Flatcar Container Linux is an open source Linux distribution designed to be immutable and suitable for running containers. It is a friendly fork of CoreOS Container Linux and as such, compatible with it. By being a minimal operating system it reduces the dependencies required and attack surface area in your infrastructure. With its automated atomic updates, you can easily apply all latest security patches and rollback partition in case of issues.<\/p>\n\n\n\n
Kinvolk<\/a>, the company behind Flatcar Container Linux was acquired by Microsoft in 2021. The initial engineers of Flatcar Linux were also critical in early work with CoreOS (the company acquired by Red Hat) on the rkt container runtime. The positive side is Microsoft’s commitment to keeping Flatcar Container Linux project under community development, while intending to bring expertise of the Kinvolk team to Azure and AKS success.<\/p>\n\n\n\n OpenStack gives us a powerful infrastructure-as-a-service (IaaS) where we can create and run Flatcar Container Linux machines. In this tutorial we’ll share a step-by-step process you’ll follow to have Flatcar Container Linux running in OpenStack. We presume that you have a working OpenStack installation with administrative access to it.<\/p>\n\n\n\n In our recently did an article using Flatcar Container Linux on KVM, see link:<\/p>\n\n\n\n Setup pre-prequisites<\/strong><\/p>\n\n\n\n Flatcar Container Linux is distributed in different channels – Stable, Beta, and Alpha Channel. The Stable channel should be used when setting up production clusters.<\/p>\n\n\n\n In your machine with Uncompress the file once it’s downloaded.<\/p>\n\n\n\n A new file called flatcar_production_openstack_image<\/em>.img will be created in current directory.<\/p>\n\n\n\n Once the image has been downloaded, we can begin to add Flatcar Container Linux image into Glance using Successful upload sample output:<\/p>\n\n\n\n List available images in Glance storage.<\/p>\n\n\n\n For simplicity we shall create only one instance of Flatcar Container Linux on OpenStack. But the same procedure can me modified to replicate as required. The Flatcar Container Linux machine parameters and systemd units can be configured via Container Linux Configs (CLC). CLC format is YAML. Once the configurations are defined, they are then transpiled into Ignition JSON configs<\/em><\/strong> and provided to the instance when booting up. For more reading on supported features<\/a> check official documentation.<\/p>\n\n\n\n The default tool recommended generating Ignition JSON configs from CLC is the Config Transpiler<\/a> (ct for short). The Config Transpiler will validate and transform a Container Linux Config into the format that Flatcar Container Linux can consume – Ignition Config<\/em><\/strong>.<\/p>\n\n\n\n Let’s create Container Linux Config for machine called Paste and modify below contents accordingly.<\/p>\n\n\n\n Where:<\/p>\n\n\n\n You can add other configurations such as systemd units in the file for services to be started. Example systemd unit to start Nginx container using systemd.<\/p>\n\n\n\n The Config Transpiler<\/em><\/strong> is responsible for transforming a Container Linux Config written by a user into an Ignition Config to be consumed by instances of Flatcar Container Linux. The Container Linux Config Transpiler command line interface, For container method ensure Docker<\/a> or Podman<\/a> is installed. Sample command execution output:<\/p>\n\n\n\n You can see the contents generated using:<\/p>\n\n\n\n With the configuration we can boot the the machine with the We\u2019re going to provide our Container Linux Config to OpenStack via the Replace provided parameters with correct values in your environment. An instance boot process begins immediately.<\/p>\n\n\n\n Listing running server instances on OpenStack:<\/p>\n\n\n\n Test it reachability<\/p>\n\n\n\n Once it’s running you should be able to login with Confirm if timezone was configured as set in config<\/p>\n\n\n\n Booting an instance using Cinder Volume<\/em><\/strong><\/p>\n\n\n\n Booting an instance using Static IP address<\/em><\/strong><\/p>\n\n\n\n Flatcar Container Linux’s built-in security features, minimal design and automated updates provide a strong foundation for your infrastructure’s security strategy. By utilizing OpenStack’s powerful orchestration system it becomes easy to deploy your instances that can power other projects such as Kubernetes cluster deployment.