@@ -34,7 +34,7 @@ CONFIGURED_PLATFORM=$([ -f .platform ] && cat .platform || echo vs)
3434# # docker engine version (with platform)
3535DOCKER_VERSION=5:24.0.2-1~debian.11~$IMAGE_DISTRO
3636CONTAINERD_IO_VERSION=1.6.21-1
37- LINUX_KERNEL_VERSION=5.10.0-18 -2
37+ LINUX_KERNEL_VERSION=5.10.0-23 -2
3838
3939# # Working directory to prepare the file system
4040FILESYSTEM_ROOT=./fsroot
@@ -59,6 +59,9 @@ TRUSTED_GPG_DIR=$BUILD_TOOL_PATH/trusted.gpg.d
5959 exit 1
6060}
6161
62+ # # Check if not a last stage of RFS build
63+ if [[ $RFS_SPLIT_LAST_STAGE != y ]]; then
64+
6265# # Prepare the file system directory
6366if [[ -d $FILESYSTEM_ROOT ]]; then
6467 sudo rm -rf $FILESYSTEM_ROOT || die " Failed to clean chroot directory"
@@ -71,11 +74,6 @@ touch $FILESYSTEM_ROOT/$PLATFORM_DIR/firsttime
7174# # ensure proc is mounted
7275sudo mount proc /proc -t proc || true
7376
74- # # make / as a mountpoint in chroot env, needed by dockerd
75- pushd $FILESYSTEM_ROOT
76- sudo mount --bind . .
77- popd
78-
7977# # Build the host debian base system
8078echo ' [INFO] Build host debian base system...'
8179TARGET_PATH=$TARGET_PATH scripts/build_debian_base_system.sh $CONFIGURED_ARCH $IMAGE_DISTRO $FILESYSTEM_ROOT
@@ -113,7 +111,8 @@ sudo LANG=C chroot $FILESYSTEM_ROOT mount
113111# # Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
114112scripts/build_mirror_config.sh files/apt $CONFIGURED_ARCH $IMAGE_DISTRO
115113sudo cp files/apt/sources.list.$CONFIGURED_ARCH $FILESYSTEM_ROOT /etc/apt/sources.list
116- sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until,apt-multiple-retries} $FILESYSTEM_ROOT /etc/apt/apt.conf.d/
114+ sudo cp files/apt/apt-retries-count $FILESYSTEM_ROOT /etc/apt/apt.conf.d/
115+ sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until} $FILESYSTEM_ROOT /etc/apt/apt.conf.d/
117116
118117# # Note: set lang to prevent locale warnings in your chroot
119118sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y update
296295 install_kubernetes ${MASTER_KUBERNETES_VERSION}
297296
298297 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
299- sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install hyperv-daemons gnupg xmlstarlet parted
298+ sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install hyperv-daemons gnupg xmlstarlet parted netcat
300299 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y remove gnupg
301300 sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/cri-dockerd.deb -fsSL \
302301 https://github.com/Mirantis/cri-dockerd/releases/download/v${MASTER_CRI_DOCKERD} /cri-dockerd_${MASTER_CRI_DOCKERD} .3-0.debian-${IMAGE_DISTRO} _amd64.deb
@@ -409,6 +408,10 @@ LogsDirectory=audit
409408LogsDirectoryMode=0750
410409EOF
411410
411+ # latest tcpdump control resource access with AppArmor.
412+ # override tcpdump profile to allow tcpdump access TACACS config file.
