hook.template.yaml

# Attention, this is a template that is run through envsubst, but with a specific list of variables to replace. Thus:
# - HOOK_VERSION: ${HOOK_VERSION} (a simple 1.2.3 string, no 'v')
# - HOOK_KERNEL_IMAGE: ${HOOK_KERNEL_IMAGE}
# - HOOK_KERNEL_ID: ${HOOK_KERNEL_ID}
# - HOOK_KERNEL_VERSION: ${HOOK_KERNEL_VERSION}
# - HOOK_CONTAINER_BOOTKIT_IMAGE: ${HOOK_CONTAINER_BOOTKIT_IMAGE}
# - HOOK_CONTAINER_DOCKER_IMAGE: ${HOOK_CONTAINER_DOCKER_IMAGE}
# - HOOK_CONTAINER_MDEV_IMAGE: ${HOOK_CONTAINER_MDEV_IMAGE}
# - HOOK_CONTAINER_CONTAINERD_IMAGE: ${HOOK_CONTAINER_CONTAINERD_IMAGE}
# - HOOK_CONTAINER_RUNC_IMAGE: ${HOOK_CONTAINER_RUNC_IMAGE}
# - Other variables are not replaced: for example this is a literal dollarsign-SOMETHING: $SOMETHING and with braces: ${SOMETHING}

kernel:
  image: "${HOOK_KERNEL_IMAGE}"
  cmdline: "this_is_not_used=at_at_all_in_hook command_line_is_determined_by=ipxe"

init:
  # this sha is the first with cgroups v2 as the default
  - linuxkit/init:8a7b6cdb89197dc94eb6db69ef9dc90b750db598
  - "${HOOK_CONTAINER_RUNC_IMAGE}"
  - "${HOOK_CONTAINER_CONTAINERD_IMAGE}"
  - linuxkit/ca-certificates:v1.0.0
  - linuxkit/firmware:24402a25359c7bc290f7fc3cd23b6b5f0feb32a5 # "Some" firmware from Linuxkit pkg; see https://github.com/linuxkit/linuxkit/blob/master/pkg/firmware/Dockerfile

onboot:
  - name: rngd1
    image: linuxkit/rngd:v1.0.0
    command: [ "/sbin/rngd", "-1" ]

  - name: sysctl
    image: linuxkit/sysctl:v1.0.0

  - name: sysfs
    image: linuxkit/sysfs:v1.0.0

  - name: modprobe
    image: linuxkit/modprobe:v1.0.0
    command: [ "modprobe", "cdc_ncm" ] # for usb ethernet dongles

  - name: vlan
    image: linuxkit/ip:v1.0.0
    capabilities:
      - all
    binds.add:
      - /etc/ip/vlan.sh:/etc/ip/vlan.sh
    command: [ "/etc/ip/vlan.sh" ]

  - name: dhcpcd-once
    image: linuxkit/dhcpcd:v1.0.0
    command: [ "/etc/ip/dhcp.sh", "true" ] # 2nd paramter is one-shot true/false: true for onboot, false for services
    #capabilities.add:
    #  - CAP_SYS_TIME # for ntp one-shot no-max-offset after ntpd, for hardware missing RTC's that boot in 1970
    capabilities:
      - all
    binds.add:
      - /var/lib/dhcpcd:/var/lib/dhcpcd
      - /run:/run
      - /etc/ip/dhcp.sh:/etc/ip/dhcp.sh
      - /dhcpcd.conf:/dhcpcd.conf
    runtime:
      mkdir:
        - /var/lib/dhcpcd

services:
  - name: rngd
    image: linuxkit/rngd:v1.0.0

  - name: ntpd
    image: linuxkit/openntpd:v1.0.0

  - name: mdev
    image: "${HOOK_CONTAINER_MDEV_IMAGE}"
    command: [ "mdev", "-v", "-S", "-df" ]
    capabilities:
      - all
    binds:
      - /dev/:/dev/
      - /lib/modules:lib/modules
    rootfsPropagation: shared
    devices:
      - path: all
        type: b

  - name: getty
    image: linuxkit/getty:v1.0.0
    capabilities:
      - all
    binds.add:
      - /etc/profile.d/local.sh:/etc/profile.d/local.sh
      - /etc/securetty:/etc/securetty
      - /etc/motd:/etc/motd
      - /etc/os-release:/etc/os-release
      - /:/host_root
      - /dev:/dev
      - /dev/console:/dev/console
      - /usr/bin/nerdctl:/usr/bin/nerdctl
    env:
      - INSECURE=true
    devices:
    - path: all
      type: b
    - path: "/dev/console"
      type: c
      major: 5
      minor: 1
      mode: "0666"
    - path: "/dev/tty0"
      type: c
      major: 4
      minor: 0
      mode: "0666"
    - path: "/dev/tty1"
      type: c
      major: 4
      minor: 1
      mode: "0666"
    - path: "/dev/ttyS0"
      type: c
      major: 4
      minor: 64
      mode: "0666"
    - path: "/dev/ttyS1"
      type: c
      major: 4
      minor: 65
      mode: "0666"
    - path: "/dev/ttyAMA0"
      type: c
      major: 204
      minor: 64
      mode: "0666"
    - path: "/dev/ttyAMA1"
      type: c
      major: 204
      minor: 65
      mode: "0666"
    - path: "/dev/ttyAML0"
      type: c
      major: 243
      minor: 0
      mode: "0666"
    - path: "/dev/ttyAML1"
      type: c
      major: 243
      minor: 1
      mode: "0666"
    - path: "/dev/ttyUSB0"
      type: c
      major: 188
      minor: 0
      mode: "0666"
    - path: "/dev/ttyUSB1"
      type: c
      major: 188
      minor: 1
      mode: "0666"

