Got LinuxKit working, and a custom VM built, but I have a docker issue

rip_docker/.gitignore

@@ -1,4 +1,6 @@
+bin
 dangerzone-cmdline
 dangerzone-initrd.img
 dangerzone-kernel
 dangerzone-state
+stdout.log

rip_docker/README.md

@@ -10,70 +10,61 @@ The most promising path forward is with [LinuxKit](https://github.com/linuxkit/l
 
 Docker is required for linuxkit to build the VM image.
 
-### Install LinuxKit and HyperKit
+### Collect the binaries
-
-Install from homebrew:
 
 ```sh
-brew tap linuxkit/linuxkit
+mkdir -p bin
-brew install --HEAD linuxkit
+
-brew install hyperkit
+# download pre-built LinuxKit binary
+cd bin
+wget https://github.com/linuxkit/linuxkit/releases/download/v0.8/linuxkit-darwin-amd64
+chmod +x linuxkit-darwin-amd64 
+mv linuxkit-darwin-amd64 linuxkit
+cd ..
+
+# copy binaries from Docker Desktop
+cp /Applications/Docker.app/Contents/Resources/bin/com.docker.hyperkit bin/hyperkit
+cp /Applications/Docker.app/Contents/Resources/bin/com.docker.vpnkit bin/vpnkit
+cp /Applications/Docker.app/Contents/Resources/bin/com.docker.cli bin/docker
 ```
 
-### Build the dangerzone VM image
+### Build the dangerzone VM image and see if it works
 
 ```sh
-linuxkit build -format kernel+initrd dangerzone.yml
+./bin/linuxkit build -format kernel+initrd dangerzone.yml
 ```
 
 And then try running it:
 
 ```sh
-linuxkit run hyperkit -hyperkit /usr/local/bin/hyperkit -networking=vpnkit -vsock-ports=2376 -disk size=4096M -data-file ./metadata.json -kernel -uefi dangerzone
+./bin/linuxkit run hyperkit \
+    -hyperkit ./bin/hyperkit \
+    -vpnkit ./bin/vpnkit \
+    -data-file ./metadata.json \
+    -networking=vpnkit \
+    -vsock-ports=2376 \
+    -disk size=4096M \
+    -mem 2048 \
+    -kernel dangerzone
 ```
 
-### Uninstall Docker Desktop
+And see if it works:
-
-Just to make sure it isn't interfering. Click the Docker systray icon > Troubleshooting > Uninstall, and then delete Docker from Applications.
-
-
-
-
-### Old stuff
-
-Here's my attempts at installing from source, documented for posterity.
 
 ```sh
-mkir -p build bin
+./bin/docker -H unix://dangerzone-state/guest.00000948 ps
-
+```
-# download pre-built linuxkit binary
+
-cd bin
+Inside the VM you can shutdown with `poweroff`.
-wget https://github.com/linuxkit/linuxkit/releases/download/v0.8/linuxkit-darwin-amd64
+
-chmod +x linuxkit-darwin-amd64 
+### Ooh, almost there
-cd ..
+
-
+```
-# build hyperkit
+$ ./bin/docker -H unix://dangerzone-state/guest.00000948 run hello-world
-cd build
+Unable to find image 'hello-world:latest' locally
-wget https://github.com/moby/hyperkit/archive/refs/tags/v0.20210107.tar.gz
+latest: Pulling from library/hello-world
-mv v0.20210107.tar.gz hyperkit-v0.20210107.tar.gz
+b8dfde127a29: Pull complete 
-tar -xf hyperkit-v0.20210107.tar.gz
+Digest: sha256:9f6ad537c5132bcce57f7a0a20e317228d382c3cd61edae14650eec68b2b345c
-cd hyperkit-0.20210107
+Status: Downloaded newer image for hello-world:latest
-make
+docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"process_linux.go:432: running prestart hook 0 caused \\\"fork/exec /proc/7/exe: no such file or directory\\\"\"": unknown.
-cp ../..
+ERRO[0003] error waiting for container: context canceled
-ln -s build/hyperkit-0.20210107/build/hyperkit bin/hyperkit
-
-# install dependencies for vpnkit
-brew install wget opam pkg-config
-opam init # only need to run this if opam wasn't installed before
-
-# build vpnkit
-cd build
-# wget https://github.com/moby/vpnkit/archive/refs/tags/v0.5.0.tar.gz
-wget https://github.com/micahflee/vpnkit/archive/refs/heads/ocaml-upgrade.tar.gz
-mv ocaml-upgrade.tar.gz vpnkit-ocaml-upgrade.tar.gz
-tar -xf vpnkit-ocaml-upgrade.tar.gz
-cd vpnkit-ocaml-upgrade
-make
-
-# uggh, I keep failing at this. going to switch to homebrew
 ```

