1 #!/bin/bash -euxo pipefail
3 # Copyright (C) The Arvados Authors. All rights reserved.
5 # SPDX-License-Identifier: Apache-2.0
10 while $SUDO fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do
11 echo "APT: Waiting for apt/dpkg locks to be released..."
17 $SUDO DEBIAN_FRONTEND=noninteractive apt-get --yes update
19 # Install gnupg and dirmgr or gpg key checks will fail
20 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
25 # For good measure, apt-get upgrade
26 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes upgrade
28 # Make sure cloud-init is installed
29 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install cloud-init
30 if [[ ! -d /var/lib/cloud/scripts/per-boot ]]; then
31 mkdir -p /var/lib/cloud/scripts/per-boot
34 TMP_LSB=`/usr/bin/lsb_release -c -s`
35 LSB_RELEASE_CODENAME=${TMP_LSB//[$'\t\r\n ']}
37 # Add the arvados apt repository
38 echo "# apt.arvados.org" |$SUDO tee --append /etc/apt/sources.list.d/apt.arvados.org.list
39 echo "deb http://apt.arvados.org/$LSB_RELEASE_CODENAME $LSB_RELEASE_CODENAME${REPOSUFFIX} main" |$SUDO tee --append /etc/apt/sources.list.d/apt.arvados.org.list
41 # Add the arvados signing key
42 cat /tmp/1078ECD7.asc | $SUDO apt-key add -
44 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get install --yes debian-keyring debian-archive-keyring
47 $SUDO /bin/sed -ri 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
48 $SUDO /usr/sbin/locale-gen
50 # Install some packages we always need
51 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get --yes update
52 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
58 libcurl4-openssl-dev \
64 # Install the Arvados packages we need
65 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
66 python3-arvados-fuse \
67 arvados-docker-cleaner \
70 # Get Go and build singularity
72 mkdir -p /var/lib/arvados
73 rm -rf /var/lib/arvados/go/
74 curl -s https://storage.googleapis.com/golang/go${goversion}.linux-amd64.tar.gz | tar -C /var/lib/arvados -xzf -
75 ln -sf /var/lib/arvados/go/bin/* /usr/local/bin/
77 singularityversion=3.7.4
78 curl -Ls https://github.com/sylabs/singularity/archive/refs/tags/v${singularityversion}.tar.gz | tar -C /var/lib/arvados -xzf -
79 cd /var/lib/arvados/singularity-${singularityversion}
81 # build dependencies for singularity
82 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install \
83 make build-essential libssl-dev uuid-dev cryptsetup
85 echo $singularityversion > VERSION
86 ./mconfig --prefix=/var/lib/arvados
88 make -C ./builddir install
89 ln -sf /var/lib/arvados/bin/* /usr/local/bin/
91 # set `mksquashfs mem` in the singularity config file if it is configured
92 if [ "$MKSQUASHFS_MEM" != "" ]; then
93 echo "mksquashfs mem = ${MKSQUASHFS_MEM}" >> /var/lib/arvados/etc/singularity/singularity.conf
96 # Print singularity version installed
99 # Remove unattended-upgrades if it is installed
100 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes remove unattended-upgrades --purge
102 # Configure arvados-docker-cleaner
103 $SUDO mkdir -p /etc/arvados/docker-cleaner
104 $SUDO echo -e "{\n \"Quota\": \"10G\",\n \"RemoveStoppedContainers\": \"always\"\n}" > /etc/arvados/docker-cleaner/docker-cleaner.json
106 # Enable cgroup accounting
