Skip to content

Commit 6cdcd57

Browse files
mattiaswalmattiaswal
authored
Merge pull request #1126 from kernelkit/misc
Upgrade podman to fix critical container issues
2 parents da3bf57 + 1d0c2be commit 6cdcd57

File tree

39 files changed

+1389
-177
lines changed

39 files changed

+1389
-177
lines changed

‎README.md‎

Lines changed: 103 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -2,58 +2,69 @@
22

33
<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
44

5-
Infix is a free, Linux-based, immutable operating system built around
6-
[Buildroot][1] and [sysrepo][2]. A powerful mix that ease porting to
7-
different platforms, simplify long-term maintenance, and provide
8-
made-easy management using NETCONF, RESTCONF[^2], or the built-in
9-
command line interface (CLI) from a console or SSH login.
10-
11-
> [!TIP]
12-
> _Curious how it works?_ Click the **▶ Example CLI Session** below to see
13-
> it in action
14-
> — or jump into the comprehensive [Infix Documentation][4] to learn even more.
15-
16-
Geared for switches and routers — yet its core value fits plenty of
17-
other use cases:
18-
19-
- Runs from a squashfs image on a read-only partition
20-
- Single configuration file on a separate partition
21-
- Built around YANG with standard IETF models
22-
- Linux switchdev provides open switch APIs
23-
- Atomic upgrades to secondary partition
24-
- Highly security focused
25-
26-
An immutable[^1] operating system enhances security and inherently makes
27-
it maintenance-free. Configuration and data, e.g, containers, is stored
28-
on separate partitions to ensure complete separation from system files
29-
and allow for seamless backup, restore, and provisioning.
30-
31-
In itself, Infix is perfectly suited for dedicated networking tasks,
32-
such as routing, switching, and monitoring. This is how it started, as
33-
a network focused operating system. Now, with native support for Docker
34-
containers, it provides a versatile platform that can easily be adapted
35-
to any customer need. Be it legacy applications, network protocols,
36-
process monitoring, or edge data analysis, it can run close to end
37-
equipment. Either directly connected on dedicated Ethernet ports or
38-
indirectly using virtual network cables to exist on the same LAN as
39-
other connected equipment.
40-
41-
The simple design of Infix provides complete control over both system
42-
and data, minimal cognitive burden, and makes it incredibly easy to get
43-
started.
44-
45-
<details><summary><b>Example CLI Session</b></summary>
46-
47-
The CLI configure context is automatically generated from the loaded
48-
YANG models and their corresponding [sysrepo][2] plugins. The following
49-
is brief example of how to set the IP address of an interface:
5+
Turn any ARM or x86 device into a powerful, manageable network appliance
6+
in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
7+
routers, IoT gateways, edge devices, or custom network solutions that
8+
just work.
509