<\/p>\n\n","protected":false},"excerpt":{"rendered":" Flatcar Container Linux is an open source Linux distribution designed to be immutable and suitable for running containers. It is a friendly fork of CoreOS Container Linux and as such, compatible with it. By being a minimal operating system it reduces the dependencies required and attack surface area in your infrastructure. With its automated atomic … Read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":130571,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2680,316,299,317,50,58],"tags":[38151],"cfg_series":[],"class_list":["post-131354","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-containers","category-how-to","category-kubernetes","category-linux-tutorials","category-openstack","tag-flatcar-container-linux-on-openstack"],"_links":{"self":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/131354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/comments?post=131354"}],"version-history":[{"count":1,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/131354\/revisions"}],"predecessor-version":[{"id":165511,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/131354\/revisions\/165511"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media\/130571"}],"wp:attachment":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media?parent=131354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/categories?post=131354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/tags?post=131354"},{"taxonomy":"cfg_series","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/cfg_series?post=131354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
openstack<\/code> command line tool configured<\/li>\n\n\n\nStep 1: Download Flatcar image for OpenStack<\/h2>\n\n\n\n
openstack<\/code> command line tool configured, download the latest stable release of Flatcar Container Linux OpenStack image.<\/p>\n\n\n\nwget https:\/\/stable.release.flatcar-linux.net\/amd64-usr\/current\/flatcar_production_openstack_image.img.bz2<\/code><\/pre>\n\n\n\nbunzip2 flatcar_production_openstack_image.img.bz2<\/code><\/pre>\n\n\n\n$ file flatcar_production_openstack_image.img<\/mark>\nflatcar_production_openstack_image.img: QEMU QCOW Image (v2), 9116319744 bytes<\/code><\/pre>\n\n\n\nStep 2: Upload Flatcar image to Glance<\/h2>\n\n\n\n
openstack<\/code> command.<\/p>\n\n\n\nopenstack image create --shared \\\n --container-format bare \\\n --disk-format qcow2 \\\n --file flatcar_production_openstack_image.img \\\n Flatcar<\/mark><\/code><\/pre>\n\n\n\n+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+\n| Field | Value |\n+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+\n| container_format | bare |\n| created_at | 2022-12-11T20:01:31Z |\n| disk_format | qcow2 |\n| file | \/v2\/images\/f164cb8c-3adf-4c7b-9527-44910dac1e63\/file |\n| id | f164cb8c-3adf-4c7b-9527-44910dac1e63 |\n| min_disk | 0 |\n| min_ram | 0 |\n| name | Flatcar |\n| owner | cbb75bc759d94e4e86a2b218a3187d0c |\n| properties | os_hidden='False', owner_specified.openstack.md5='', owner_specified.openstack.object='images\/Flatcar', owner_specified.openstack.sha256='' |\n| protected | False |\n| schema | \/v2\/schemas\/image |\n| status | queued |\n| tags | |\n| updated_at | 2022-12-11T20:01:31Z |\n| visibility | shared |\n+------------------+---------------------------------------------------------------------------------------------------------------------------------------------+<\/code><\/pre>\n\n\n\n$ openstack image list<\/mark>\n+--------------------------------------+-----------------+--------+\n| ID | Name | Status |\n+--------------------------------------+-----------------+--------+\n| 4d40c585-5fc3-4885-b2e6-b5594a1e00a6 | Cirros | active |\n| 420929c2-e295-41b6-974a-71ec9be18673 | Fedora-CoreOS | active |\n| f164cb8c-3adf-4c7b-9527-44910dac1e63 | Flatcar | active |\n+--------------------------------------+-----------------+--------+<\/code><\/pre>\n\n\n\nStep 3: Create Flatcar Container Linux Configuration<\/h2>\n\n\n\n
