Customizing Flatcar on Flatcar Container Linux

Adding users

Mon, 01 Jan 0001 00:00:00 +0000

You can create user accounts on a Flatcar Container Linux machine manually with useradd or via a Butane Config when the machine is created.

Add Users via Butane Configs

In your Butane Config, you can specify many different parameters for each user. Here’s an example:

variant: flatcar
version: 1.0.0
passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGdByTgSVHq......."
    - name: elroy
      password_hash: "$6$5s2u6/jR$un0AvWnqilcgaNB3Mkxd5yYv6mTlWfOoCYHZmfi3LDKVltj.E8XNKEcwWm..."
      ssh_authorized_keys:
        - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGdByTgSVHq......."
      groups: [ sudo, docker ]

Because usermod does not work to add a user to a predefined system group, you can use systemd-userdb to define membership. Here’s the same example with userdb:

Configuring date and time zone

Mon, 01 Jan 0001 00:00:00 +0000

By default, Flatcar Container Linux machines keep time in the Coordinated Universal Time (UTC) zone and synchronize their clocks with the Network Time Protocol (NTP). This page contains information about customizing those defaults, explains the change in NTP client daemons in recent Flatcar Container Linux versions, and offers advice on best practices for timekeeping in Flatcar Container Linux clusters.

Viewing and changing time and date

The timedatectl(1) command displays and sets the date, time, and time zone.

DNS Configuration

Mon, 01 Jan 0001 00:00:00 +0000

By default, DNS resolution on Flatcar Container Linux is handled through /etc/resolv.conf, which is a symlink to /run/systemd/resolve/resolv.conf. This file is managed by systemd-resolved . Normally, systemd-resolved gets DNS IP addresses from systemd-networkd , either via DHCP or static configuration. DNS IP addresses can also be set via systemd-resolved’s resolved.conf . See Network configuration with networkd for more information on systemd-networkd.

Using a local DNS cache

systemd-resolved includes a caching DNS resolver. To use it for DNS resolution and caching, you must enable it via nsswitch.conf by adding resolve to the hosts section.

Kernel modules and other settings

Mon, 01 Jan 0001 00:00:00 +0000

Loading kernel modules

Most Linux kernel modules get automatically loaded as-needed but there are a some situations where this doesn’t work. Problems can arise if there is boot-time dependencies are sensitive to exactly when the module gets loaded. Module auto-loading can be broken all-together if the operation requiring the module happens inside of a container. iptables and other netfilter features can easily encounter both of these issues. To force a module to be loaded early during boot simply list them in a file under /etc/modules-load.d. The file name must end in .conf.

OverlayBD Artifact Streaming

Mon, 01 Jan 0001 00:00:00 +0000

Installation

Flatcar Container Linux offers support for the installation and customization of containerd’s accelerated container image artifact streaming. Both accelerated-container-image and the overlaybd back-end are combined in an optional, system dependent sysext .

The sysext can be provisioned simply by adding the line overlaybd to /etc/flatcar/enabled-sysext.conf. Since these sysexts are system dependent (compiled against the system’s C library), they will be updated automatically in lockstep with the operating system.

Example Butane configuration:

---
# config.yaml
# butane < config.yaml > config.json
variant: flatcar
version: 1.0.0

storage:
  files:
  - path: /etc/flatcar/enabled-sysext.conf
    contents:
      inline: |
        overlaybd

Usage

The below usage largely follows upstream’s Getting started guide .

Using NVIDIA GPUs on Flatcar

Mon, 01 Jan 0001 00:00:00 +0000

Installation

Flatcar Container Linux offers support for the installation and customization of NVIDIA drivers for Tesla GPUs (both in VMs and on bare metal). Please take note that NVIDIA drivers have been migrated from being solely available on AWS and Azure to being accessible on all platforms with the release of version 3637.0.0. If you are using an older version, please be aware that it is restricted to AWS and Azure only.

Network configuration with networkd

Mon, 01 Jan 0001 00:00:00 +0000

Flatcar Container Linux machines are preconfigured with networking customized for each platform. You can write your own networkd units to replace or override the units created for each platform. This article covers a subset of networkd functionality. You can view the full docs here .

Drop a networkd unit in /etc/systemd/network/ or inject a unit on boot via a Butane Config. Files placed manually on the filesystem will need to reload networkd afterwards with sudo systemctl restart systemd-networkd. Network units injected via a Butane Config will be written to the system before networkd is started, so there are no work-arounds needed.

Customizing the etcd unit

Mon, 01 Jan 0001 00:00:00 +0000

The etcd systemd unit can be customized by overriding the unit that ships with the default Flatcar Container Linux settings. Common use-cases for doing this are covered below.

Use client certificates

etcd supports client certificates as a way to provide secure communication between clients ↔ leader and internal traffic between etcd peers in the cluster. Configuring certificates for both scenarios is done through a Butane Config. Options provided here will augment the unit that ships with Flatcar Container Linux.

Tuning Flatcar Container Linux power management

Mon, 01 Jan 0001 00:00:00 +0000

CPU governor

By default, Flatcar Container Linux uses the “performance” CPU governor meaning that the CPU operates at the maximum frequency regardless of load. This is reasonable for a system that is under constant load or cannot tolerate increased latency. On the other hand, if the system is idle much of the time and latency is not a concern, power savings may be desired.

Several governors are available:

Governor	Description
`performance`	Default. Operate at the maximum frequency
`ondemand`	Dynamically scale frequency at 75% cpu load
`conservative`	Dynamically scale frequency at 95% cpu load
`powersave`	Operate at the minimum frequency
`userspace`	Controlled by a userspace application via the `scaling_setspeed` file

The “conservative” governor can be used instead using the following shell commands:

Handle ACPI events

Mon, 01 Jan 0001 00:00:00 +0000

acpid

Beginning with Flatcar major release 3255 acpid can be enabled at boot with Ignition.

This can be configured with a butane definition:

---
variant: flatcar
version: 1.0.0
systemd:
  units:
    - name: acpid.service
      enabled: true
storage:
  files:
    - path: /etc/acpi/events/default
      contents:
        inline: |
          event=.*
          action=/etc/acpi/default.sh %e

    - path: /etc/acpi/default.sh
      contents:
        inline: |
          set $*
          logger "ACPI event handled: $*"
      mode: 0744

This simple configuration will only log the handled ACPI events, example with QEMU: