diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 5ee7d97..be7d10e 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -42,7 +42,7 @@ build: - aws-autoscale parallel: matrix: - - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly ] + - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly, ubuntu-bionic-dind, ubuntu-bionic-dind-rootless ] @@ -73,7 +73,7 @@ build_dev: - aws-autoscale parallel: matrix: - - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly ] + - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly, ubuntu-bionic-dind, ubuntu-bionic-dind-rootless ] @@ -101,7 +101,7 @@ build_schedules: - aws-autoscale parallel: matrix: - - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly ] + - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly, ubuntu-bionic-dind, ubuntu-bionic-dind-rootless ] @@ -121,4 +121,4 @@ update_readmes: - $README_PASSWORD parallel: matrix: - - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly ] + - KASM_IMAGE: [chrome, chromium, firefox, desktop, desktop-deluxe, firefox-mobile, tor-browser, doom, edge, terminal, vmware-horizon, remmina, rdesktop, brave, discord, sublime-text, gimp, vs-code, slack, teams, only-office, zoom, signal, steam, postman, insomnia, zsnes, vlc, ubuntu-bionic-desktop, maltego, centos-7-desktop, telegram, hunchly, ubuntu-bionic-dind, ubuntu-bionic-dind-rootless ] diff --git a/dockerfile-kasm-ubuntu-bionic-dind b/dockerfile-kasm-ubuntu-bionic-dind new file mode 100644 index 0000000..e906dff --- /dev/null +++ b/dockerfile-kasm-ubuntu-bionic-dind @@ -0,0 +1,61 @@ +ARG BASE_TAG="develop" +FROM kasmweb/core-ubuntu-bionic:$BASE_TAG +USER root + +ENV HOME /home/kasm-default-profile +ENV STARTUPDIR /dockerstartup +ENV INST_SCRIPTS $STARTUPDIR/install +WORKDIR $HOME + +######### Customize Container Here ########### + +ENV DOCKER_CHANNEL=stable \ + DOCKER_VERSION=20.10.9 \ + DOCKER_COMPOSE_VERSION=1.29.2 \ + DEBUG=false + +COPY ./src/ubuntu/install/dind $INST_SCRIPTS/dind/ +COPY ./src/ubuntu/install/dind/daemon.json /etc/docker/daemon.json + +RUN bash $INST_SCRIPTS/dind/install_dind.sh && rm -rf $INST_SCRIPTS/dind/ + +COPY ./src/ubuntu/install/dind/custom_startup.sh $STARTUPDIR/custom_startup.sh +RUN chmod +x $STARTUPDIR/custom_startup.sh +RUN chmod 755 $STARTUPDIR/custom_startup.sh + +COPY ./src/ubuntu/install/dind/modprobe /usr/local/bin/modprobe +RUN chmod +x /usr/local/bin/modprobe +COPY ./src/ubuntu/install/dind/dockerd.conf /etc/supervisor/conf.d/ + +### Install Tools +COPY ./src/ubuntu/install/tools $INST_SCRIPTS/tools/ +RUN bash $INST_SCRIPTS/tools/install_tools_deluxe.sh && rm -rf $INST_SCRIPTS/tools/ + +# Install Utilities +COPY ./src/ubuntu/install/misc $INST_SCRIPTS/misc/ +RUN bash $INST_SCRIPTS/misc/install_tools.sh && rm -rf $INST_SCRIPTS/misc/ + +### Install Sublime Text +COPY ./src/ubuntu/install/sublime_text $INST_SCRIPTS/sublime_text/ +RUN bash $INST_SCRIPTS/sublime_text/install_sublime_text.sh && rm -rf $INST_SCRIPTS/sublime_text/ + +### Install Visual Studio Code +COPY ./src/ubuntu/install/vs_code $INST_SCRIPTS/vs_code/ +RUN bash $INST_SCRIPTS/vs_code/install_vs_code.sh && rm -rf $INST_SCRIPTS/vs_code/ + +# Install Google Chrome +COPY ./src/ubuntu/install/chrome $INST_SCRIPTS/chrome/ +RUN bash $INST_SCRIPTS/chrome/install_chrome.sh && rm -rf $INST_SCRIPTS/chrome/ + +### Remove maxmius +RUN apt-get remove -y maximus + +######### End Customizations ########### + +RUN chown 1000:0 $HOME + +ENV HOME /home/kasm-user +WORKDIR $HOME +RUN mkdir -p $HOME && chown -R 1000:0 $HOME + +USER 1000 diff --git a/dockerfile-kasm-ubuntu-bionic-dind-rootless b/dockerfile-kasm-ubuntu-bionic-dind-rootless new file mode 100644 index 0000000..db5bbdd --- /dev/null +++ b/dockerfile-kasm-ubuntu-bionic-dind-rootless @@ -0,0 +1,71 @@ +ARG BASE_TAG="develop" +FROM kasmweb/core-ubuntu-bionic:$BASE_TAG +USER root + +ENV HOME /home/kasm-default-profile +ENV STARTUPDIR /dockerstartup +ENV INST_SCRIPTS $STARTUPDIR/install +WORKDIR $HOME + +######### Customize Container Here ########### + +ENV DOCKER_CHANNEL=stable \ + DOCKER_VERSION=20.10.9 \ + DOCKER_COMPOSE_VERSION=1.29.2 \ + DEBUG=false + +COPY ./src/ubuntu/install/dind_rootless $INST_SCRIPTS/dind_rootless/ +RUN bash $INST_SCRIPTS/dind_rootless/install_dind_rootless.sh && rm -rf $INST_SCRIPTS/dind_rootless/ + +COPY ./src/ubuntu/install/dind_rootless/custom_startup.sh $STARTUPDIR/custom_startup.sh +RUN chmod +x $STARTUPDIR/custom_startup.sh +RUN chmod 755 $STARTUPDIR/custom_startup.sh + +COPY ./src/ubuntu/install/dind/modprobe /usr/local/bin/modprobe +RUN chmod +x /usr/local/bin/modprobe + +### Install Tools +COPY ./src/ubuntu/install/tools $INST_SCRIPTS/tools/ +RUN bash $INST_SCRIPTS/tools/install_tools_deluxe.sh && rm -rf $INST_SCRIPTS/tools/ + +# Install Utilities +COPY ./src/ubuntu/install/misc $INST_SCRIPTS/misc/ +RUN bash $INST_SCRIPTS/misc/install_tools.sh && rm -rf $INST_SCRIPTS/misc/ + +### Install Sublime Text +COPY ./src/ubuntu/install/sublime_text $INST_SCRIPTS/sublime_text/ +RUN bash $INST_SCRIPTS/sublime_text/install_sublime_text.sh && rm -rf $INST_SCRIPTS/sublime_text/ + +### Install Visual Studio Code +COPY ./src/ubuntu/install/vs_code $INST_SCRIPTS/vs_code/ +RUN bash $INST_SCRIPTS/vs_code/install_vs_code.sh && rm -rf $INST_SCRIPTS/vs_code/ + +# Install Google Chrome +COPY ./src/ubuntu/install/chrome $INST_SCRIPTS/chrome/ +RUN bash $INST_SCRIPTS/chrome/install_chrome.sh && rm -rf $INST_SCRIPTS/chrome/ + +### Remove maxmius +RUN apt-get remove -y maximus + +RUN chown 1000:0 $HOME + +USER 1000 + +### Install docker rootless +RUN curl -fsSL https://get.docker.com/rootless | sh + +ENV XDG_RUNTIME_DIR /home/kasm-user/.docker/run +ENV PATH /home/kasm-user/bin:$PATH +ENV DOCKER_HOST unix:///home/kasm-user/.docker/run/docker.sock + +USER root + +######### End Customizations ########### + +RUN chown 1000:0 $HOME + +ENV HOME /home/kasm-user +WORKDIR $HOME +RUN mkdir -p $HOME && chown -R 1000:0 $HOME + +USER 1000 diff --git a/docs/ubuntu-bionic-dind-rootless/README.md b/docs/ubuntu-bionic-dind-rootless/README.md new file mode 100644 index 0000000..82c1142 --- /dev/null +++ b/docs/ubuntu-bionic-dind-rootless/README.md @@ -0,0 +1,13 @@ +# About This Image + +This Image contains a browser-accessible version of [Docker](https://www.docker.com/) running as a normal, non-root user. + +![Screenshot][Image_Screenshot] + +[Image_Screenshot]: