CoreOS那些事之Rkt容器尝鲜（上） 转

wget https://github.com/coreos/rkt/releases/download/v0.5.4/rkt-v0.5.4.tar.gz

tar xzvf rkt-v0.5.4.tar.gz

sudo cp rkt-v0.5.4/* /usr/local/bin/

$ rkt version
rkt version 0.5.4
appc version 0.5.1+git

$ ls rkt-v0.5.4
rkt  stage1.aci

$ sudo rkt trust --prefix coreos.com/etcd
Prefix: "coreos.com/etcd"
Key: "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg"
GPG key fingerprint is: 8B86 DE38 890D DB72 9186  7B02 5210 BD88 8818 2190
  CoreOS ACI Builder 
Are you sure you want to trust this key (yes/no)? yes <--输入"yes"回车
Trusting "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg" for prefix "coreos.com/etcd".
Added key for prefix "coreos.com/etcd" at "/etc/rkt/trustedkeys/prefix.d/coreos.com/etcd/8b86de38890ddb7291867b025210bd8888182190"

$ cat /etc/rkt/trustedkeys/prefix.d/coreos.com/etcd/8b86de38890ddb7291867b025210bd8888182190
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1
mQINBFTCnMQBEAC/49bGbStCpa3peej+/42mobfuGbTcdmcGGwYZmigP0Kl0TPZK
... 省略部分输出 ...
fMkBtaM3knaFonHZc19BD1FOishRThCCq2Ty8HUoN2Fk7w0l
=bYl7
-----END PGP PUBLIC KEY BLOCK-----

$ sudo rkt fetch coreos.com/etcd:v2.0.9
rkt: searching for app image coreos.com/etcd:v2.0.9
rkt: fetching image from https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
Downloading signature from https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci.asc
Downloading ACI: [=============================================] 3.79 MB/3.79 MB
rkt: signature verified:
  CoreOS ACI Builder 
sha512-91e98d7f1679a097c878203c9659f2a2

$ sudo rkt fetch coreos.com/etcd:v2.0.9
...
Downloading ACI: [=============================================] 3.79 MB/3.79 MB
openpgp: signature made by unknown entity

$ sudo rkt --insecure-skip-verify fetch coreos.com/etcd:v2.0.9
rkt: searching for app image coreos.com/etcd:v2.0.9
rkt: fetching image from https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
Downloading ACI: [=============================================] 3.79 MB/3.79 MB
sha512-91e98d7f1679a097c878203c9659f2a2

$ tree /var/lib/rkt/cas/blob/sha512/
/var/lib/rkt/cas/blob/sha512/
└── 91
    └── sha512-91e98d7f1679a097c878203c9659f2a26ae394656b3147963324c61fa3832f15

$ sudo rkt run coreos.com/etcd:v2.0.9
rkt: searching for app image coreos.com/etcd:v2.0.9
rkt: fetching image from https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
...
Press ^] three times to kill container

$ sudo rkt run sha512-91e98d7f1679a097c878203c9659f2a26ae394656b3147963324c61fa3832f15
...
Press ^] three times to kill container

$ sudo rkt run https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
rkt: fetching image from https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
...
Press ^] three times to kill container

$ sudo rkt run --help
Usage:
  -inherit-env=false: inherit all environment variables not set by apps
  -interactive=false: run pod interactively
  -local=false: use only local images (do not discover or download from remote URLs)
  -no-overlay=false: disable overlay filesystem
  -pod-manifest="": the path to the pod manifest. If it's non-empty, then only '--private-net', '--no-overlay' and '--interactive' will have effects
  -port=: ports to expose on the host (requires --private-net)
  -private-net=false: give pod a private network
  -set-env=: an environment variable to set for apps in the form name=value
  -signature=: local signature file to use in validating the preceding image
  -stage1-image="/usr/local/bin/stage1.aci": image to use as stage1. Local paths and http/https URLs are supported. If empty, rkt will look for a file called "stage1.aci" in the same directory as rkt itself
  -volume=: volumes to mount into the pod

$ wget https://github.com/coreos/etcd/releases/download/v2.0.9/etcd-v2.0.9-linux-amd64.aci
...
aving to: ‘etcd-v2.0.9-linux-amd64.aci’
100%[=================================>] 3,788,138   1.00MB/s   in 5.1s
‘etcd-v2.0.9-linux-amd64.aci’ saved [3788138/3788138]
$ sudo rkt run etcd-v2.0.9-linux-amd64.aci
error opening signature file: open /home/ubuntu/etcd-v2.0.9-linux-amd64.aci.asc: no such file or directory

sudo rkt run image.aci --signature sign.asc

$ sudo rkt --insecure-skip-verify fetch docker://centos
rkt: fetching image from docker://centos
Downloading layer: 6941bfcbbfca7f4f48becd38f2639157042b5cf9ab8c080f1d8b6d047380ecfc
Downloading layer: 41459f052977938b824dd011e1f2bec2cb4d133dfc7e1aa0e90f7c5d337ca9c4
Downloading layer: fd44297e2ddb050ec4fa9752b7a4e3a8439061991886e2091e7c1f007c906d75
sha512-94b712e21c2f88aebcbe67b7e97911c9

$ sudo rkt run --interactive sha512-94b712e21c2f88aebcbe67b7e97911c9ed3be062f976cefcebed8baab826ed32
[root@rkt-0ff47941-3934-4dcd-9b9d-3db558f62cd9 /]#

$ sudo cat /etc/rkt/auth.d/myuser.json 
{
    "rktKind": "dockerAuth",
    "rktVersion": "v1",
    "registries": ["quay.io"],
    "credentials": {
        "user": "myuser",
        "password": "sekr3tstuff"
    }
}

$ sudo rkt --insecure-skip-verify fetch docker://quay.io/myuser/privateapp
rkt: fetching image from docker://quay.io/myuser/privateapp
Downloading layer: cf2616975b4a3cba083ca99bc3f0bf25f5f528c3c52be1596b30f60b0b1c37ff
Downloading layer: 6ce2e90b0bc7224de3db1f0d646fe8e2c4dd37f1793928287f6074bc451a57ea
....

$ rkt help
...
COMMANDS:
    enter           Enter the namespaces of an app within a rkt pod
    fetch           Fetch image(s) and store them in the local cache
    gc          Garbage-collect rkt pods no longer in use
    help            Show a list of commands or help for one command
    install         Set up rkt data directories with correct permissions
    list            List pods
    metadata-service    Run metadata service
    prepare         Prepare to run image(s) in a pod in rkt
    run         Run image(s) in a pod in rkt
    run-prepared        Run a prepared application pod in rkt
    status          Check the status of a rkt pod
    trust           Trust a key for image verification
    version         Print the version and exit
GLOBAL OPTIONS:
    --debug=false           Print out more debug information to stderr
    --dir=/var/lib/rkt      rkt data directory
    --help=false            Print usage information and exit
    --insecure-skip-verify=false    skip image or key verification
    --local-config=/etc/rkt     local configuration directory
    --system-config=/usr/lib/rkt    system configuration directory