Fedora CoreOSや色々なディストリビューションをnetboot.xyzでディスクレスブート

.
├── README.md
├── containers
│   ├── dnsmasq
│   │   ├── Dockerfile
│   │   ├── dnsmasq.conf
│   │   └── tftpboot
│   ├── matchbox
│   │   ├── etc
│   │   └── var
└── docker-compose.yml

version: '3'

services:
  dnsmasq:
    container_name: dnsmasq
    build:
      context: containers/dnsmasq
    network_mode: "host"
    volumes:
    - ./containers/dnsmasq/tftpboot/linux-install:/var/ftpd
    - ./containers/dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf
    restart: always
  matchbox:
    container_name: 'matchbox'
    image: quay.io/poseidon/matchbox:latest
    volumes:
      - ./containers/matchbox/var/lib/matchbox:/var/lib/matchbox:Z
      - ./containers/matchbox/etc/matchbox:/etc/matchbox:Z,ro
    ports:
      - '8080:8080'
    command: -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081
    restart: always
  netbootxyz:
    image: linuxserver/netbootxyz
    container_name: netbootxyz
    environment:
      - PUID=1000
      - PGID=1000
    ports:
      - 3000:3000
      - 8081:80
    restart: always

FROM alpine:edge
RUN apk --no-cache add dnsmasq
EXPOSE 67/udp 69/udp 4011/udp
CMD ["dnsmasq", "-k", "-d"]

except-interface=virbr0
dhcp-range=10.10.254.0,proxy
pxe-service=tag:#ipxe,x86PC,"PXE chainload to iPXE",undionly.kpxe
# iPXE user classからのリクエストの場合はipxeタグをセットする
dhcp-userclass=set:ipxe,iPXE
# netboot.xyzでセットアップしたいMACアドレスを追記していく
dhcp-mac=set:netboot,02:1a:4a:16:01:9c
tag-if=set:netboot-xyz, tag:ipxe, tag:netboot
# netboot.xyz
pxe-service=tag:netboot-xyz,x86PC,"iPXE",http://10.10.254.200:8081/menus/menu.ipxe
# matchbox
pxe-service=tag:ipxe,x86PC,"iPXE",http://10.10.254.200:8080/boot.ipxe
enable-tftp
tftp-root=/var/ftpd
log-queries
log-dhcp

  matchbox:
    container_name: 'matchbox'
    image: quay.io/poseidon/matchbox:latest
    volumes:
      - ./containers/matchbox/var/lib/matchbox:/var/lib/matchbox:Z
      - ./containers/matchbox/etc/matchbox:/etc/matchbox:Z,ro
    ports:
      - '8080:8080'
    command: -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081
    restart: always

.
├── assets
│   ├── default.ipxe
│   ├── fedora-coreos-31.20200113.3.1-live-initramfs.x86_64.img
│   └── fedora-coreos-31.20200113.3.1-live-kernel-x86_64
├── groups
│   └── fs01.json
├── ignition
│   ├── fedora-core-1.ign
│   └── netboot-xyz-1.ign
└── profiles
    ├── fedora-core-1.json
    └── netboot-xyz-1.json

{
  "id": "fedora-core-1",
  "name": "Fedora Core - 1",
  "profile": "fedora-core-1",
  "selector": {
    "mac": "00:24:1d:18:28:09"
  }
}

{
    "id": "fedora-core-1",
    "name": "Fedora Core - 1",
    "ignition_id": "fedora-core-1.ign",
    "boot": {
        "kernel": "/assets/fedora-coreos-31.20200407.3.0-live-kernel-x86_64",
        "initrd": [
            "/assets/fedora-coreos-31.20200407.3.0-live-initramfs.x86_64.img"
        ],
        "args": [
            "ip=dhcp",
            "rd.neednet=1",
            "console=tty0",
            "console=ttyS0",
            "selinux=0",
            "ignition.firstboot",
            "ignition.platform.id=metal",
            "systemd.unified_cgroup_hierarchy=0",
            "sshkey=ssh-rsa himitu [email protected]",
            "ignition.config.url=http://10.10.254.200:8080/ignition?mac=${mac:hexhyp}"
        ]
    }
}

coreos_stable=$(curl https://builds.coreos.fedoraproject.org/streams/stable.json)
kernel_url=$(echo $coreos_stable | jq  --raw-output '.architectures.x86_64.artifacts.metal.formats.pxe.kernel.location')
initramfs_url=$(echo $coreos_stable | jq  --raw-output '.architectures.x86_64.artifacts.metal.formats.pxe.initramfs.location')

curl -O $kernel_url
curl -O $initramfs_url

variant: fcos
version: 1.0.0
passwd:
  users:
    - name: inoue
      groups:
        - adm
        - sudo
      ssh_authorized_keys:
        - ssh-rsa ssh公開鍵 [email protected]
systemd:
  units:
    - name: shell.service
      enabled: true
      contents: |
        [Unit]
        Description=Alpine CLI Shell
        After=network.target
        [Service]
        Type=simple
        ExecStart=/usr/bin/podman run --rm --privileged -v /:/host -ti alpine:latest /bin/ash
        [Install]
        WantedBy=multi-user.target

{
  "ignition": {
    "config": {
      "replace": {
        "source": null,
        "verification": {}
      }
    },
    "security": {
      "tls": {}
    },
    "timeouts": {},
    "version": "3.0.0"
  },
  "passwd": {
    "users": [
      {
        "groups": [
          "adm",
          "sudo"
        ],
        "name": "inoue",
        "sshAuthorizedKeys": [
          "ssh-rsa SSHの公開鍵 [email protected]"
        ]
      }
    ]
  },
  "storage": {},
  "systemd": {
    "units": [
      {
        "contents": "[Unit]\nDescription=Alpine CLI Shell\nAfter=network.target\n[Service]\nType=simple\nExecStart=/usr/bin/podman run --rm --privileged -v /:/host -ti alpine:latest /bin/ash\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
        "name": "shell.service"
      }
    ]
  }

firewall-cmd --zone=public --add-service=tftp-client --permanent
firewall-cmd --zone=public --add-service=tftp --permanent
firewall-cmd --zone=public --add-service=proxy-dhcp --permanent
firewall-cmd --zone=public --add-service=dhcp --permanent
firewall-cmd --zone=public --add-port=69/udp --permanent         # TFTP
firewall-cmd --zone=public --add-service=dns --permanent
firewall-cmd --zone=public --add-port=4011/udp --permanent       # PXE proxy
firewall-cmd --zone=public --add-port=8080/tcp --permanent       # 私がmatchboxに割り当てたポート
firewall-cmd --reload
firewall-cmd --list-all