Alpine Docker container

[coolapso]

checking my options to implement CI testing for alpine and during the discussions to add Alpine support, I Was under impression that some testing on docker containers was also done.
considering it was the main intent of supporting alpine goes exactly towards the objective of getting pivpn somehow working on docker containers with alpine, so I decided to go on some naive testing and just start an alpine:latest container and run pivpn script on it. most of the script worked without errors except this, and obviously wireguard service does not start.

Executing busybox-1.35.0-r15.trigger
OK: 275 MiB in 141 packages
:::    Package wireguard-tools successfully installed!
:::    Package libqrencode successfully installed!
::: Using Quad9 servers.
::: Adding wg-quick unit
::: Backing up the wireguard folder to /etc/wireguard_2022-08-06-181411.tar.gz
::: Server Keys have been generated.
::: Server config generated.
sysctl: error setting key 'net.ipv4.ip_forward': Read-only file system
iptables v1.8.8 (legacy): can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
getsockopt failed strangely: Operation not permitted
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
getsockopt failed strangely: Operation not permitted
iptables v1.8.8 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
getsockopt failed strangely: Operation not permitted
getsockopt failed strangely: Operation not permitted
::: Install Complete...
::: Restarting services...
 * WARNING: wg-quick is already starting
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
(1/7) Installing libffi (3.4.2-r1)
(2/7) Installing libucontext (1.2-r0)
(3/7) Installing yaml (0.2.5-r0)
(4/7) Installing ruby-libs (3.1.2-r0)

This errors are totally expected as the networking inside the containers is not exactly the same as with a native OS, so this are the errors i encountered earlier in my first attempts to get pivpn running on docker and which I got through to some extent but did not had time to finish.

@giulio-coa Did I understood wrong about docker (is a possibility since all of it was quite busy time for me)? isn't it working yet on docker or did you get it to run on docker and there is something wrong?

"baremetal" Alpine is working just fine, however with some caveats that I will add later to the documentation.

AWS AMI's privilege escalation needs to be done with doas otherwise its impossible to install dependencies.

doas su
apk add bash
apk add busybox-initscripts
apk add sudo
echo '%wheel ALL=(ALL) ALL' > /etc/sudoers.d/wheel
mv wheel /etc/sudoers.d/
chown root:root /etc/sudoers.d/wheel

[giulio-coa]

Did you use option --cap-add NET_ADMIN ?

[coolapso]

btw this worked:

VOLUME [ "/sys/fs/cgroup" ]

RUN mkdir -p /run/openrc \
  && touch /run/openrc/softlevel

So I think ti can be used to make the CI testing, as neither Github or Travis CI provide any Alpine image to use with and I don't really wanna go through the steps of getting a runner just for that, it would be something extra to maintain and I have already plenty :p

[giulio-coa]

doesn't feel that manageable.

When i started testing a possible pivpn docker image, what came to my mind was to have a DOCKER=1 Variable when building docker images which would tell pivpn script to only install the components without generating any of the certificates/cryptography components and those would be generated on runtime when starting a container.

IF a volume/bind mount exists and contains the stuff it needs then it skips it, otherwise generates them.

but this was just a concept never materialized it.

We could do a multi-stage container
If the user uses option --build-arg COMPLETE=1, then create the full version, otherwise the one to build

[coolapso]

That can also be an idea. but i'd rather find a way to keep users hands out of it :p
let's wait till @orazioedoardo makes his review of #1572, otherwise ill merge it during the week.
then Ill make the CI changes plus some other changes i have planed, and then after maybe we can finally come with an official pivpn image.

[giulio-coa]

Ok

[giulio-coa]

So I think it can be used to make the CI testing, as neither Github or Travis CI provide any Alpine image to use with and I don't really wanna go through the steps of getting a runner just for that, it would be something extra to maintain and I have already plenty :p

We could do our test
Pi-hole use tox to do this
To add a new distro, you must only add its name to the distro matrix, create the opportune new files (Dockerfile, tox .ini file) into the test directory and adapt the existing tests if necessary
I have tried this procedure in order to add Alpine and it works
It's simple and often you don't have to edit old files