Red Hat SummitChapter 6. Managing Atomic Hosts
6.1. Atomic Host
The atomic command-line tool can be used to check the status of your Atomic Host system, perform upgrades and rollbacks or deploy a specific operating system tree.
Use atomic host status to list the operating system trees downloaded on your system and check which version you are currently running. The asterisk (*) marks the currently running tree.
To upgrade your system, use atomic host upgrade. This command will download the latest ostree available and will deploy it after you reboot the system. When you upgrade again, the newly downloaded ostree will replace the oldest one. Upgrading can take a few minutes.
atomic host upgrade systemctl reboot
# atomic host upgrade
# systemctl reboot
To switch back to the other downloaded tree on your system, use atomic host rollback. This command is particularly useful when there is a problem after upgrade (for example the new packages break a service that you’ve configured) because it lets you quickly switch back to the previous state. You can use the -r option to initiate a reboot immediately:
atomic host rollback -r
# atomic host rollback -rTo deploy a specific version of an ostree, use atomic host deploy. You can specify a version or a commit ID if you know it.
atomic host deploy <version/commit ID>
# atomic host deploy <version/commit ID>
Use the --preview option to check the package difference between the specified version and your currently running tree.
atomic host deploy 7.3 --preview
# atomic host deploy 7.3 --previewFor finer tasks you can use the ostree tool to manage you Atomic Host. For example, if you are unsure about the version numbering of the trees, you can use the following commands to fetch the ostree logs and list the versions available:
ostree pull --commit-metadata-only --depth -1 rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard ostree log rhel-atomic-host/7/x86_64/standard
# ostree pull --commit-metadata-only --depth -1 rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
# ostree log rhel-atomic-host/7/x86_64/standardYou can delete an ostree deployment using one of the following commands:
rpm-ostree cleanup -r rpm-ostree cleanup -p
# rpm-ostree cleanup -r
# rpm-ostree cleanup -p
The -p option causes the pending deployment to be removed, while -r removes the rollback deployment.
To clear temporary files and cached data, use one of the following commands:
rpm-ostree -m rpm-ostree -b
# rpm-ostree -m
# rpm-ostree -b
The -m option deletes cached RPM repository metadata, while -b clears temporary files, but leaves deployments intact.
Both the atomic and ostree tools have built-in detailed --help options, to check all commands available on the system, use atomic host --help or ostree --help.
6.2. Package Layering
Using rpm-ostree install, you can add an RPM software packages that is not part of the original OSTree permanently to the system. With rpm-ostree override, you can override an existing RPM package in the base system layer with a different version of that package. These features are done using the package layering feature.
Package layering is useful when you need to install a certain package on a single machine, without affecting other machines that share the same OSTree. An example use case of package layering is installing diagnostics tools, such as strace. An example of overriding a package in the base system is if you wanted to use a different version of the docker package.
6.2.1. Installing a new RPM package on a RHEL Atomic Host
To install a layered package and its dependencies on RHEL Atomic Host, run the following command:
rpm-ostree install <package>
# rpm-ostree install <package>To remove a layered package, use the following command:
rpm-ostree uninstall <package>
# rpm-ostree uninstall <package>
Running the rpm-ostree install or rpm-ostree uninstall does not immediately install or uninstall the packages. To actually install or uninstall the packages, you have two options:
- Reboot the system.
Use LiveFS to apply the changes immediately.
NoteLiveFS is still a technology preview feature, so do not rely on it in production.
If you are only installing packages, use the
rpm-ostree ex livefscommand.If you are deleting or upgrading the packages, use the
rpm-ostree ex livefs --replacecommand.
You can find out which packages have been manually installed on the system by running atomic host status.
The following is an example of installing strace on RHEL Atomic Host and how to verify it is part of the OSTree. Just as with installing a package with yum, you must register and subscribe your Atomic Host system before installing packages:
Check the current status of your Atomic Host’s deployments:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Install the strace package as follows:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check the status again to see the layered package created by installing strace.
