hook.yaml

# Attention, this is a template that is run through envsubst, but with a specific list of variables to replace. Thus:
# - HOOK_VERSION: ${HOOK_VERSION} (a simple 1.2.3 string, no 'v')
# - HOOK_KERNEL_IMAGE: ${HOOK_KERNEL_IMAGE}
# - HOOK_KERNEL_ID: ${HOOK_KERNEL_ID}
# - HOOK_KERNEL_VERSION: ${HOOK_KERNEL_VERSION}
# - HOOK_CONTAINER_BOOTKIT_IMAGE: ${HOOK_CONTAINER_BOOTKIT_IMAGE}
# - HOOK_CONTAINER_DOCKER_IMAGE: ${HOOK_CONTAINER_DOCKER_IMAGE}
# - HOOK_CONTAINER_MDEV_IMAGE: ${HOOK_CONTAINER_MDEV_IMAGE}
# - HOOK_CONTAINER_CONTAINERD_IMAGE: ${HOOK_CONTAINER_CONTAINERD_IMAGE}
# - HOOK_CONTAINER_RUNC_IMAGE: ${HOOK_CONTAINER_RUNC_IMAGE}
# - HOOK_CONTAINER_EMBEDDED_IMAGE: ${HOOK_CONTAINER_EMBEDDED_IMAGE}
# - Other variables are not replaced: for example this is a literal dollarsign-SOMETHING: $SOMETHING and with braces: ${SOMETHING}

# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

kernel:
  image: "${HOOK_KERNEL_IMAGE}"
  # The cmdline is a random string with 1024 characters. It is used for binary patching in the ISO image.
  # The kernel and initrd don't use this cmdline. The bootloader that loads the kernel determines the cmdline that will be used.
  cmdline: "464vn90e7rbj08xbwdjejmdf4it17c5zfzjyfhthbh19eij201hjgit021bmpdb9ctrc87x2ymc8e7icu4ffi15x1hah9iyaiz38ckyap8hwx2vt5rm44ixv4hau8iw718q5yd019um5dt2xpqqa2rjtdypzr5v1gun8un110hhwp8cex7pqrh2ivh0ynpm4zkkwc8wcn367zyethzy7q8hzudyeyzx3cgmxqbkh825gcak7kxzjbgjajwizryv7ec1xm2h0hh7pz29qmvtgfjj1vphpgq1zcbiiehv52wrjy9yq473d9t1rvryy6929nk435hfx55du3ih05kn5tju3vijreru1p6knc988d4gfdz28eragvryq5x8aibe5trxd0t6t7jwxkde34v6pj1khmp50k6qqj3nzgcfzabtgqkmeqhdedbvwf3byfdma4nkv3rcxugaj2d0ru30pa2fqadjqrtjnv8bu52xzxv7irbhyvygygxu1nt5z4fh9w1vwbdcmagep26d298zknykf2e88kumt59ab7nq79d8amnhhvbexgh48e8qc61vq2e9qkihzt1twk1ijfgw70nwizai15iqyted2dt9gfmf2gg7amzufre79hwqkddc1cd935ywacnkrnak6r7xzcz7zbmq3kt04u2hg1iuupid8rt4nyrju51e6uejb2ruu36g9aibmz3hnmvazptu8x5tyxk820g2cdpxjdij766bt2n3djur7v623a2v44juyfgz80ekgfb9hkibpxh3zgknw8a34t4jifhf116x15cei9hwch0fye3xyq0acuym8uhitu5evc4rag3ui0fny3qg4kju7zkfyy8hwh537urd5uixkzwu5bdvafz4jmv7imypj543xg5em8jk8cgk7c4504xdd5e4e71ihaumt6u5u2t1w7um92fepzae8p0vq93wdrd1756npu1pziiur1payc7kmdwyxg3hj5n4phxbc29x0tcddamjrwt260b0w"

init:
  # this init container sha has support for volumes
  - linuxkit/init:872d2e1be745f1acb948762562cf31c367303a3b
  - "${HOOK_CONTAINER_RUNC_IMAGE}"
  - "${HOOK_CONTAINER_CONTAINERD_IMAGE}"
  - linuxkit/ca-certificates:v1.0.0
  - linuxkit/firmware:24402a25359c7bc290f7fc3cd23b6b5f0feb32a5 # "Some" firmware from Linuxkit pkg; see https://github.com/linuxkit/linuxkit/blob/master/pkg/firmware/Dockerfile
  - "${HOOK_CONTAINER_EMBEDDED_IMAGE}"

onboot:
  - name: rngd1
    image: linuxkit/rngd:v1.0.0
    command: [ "/sbin/rngd", "-1" ]