flatcar-vm-1-config.yaml<\/code><\/p>\n\n\n\nvim flatcar-vm-1-config.yaml<\/code><\/pre>\n\n\n\npasswd:\n users:\n - name: core<\/mark>\n ssh_authorized_keys:\n - ssh-rsa ABCD...<\/mark>\nstorage:\n links:\n - path: \/etc\/localtime\n target: ..\/usr\/share\/zoneinfo\/Africa\/Nairobi<\/mark>\n files:\n - path: \/etc\/systemd\/timesyncd.conf\n filesystem: root\n mode: 0644\n contents:\n inline: |\n [Time]\n NTP=192.168.1.1<\/mark>\n - path: \/etc\/hostname\n mode: 0644\n filesystem: \"root\"\n contents:\n inline: server1.example.com<\/mark><\/code><\/pre>\n\n\n\n\n
systemd:\n units:\n - name: nginx.service\n enabled: true\n contents: |\n [Unit]\n Description=NGINX example\n After=docker.service\n Requires=docker.service\n [Service]\n TimeoutStartSec=0\n ExecStartPre=-\/usr\/bin\/docker rm --force nginx1\n ExecStart=\/usr\/bin\/docker run --name nginx1 --pull always --log-driver=journald --net host docker.io\/nginx:1\n ExecStop=\/usr\/bin\/docker stop nginx1\n Restart=always\n RestartSec=5s\n [Install]\n WantedBy=multi-user.target <\/code><\/pre>\n\n\n\nStep 4: Generate Ignition Config using Config Transpiler<\/h2>\n\n\n\n
ct<\/code> for short, can be downloaded from its GitHub Releases page<\/a> or used via Docker \/ Podman.<\/p>\n\n\n\nct<\/code> requires information about the target environment before it can transform configs which use templating. See example:<\/p>\n\n\n\n### Using Docker ###\n<\/mark><\/em>cat flatcar-vm-1-config.yaml<\/mark> | docker run --rm -i ghcr.io\/flatcar\/ct:latest -platform openstack-metadata > flatcar-vm-1-ignition.json<\/mark>\n\n### Using Podman ###\n<\/mark><\/em>cat flatcar-vm-1-config.yaml<\/mark> | podman run --rm -i ghcr.io\/flatcar\/ct:latest -platform openstack-metadata > flatcar-vm-1-ignition.json<\/mark><\/code><\/pre>\n\n\n\nTrying to pull ghcr.io\/flatcar\/ct:latest...\nGetting image source signatures\nCopying blob fa667c24ea49 done\nCopying config 1b42533095 done\nWriting manifest to image destination\nStoring signatures<\/code><\/pre>\n\n\n\ncat flatcar-vm-1-ignition.json<\/mark><\/code><\/pre>\n\n\n\nStep 5: Boot Flatcar instance on OpenStack using Ignition Config<\/h2>\n\n\n\n
openstack<\/code> CLI, referencing our JSON file from ct<\/a>. But first get required information to create an instance.<\/p>\n\n\n\n### OpenStack Network to use ###\n<\/mark><\/em>$ openstack network list<\/mark>\n+--------------------------------------+---------+--------------------------------------+\n| ID | Name | Subnets |\n+--------------------------------------+---------+--------------------------------------+\n| 60ba5cbb-dc2d-439f-93e2-4f0ba92279e5 | public | ef63e577-7201-4924-b203-daccb21a16ec |\n| b6452743-3910-47dd-b50d-ec8d985fb807 | private | f268d15c-ec47-4c69-ad55-9dc894ce0bc7 |\n+--------------------------------------+---------+--------------------------------------+\n\n### OpenStack flavor to use ###<\/mark><\/em>\n$ openstack flavor list<\/mark>\n+----+-----------+------+------+-----------+-------+-----------+\n| ID | Name | RAM | Disk | Ephemeral | VCPUs | Is Public |\n+----+-----------+------+------+-----------+-------+-----------+\n| 0 | m1.tiny | 512 | 5 | 0 | 1 | True |\n| 1 | m1.small | 1024 | 10 | 0 | 1 | True |\n| 2 | m1.medium | 2048 | 20 | 0 | 2 | True |\n| 3 | m1.large | 4096 | 30 | 0 | 2 | True |\n| 4 | m1.xlarge | 8192 | 40 | 0 | 4 | True |\n+----+-----------+------+------+-----------+-------+-----------+\n<\/mark><\/em>\n### OpenStack <\/mark><\/em>security group<\/em><\/mark> to use ###\n<\/mark><\/em>$ openstack security group list<\/mark>\n+--------------------------------------+------------+------------------------+----------------------------------+------+\n| ID | Name | Description | Project | Tags |\n+--------------------------------------+------------+------------------------+----------------------------------+------+\n| 60c38659-0594-45ed-b662-be22ccc2e63a | permit_all | Allow all ports | cbb75bc759d94e4e86a2b218a3187d0c | [] |\n| d2d7ffe3-5bd5-4703-8b02-b9c59df254ed | default | Default security group | cbb75bc759d94e4e86a2b218a3187d0c | [] |\n| fdae38aa-916a-444c-8b0c-769625717730 | default | Default security group | 8fa3ebba82c44b21878c7740fdc9f4a5 | [] |\n+--------------------------------------+------------+------------------------+----------------------------------+------+\n\n### OpenStack