https://f.hubspotusercontent30.net/hubfs/5856039/dockerhub/ubuntu_dind.jpg "Image Screenshot" + +See [Kasm Docs](https://kasmweb.com/docs/latest/how_to/docker_in_kasm.html) for additional setup instructions. + +# Environment Variables + +* `APP_ARGS` - Additional arguments to pass to the application when launched. diff --git a/docs/ubuntu-bionic-dind-rootless/description.txt b/docs/ubuntu-bionic-dind-rootless/description.txt new file mode 100644 index 0000000..f976460 --- /dev/null +++ b/docs/ubuntu-bionic-dind-rootless/description.txt @@ -0,0 +1 @@ +Rootless Docker for Kasm Workspaces \ No newline at end of file diff --git a/docs/ubuntu-bionic-dind/README.md b/docs/ubuntu-bionic-dind/README.md new file mode 100644 index 0000000..5abddde --- /dev/null +++ b/docs/ubuntu-bionic-dind/README.md @@ -0,0 +1,13 @@ +# About This Image + +This Image contains a browser-accessible version of [Docker](https://www.docker.com/). + +![Screenshot][Image_Screenshot] + +[Image_Screenshot]: https://f.hubspotusercontent30.net/hubfs/5856039/dockerhub/ubuntu_dind.jpg "Image Screenshot" + +See [Kasm Docs](https://kasmweb.com/docs/latest/how_to/docker_in_kasm.html) for additional setup instructions. + +# Environment Variables + +* `APP_ARGS` - Additional arguments to pass to the application when launched. diff --git a/docs/ubuntu-bionic-dind/description.txt b/docs/ubuntu-bionic-dind/description.txt new file mode 100644 index 0000000..3f8c02c --- /dev/null +++ b/docs/ubuntu-bionic-dind/description.txt @@ -0,0 +1 @@ +Docker for Kasm Workspaces \ No newline at end of file diff --git a/src/ubuntu/install/dind/custom_startup.sh b/src/ubuntu/install/dind/custom_startup.sh new file mode 100644 index 0000000..f757ba1 --- /dev/null +++ b/src/ubuntu/install/dind/custom_startup.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +set -ex +START_COMMAND="/usr/bin/supervisord" +PGREP="supervisord" +MAXIMUS="false" +DEFAULT_ARGS="-n" +ARGS=${APP_ARGS:-$DEFAULT_ARGS} + +options=$(getopt -o gau: -l go,assign,url: -n "$0" -- "$@") || exit +eval set -- "$options" + +while [[ $1 != -- ]]; do + case $1 in + -g|--go) GO='true'; shift 1;; + -a|--assign) ASSIGN='true'; shift 1;; + -u|--url) OPT_URL=$2; shift 2;; + *) echo "bad option: $1" >&2; exit 1;; + esac +done +shift + +# Process non-option arguments. +for arg; do + echo "arg! $arg" +done + +FORCE=$2 + +kasm_startup() { + if [ -n "$KASM_URL" ] ; then + URL=$KASM_URL + elif [ -z "$URL" ] ; then + URL=$LAUNCH_URL + fi + + if [ -z "$DISABLE_CUSTOM_STARTUP" ] || [ -n "$FORCE" ] ; then + + if [[ $MAXIMUS == 'true' ]] ; then + maximus & + fi + + while true + do + if ! pgrep -x $PGREP > /dev/null + then + /usr/bin/filter_ready + /usr/bin/desktop_ready + set +e + sudo /usr/bin/supervisord -n & + set -e + fi + sleep 1 + done + + fi + +} + +if [ -n "$GO" ] || [ -n "$ASSIGN" ] ; then + kasm_exec +else + kasm_startup +fi diff --git a/src/ubuntu/install/dind/daemon.json b/src/ubuntu/install/dind/daemon.json new file mode 100644 index 0000000..de9249c --- /dev/null +++ b/src/ubuntu/install/dind/daemon.json @@ -0,0 +1,3 @@ +{ + "storage-driver": "vfs" +} diff --git a/src/ubuntu/install/dind/dockerd.conf