  - name: sysctl
    image: linuxkit/sysctl:v1.0.0

  - name: sysfs
    image: linuxkit/sysfs:v1.0.0

  - name: modprobe
    image: linuxkit/modprobe:v1.0.0
    command: [ "modprobe", "cdc_ncm" ] # for usb ethernet dongles

  - name: dhcpcd-once
    image: linuxkit/dhcpcd:v1.0.0
    command: [ "/etc/ip/dhcp.sh", "true" ] # 2nd paramter is one-shot true/false: true for onboot, false for services
    #capabilities.add:
    #  - CAP_SYS_TIME # for ntp one-shot no-max-offset after ntpd, for hardware missing RTC's that boot in 1970
    capabilities:
      - all
    binds.add:
      - /var/lib/dhcpcd:/var/lib/dhcpcd
      - /run:/run
      - /etc/ip/dhcp.sh:/etc/ip/dhcp.sh
      - /dhcpcd.conf:/dhcpcd.conf
    runtime:
      mkdir:
        - /var/lib/dhcpcd

  - name: device-discovery
    image: device-discovery:latest
    capabilities:
      - all
    net: host
    binds:
      - /dev:/dev
      - /dev/ttyS0:/dev/ttyS0 
      - /dev/ttyS1:/dev/ttyS1 
      - /etc/resolv.conf:/etc/resolv.conf
      - /etc/idp/server_cert.pem:/usr/local/share/ca-certificates/IDP_keyclock.crt
      - /var:/var:rshared,rbind
      - /etc/hook/env_config:/etc/hook/env_config
      - /proc/cmdline:/host_proc_cmdline
      - /etc/idp/ca.pem:/usr/local/share/ca-certificates/ca.crt
    rootfsPropagation: shared
    env:
      - KEYCLOAK_URL=update_idp_url
      - onboarding_manager_svc=update_onboarding_manager_svc
      - onboarding_stream_svc=update_onboarding_stream_svc
      - OBM_PORT=443
      - EXTRA_HOSTS=update_extra_hosts
      - INSECURE=true
    devices:
    - path: all
      type: b
    - path: all
      type: c
    - path: "/dev/console"
      type: c
      major: 5
      minor: 1
      mode: "0666"
    - path: "/dev/tty0"
      type: c
      major: 4
      minor: 0
      mode: "0666"
    - path: "/dev/tty1"
      type: c
      major: 4
      minor: 1
      mode: "0666"
    - path: "/dev/ttyS0"
      type: c
      major: 4
      minor: 64
      mode: "0666"
    - path: "/dev/ttyS1"
      type: c
      major: 4
      minor: 65
      mode: "0666"
    - path: "/dev/ttyS2"
      type: c
      major: 4
      minor: 66
      mode: "0666"

services:
  - name: rngd
    image: linuxkit/rngd:v1.0.0

  - name: ntpd
    image: linuxkit/openntpd:v1.0.0

  - name: mdev
    image: "${HOOK_CONTAINER_MDEV_IMAGE}"
    command: [ "mdev", "-v", "-S", "-df" ]
    capabilities:
      - all
    binds:
      - /dev/:/dev/
      - /lib/modules:lib/modules
    rootfsPropagation: shared
    devices:
      - path: all
        type: b

