1 #!/bin/bash -euxo pipefail
3 # Copyright (C) The Arvados Authors. All rights reserved.
5 # SPDX-License-Identifier: Apache-2.0
11 wait_for_apt_locks() {
12 while $SUDO fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do
13 echo "APT: Waiting for apt/dpkg locks to be released..."
18 # $DIST should not have a dot if there is one in /etc/os-release (e.g. 18.04)
19 DIST=$(. /etc/os-release; echo $ID$VERSION_ID | tr -d '.')
22 $SUDO DEBIAN_FRONTEND=noninteractive apt-get --yes update
24 # Install gnupg and dirmgr or gpg key checks will fail
25 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
30 # For good measure, apt-get upgrade
31 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes upgrade
33 # Make sure cloud-init is installed
34 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install cloud-init
35 if [[ ! -d /var/lib/cloud/scripts/per-boot ]]; then
36 mkdir -p /var/lib/cloud/scripts/per-boot
39 TMP_LSB=`/usr/bin/lsb_release -c -s`
40 LSB_RELEASE_CODENAME=${TMP_LSB//[$'\t\r\n ']}
43 if [ -n "$RESOLVER" ]; then
44 SET_RESOLVER="--dns ${RESOLVER}"
47 # Add the arvados apt repository
48 echo "# apt.arvados.org" |$SUDO tee --append /etc/apt/sources.list.d/apt.arvados.org.list
49 echo "deb http://apt.arvados.org/$LSB_RELEASE_CODENAME $LSB_RELEASE_CODENAME${REPOSUFFIX} main" |$SUDO tee --append /etc/apt/sources.list.d/apt.arvados.org.list
51 # Add the arvados signing key
52 cat /tmp/1078ECD7.asc | $SUDO apt-key add -
53 # Add the debian keys (but don't abort if we can't find them, e.g. on Ubuntu where we don't need them)
54 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get install --yes debian-keyring debian-archive-keyring 2>/dev/null || true
57 $SUDO /bin/sed -ri 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
58 $SUDO /usr/sbin/locale-gen
60 # Install some packages we always need
61 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get --yes update
62 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
68 libcurl4-openssl-dev \
73 # Install the Arvados packages we need
74 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
75 python3-arvados-fuse \
76 arvados-docker-cleaner
78 # We want Docker 20.10 or later so that we support glibc 2.33 and up in the container, cf.
79 # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005906
80 dockerversion=5:20.10.13~3-0
81 if [[ "$DIST" =~ ^debian ]]; then
83 if [ "$DIST" == "debian11" ]; then
85 elif [ "$DIST" == "debian12" ]; then
88 elif [[ "$DIST" =~ ^ubuntu ]]; then
90 if [ "$DIST" == "ubuntu2004" ]; then
92 elif [ "$DIST" == "ubuntu2204" ]; then
96 echo "Unsupported distribution $DIST"
99 curl -fsSL https://download.docker.com/linux/$family/gpg | $SUDO gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
100 echo deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/$family/ $distro stable | \
101 $SUDO tee /etc/apt/sources.list.d/docker.list
103 $SUDO apt-get -yq --no-install-recommends install docker-ce=${dockerversion}~${family}-${distro}
105 # Set a higher ulimit and the resolver (if set) for docker
106 $SUDO sed "s/ExecStart=\(.*\)/ExecStart=\1 --default-ulimit nofile=10000:10000 ${SET_RESOLVER}/g" \
107 /lib/systemd/system/docker.service \
108 > /etc/systemd/system/docker.service
110 $SUDO systemctl daemon-reload
112 # docker should not start on boot: we restart it inside /usr/local/bin/ensure-encrypted-partitions.sh,
