PacketFence running inside a Docker container
This image is based on the official ubuntu 12.04 (precise) docker hub image.
The recipe install packetfence, its dependencies and supervisor.
The container will run supervisord as main process in order to manage the execution of several services needed by packetfence.
This may sound like breaking the Docker best practices, but in this case the complete packetfence service must be considered as a unique service (although we know that is composed of other microservices). Packetfence interacts tightly with several processes and he wants to have the control, so it is not possible to have them in separate containers.
Docker also explain how to run several proceses in a container with supervisor
Mysql is the only service that might be separated, but at the moment it's included to keep the Packetfence configuration simply. In future releases it will be in a separate container and with data volumes.
Docker-compose takes care of the deploy process.
Once the container has been built, docker-compose runs it with this custom options:
-
privileged: packetfence requires several privileges, like namespaces management. Because of this, the container has to be executed as privileged.
-
host network: the container will be launched with full access to the host network stack. This is another requisite for packetfence.
-
kernel modules as volume: at any point, packetfence accesses to /lib/modules/-generic. So it has to be accessible in the container.
The launch command_ for the container is the supervisor daemon. Supervisor will take care of running packetfence and mysqld.
In data/packetfence, execute:
docker-compose up
I used a vagrant environment to test this software. I decided to include the Vagrantfile to let anybody recreate the environment and play with packetfence.
- vagrant
- virtualbox
Download base box
vagrant box add ubuntu-14.04 https://cloud-images.ubuntu.com/vagrant/trusty/current/trusty-server-cloudimg-amd64-vagrant-disk1.box
Start the machine
vagrant up
The first time, vagrant will provision the machine following the provision script embedded in the Vagrantfile.
Vagrant will create 3 virtual private networks. The virtual machine will be connected to them with the following IPs: eth1 -> 192.168.40.4, eth2 -> 192.168.50.4, eth3 -> 192.168.55.4.
When configuring packetfence, you will be able to select which interface acts as inline, which as management, etc.
In the virtual machine, go to /data/packetfence and execute docker-compose up