Server Overlay and Serverless
Can application layer isolated from OS layer?
Overlay
Docker uses overlay system, but it requires docker file to rebulid docker image. My colleague was asking me about the image patching and I told him that upper layer can overwrite the lower layer, there is no way to prevent this.
Layering
If the layering can be done in managed way, then it could be a better option to deploy applications. So the ideal is to separate platform to more layers as below
- OS layer - Kernal and all OS packages are sitting in this layer
- OS configuration layer - This layer consists of operating system configurations, such as network configuration, application filesystem configuration, etc.
- OS to APP Patch layer - Some specific OS requirements for specific application.
- Middleware layer - This includes middleware packages
- Data layer - This includes all data required to run application
- Application layer - This is the actual application
Docker or Containerd
The Docker or Containerd packages can be in OS layer, but the actual configuration should be Middleware layer.
CoreOS
The CoreOS implementation is a good example for this layering.
Sample implementation
solve raspbian SD card corruption issues with read-only mounted root partition
Steps
- Copy the script in next section to
/sbin/overlayRoot.sh and make it executable
sudo chmod +x /sbin/overlayRoot.sh
sudo dphys-swapfile swapoff
sudo dphys-swapfile uninstall
sudo update-rc.d dphys-swapfile remove
- Add following line to the end of
cmdline.txt file in the boot partition:
init=/sbin/overlayRoot.sh
Script
The copy of script is listed below
#!/bin/sh
fail(){
echo -e "$1"
/bin/bash
}
modprobe overlay
if [ $? -ne 0 ]; then
fail "ERROR: missing overlay kernel module"
fi
mount -t proc proc /proc
if [ $? -ne 0 ]; then
fail "ERROR: could not mount proc"
fi
mount -t tmpfs inittemp /mnt
if [ $? -ne 0 ]; then
fail "ERROR: could not create a temporary filesystem to mount the base filesystems for overlayfs"
fi
mkdir /mnt/lower
mkdir /mnt/rw
mount -t tmpfs root-rw /mnt/rw
if [ $? -ne 0 ]; then
fail "ERROR: could not create tempfs for upper filesystem"
fi
mkdir /mnt/rw/upper
mkdir /mnt/rw/work
mkdir /mnt/newroot
rootDev=`awk '$2 == "/" {print $1}' /etc/fstab`
rootMountOpt=`awk '$2 == "/" {print $4}' /etc/fstab`
rootFsType=`awk '$2 == "/" {print $3}' /etc/fstab`
echo "check if we can locate the root device based on fstab"
blkid $rootDev
if [ $? -gt 0 ]; then
echo "no success, try if a filesystem with label 'rootfs' is avaialble"
rootDevFstab=$rootDev
rootDev=`blkid -L "rootfs"`
if [ $? -gt 0 ]; then
echo "no luck either, try to further parse fstab's root device definition"
echo "try if fstab contains a PARTUUID definition"
echo "$rootDevFstab" | grep 'PARTUUID=\(.*\)-\([0-9]\{2\}\)'
if [ $? -gt 0 ]; then
fail "could not find a root filesystem device in fstab. Make sure that fstab contains a device definition or a PARTUUID entry for / or that the root filesystem has a label 'rootfs' assigned to it"
fi
device=""
partition=""
eval `echo "$rootDevFstab" | sed -e 's/PARTUUID=\(.*\)-\([0-9]\{2\}\)/device=\1;partition=\2/'`
rootDev=`blkid -t "PTUUID=$device" | awk -F : '{print $1}'`p$(($partition))
blkid $rootDev
if [ $? -gt 0 ]; then
fail "The PARTUUID entry in fstab could not be converted into a valid device name. Make sure that fstab contains a device definition or a PARTUUID entry for / or that the root filesystem has a label 'rootfs' assigned to it"
fi
fi
fi
mount -t ${rootFsType} -o ${rootMountOpt},ro ${rootDev} /mnt/lower
if [ $? -ne 0 ]; then
fail "ERROR: could not ro-mount original root partition"
fi
mount -t overlay -o lowerdir=/mnt/lower,upperdir=/mnt/rw/upper,workdir=/mnt/rw/work overlayfs-root /mnt/newroot
if [ $? -ne 0 ]; then
fail "ERROR: could not mount overlayFS"
fi
mkdir /mnt/newroot/ro
mkdir /mnt/newroot/rw
grep -v "$rootDev" /mnt/lower/etc/fstab > /mnt/newroot/etc/fstab
echo "#the original root mount has been removed by overlayRoot.sh" >> /mnt/newroot/etc/fstab
echo "#this is only a temporary modification, the original fstab" >> /mnt/newroot/etc/fstab
echo "#stored on the disk can be found in /ro/etc/fstab" >> /mnt/newroot/etc/fstab
cd /mnt/newroot
pivot_root . mnt
exec chroot . sh -c "$(cat <<END
# move ro and rw mounts to the new root
mount --move /mnt/mnt/lower/ /ro
if [ $? -ne 0 ]; then
echo "ERROR: could not move ro-root into newroot"
/bin/bash
fi
mount --move /mnt/mnt/rw /rw
if [ $? -ne 0 ]; then
echo "ERROR: could not move tempfs rw mount into newroot"
/bin/bash
fi
# unmount unneeded mounts so we can unmout the old readonly root
umount /mnt/mnt
umount /mnt/proc
umount /mnt/dev
umount /mnt
# continue with regular init
exec /sbin/init
END
)"