CI: fix start-docker script

aramprice · aramprice · commit e8f7bb139b9c · 2026-01-29T10:41:16.000-08:00
- replace ruby with bash
- fail if more than one IP addr is found for "OUTER_CONTAINER_IP"
- sundry bash lint cleanup
diff --git a/ci/dockerfiles/docker-cpi/start-bosh.sh b/ci/dockerfiles/docker-cpi/start-bosh.sh
@@ -90,10 +90,12 @@ function stop_docker() {
 }
 
 function start_docker() {
+  local certs_dir
+  certs_dir="${1}"
   # docker will fail starting with the new iptables. it throws:
   # iptables v1.8.7 (nf_tables): Could not fetch rule set generation id: ....
   update-alternatives --set iptables /usr/sbin/iptables-legacy
-  generate_certs $1
+  generate_certs "${certs_dir}"
   mkdir -p /var/log
   mkdir -p /var/run
 
@@ -110,7 +112,8 @@ function start_docker() {
     mount -o remount,rw /proc/sys
   fi
 
-  local mtu=$(cat /sys/class/net/$(ip route get 169.254.169.254|awk '{ print $5 }')/mtu)
+  local mtu
+  mtu=$(cat "/sys/class/net/$(ip route get 169.254.169.254|awk '{ print $5 }')/mtu")
 
   [[ ! -d /etc/docker ]] && mkdir /etc/docker
   cat <<EOF > /etc/docker/daemon.json
@@ -131,11 +134,11 @@ EOF
   service docker start
 
   export DOCKER_TLS_VERIFY=1
-  export DOCKER_CERT_PATH=$1
+  export DOCKER_CERT_PATH="${certs_dir}"
 
   rc=1
   for i in $(seq 1 100); do
-    echo waiting for docker to come up...
+    echo "waiting for docker to come up... (${i})"
     sleep 1
     set +e
     docker info
@@ -150,13 +153,23 @@ EOF
     exit 1
   fi
 
-  echo $certs_dir
+  echo "${certs_dir}"
 }
 
 function main() {
-  export OUTER_CONTAINER_IP=$(ruby -rsocket -e 'puts Socket.ip_address_list
-                          .reject { |addr| !addr.ip? || addr.ipv4_loopback? || addr.ipv6? }
-                          .map { |addr| addr.ip_address }')
+  OUTER_CONTAINER_IP=$(
+    ip addr \
+    | grep 'inet ' \
+    | grep -v -E ' (127\.|172\.|10\.245)' \
+    | cut -d/ -f 1 \
+    | cut -d' ' -f6
+  )
+  export OUTER_CONTAINER_IP
+
+  if [[ "${OUTER_CONTAINER_IP}" == *$'\n'* ]] ; then
+    echo "OUTER_CONTAINER_IP had more than one ip: '${OUTER_CONTAINER_IP}'" >&2
+    exit 1
+  fi
 
   export DOCKER_HOST="tcp://${OUTER_CONTAINER_IP}:4243"
 
@@ -167,9 +180,14 @@ function main() {
   local local_bosh_dir
   local_bosh_dir="/tmp/local-bosh/director"
 
-  docker network create -d bridge --subnet=10.245.0.0/16 director_network
+  local docker_network_name="director_network"
+  if docker network ls | grep -q "${docker_network_name}"; then
+    echo "A docker network named '${docker_network_name}' already exists, skipping creation" >&2
+  else
+    docker network create -d bridge --subnet=10.245.0.0/16 "${docker_network_name}"
+  fi
 
-  pushd ${BOSH_DEPLOYMENT_PATH:-/usr/local/bosh-deployment} > /dev/null
+  pushd "${BOSH_DEPLOYMENT_PATH:-/usr/local/bosh-deployment}" > /dev/null
       export BOSH_DIRECTOR_IP="10.245.0.3"
       export BOSH_ENVIRONMENT="docker-director"
 
@@ -191,7 +209,7 @@ function main() {
         -v internal_ip="${BOSH_DIRECTOR_IP}" \
         -v docker_host="${DOCKER_HOST}" \
         -v network=director_network \
-        -v docker_tls="{\"ca\": \"$(cat ${certs_dir}/ca_json_safe.pem)\",\"certificate\": \"$(cat ${certs_dir}/client_certificate_json_safe.pem)\",\"private_key\": \"$(cat ${certs_dir}/client_private_key_json_safe.pem)\"}" \
+        -v docker_tls="{\"ca\": \"$(cat "${certs_dir}/ca_json_safe.pem")\",\"certificate\": \"$(cat "${certs_dir}/client_certificate_json_safe.pem")\",\"private_key\": \"$(cat "${certs_dir}/client_private_key_json_safe.pem")\"}" \
         ${@} > "${local_bosh_dir}/bosh-director.yml"
 
       command bosh create-env "${local_bosh_dir}/bosh-director.yml" \
@@ -201,10 +219,12 @@ function main() {
       bosh int "${local_bosh_dir}/creds.yml" --path /director_ssl/ca > "${local_bosh_dir}/ca.crt"
       bosh -e "${BOSH_DIRECTOR_IP}" --ca-cert "${local_bosh_dir}/ca.crt" alias-env "${BOSH_ENVIRONMENT}"
 
+      bosh_client_secret="$(bosh int "${local_bosh_dir}/creds.yml" --path /admin_password)"
+
       cat <<EOF > "${local_bosh_dir}/env"
       export BOSH_ENVIRONMENT="${BOSH_ENVIRONMENT}"
       export BOSH_CLIENT=admin
-      export BOSH_CLIENT_SECRET=`bosh int "${local_bosh_dir}/creds.yml" --path /admin_password`
+      export BOSH_CLIENT_SECRET=${bosh_client_secret}
       export BOSH_CA_CERT="${local_bosh_dir}/ca.crt"
 
 EOF
@@ -215,4 +235,4 @@ EOF
   popd > /dev/null
 }
 
-main $@
+main ${@}
