iceBear67
c7afb86ebc
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
34 lines
1000 B
Markdown
34 lines
1000 B
Markdown
# bearnet
|
|
|
|
This repository contains necessarities to build a VM image and corresponding hypervisor image using Dockerfiles.
|
|
|
|
Edit corresponding files in [image/overlay](./image/overlay) to customize VM behaviour. Privileges are required for building VM images as some scripts are depending on `/dev/nbd`.
|
|
|
|
# Build & Running
|
|
|
|
```bash
|
|
# cp .env.example .env
|
|
# vim .env
|
|
# VM_OPTS="--no-cache" HY_OPTS="--no-cache" make
|
|
# fallocate -l 128G ./data/data.raw
|
|
# sgdisk -o -n 1:0:0 -t 1:8300 ./data/data.raw
|
|
# losetup -Pf ./data/data.raw
|
|
# mkfs.ext4 /dev/loop0p1
|
|
# losetup -d /dev/loop0
|
|
|
|
# vim docker-compose.yml
|
|
# docker compose up
|
|
```
|
|
|
|
The given compose file is for reference only. It must be edited according to your situation.
|
|
|
|
Once the image is built and udhcpd is ready, VM's IP will be shown in logs.
|
|
|
|
By default, a OpenSSH server will be listening on :2222.
|
|
|
|
# FAQ
|
|
|
|
> udhcpc: socket(AF_PACKET,2,8): Address family not supported by protocol
|
|
|
|
Clear build cache for both images to unify kernel version.
|