keypair to use ###<\/mark><\/em>\n$ openstack keypair list<\/mark>\n+---------+-------------------------------------------------+------+\n| Name | Fingerprint | Type |\n+---------+-------------------------------------------------+------+\n| admin | 19:7b:5c:14:a2:21:7a:a3:dd:56:c6:e4:3a:22:e8:3f | ssh |\n+---------+-------------------------------------------------+------+<\/code><\/pre>\n\n\n\nuser-data<\/code> flag. See example:<\/p>\n\n\n\nopenstack server create --image Flatcar<\/mark> \\\n --flavor m1.k8s<\/mark> \\\n --network public<\/mark> \\\n --security-group permit_all<\/mark> \\\n --key-name admin<\/mark> \\\n --user-data .\/ flatcar-vm-1-ignition.json<\/mark> \\\n server01<\/mark><\/em><\/code><\/pre>\n\n\n\n+-------------------------------------+------------------------------------------------+\n| Field | Value |\n+-------------------------------------+------------------------------------------------+\n| OS-DCF:diskConfig | MANUAL |\n| OS-EXT-AZ:availability_zone | |\n| OS-EXT-SRV-ATTR:host | None |\n| OS-EXT-SRV-ATTR:hypervisor_hostname | None |\n| OS-EXT-SRV-ATTR:instance_name | |\n| OS-EXT-STS:power_state | NOSTATE |\n| OS-EXT-STS:task_state | scheduling |\n| OS-EXT-STS:vm_state | building |\n| OS-SRV-USG:launched_at | None |\n| OS-SRV-USG:terminated_at | None |\n| accessIPv4 | |\n| accessIPv6 | |\n| addresses | |\n| adminPass | c9aZW7Jn7WxY |\n| config_drive | |\n| created | 2022-12-11T22:19:11Z |\n| flavor | m1.k8s (5) |\n| hostId | |\n| id | 43770e4c-d1fa-406e-9e5a-300d10e10809 |\n| image | Flatcar (f164cb8c-3adf-4c7b-9527-44910dac1e63) |\n| key_name | jkmutai |\n| name | server01 |\n| progress | 0 |\n| project_id | cbb75bc759d94e4e86a2b218a3187d0c |\n| properties | |\n| security_groups | name='60c38659-0594-45ed-b662-be22ccc2e63a' |\n| status | BUILD |\n| updated | 2022-12-11T22:19:11Z |\n| user_id | ff9beb7f5dca4a0887fda897da86f12d |\n| volumes_attached | |\n+-------------------------------------+------------------------------------------------+<\/code><\/pre>\n\n\n\n$ openstack server list<\/mark>\n+--------------------------------------+----------+--------+---------------------+--------------------------+-----------+\n| ID | Name | Status | Networks | Image | Flavor |\n+--------------------------------------+----------+--------+---------------------+--------------------------+-----------+\n| 43770e4c-d1fa-406e-9e5a-300d10e10809 | server01 | ACTIVE | public=192.168.1.12 | Flatcar | m1.k8s |\n| ec90bfd2-e163-47a1-9826-46c4130eae6b | test | ACTIVE | public=192.168.1.84 | N\/A (booted from volume) | m1.medium |\n+--------------------------------------+----------+--------+---------------------+--------------------------+-----------+<\/code><\/pre>\n\n\n\n$ ping -c 2 192.168.1.12<\/mark>\nPING 192.168.1.12 (192.168.1.12): 56 data bytes\n64 bytes from 192.168.1.12: icmp_seq=0 ttl=63 time=58.931 ms\n64 bytes from 192.168.1.12: icmp_seq=1 ttl=63 time=42.578 ms\n\n--- 192.168.1.12 ping statistics ---\n2 packets transmitted, 2 packets received, 0.0% packet loss\nround-trip min\/avg\/max\/stddev = 42.578\/50.755\/58.931\/8.177 ms<\/code><\/pre>\n\n\n\ncore<\/code> user:<\/p>\n\n\n\n$ ssh core@192.168.1.12<\/mark>\nLast login: Mon Dec 12 01:21:46 EAT 2022 from 10.10.10.3 on pts\/0\nFlatcar Container Linux by Kinvolk stable 3374.2.1 for Openstack<\/code><\/pre>\n\n\n\ncore@server01 ~ $ timedatectl<\/mark>\n Local time: Mon 2022-12-12 01:25:13 EAT\n Universal time: Sun 2022-12-11 22:25:13 UTC\n RTC time: Sun 2022-12-11 22:25:13\n Time zone: Africa\/Nairobi<\/mark> (EAT, +0300)\nSystem clock synchronized: yes\n NTP service: active\n RTC in local TZ: no<\/code><\/pre>\n\n\n\nOther examples:<\/h4>\n\n\n\n
openstack server create --image Flatcar \\\n --flavor m1.k8s \\\n --security-group permit_all \\\n --key-name jkmutai \\\n --user-data .\/node04-ignition.json \\\n --boot-from-volume 40<\/mark> \\\n k8snode04<\/code><\/pre>\n\n\n\nopenstack server create --image Flatcar \\\n --flavor m1.k8s \\\n --security-group permit_all \\\n --key-name jkmutai \\\n --user-data .\/node04-ignition.json \\\n --nic net-id=60ba5cbb-dc2d-439f-93e2-4f0ba92279e5<\/mark>,v4-fixed-ip=192.168.1.16<\/mark> \\\n k8snode04<\/code><\/pre>\n\n\n\nConclusion<\/h2>\n\n\n\n