107 $SUDO sed -i 's/GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"/g' /etc/default/grub
110 # Set a higher ulimit and the resolver (if set) for docker
111 if [ "x$RESOLVER" != "x" ]; then
112 SET_RESOLVER="--dns ${RESOLVER}"
115 $SUDO sed "s/ExecStart=\(.*\)/ExecStart=\1 --default-ulimit nofile=10000:10000 ${SET_RESOLVER}/g" \
116 /lib/systemd/system/docker.service \
117 > /etc/systemd/system/docker.service
119 $SUDO systemctl daemon-reload
121 # docker should not start on boot: we restart it inside /usr/local/bin/ensure-encrypted-partitions.sh,
122 # and the BootProbeCommand might be "docker ps -q"
123 $SUDO systemctl disable docker
125 # Make sure user_allow_other is set in fuse.conf
126 $SUDO sed -i 's/#user_allow_other/user_allow_other/g' /etc/fuse.conf
128 # Add crunch user with sudo powers
129 $SUDO adduser --disabled-password --gecos "Crunch user,,,," crunch
130 # Do not require a password to sudo
131 echo -e "# for the crunch user\ncrunch ALL=(ALL) NOPASSWD:ALL" | $SUDO tee /etc/sudoers.d/91-crunch
133 # Set up the ssh public key for the crunch user
134 $SUDO mkdir /home/crunch/.ssh
135 $SUDO mv /tmp/crunch-authorized_keys /home/crunch/.ssh/authorized_keys
136 $SUDO chown -R crunch:crunch /home/crunch/.ssh
137 $SUDO chmod 600 /home/crunch/.ssh/authorized_keys
138 $SUDO chmod 700 /home/crunch/.ssh/
140 # Make sure we resolve via the provided resolver IP if set. Prepending is good enough because
141 # unless 'rotate' is set, the nameservers are queried in order (cf. man resolv.conf)
142 if [ "x$RESOLVER" != "x" ]; then
143 $SUDO sed -i "s/#prepend domain-name-servers 127.0.0.1;/prepend domain-name-servers ${RESOLVER};/" /etc/dhcp/dhclient.conf
146 if [ "$AWS_EBS_AUTOSCALE" != "1" ]; then
147 # Set up the cloud-init script that will ensure encrypted disks
148 $SUDO mv /tmp/usr-local-bin-ensure-encrypted-partitions.sh /usr/local/bin/ensure-encrypted-partitions.sh
150 wait_for_apt_locks && $SUDO DEBIAN_FRONTEND=noninteractive apt-get -qq --yes install jq unzip
152 curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"
153 unzip -q /tmp/awscliv2.zip -d /tmp && $SUDO /tmp/aws/install
154 # Pinned to v2.4.5 because we apply a patch below
155 #export EBS_AUTOSCALE_VERSION=$(curl --silent "https://api.github.com/repos/awslabs/amazon-ebs-autoscale/releases/latest" | jq -r .tag_name)
156 export EBS_AUTOSCALE_VERSION="v2.4.5"
157 cd /opt && $SUDO git clone https://github.com/awslabs/amazon-ebs-autoscale.git
158 cd /opt/amazon-ebs-autoscale && $SUDO git checkout $EBS_AUTOSCALE_VERSION
160 $SUDO patch -p1 < /tmp/create-ebs-volume-nvme.patch
162 # This script really requires bash and the shebang line is wrong
163 $SUDO sed -i 's|^#!/bin/sh|#!/bin/bash|' /opt/amazon-ebs-autoscale/bin/ebs-autoscale
165 # Set up the cloud-init script that makes use of the AWS EBS autoscaler
166 $SUDO mv /tmp/usr-local-bin-ensure-encrypted-partitions-aws-ebs-autoscale.sh /usr/local/bin/ensure-encrypted-partitions.sh
169 $SUDO chmod 755 /usr/local/bin/ensure-encrypted-partitions.sh
170 $SUDO chown root:root /usr/local/bin/ensure-encrypted-partitions.sh
171 $SUDO mv /tmp/etc-cloud-cloud.cfg.d-07_compute_arvados_dispatch_cloud.cfg /etc/cloud/cloud.cfg.d/07_compute_arvados_dispatch_cloud.cfg
172 $SUDO chown root:root /etc/cloud/cloud.cfg.d/07_compute_arvados_dispatch_cloud.cfg