  - name: getty
    image: linuxkit/getty:v1.0.0
    capabilities:
      - all
    binds.add:
      - /etc/profile.d/local.sh:/etc/profile.d/local.sh
      - /etc/securetty:/etc/securetty
      - /etc/motd:/etc/motd
      - /etc/os-release:/etc/os-release
      - /:/host_root
      - /dev:/dev
      - /dev/console:/dev/console
      - /usr/bin/nerdctl:/usr/bin/nerdctl
    env:
      - INSECURE=true
    devices:
    - path: all
      type: b
    - path: all
      type: c
    - path: "/dev/console"
      type: c
      major: 5
      minor: 1
      mode: "0666"
    - path: "/dev/tty0"
      type: c
      major: 4
      minor: 0
      mode: "0666"
    - path: "/dev/tty1"
      type: c
      major: 4
      minor: 1
      mode: "0666"
    - path: "/dev/ttyS0"
      type: c
      major: 4
      minor: 64
      mode: "0666"
    - path: "/dev/ttyS1"
      type: c
      major: 4
      minor: 65
      mode: "0666"
    - path: "/dev/ttyS2"
      type: c
      major: 4
      minor: 66
      mode: "0666"
    - path: "/dev/ttyAMA0"
      type: c
      major: 204
      minor: 64
      mode: "0666"
    - path: "/dev/ttyAMA1"
      type: c
      major: 204
      minor: 65
      mode: "0666"
    - path: "/dev/ttyAML0"
      type: c
      major: 243
      minor: 0
      mode: "0666"
    - path: "/dev/ttyAML1"
      type: c
      major: 243
      minor: 1
      mode: "0666"
    - path: "/dev/ttyUSB0"
      type: c
      major: 188
      minor: 0
      mode: "0666"
    - path: "/dev/ttyUSB1"
      type: c
      major: 188
      minor: 1
      mode: "0666"

  - name: fluent-bit
    image: fluentbit:latest
    binds.add:
      - /etc/fluent-bit/fluent-bit.yaml:/fluent-bit/etc/fluent-bit.yaml
      - /var/log:/var/log
    rootfsPropagation: shared

  - name: hook-docker
    image: "${HOOK_CONTAINER_DOCKER_IMAGE}"
    capabilities:
      - all
    net: host
    pid: host
    mounts:
      - type: cgroup2
        options: [ "rw", "nosuid", "noexec", "nodev", "relatime" ]
        destination: /sys/fs/cgroup
    binds.add:
      - /dev/console:/dev/console
      - /dev:/dev
      - /etc/resolv.conf:/etc/resolv.conf
      - /lib/modules:/lib/modules
      - /var/run/docker:/var/run
      - /var/run/images:/var/lib/docker
      - /var/run/worker:/worker
      - /dev/shm:/dev/shm
    runtime:
      mkdir:
        - /var/run/images
        - /var/run/docker
        - /var/run/worker
    devices:
    - path: all
      type: b
    - path: all
      type: c

  - name: hook-bootkit
    image: "${HOOK_CONTAINER_BOOTKIT_IMAGE}"
    capabilities:
      - all
    net: host
    mounts:
      - type: cgroup2
        options: [ "rw", "nosuid", "noexec", "nodev", "relatime" ]
        destination: /sys/fs/cgroup
    binds:
      - /var/run/docker:/var/run
    runtime:
      mkdir:
        - /var/run/docker

  - name: caddy
    image: caddy:2.9.1-alpine
    command: ["/bin/sh", "/etc/caddy/caddy_run.sh"]
    capabilities:
      - all
    binds.add:
      - /etc/resolv.conf:/etc/resolv.conf
      - /etc/idp/ca.pem:/usr/local/share/ca-certificates/orchestrator-ca.crt
      - /etc/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /etc/caddy/caddy_run.sh:/etc/caddy/caddy_run.sh
      - /dev/shm/idp_access_token:/dev/shm/idp_access_token
      - /dev/shm/release_token:/dev/shm/release_token
      - /dev/shm/project_id:/dev/shm/project_id
      - /etc/hook/env_config:/etc/hook/env_config

    # Intended docker variables to be populated from environment
    env:
      - tink_stack_svc=update_tink_stack_svc
      - tink_server_svc=update_tink_server_svc
      - release_svc=update_release_svc
      - logging_svc=update_logging_svc
      - oci_release_svc=update_oci_release_svc
      - EXTRA_HOSTS=update_extra_hosts