b/src/ubuntu/install/dind/dockerd.conf new file mode 100644 index 0000000..0876789 --- /dev/null +++ b/src/ubuntu/install/dind/dockerd.conf @@ -0,0 +1,6 @@ +[program:dockerd] +command=/usr/local/bin/dockerd +autostart=true +autorestart=true +stderr_logfile=/var/log/dockerd.err.log +stdout_logfile=/var/log/dockerd.out.log diff --git a/src/ubuntu/install/dind/install_dind.sh b/src/ubuntu/install/dind/install_dind.sh new file mode 100644 index 0000000..e7ee594 --- /dev/null +++ b/src/ubuntu/install/dind/install_dind.sh @@ -0,0 +1,55 @@ +#!/usr/bin/env bash +set -ex + +apt-get update +apt-get install -y \ + ca-certificates \ + curl \ + dbus-user-session \ + kmod \ + iptables \ + openssh-client \ + sudo \ + supervisor \ + uidmap \ + wget +rm -rf /var/lib/apt/list/* + +mkdir -p /var/log/supervisor +chown -R 1000:1000 /var/log/supervisor + +arch="$(uname --m)"; +case "$arch" in + # amd64 + x86_64) dockerArch='x86_64' ;; + # arm32v6 + armhf) dockerArch='armel' ;; + # arm32v7 + armv7) dockerArch='armhf' ;; + # arm64v8 + aarch64) dockerArch='aarch64' ;; + *) echo >&2 "error: unsupported architecture ($arch)"; exit 1 ;; +esac; + +curl -o docker.tgz "https://download.docker.com/linux/static/${DOCKER_CHANNEL}/${dockerArch}/docker-${DOCKER_VERSION}.tgz" + +tar --extract \ + --file docker.tgz \ + --strip-components 1 \ + --directory /usr/local/bin/ +rm docker.tgz + +dockerd --version +docker --version + +echo "Installing Docker Compose" +mkdir -p /usr/local/lib/docker/cli-plugins +curl -L https://github.com/docker/compose/releases/download/v2.0.1/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/lib/docker/cli-plugins/docker-compose +chmod +x /usr/local/lib/docker/cli-plugins/docker-compose + +useradd -m -d /home/kasm-user -s /bin/bash kasm-user +echo 'kasm-user:kasm-user' | chpasswd +echo 'kasm-user ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers + +groupadd docker +adduser kasm-user docker diff --git a/src/ubuntu/install/dind/modprobe b/src/ubuntu/install/dind/modprobe new file mode 100644 index 0000000..b357d89 --- /dev/null +++ b/src/ubuntu/install/dind/modprobe @@ -0,0 +1,20 @@ +#!/bin/sh +set -eu + +# "modprobe" without modprobe +# https://twitter.com/lucabruno/status/902934379835662336 + +# this isn't 100% fool-proof, but it'll have a much higher success rate than simply using the "real" modprobe + +# Docker often uses "modprobe -va foo bar baz" +# so we ignore modules that start with "-" +for module; do + if [ "${module#-}" = "$module" ]; then + ip link show "$module" || true + lsmod | grep "$module" || true + fi +done + +# remove /usr/local/... from PATH so we can exec the real modprobe as a last resort +export PATH='/usr/sbin:/usr/bin:/sbin:/bin' +exec modprobe "$@" diff --git a/src/ubuntu/install/dind_rootless/custom_startup.sh b/src/ubuntu/install/dind_rootless/custom_startup.sh new file mode 100644 index 0000000..e8327f7 --- /dev/null +++ b/src/ubuntu/install/dind_rootless/custom_startup.