Flatcar Container Linux
Lokomotive uses Flatcar Container Linux as the underlying operating system.
Flatcar Container Linux is an open source immutable Linux distribution for containers. It is a friendly fork of CoreOS Container Linux and as such, compatible with it.
Why Flatcar Container Linux ?
- Minimal distribution required for containers.
- Reduced dependencies.
- Reduced attack surface area.
- Immutable file system.
- Operational simplicity.
- Removes entire category of security threats. (e.g. runc vulnerability CVE-2019-5736) https://kinvolk.io/blog/2019/02/runc-breakout-vulnerability-mitigated-on-flatcar-linux/
- Automated, streamlined and atomic updates.
- Easily apply all latest security patches.
- Rollback partition.
- Declarative and immutable configuration.
- Optimization for containerized applications.
Container runtime properties
Flatcar Container Linux uses Docker as its container runtime. This is the default configuration:
Property | Value |
---|---|
cgroup driver | cgroupfs |
logging driver | json-file |
storage driver | overlay2 |
Directory locations
Lokomotive conventional directories:
Kubelet setting | Host location |
---|---|
cni-conf-dir | /etc/cni/net.d |
pod-manifest-path | /etc/kubernetes/manifests |
volume-plugin-dir | /var/lib/kubelet/volumeplugins |
Kubelet mounts
Kubelet mount points on Flatcar Container Linux:
Mount location | Host location | Options |
---|---|---|
/etc/kubernetes | /etc/kubernetes | ro |
/etc/ssl/certs | /etc/ssl/certs | ro |
/usr/share/ca-certificates | /usr/share/ca-certificates | ro |
/var/lib/kubelet | /var/lib/kubelet | recursive |
/var/lib/docker | /var/lib/docker | |
/var/lib/cni | /var/lib/cni | |
/var/lib/calico | /var/lib/calico | |
/var/log | /var/log | |
/etc/os-release | /usr/lib/os-release | ro |
/run | /run | |
/lib/modules | /lib/modules | ro |
/etc/resolv.conf | /etc/resolv.conf | |
/opt/cni/bin | /opt/cni/bin |
Customization
Flatcar Container Linux can be customized via Container Linux Configs (CLC) that are interpreted by Ignition (see some examples ).
Lokomotive supports defining CLC snippets for clusters running on Packet and AWS.
CLC snippets can be defined both for controllers and for workers with controller_clc_snippets
in the
controller definition, and clc_snippets
for the worker pool definition.
An example CLC snippet:
controller_clc_snippets = [
file("./snippet/controller-snippet.yaml"),
]
clc_snippets
and controller_clc_snippets
also accept inline text:
clc_snippets = [
<<EOF
systemd:
units:
- name: helloworld.service
dropins:
- name: 10-helloworld.conf
contents: |
[Install]
WantedBy=multi-user.target
EOF
,
]