  - name: hook-docker
    image: "${HOOK_CONTAINER_DOCKER_IMAGE}"
    capabilities:
      - all
    net: host
    pid: host
    mounts:
      - type: cgroup2
        options: [ "rw", "nosuid", "noexec", "nodev", "relatime" ]
        destination: /sys/fs/cgroup
    binds.add:
      - /dev/console:/dev/console
      - /dev:/dev
      - /etc/resolv.conf:/etc/resolv.conf
      - /lib/modules:/lib/modules
      - /var/run/docker:/var/run
      - /var/run/images:/var/lib/docker
      - /var/run/worker:/worker
    runtime:
      mkdir:
        - /var/run/images
        - /var/run/docker
        - /var/run/worker
    devices:
    - path: all
      type: b

  - name: hook-bootkit
    image: "${HOOK_CONTAINER_BOOTKIT_IMAGE}"
    capabilities:
      - all
    net: host
    mounts:
      - type: cgroup2
        options: [ "rw", "nosuid", "noexec", "nodev", "relatime" ]
        destination: /sys/fs/cgroup
    binds:
      - /var/run/docker:/var/run
    runtime:
      mkdir:
        - /var/run/docker
  
  - name: dhcpcd-daemon
    image: linuxkit/dhcpcd:v1.0.0
    command: [ "/etc/ip/dhcp.sh", "false" ] # 2nd paramter is one-shot true/false: true for onboot, false for services
    #capabilities.add:
    #  - CAP_SYS_TIME # for ntp one-shot no-max-offset after ntpd, for hardware missing RTC's that boot in 1970
    capabilities:
      - all
    binds.add:
      - /var/lib/dhcpcd:/var/lib/dhcpcd
      - /run:/run
      - /etc/ip/dhcp.sh:/etc/ip/dhcp.sh
      - /dhcpcd.conf:/dhcpcd.conf
    runtime:
      mkdir:
        - /var/lib/dhcpcd

#dbg  - name: sshd
#dbg    image: linuxkit/sshd:v1.0.0

files:
  - path: etc/profile.d/local.sh
    contents: |
      alias       docker='nerdctl -n services.linuxkit exec -it hook-docker docker'
      alias docker-shell='nerdctl -n services.linuxkit exec -it hook-docker sh'
      export PS1='HookOS ${HOOK_VERSION}:\w\$ '
      # only print WARNING or higher kernel messages to console
      echo 4 > /proc/sys/kernel/printk
    mode: "0644"

  - path: etc/motd
    mode: "0644"
    # This is ANSI Regular font
    contents: |
      Welcome to HookOS! Your Tinkerbell operating system installation environment.

      ██   ██                   ██       ██████  ███████
      ██   ██  ██████   ██████  ██  ██  ██    ██ ██
      ███████ ██    ██ ██    ██ █████   ██    ██ ███████
      ██   ██ ██    ██ ██    ██ ██  ██  ██    ██      ██
      ██   ██  ██████   ██████  ██   ██  ██████  ███████

      - Hook flavor ${HOOK_KERNEL_ID} version ${HOOK_VERSION} / Kernel version ${HOOK_KERNEL_VERSION}
      - Use `docker` commands to access the tink worker/agent container and workflow action containers.
      - Logs are located in the `/var/log/` directory.
      - Use `docker logs tink-worker --follow` to watch the worker logs.

  - path: etc/os-release
    mode: "0444"
    contents: |
      NAME="HookOS"
      VERSION=${HOOK_VERSION}
      ID=hookos
      VERSION_ID=${HOOK_VERSION}
      PRETTY_NAME="HookOS ${HOOK_KERNEL_ID} v${HOOK_VERSION}/k${HOOK_KERNEL_VERSION}"
      ANSI_COLOR="1;34"
      HOME_URL="https://github.com/tinkerbell/hook"

  - path: etc/ip/vlan.sh
    source: "files/vlan.sh"
    mode: "0777"

  - path: etc/ip/dhcp.sh
    source: "files/dhcp.sh"
    mode: "0777"

  - path: dhcpcd.conf
    source: "files/dhcpcd.conf"
    mode: "0644"

  - path: etc/securetty
    contents: |
      console
      tty0
      tty1
      tty2
      tty3
      tty4
      tty5
      tty6
      tty7
      tty8
      tty9
      tty10
      tty11
      hvc0
      ttyS0
      ttyS1
      ttyAMA0
      ttyAMA1
      ttyAML0
      ttyAML1
      ttyUSB0
      ttyUSB1
      ttyUSB2

#dbg  - path: root/.ssh/authorized_keys
#dbg    source: ~/.ssh/id_rsa.pub
#dbg    mode: "0600"
#dbg    optional: true

trust:
  org:
    - linuxkit
    - library