113 # and the BootProbeCommand might be "docker ps -q"
114 $SUDO systemctl disable docker
116 # Remove unattended-upgrades if it is installed
117 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes remove unattended-upgrades --purge
119 # Configure arvados-docker-cleaner
120 $SUDO mkdir -p /etc/arvados/docker-cleaner
121 $SUDO echo -e "{\n \"Quota\": \"10G\",\n \"RemoveStoppedContainers\": \"always\"\n}" > /etc/arvados/docker-cleaner/docker-cleaner.json
123 # Enable cgroup accounting (forcing cgroups v1)
124 $SUDO echo 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX cgroup_enable=memory swapaccount=1 systemd.unified_cgroup_hierarchy=0"' >> /etc/default/grub
127 # Make sure user_allow_other is set in fuse.conf
128 $SUDO sed -i 's/#user_allow_other/user_allow_other/g' /etc/fuse.conf
130 # Add crunch user with sudo powers
131 $SUDO adduser --disabled-password --gecos "Crunch user,,,," crunch
132 # Do not require a password to sudo
133 echo -e "# for the crunch user\ncrunch ALL=(ALL) NOPASSWD:ALL" | $SUDO tee /etc/sudoers.d/91-crunch
135 # Set up the ssh public key for the crunch user
136 $SUDO mkdir /home/crunch/.ssh
137 $SUDO mv /tmp/crunch-authorized_keys /home/crunch/.ssh/authorized_keys
138 $SUDO chown -R crunch:crunch /home/crunch/.ssh
139 $SUDO chmod 600 /home/crunch/.ssh/authorized_keys
140 $SUDO chmod 700 /home/crunch/.ssh/
142 # Make sure we resolve via the provided resolver IP if set. Prepending is good enough because
143 # unless 'rotate' is set, the nameservers are queried in order (cf. man resolv.conf)
144 if [ "x$RESOLVER" != "x" ]; then
145 $SUDO sed -i "s/#prepend domain-name-servers 127.0.0.1;/prepend domain-name-servers ${RESOLVER};/" /etc/dhcp/dhclient.conf
148 # AWS_EBS_AUTOSCALE is not always set, work around unset variable check
149 EBS_AUTOSCALE=${AWS_EBS_AUTOSCALE:-}
151 if [ "$EBS_AUTOSCALE" != "1" ]; then
152 # Set up the cloud-init script that will ensure encrypted disks
153 $SUDO mv /tmp/usr-local-bin-ensure-encrypted-partitions.sh /usr/local/bin/ensure-encrypted-partitions.sh
155 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install jq unzip
157 curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"
158 unzip -q /tmp/awscliv2.zip -d /tmp && $SUDO /tmp/aws/install
159 # Pinned to v2.4.5 because we apply a patch below
160 #export EBS_AUTOSCALE_VERSION=$(curl --silent "https://api.github.com/repos/awslabs/amazon-ebs-autoscale/releases/latest" | jq -r .tag_name)
161 export EBS_AUTOSCALE_VERSION="5ca6e24e05787b8ae1184c2a10db80053ddd3038"
162 cd /opt && $SUDO git clone https://github.com/arvados/amazon-ebs-autoscale.git
163 cd /opt/amazon-ebs-autoscale && $SUDO git checkout $EBS_AUTOSCALE_VERSION
165 # Set up the cloud-init script that makes use of the AWS EBS autoscaler
166 $SUDO mv /tmp/usr-local-bin-ensure-encrypted-partitions-aws-ebs-autoscale.sh /usr/local/bin/ensure-encrypted-partitions.sh
169 $SUDO chmod 755 /usr/local/bin/ensure-encrypted-partitions.sh
170 $SUDO chown root:root /usr/local/bin/ensure-encrypted-partitions.sh
171 $SUDO mv /tmp/etc-cloud-cloud.cfg.d-07_compute_arvados_dispatch_cloud.cfg /etc/cloud/cloud.cfg.d/07_compute_arvados_dispatch_cloud.cfg
172 $SUDO chown root:root /etc/cloud/cloud.cfg.d/07_compute_arvados_dispatch_cloud.cfg
174 if [ "$NVIDIA_GPU_SUPPORT" == "1" ]; then
175 # We need a kernel and matching headers
