application/json" -X POST   -d '[
        {
          "apiVersion": "v3",
          "device": {
            "name": "Power-Submeter-Device",
            "description":"Power Submeter device",
            "labels":[
              "power submeter",
              "modbus rtu"
            ],
            "adminState": "UNLOCKED",
            "operatingState": "UP",
            "protocols": {
              "modbus-rtu": {
                "Address": "/dev/virtualport",
                "BaudRate": 19200,
                "DataBits": 8,
                "Parity": "N",
                "StopBits": 1,
                "UnitID": 1,
                "Timeout" : "5",
                "IdleTimeout" : "5"
              }
            },
            "serviceName": "device-modbus",
            "properties": {
              "IOTech_ProtocolName": "modbus-rtu"
            },
            "profileName": "Network-Power-Meter"
          }
        }
      ]'

Test Modbus Device

curl -H "Authorization: Bearer $token" http://localhost:59882/api/v3/device/name/Power-Submeter-Device/Configuration

Navigate to portainer

Using a web browser, go to localhosty:9000 and log in with default portainer credentials

Copy link
Contributor

@cherrycl cherrycl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please execute the make build after updating yml files under compose-builder to make sure all docker-compose files are updated for this change.

Also make sure every commit and the PR title is semantic.

compose-builder/add-security.yml Outdated Show resolved Hide resolved
@cherrycl
Copy link
Contributor

Please execute the make build after updating yml files under compose-builder to make sure all docker-compose files are updated for this change.

Also make sure every commit and the PR title is semantic.

@jakeiotechsys Are you working on this comment? Please also squash the commits.

@jakeiotechsys jakeiotechsys changed the title Docker rootless2 feat: Docker rootless Aug 15, 2024
@cloudxxx8
Copy link
Member

recheck

docker-compose-arm64.yml Outdated Show resolved Hide resolved
@weichou1229
Copy link
Member

recheck

jakeiotechsys and others added 18 commits August 27, 2024 11:08
Modified vault compose entries to disable memory locking feature of vault. This lets us run vault in a rootless docker environment

Signed-off-by: jakeiotechsys <[email protected]>
Added user ID resolver in Makefile and docker sock mounts for portainer and security-spire-config container

Signed-off-by: jakeiotechsys <[email protected]>
added user ID resolver in Makefile

Signed-off-by: jakeiotechsys <[email protected]>
Added test for docker rootless mode in makefiles

Signed-off-by: jakeiotechsys <[email protected]>
Fixed up left over lines

Signed-off-by: jakeiotechsys <[email protected]>
Updated readme files

Signed-off-by: jakeiotechsys <[email protected]>
made makefile resolve docker environment

Signed-off-by: jakeiotechsys <[email protected]>
Updated compose files for root dir

Signed-off-by: jakeiotechsys <[email protected]>
added total system memory resolver to Makefile

Signed-off-by: jakeiotechsys <[email protected]>
added generated files

Signed-off-by: jakeiotechsys <[email protected]>
Removed debug

Signed-off-by: jakeiotechsys <[email protected]>
Fixed vault storage backend issue causing vault not to boot

Signed-off-by: jakeiotechsys <[email protected]>
Commiting generated files

Signed-off-by: jakeiotechsys <[email protected]>
Fixed makefile delayed-start gen syntax issues

Signed-off-by: jakeiotechsys <[email protected]>
change yaml multi line Indicator

Signed-off-by: weichou1229 <[email protected]>
Removed multiline formatting

Signed-off-by: jakeiotechsys <[email protected]>
add default vault config

Signed-off-by: weichou1229 <[email protected]>
Copy link
Member

@cloudxxx8 cloudxxx8 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cloudxxx8 cloudxxx8 merged commit b8b33b4 into edgexfoundry:main Aug 27, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add support for rootless docker environment
4 participants