413+ sudo cp files/apparmor/usr.bin.tcpdump $FILESYSTEM_ROOT /etc/apparmor.d/local/usr.bin.tcpdump
414+
412415if [[ $CONFIGURED_ARCH == amd64 ]]; then
413416# # Pre-install the fundamental packages for amd64 (x86)
414417sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
@@ -573,24 +576,11 @@ if [ -f files/image_config/ntp/ntp-systemd-wrapper ]; then
573576 sudo cp ./files/image_config/ntp/ntp-systemd-wrapper $FILESYSTEM_ROOT /usr/lib/ntp/
574577fi
575578
576- # # Version file
579+ # # Version file part 1
577580sudo mkdir -p $FILESYSTEM_ROOT /etc/sonic
578581if [ -f files/image_config/sonic_release ]; then
579582 sudo cp files/image_config/sonic_release $FILESYSTEM_ROOT /etc/sonic/
580583fi
581- export build_version= " ${SONIC_IMAGE_VERSION} "
582- export debian_version= " $( cat $FILESYSTEM_ROOT /etc/debian_version) "
583- export kernel_version= " ${kversion} "
584- export asic_type= " ${sonic_asic_platform} "
585- export asic_subtype= " ${TARGET_MACHINE} "
586- export commit_id= " $( git rev-parse --short HEAD) "
587- export branch= " $( git rev-parse --abbrev-ref HEAD) "
588- export release= " $( if [ -f $FILESYSTEM_ROOT /etc/sonic/sonic_release ]; then cat $FILESYSTEM_ROOT /etc/sonic/sonic_release; fi) "
589- export build_date= " $( date -u) "
590- export build_number= " ${BUILD_NUMBER:- 0} "
591- export built_by= " $USER @$BUILD_HOSTNAME "
592- export sonic_os_version= " ${SONIC_OS_VERSION} "
593- j2 files/build_templates/sonic_version.yml.j2 | sudo tee $FILESYSTEM_ROOT /etc/sonic/sonic_version.yml
594584
595585# Default users info
596586export password_expire= " $( [[ " $CHANGE_DEFAULT_PASSWORD " == " y" && echo true || echo false ) "
@@ -612,6 +602,60 @@ if [[ ! -f './asic_config_checksum' ]]; then
612602fi
613603sudo cp ./asic_config_checksum $FILESYSTEM_ROOT /etc/sonic/asic_config_checksum
614604
605+ # # Check if not a last stage of RFS build
606+ fi
607+
608+ if [[ $RFS_SPLIT_FIRST_STAGE == y ]]; then
609+ echo ' [INFO] Finished with RFS first stage'
610+ echo ' [INFO] Umount all'
611+
612+ # # Display all process details access /proc
613+ sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
614+ # # Kill the processes
615+ sudo LANG=C chroot $FILESYSTEM_ROOT fuser -km /proc || true
616+ # # Wait fuser fully kill the processes
617+ sudo timeout 15s bash -c ' until LANG=C chroot $0 umount /proc; do sleep 1; done' $FILESYSTEM_ROOT || true
618+
619+ sudo rm -f $TARGET_PATH /$RFS_SQUASHFS_NAME
620+ sudo mksquashfs $FILESYSTEM_ROOT $TARGET_PATH /$RFS_SQUASHFS_NAME -Xcompression-level 1
621+
622+ exit 0
623+ fi
624+
625+ if [[ $RFS_SPLIT_LAST_STAGE == y ]]; then
626+ echo ' [INFO] RFS build: second stage'
627+
628+ # # ensure proc is mounted
629+ sudo mount proc /proc -t proc || true
630+
631+ sudo fuser -vm $FILESYSTEM_ROOT || true
632+ sudo rm -rf $FILESYSTEM_ROOT
633+ sudo unsquashfs -d $FILESYSTEM_ROOT $TARGET_PATH /$RFS_SQUASHFS_NAME
634+
635+ # # make / as a mountpoint in chroot env, needed by dockerd
636+ pushd $FILESYSTEM_ROOT
637+ sudo mount --bind . .
638+ popd
639+
640+ trap_push ' sudo LANG=C chroot $FILESYSTEM_ROOT umount /proc || true'
641+ sudo LANG=C chroot $FILESYSTEM_ROOT mount proc /proc -t proc
642+ fi
643+
644+ # # Version file part 2
645+ export build_version= " ${SONIC_IMAGE_VERSION} "
646+ export debian_version= " $( cat $FILESYSTEM_ROOT /etc/debian_version) "
647+ export kernel_version= " ${kversion} "
648+ export asic_type= " ${sonic_asic_platform} "
649+ export asic_subtype= " ${TARGET_MACHINE} "
650+ export commit_id= " $( git rev-parse --short HEAD) "
651+ export branch= " $( git rev-parse --abbrev-ref HEAD) "
652+ export release= " $( if [ -f $FILESYSTEM_ROOT /etc/sonic/sonic_release ]; then cat $FILESYSTEM_ROOT /etc/sonic/sonic_release; fi) "
653+ export build_date= " $( date -u) "
654+ export build_number= " ${BUILD_NUMBER:- 0} "
655+ export built_by= " $USER @$BUILD_HOSTNAME "
656+ export sonic_os_version= " ${SONIC_OS_VERSION} "
657+ j2 files/build_templates/sonic_version.yml.j2 | sudo tee $FILESYSTEM_ROOT /etc/sonic/sonic_version.yml
658+
615659if [ -f sonic_debian_extension.sh ]; then
616660 ./sonic_debian_extension.sh $FILESYSTEM_ROOT $PLATFORM_DIR $IMAGE_DISTRO
617661fi
@@ -757,8 +801,7 @@ sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
757801# # Kill the processes
758802sudo LANG= C chroot $FILESYSTEM_ROOT fuser -k m /proc || true
759803# # Wait fuser fully kill the processes
760- sleep 15
761- sudo LANG= C chroot $FILESYSTEM_ROOT umount /proc || true
804+ sudo timeout 15s bash -c ' until LANG=C chroot $0 umount /proc; do sleep 1; done' $FILESYSTEM_ROOT || true
762805
763806# # Prepare empty directory to trigger mount move in initramfs-tools/mount_loop_root, implemented by patching
764807sudo mkdir $FILESYSTEM_ROOT /host
0 commit comments