176 if [[ "$DIST" =~ ^debian ]]; then
177 $SUDO apt-get -y install linux-image-cloud-amd64 linux-headers-cloud-amd64
178 elif [ "$CLOUD" == "azure" ]; then
179 $SUDO apt-get -y install linux-image-azure linux-headers-azure
180 elif [ "$CLOUD" == "aws" ]; then
181 $SUDO apt-get -y install linux-image-aws linux-headers-aws
185 $SUDO apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/$DIST/x86_64/7fa2af80.pub
186 $SUDO apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/$DIST/x86_64/3bf863cc.pub
187 $SUDO apt-get -y install software-properties-common
188 $SUDO add-apt-repository "deb https://developer.download.nvidia.com/compute/cuda/repos/$DIST/x86_64/ /"
189 $SUDO add-apt-repository contrib
191 $SUDO apt-get -y install cuda
193 # Install libnvidia-container, the tooling for Docker/Singularity
194 curl -s -L https://nvidia.github.io/libnvidia-container/gpgkey | \
196 if [ "$DIST" == "debian11" ]; then
197 # As of 2021-12-16 libnvidia-container and friends are only available for
198 # Debian 10, not yet Debian 11. Install experimental rc1 package as per this
200 # https://github.com/NVIDIA/nvidia-docker/issues/1549#issuecomment-989670662
201 curl -s -L https://nvidia.github.io/libnvidia-container/debian10/libnvidia-container.list | \
202 $SUDO tee /etc/apt/sources.list.d/libnvidia-container.list
203 $SUDO sed -i -e '/experimental/ s/^#//g' /etc/apt/sources.list.d/libnvidia-container.list
205 # here, $DIST should have a dot if there is one in /etc/os-release (e.g. 18.04)...
206 DIST=$(. /etc/os-release; echo $ID$VERSION_ID)
207 curl -s -L https://nvidia.github.io/libnvidia-container/$DIST/libnvidia-container.list | \
208 $SUDO tee /etc/apt/sources.list.d/libnvidia-container.list
212 $SUDO apt-get -y install libnvidia-container1 libnvidia-container-tools nvidia-container-toolkit
213 # This service fails to start when the image is booted without Nvidia GPUs present, which makes
214 # `systemctl is-system-running` respond with "degraded" and since that command is our default
215 # BootProbeCommand, compute nodes never finish booting from Arvados' perspective.
216 # Disable the service to avoid this. This should be fine because crunch-run does its own basic
217 # CUDA initialization.
218 $SUDO systemctl disable nvidia-persistenced.service
221 # Get Go and build singularity
222 mkdir -p /var/lib/arvados
223 rm -rf /var/lib/arvados/go/
224 curl -s https://storage.googleapis.com/golang/go${GOVERSION}.linux-amd64.tar.gz | tar -C /var/lib/arvados -xzf -
225 ln -sf /var/lib/arvados/go/bin/* /usr/local/bin/
227 singularityversion=3.10.4
229 git clone --recurse-submodules https://github.com/sylabs/singularity
231 git checkout v${singularityversion}
233 # build dependencies for singularity
234 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
235 make build-essential libssl-dev uuid-dev cryptsetup \
236 squashfs-tools libglib2.0-dev libseccomp-dev
239 echo $singularityversion > VERSION
240 ./mconfig --prefix=/var/lib/arvados
242 make -C ./builddir install
243 ln -sf /var/lib/arvados/bin/* /usr/local/bin/
245 # set `mksquashfs mem` in the singularity config file if it is configured
246 if [ "$MKSQUASHFS_MEM" != "" ]; then
247 echo "mksquashfs mem = ${MKSQUASHFS_MEM}" >> /var/lib/arvados/etc/singularity/singularity.conf
250 # Print singularity version installed
251 singularity --version