rip_docker/dangerzone.yml

@@ -27,7 +27,7 @@ onboot:
   # make a swap file on the mounted disk
   - name: swap
     image: linuxkit/swap:0028aeae2741d28120e4d2c6efcc5af003eae395
-    command: ["/swap.sh", "--path", "/var/lib/swap", "--size", "1024M"]
+    command: ["/swap.sh", "--path", "/var/lib/swap", "--size", "1G"]
   # mount-vpnkit mounts the 9p share used by vpnkit to coordinate port forwarding
   - name: mount-vpnkit
     image: alpine:3.11
@@ -46,18 +46,22 @@ onboot:
   - name: dhcpcd
     image: linuxkit/dhcpcd:1033f340e2d42f86a60aab70752346f0045ea388
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
+
 services:
-  # Enable acpi to shutdown on power events
+  # # Enable acpi to shutdown on power events
-  - name: acpid
+  # - name: acpid
-    image: linuxkit/acpid:d2ddd88c7918466f875e7c5c3e527b51dfb0b0ea
+  #   image: linuxkit/acpid:d2ddd88c7918466f875e7c5c3e527b51dfb0b0ea
+
   # Enable getty for easier debugging
   - name: getty
     image: linuxkit/getty:ed32c71531f5998aa510847bb07bd847492d4101
     env:
         - INSECURE=true
-  # Run ntpd to keep time synchronised in the VM
+
-  - name: ntpd
+  # # Run ntpd to keep time synchronised in the VM
-    image: linuxkit/openntpd:66f25a516c7460f5e49195309cf276903741c428
+  # - name: ntpd
+  #   image: linuxkit/openntpd:66f25a516c7460f5e49195309cf276903741c428
+
   # VSOCK to unix domain socket forwarding. Forwards guest /var/run/docker.sock
   # to a socket on the host.
   - name: vsudd
@@ -65,6 +69,7 @@ services:
     binds:
         - /var/run:/var/run
     command: ["/vsudd", "-inport", "2376:unix:/var/run/docker.sock"]
+
   # vpnkit-forwarder forwards network traffic to/from the host via VSOCK port 62373. 
   # It needs access to the vpnkit 9P coordination share 
   - name: vpnkit-forwarder
@@ -73,12 +78,15 @@ services:
         - /var/vpnkit:/port
     net: host
     command: ["/vpnkit-forwarder", "-vsockPort", "62373"]
+
   # Monitor for image deletes and invoke a TRIM on the container filesystem
   - name: trim-after-delete
     image: linuxkit/trim-after-delete:ac6307a62c926a49a067d4de8667c2789b5ce2c9
-  # When the host resumes from sleep, force a clock resync
+
-  - name: host-timesync-daemon
+  # # When the host resumes from sleep, force a clock resync
-    image: linuxkit/host-timesync-daemon:32fec3fc7d03e5600ef88526c8f187cf21e8e0cc
+  # - name: host-timesync-daemon
+  #   image: linuxkit/host-timesync-daemon:32fec3fc7d03e5600ef88526c8f187cf21e8e0cc
+
   # Run dockerd with the vpnkit userland proxy from the vpnkit-forwarder container.
   # Bind mounts /var/run to allow vsudd to connect to docker.sock, /var/vpnkit
   # for vpnkit coordination and /run/config/docker for the configuration file.
@@ -107,7 +115,11 @@ services:
     runtime:
       mkdir: ["/var/lib/docker"]
 
-trust:
+# Definitely not ideal to comment this out, but this was throwing an error I couldn't get past:
-    org:
+# ERRO[0001] Metadata for targets/justin expired
-        - linuxkit
+# DEBU[0001] downloaded targets/justin.3be767f335e3367389eaae85739901f6e9c886995e752615adfe63ba5cb3cd34 is invalid: targets/justin expired at Thu Jun 11 16:05:18 +0200 2020
-        - library
+
+# trust:
+#     org:
+#         - linuxkit
+#         - library

rip_docker/rip.py

@@ -0,0 +1,9 @@
+import docker
+
+
+def main():
+    client = docker.DockerClient(base_url="unix://dangerzone-state/guest.00000948")
+
+
+if __name__ == "__main__":
+    main()