The latter is the most secure route since it keeps the password
completely out of any command lines, and the permissions on the file
can be very restrictive, e.g. 0400.
It would be somewhat nicer if the password file contained just
<password>
rather than
WEAVE_PASSWORD=<password>
but then we'd have to transit the password via a temporary file with
0600 permissions.
since w/o that we get an obscure error.
The most likely cause for not having an eth0 is that the docker daemon
has been configured to disable container networking.
e.g. when it was started with --net=none
weavedns wasn't actually using the docker-assigned ip for anything, so
this change is a simple matter of eradicating it from the code.
We want to run as little as possible inside the container netns.
Unfortunately we cannot make that change for the weave container,
since the interface on which we need to invoke ethtool is created by
docker and already inside the container netns by the time we get
control.
`populate_dns` previously used http_call, which looks up the IP for a
container each time. I've factored the HTTP bit after the IP look-up
in http_call out, so it can be used directly. This involved switching
arguments around to make the tail call easier.
_NOTE: You will need to satisfy kernel requirements for Docker._ It's
currently recommended to use 3.10, although 3.8 works as well. We have
done some additional testing on Ubuntu Preciese, and found that the
oldest kernel that Ubuntu ships and weave happily runs on is 3.5,
presumably some some of the issues had been fix since Docker docs were
last updated. This is not to say that kernel version is good one to use,
we do recommend to use the latest, but just in case if you have any
specific reason why you cannot upgrade, then the 3.5 is the oldest we
have tried.
In the absence of *either* a `--dns` or `--dns-search` argument,
Docker will write a `/etc/resolv.conf` based on the host's. Since, in
general, we rely on the DNS search path being empty (so that the
resolver uses the local domain), we want to blank the
`/etc/resolv.conf` by providing `--dns-search=.` when running a
container.
However, if there's a `--dns-search=` in the remainder of the args,
Docker will append them to the dot, which breaks resolution. Not good.
So, we only "blank" the search path if there's no `--dns-search`
argument present already.
since otherwise we are leaving veth pairs behind which a) breaks a
subsequent 'weave attach', and b) runs contrary to 'weave reset's
stated purpose of removing all traces of weave.
NB: This does yank the ethwe interface from the containers.
Fixes#164
Matthias Radestock