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Note that the strace package does not appear to be installed yet:
rpm -q strace
# rpm -q strace package strace is not installedCopy to Clipboard Copied! Toggle word wrap Toggle overflow Consider several issues: Although the package was installed on its own layer, it does not yet appear as being installed on the system. At this point you need to apply the pending deployment by either rebooting or applying them immediately using
rpm-ostree ex livefs. Before making that decision, however, take into account these notes and limitations:If you run
rpm-ostree installseveral times consecutively without rebooting or applying changes live, only the most recent command will take effect. If you installwgetandstraceconsecutively and reboot afterwards, onlystracewill be present after reboot. To add multiple packages onto a new deployment, specify them all on the same line with the command. For example:rpm-ostree install wget strace
# rpm-ostree install wget straceCopy to Clipboard Copied! Toggle word wrap Toggle overflow Installing packages which contain files owned by users other than root is currently not supported. For example, the
httpdpackage contains files with a group ownership ofapache, installing it will fail:Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
After
rpm-ostree install, do not useatomic host deployorrpm-ostree deployto deploy a specific version OSTree version older than 7.2.6. If you attempt to deploy to such a version afterrpm-ostree install, the system will be left in a state where you will be unable to useatomic host upgradeorrpm-ostree upgradeto upgrade to the next release. However,atomic host rollbackorrpm-ostree rollbackwill still be successful and bring the system back to the previous deployment.
Reboot or LiveFS: Either reboot for the deployments to take effect or use the livefs feature, to have them immediately take effect, as follows:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check again to see that the strace package is installed and note the status of deployments, including the new LiveCommit:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
At this point, you can go ahead and start using the installed software. For more information on rpm-ostree and Live updates, see the Project Atomic rpm-ostree
6.2.2. Downloading and caching RPMs for later installation
The --download-only and --cache-only options allow to separate the rpm-ostree install process into two stages:
- Downloading and caching the layered RPMs.
- Installing from the cached data.
These options enable you to download the RPMs at one time, and then install them later whenever you choose, even offline.
6.2.3. Updating the repository metadata
The rpm-ostree refresh-md subcommand downloads and caches the latest repository metadata. It is similar to the yum makecache command for the Yum package manager.
6.2.4. Overriding an existing RPM package
To override an RPM package that is in the Atomic base and install a different version, you use the rpm-ostree override command. Here’s how it works:
- Copy the RPM package you want to use to the Atomic host. Include any dependent packages needed by the RPM as well. The packages can be upgrades or downgrades from the current packages.
-
Run the
rpm-ostree overridecommand. - Reboot the Atomic host for the change to take effect.
See Locking the version of the docker package on RHEL Atomic Host for an example of how to use rpm-ostree override to replace the docker runtime in Atomic.
Here’s an example of replacing the openssh-server package (and dependent packages) on a RHEL Atomic Host.
- Get the RPM package (and dependent packages) you want to replace and put them in a directory on the Atomic Host.
With the packages in the current directory (in this case, downgrades of openssh-server, openssh-clients, and openssh), type the following to replace those packages:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Reboot the Atomic Host system:
systemctl reboot
# systemctl rebootCopy to Clipboard Copied! Toggle word wrap Toggle overflow Check that the packages have been installed and are available:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
If you just want to go back to the previous package versions, you can use rpm-ostree override reset to do that. Use rpm-ostree override reset <packagename> to remove individual packages or rpm-ostree override reset --all to remove all overridden packages.
6.3. "ostree admin unlock"
ostree admin unlock unlocks the current ostree deployment and allows packages to be installed temporarily by mounting a writable overlayfs on /usr. However, the packages installed afterwards will not persist after reboot. ostree admin unlock also has certain limitations and known issues with overlayfs and SELinux, so it should be used only for testing. For adding software, rpm-ostree install is recommended for long-term use.
6.4. System Containers and Super-Privileged Containers (SPCs)
In some cases, containerized services or applications require that they are run from a container image that is built in a different than the default way for Docker-formatted containers. Such special case containers are the Super-Privileged Containers (SPCs), and the system containers. They are necessary in two situations:
- SPCs: When a certain container needs more privileges and access to the host.
Super-Privileged Containers are run with special privileges to the host computer, and unlike the default Docker-formatted containers, are able to modify the host. Tools for monitoring and logging are containzerized in SPCs so they can have the access to the host they requires. Such SPCs are rsyslog, sadc, and the atomic-tools container. For detailed information about SPCs, see Running Super-Privileged Containers chapter from the Red Hat Enterprise Linux Atomic Host Managing Containers Guide.
- System Containers: A certain container needs to run independently of the docker daemon.
System containers are a way to containerize services which are needed before the docker daemon is running. Such services configure the environment for docker, (for example setting up networking), so they can’t be run by the docker daemon and because of that, they are not Docker-formatted images. They use runc for runtime, ostree for storage, skopeo for searching and pulling from a registry and systemd for management. A system container is executed from a systemd UNIT file using the runc utility. Additionally, containerizing such services is a way to make the ostree system image smaller. Such System Containers are etcd and flannel. For detailed information, see Running System Containers chapter from the Red Hat Enterprise Linux Atomic Host Managing Containers Guide.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}