51-
```
10+
## Our Values
11+
12+
**🔒 Immutable**
13+
Your system never breaks. Read-only filesystem with atomic upgrades
14+
means no configuration drift, no corrupted updates, and instant rollback
15+
if something goes wrong. Deploy once, trust forever.
16+
17+
**🤝 Friendly**
18+
Actually easy to use. Auto-generated CLI from standard YANG models comes
19+
with built-in help for every command — just hit `?` or TAB for
20+
context-aware assistance. Familiar NETCONF/RESTCONF APIs and
21+
[comprehensive documentation][4] mean you're never stuck. Whether
22+
you're learning networking or managing enterprise infrastructure.
23+
24+
**🛡️ Secure**
25+
Built with security as a foundation, not an afterthought. Minimal
26+
attack surface, separation between system and data, and container
27+
isolation. Sleep better knowing your infrastructure is protected.
28+
29+
## Why Choose Infix
30+
31+
**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
32+
enterprise switching hardware. Same OS, same tools, same reliability.
33+
34+
**Standards-Based**: Built around YANG models and IETF standards. Learn
35+
once, use everywhere - no vendor lock-in.
36+
37+
**Container Ready**: Run your applications alongside networking
38+
functions. GPIO access, dedicated Ethernet ports, custom protocols —
39+
your device, your rules.
40+
41+
## Use Cases
42+
43+
1. **Home Labs & Hobbyists**:
44+
Transform a Raspberry Pi into a full-featured router with WiFi
45+
1. **IoT & Edge Computing**:
46+
Bridge devices to the cloud with reliable, updatable gateways
47+
1. **Small Business Networks**:
48+
Enterprise-grade features without the complexity or cost
49+
1. **Developers & Makers**:
50+
Test networking concepts, prototype IoT solutions, or build custom
51+
appliances
52+
1. **Network Professionals**:
53+
Consistent tooling from development to production deployment.
54+
How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
55+
56+
## See It In Action
57+
58+
Configure an interface in seconds - the CLI guides you with built-in help:
59+
60+
<details><summary><b>Click Here for an example CLI Session</b></summary>
61+
62+
```bash
5263
admin@infix-12-34-56:/> configure
5364
admin@infix-12-34-56:/config/> edit interface eth0
5465
admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
5566
address autoconf bind-ni-name enabled
56-
forwarding mtu neighbor
67+
forwarding mtu neighbor
5768
admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
5869
admin@infix-12-34-56:/config/interface/eth0/> show
5970
type ethernet;
@@ -62,7 +73,6 @@ ipv4 {
6273
prefix-length 24;
6374
}
6475
}
65-
ipv6
6676
admin@infix-12-34-56:/config/interface/eth0/> diff
6777
interfaces {
6878
interface eth0 {
@@ -85,56 +95,64 @@ lo ethernet UP 00:00:00:00:00:00
8595
admin@infix-12-34-56:/> copy running-config startup-config
8696
```
8797
88-
[Click here][3] for more details.
98+
Notice how TAB completion shows available options, `show` displays
99+
current config, and `diff` shows exactly what changed before you
100+
commit your changes with the `leave` command.
101+
89102
</details>
90103
91-
Infix can run on many different types of architectures and boards, much
92-
thanks to Linux and Buildroot. Currently the focus is on 64-bit ARM
93-
devices, optionally with switching fabric supported by Linux switchdev.
94-
The [following boards](board/aarch64/README.md) are fully supported:
104+
> [Full CLI documentation →][3]
95105
96-
- Marvell CN9130 CRB
97-
- Marvell EspressoBIN
98-
- Microchip SparX-5i PCB135 (eMMC)
99-
- NXP i.MX8MP EVK
100-
- Raspberry Pi 4B
101-
- NanoPi R2S
106+
## Get Started
102107
103-
Additionally, StarFive VisionFive2, a RISC-V based two-port router, and
104-
an x86_64 build is also available. The latter is primarily intended for
105-
development and testing, but can also be used for evaluation and demo
106-
purposes. For more information, see: [Infix in Virtual
107-
Environments](doc/virtual.md).
108+
Get [pre-built images][5] for your hardware. Use the CLI, web
109+
interface, or standard NETCONF/RESTCONF tools, e.g., `curl`. Add
110+
containers for any custom functionality you need.
108111
109-
> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
110-
> page for our pre-built images. The *[Latest Build][]* has bleeding
111-
> edge images, if possible we recommend using a versioned release.
112-
>
113-
> For *customer specific builds* of Infix, see your product repository.
112+
### Supported Platforms
114113
114+
- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
115+
- **NanoPi R2S** - Compact dual-port router in a tiny package
116+
- **x86_64** - Run in VMs or on mini PCs for development and testing
117+
- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM platforms
118+
- **Microchip SparX-5i, NXP i.MX8MP EVK** - Enterprise switching capabilities
119+
- **StarFive VisionFive2** - RISC-V architecture support
115120
116-
----
121+
*Why start with Raspberry Pi?* It's affordable, widely available, has
122+
built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
123+
in production. Perfect for learning, prototyping, or even small-scale
124+
deployments.
117125
118-
<div align="center">
119-
<a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
120-
<br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
121-
</div>
126+
> 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
127+
128+
## Technical Details
122129
123-
----
130+
Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
131+
for reliability you can trust:
124132
125-
[^1]: An immutable operating system is one with read-only file systems,
126-
atomic updates, rollbacks, declarative configuration, and workload
127-
isolation. All to improve reliability, scalability, and security.
128-
For more information, see this [survey paper][5] and [article][6].
129-
[^2]: Partial RESTCONF support, features like HTTP PATCH, OPTIONS, HEAD,
130-
and copying between datastores are still missing.
133+
- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
134+
- **YANG Configuration**: Industry-standard models with auto-generated tooling
135+
- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
136+
- **Container Integration**: Docker support with flexible network and hardware access
137+
- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
138+
139+
Perfect for everything from resource-constrained edge devices to
140+
high-throughput network appliances.
141+
142+
> Check the *[Latest Build][]* for bleeding-edge features.
143+
144+
---
145+
146+
<div align="center">
147+
<a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/play.svg" width=300></a>
148+
<br />Infix development is sponsored by <a href="https://wires.se">Wires</a>
149+
</div>
131150
132151
[1]: https://buildroot.org/ "Buildroot Homepage"
133152
[2]: https://www.sysrepo.org/ "Sysrepo Homepage"
134-
[3]: doc/cli/introduction.md
135-
[4]: https://kernelkit.org/infix/ "Infix User's Guide"
136-
[5]: https://ceur-ws.org/Vol-3386/paper9.pdf "Immutable Operating Systems: A Survey"
137-
[6]: https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/ "Why you should run an immutable Linux distro"
153+
[3]: https://kernelkit.org/infix/latest/cli/introduction/
154+
[4]: https://kernelkit.org/infix/
155+
[5]: https://github.com/kernelkit/infix/releases
138156
[Latest Build]: https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
139157
[License]: https://en.wikipedia.org/wiki/GPL_license
140158
[License Badge]: https://img.shields.io/badge/License-GPL%20v2-blue.svg

‎board/common/rootfs/etc/finit.d/available/[email protected]‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Start a container instance (%i) and redirect logs to /log/container
2-
# Give podman enough time to properly shut down the container. Every
3-
# time we start a container we run the setup stage, disable the Finit
4-
# timeout to allow the setup stage to run to completion.
5-
sysv log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
6-
pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container \
2+
# Give podman enough time to properly shut down the container, kill:30
3+
# The pre:script, which is responsibe for fetching a remote image, must
4+
# not have a timeout. The cleanup should take no longer than a minute.
5+
sysv log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
6+
pre:0,/usr/sbin/container cleanup:60,/usr/sbin/container \
77
[2345] <!> :%i container -n %i -- container %i

0 commit comments

Comments
 (0)