This is not a how-to, but more of a detailed confession about a terrible thing I’ve done in the last few days. The basic concept for this crime against humanity came during a user’s group meeting where several companies expressed overwhelming interest in containers, but were pinned to older, unsupported versions of CentOS due to 3rd party software constraints. They asked if it would be possible to run a CentOS-4 based container instead of a full VM. While obviously migrating from CentOS-4 to a more recent (and supported) version would be preferable, there are some benefits to migrating a CentOS 4 system to a Docker container. I played around with this off and on over the weekend, and finally came up with something fairly functional. I immediately destroyed it so there could be no evidence linking me to this activity.
The basics for how I accomplied this are listed below. They are terrible. Please do NOT follow them.
Disable selinux on your container host.
Look, I told you this was terrible. Dan Walsh and Vaclav Pavlin of Red Hat were kind enough to provide us patches for SELinux in CentOS-6, and then again for CentOS-5. I’m not going to repay their kindness by dragging them into this mess too. Dan is a really nice guy, please don’t make him cry.
The reason we disable selinux is explained on the CentOS-Devel mailing list. Since there’s no patch for CentOS-4 containers, selinux has to be disabled on the host for things to work properly.
Build a minimal vm.
Initially I tried running a slightly modified version of our CentOS-5 kickstart file for Docker through the usual build process. This mostly worked, however it was somewhat unreliable. The build process did not always exit cleanly, often leaving behind broken loop objects I couldn’t unmount. The resulting container worked, but had no functional rpmdb. The conversion trick used with CentOS-5 didn’t work properly with CentOS-4, even accounting for version differences.
I finally decided to build a normal vm image using virt-install. You could use virt-manager to do this part, it really doesn’t matter. There have been a number of functional improvements to anaconda over the years, and going back to the CentOS-4 installer hammers this home. I had to adjust my kickstart to use the old format, removing several more modern options I’d taken for granted. I ended up with the following. For this install, I made sure to install to an image file for easy extraction later on.
install url --url=http://vault.centos.org/4.9/os/x86_64/ lang en_US.UTF-8 network --device=eth0 --bootproto=dhcp rootpw --iscrypted $1$UKLtvLuY$kka6S665oCFmU7ivSDZzU. authconfig --enableshadow selinux --disabled timezone --utc UTC clearpart --all --initlabel part / --fstype ext3 --size=1024 --grow reboot %packages @Base %post dd if=/dev/urandom count=50 | md5sum | passwd --stdin root passwd -l root rpm -q grub redhat-logos rm -rf /boot rm -rf /etc/ld.so.cache
Extract to tarball
Because we’re wiping out /boot and locking the root user, this image really won’t be useful for anything except converting to a container. The next step is to extract the contents into a smaller archive we can use to build our container. In order to do this, we’ll use the
virt-tar-out command. This image is not going to be as small as the regular CentOS containers in the Docker index. This is partly due to rpm dependencies, and partly to how the image is created. Honestly, if you’re doing this, a few megs of wasted disk space is the least of your worries.
virt-tar-out -a /path/to/centos-4.img / - | xz --best > /path/to/centos-4-docker.tar.xz
Building the Container
At this point we have enough that we could actually just do a
cat centos-4-docker.tar.xz | docker import - centos4, but there are still a few cleanup items that need to be addressed. From here, a basic Dockerfile that provides a vew changes is in order. Since CentOS-4 is End-of-Life and no longer served via the mirrors, the contents of
/etc/yum.repos.d/ need to be modified to point to your local mirror as well as
/etc/sysconfig/rhn/sources if you intend to still use the
up2date utility. To do this, copy your existing yum repo files and sources from your working CentOS-4 systems into the directory with the container tarball, and use a
Dockerfile similar to the one below.
FROM scratch MAINTAINER you <email@example.com> ADD centos-4-docker.tar.xz / ADD CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo ADD sources /etc/sysconfig/rhn/sources
DELETE IT ALL
All that’s left now is to run docker’s build command, and you have a successfully built a CentOS-4 base container to use for migration purposes, or just to make your inner sysadmin cry. Either way. This is completely unsupported. If you’ve treated this as a how-to and followed the steps, I would recommend the following actions:
- Having a long think about the decisions in your life that led you to this moment
- Sobbing uncontrollably
- Apologizing to everyone around you.