  - name: dhcpcd-daemon
    image: linuxkit/dhcpcd:v1.0.0
    command: [ "/etc/ip/dhcp.sh", "false" ] # 2nd paramter is one-shot true/false: true for onboot, false for services
    #capabilities.add:
    #  - CAP_SYS_TIME # for ntp one-shot no-max-offset after ntpd, for hardware missing RTC's that boot in 1970
    capabilities:
      - all
    binds.add:
      - /var/lib/dhcpcd:/var/lib/dhcpcd
      - /run:/run
      - /etc/ip/dhcp.sh:/etc/ip/dhcp.sh
      - /dhcpcd.conf:/dhcpcd.conf
    runtime:
      mkdir:
        - /var/lib/dhcpcd

#SSH_SERVER  - name: sshd
#SSH_SERVER    image: linuxkit/sshd:v1.0.0
#SSH_SERVER    binds.add:
#SSH_SERVER      - /etc/profile.d/local.sh:/etc/profile.d/local.sh
#SSH_SERVER      - /root/.ssh/authorized_keys:/root/.ssh/authorized_keys
#SSH_SERVER      - /usr/bin/nerdctl:/usr/bin/nerdctl
#SSH_SERVER      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
#SSH_SERVER      - /:/host_root


files:
  - path: etc/profile.d/local.sh
    contents: |
      alias       docker='nerdctl -n services.linuxkit exec -it hook-docker docker'
      alias docker-shell='nerdctl -n services.linuxkit exec -it hook-docker sh'
      export PS1='HookOS ${HOOK_VERSION}:\w\$ '
      # only print CRITICAL or higher kernel messages to console
      echo 2 > /proc/sys/kernel/printk

    mode: "0644"

  - path: etc/idp/ca.pem
    source: files/idp/ca.pem
    mode: "0644"

  - path: etc/idp/server_cert.pem
    source: files/idp/server_cert.pem
    mode: "0644"

  - path: etc/motd
    mode: "0644"
    contents: ""

  - path: etc/issue
    mode: "0644"
    contents: ""

  - path: etc/os-release
    mode: "0444"
    contents: |
      NAME="HookOS"
      VERSION=${HOOK_VERSION}
      ID=hookos
      VERSION_ID=${HOOK_VERSION}
      PRETTY_NAME="HookOS ${HOOK_KERNEL_ID} v${HOOK_VERSION}/k${HOOK_KERNEL_VERSION}"
      ANSI_COLOR="1;34"
      HOME_URL="https://github.com/tinkerbell/hook"

  # Putting scripts in /etc/init.d/ allows them to be run at boot time by the init system
  - path: etc/init.d/002-vlan.sh
    source: "files/vlan.sh"
    mode: "0777"

  # Putting scripts in /etc/init.d/ allows them to be run at boot time by the init system
  - path: etc/init.d/003-static-network.sh
    source: "files/static-network.sh"
    mode: "0777"

  # This makes the script available in the host $PATH
  - path: sbin/setup-dns
    source: "files/setup-dns.sh"
    mode: "0777"

  - path: etc/ip/dhcp.sh
    source: "files/dhcp.sh"
    mode: "0777"

  - path: dhcpcd.conf
    source: "files/dhcpcd.conf"
    mode: "0644"

  - path: etc/securetty
    contents: |
      console
      tty0
      tty1
      tty2
      tty3
      tty4
      tty5
      tty6
      tty7
      tty8
      tty9
      tty10
      tty11
      hvc0
      ttyS0
      ttyS1
      ttyS2
      ttyAMA0
      ttyAMA1
      ttyAML0
      ttyAML1
      ttyUSB0
      ttyUSB1
      ttyUSB2

  - path: /etc/fluent-bit/fluent-bit.yaml
    source: "files/fluent-bit/fluent-bit.yaml"
    mode: "0644"

  - path: etc/caddy/Caddyfile
    source: "files/caddy/Caddyfile"
    mode: "0644"

  - path: etc/caddy/caddy_run.sh
    source: "files/caddy/caddy_run.sh"
    mode: "0777"

  - path: etc/hook/env_config
    contents: ""
    mode: "0644"


#SSH_SERVER  - path: root/.ssh/authorized_keys
#SSH_SERVER    source: ~/.ssh/id_rsa.pub
#SSH_SERVER    mode: "0600"
#SSH_SERVER    optional: true

trust:
  org:
    - linuxkit
    - library