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +set -ex +START_COMMAND="/home/kasm-user/bin/dockerd-rootless.sh" +PGREP="dockerd" +MAXIMUS="false" +DEFAULT_ARGS="" +ARGS=${APP_ARGS:-$DEFAULT_ARGS} + +options=$(getopt -o gau: -l go,assign,url: -n "$0" -- "$@") || exit +eval set -- "$options" + +while [[ $1 != -- ]]; do + case $1 in + -g|--go) GO='true'; shift 1;; + -a|--assign) ASSIGN='true'; shift 1;; + -u|--url) OPT_URL=$2; shift 2;; + *) echo "bad option: $1" >&2; exit 1;; + esac +done +shift + +# Process non-option arguments. +for arg; do + echo "arg! $arg" +done + +FORCE=$2 + +kasm_startup() { + if [ -n "$KASM_URL" ] ; then + URL=$KASM_URL + elif [ -z "$URL" ] ; then + URL=$LAUNCH_URL + fi + + if [ -z "$DISABLE_CUSTOM_STARTUP" ] || [ -n "$FORCE" ] ; then + + if [[ $MAXIMUS == 'true' ]] ; then + maximus & + fi + + while true + do + if ! pgrep -x $PGREP > /dev/null + then + /usr/bin/filter_ready + /usr/bin/desktop_ready + set +e + $START_COMMAND $ARGS + set -e + fi + sleep 1 + done + + fi + +} + +if [ -n "$GO" ] || [ -n "$ASSIGN" ] ; then + kasm_exec +else + kasm_startup +fi diff --git a/src/ubuntu/install/dind_rootless/install_dind_rootless.sh b/src/ubuntu/install/dind_rootless/install_dind_rootless.sh new file mode 100644 index 0000000..1e7b07c --- /dev/null +++ b/src/ubuntu/install/dind_rootless/install_dind_rootless.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +set -ex + +apt-get update +apt-get install -y \ + ca-certificates \ + curl \ + dbus-user-session \ + kmod \ + iptables \ + openssh-client \ + uidmap \ + wget +rm -rf /var/lib/apt/list/* + +mkdir -p /var/log/supervisor +chown -R 1000:1000 /var/log/supervisor + +arch="$(uname --m)"; +case "$arch" in + # amd64 + x86_64) dockerArch='x86_64' ;; + # arm32v6 + armhf) dockerArch='armel' ;; + # arm32v7 + armv7) dockerArch='armhf' ;; + # arm64v8 + aarch64) dockerArch='aarch64' ;; + *) echo >&2 "error: unsupported architecture ($arch)"; exit 1 ;; +esac; + +curl -o docker.tgz "https://download.docker.com/linux/static/${DOCKER_CHANNEL}/${dockerArch}/docker-${DOCKER_VERSION}.tgz" + +tar --extract \ + --file docker.tgz \ + --strip-components 1 \ + --directory /usr/local/bin/ +rm docker.tgz + +dockerd --version +docker --version + +echo "Installing Docker Compose" +mkdir -p /usr/local/lib/docker/cli-plugins +curl -L https://github.com/docker/compose/releases/download/v2.0.1/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/lib/docker/cli-plugins/docker-compose +chmod +x /usr/local/lib/docker/cli-plugins/docker-compose + +useradd -m -d /home/kasm-user -s /bin/bash kasm-user diff --git a/src/ubuntu/install/dind_rootless/modprobe b/src/ubuntu/install/dind_rootless/modprobe new file mode 100644 index 0000000..b357d89 --- /dev/null +++ b/src/ubuntu/install/dind_rootless/modprobe @@ -0,0 +1,20 @@ +#!/bin/sh +set -eu + +# "modprobe" without modprobe +# https://twitter.com/lucabruno/status/902934379835662336 + +# this isn't 100% fool-proof, but it'll have a much higher success rate than simply using the "real" modprobe + +# Docker often uses "modprobe -va foo bar baz" +# so we ignore modules that start with "-" +for module; do + if [ "${module#-}" = "$module" ]; then + ip link show "$module" || true + lsmod | grep "$module" || true + fi +done + +# remove /usr/local/... from PATH so we can exec the real modprobe as a last resort +export PATH='/usr/sbin:/usr/bin:/sbin:/bin' +exec modprobe "$@"