Hi,
I have a few questions about CoreOS and its suitability for my needs. I currently have a Debian server in need of desperate upgrade running several containers ( currrently in docker). I want to switch to Fedora , either Server or CoreOS.
I’m more drawn to CoreOS, for my simple use case it seem perfect . I don’t really change the base OS much beyond utilising Wireguard for remote access , everything else runs in containers.
I have tested CoreOs in a VM and I’ve started adapting my containers to run using Podman. I’m now testing on an old laptop to perfect my setup before switching my Debian install to Fedora.
This is the basic Butane file I use
variant: fcos
version: 1.6.0
passwd:
users:
- name: core
ssh_authorized_keys:
- ssh-ed25519 MY_KEY
password_hash: My_Password_HASH
storage:
files:
- path: /etc/sysctl.d/90-ipv4-ip-forward.conf
mode: 0644
contents:
inline: |
net.ipv4.ip_forward = 1
- path: /etc/wireguard/wg0.conf
mode: 0600
contents:
inline: |
[Interface]
Address = 10.100.0.1/24
PrivateKey = my_private_key
ListenPort = 51821
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp1s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp1s0 -j MASQUERADE
[Peer]
PublicKey = my_public_key
PresharedKey = my pre_shared_key
AllowedIPs = 10.100.0.2/32
systemd:
units:
- name: wg-quick@wg0.service
enabled: true
Everything works as expected, however it may be just the laptop I’m using but boot to prompt takes maybe 4 or 5 minutes is this normal ?
It displays this for quite a long time,
>>Checking Media Presence...........
>>Media Present..........
>>START PXE over IPv4 on MAC: 00-00-00-00-00-00.
before the boot text starts and eventually I get to the prompt.
also from a fresh install with the above butane and nothing but cockpit installed I have these SELinux errors are they related to the delayed boot times?:
SELinux is preventing ln from create access on the lnk_file boot.mount. For complete SELinux messages run: sealert -l c018328d-e1c0-4ea6-aef7-9c6c4e3ac102
SELinux is preventing cat from getattr access on the file /run/systemd/generator/boot.mount. For complete SELinux messages run: sealert -l 1ab09bce-09c4-4ac5-902d-466844817f59
SELinux is preventing coreos-boot-mou from 'write, open' accesses on the file /run/systemd/generator/boot.mount. For complete SELinux messages run: sealert -l 080241b4-218a-4362-a429-dff62ea83a66
failed to retrieve rpm info for path '/run/systemd/generator/boot.mount':
SELinux is preventing coreos-boot-mou from create access on the file boot.mount. For complete SELinux messages run: sealert -l b8547893-777c-41d1-bdf1-36237d1f56ce
SELinux is preventing coreos-boot-mou from add_name access on the directory boot.mount. For complete SELinux messages run: sealert -l be0e17b3-a253-4dac-b325-7631559cced3
SELinux is preventing coreos-boot-mou from write access on the directory generator. For complete SELinux messages run: sealert -l dbd56e78-a5d5-41a5-bebd-d66abd76b7cc
Apologies for any ignorance regarding SELinux, its always been somewhat an Achilles heel of mine.
I also don’t think I quite understand what BootC and bootable CoreOS images etc.. means. will this mean at some point I will need to transition across to a different setup? or as I read somewhere this should not affect the end user ! I like the idea of set and forget for the most part , but If Fedora CoreOS is in a transition period then maybe I should consider Server instead.
If updates are handled by Zincati within a maintenance window will this be effected in any way if I enable “linger” for a user to start user-run Podman containers.
Cockpit also shows an error:
is this normal also?
I currently use Fedora Kinoite for my desktop which is why I was drawn to CoreOS’s atomic nature and the use of toolbx and Podman containers by default.
thanks in advance for any advice and tips given.