GoatOS:: Fully automated CI to build and test chef infrastructure

Chef Infra (archive)
1

Hi all,
I am happy to announce an opensource project GoatOS. It provides fully
automated CI/CD setup[1], with agents capable of running unprivileged LXC
containers. These are full blown system containers (running init, cron
etc), unlike docker’s app container (which requires process supervision,
runs as privileged mode etc), running as normal, nono-root user. It also
uses blender, a modular orchestration framework to run tasks against a set
of container or agents.

Together, these technologies allows creating arbitrary artifact (like debs,
rpms. container images) and publishing them. I have setup a full blown
build pipeline that tests chef, builds omnibus installers, and then use it
to test community couple of community cookbooks.

I’ll be more than happy to get some feedback on this. Currently the whole
stack is tested against ubuntu 14.04 servers.

regards
ranjib

[2]https://github.com/GoatOS/Spec
[1]https://github.com/GoatOS/GoatOS
[3]https://github.com/GoatOS/go_cd
[4]https://github.com/GoatOS/container
[5]https://github.com/PagerDuty/blender

2

Looks fantastic, Ranjib! I’ll definitely be taking a look at this!

On 8 March 2015 at 05:38, Ranjib Dey dey.ranjib@gmail.com wrote:

Hi all,
I am happy to announce an opensource project GoatOS. It provides fully
automated CI/CD setup[1], with agents capable of running unprivileged LXC
containers. These are full blown system containers (running init, cron etc),
unlike docker’s app container (which requires process supervision, runs as
privileged mode etc), running as normal, nono-root user. It also uses
blender, a modular orchestration framework to run tasks against a set of
container or agents.

Together, these technologies allows creating arbitrary artifact (like debs,
rpms. container images) and publishing them. I have setup a full blown build
pipeline that tests chef, builds omnibus installers, and then use it to test
community couple of community cookbooks.

I’ll be more than happy to get some feedback on this. Currently the whole
stack is tested against ubuntu 14.04 servers.

regards
ranjib

[2]https://github.com/GoatOS/Spec
[1]https://github.com/GoatOS/GoatOS
[3]https://github.com/GoatOS/go_cd
[4]https://github.com/GoatOS/container
[5]https://github.com/PagerDuty/blender

–
Stephen Nelson-Smith,
Founder, Principal Consultant,
Atalanta Systems Ltd,
Web: http://agilesysadmin.net
Twitter: @lordcope
Skype: atalanta.systems
Direct: +44 (0) 1329 550203
Mobile: +44 (0) 7917 101919

Atalanta Systems: The Agile Infrastructure Enablers
http://atalanta-systems.com

3

Nice work Ranjib!

I’m looking into a solution that lets us fully test cookbooks using
kitchenci and LXC containers, and this looks quite promising
(especially since I found out go ci/cd is free now, right?). I would
love to see something like that being available as a SaaS offering
(like travis-ci or cirlceci).

For open source cookbooks circleci got me quite far (you can run lxc
containers inside docker containers there), but I never got it to work
with vagrant-lxc though (see [0] if anyone with some lxc background
wants to chime in)

Hats off!
Torben

[0] https://github.com/fgrehm/vagrant-lxc/issues/339

On Sun, Mar 8, 2015 at 6:38 AM, Ranjib Dey dey.ranjib@gmail.com wrote:

Hi all,
I am happy to announce an opensource project GoatOS. It provides fully
automated CI/CD setup[1], with agents capable of running unprivileged LXC
containers. These are full blown system containers (running init, cron etc),
unlike docker’s app container (which requires process supervision, runs as
privileged mode etc), running as normal, nono-root user. It also uses
blender, a modular orchestration framework to run tasks against a set of
container or agents.

Together, these technologies allows creating arbitrary artifact (like debs,
rpms. container images) and publishing them. I have setup a full blown build
pipeline that tests chef, builds omnibus installers, and then use it to test
community couple of community cookbooks.

I’ll be more than happy to get some feedback on this. Currently the whole
stack is tested against ubuntu 14.04 servers.

regards
ranjib

[2]https://github.com/GoatOS/Spec
[1]https://github.com/GoatOS/GoatOS
[3]https://github.com/GoatOS/go_cd
[4]https://github.com/GoatOS/container
[5]https://github.com/PagerDuty/blender

4

Hi torben,
kitchen-ci dont have any native lxc based driver, i want get that addressed
first. Current LXC driver uses shell-out to do its magic, which is
cumbersome.
Yeah, GoCD is now opensource :slight_smile: . Thats why i am building things on top of
it, instead of jenkins.
I too would love to have a SaaS offering, which give vanilla linux kernel.
I dont know much about circle-ci. But i know for fact that travis uses
openvz, and they dont have any plan to move to mainline kernel anytime
soon, so we wont get containers from them. When i used to work at
ThoughtWorks (the company behind GoCD) we had built DevCloud, an internal
SaaS for GoCD farm. Currently they have Snap CI, but i doubt its anything
closer to GoCD (i.e the pipelines, fan-in, fan-out dependencies etc), but
you should definitely talk to them and check if they have any plans to do
it.

Im pretty sure Docker inside LXC will force you to run lxc as root :-(.

It will be awesome if someone starts something like cloudbees, but backed
by GoCD, with multi-tenancy baked in :slight_smile:
Till then, I’ll continue improving these tools, and their integration. i.e.
reduce the entry barrier for CI-CD adoption for infrastructure as code.

cheers
ranjib

On Sun, Mar 8, 2015 at 1:20 AM, Torben Knerr mail@tknerr.de wrote:

Nice work Ranjib!

I’m looking into a solution that lets us fully test cookbooks using
kitchenci and LXC containers, and this looks quite promising
(especially since I found out go ci/cd is free now, right?). I would
love to see something like that being available as a SaaS offering
(like travis-ci or cirlceci).

For open source cookbooks circleci got me quite far (you can run lxc
containers inside docker containers there), but I never got it to work
with vagrant-lxc though (see [0] if anyone with some lxc background
wants to chime in)

Hats off!
Torben

[0] https://github.com/fgrehm/vagrant-lxc/issues/339

On Sun, Mar 8, 2015 at 6:38 AM, Ranjib Dey dey.ranjib@gmail.com wrote:

Hi all,
I am happy to announce an opensource project GoatOS. It provides fully
automated CI/CD setup[1], with agents capable of running unprivileged LXC
containers. These are full blown system containers (running init, cron
etc),
unlike docker’s app container (which requires process supervision, runs
as
privileged mode etc), running as normal, nono-root user. It also uses
blender, a modular orchestration framework to run tasks against a set of
container or agents.

Together, these technologies allows creating arbitrary artifact (like
debs,
rpms. container images) and publishing them. I have setup a full blown
build
pipeline that tests chef, builds omnibus installers, and then use it to
test
community couple of community cookbooks.

I’ll be more than happy to get some feedback on this. Currently the whole
stack is tested against ubuntu 14.04 servers.

regards
ranjib

[2]https://github.com/GoatOS/Spec
[1]https://github.com/GoatOS/GoatOS
[3]https://github.com/GoatOS/go_cd
[4]https://github.com/GoatOS/container
[5]https://github.com/PagerDuty/blender

5

Hi Ranjib,

thanks for the pointer to SnapCI, looks nice too. Would be worth
taking a stab on whether they allow you to create / run lxc containers
during a build.

For Travis-CI I can confirm they don’t support lxc containers.

CircleCI is the only one I’m aware of which allows it, and I have seen
it working with plain lxc commands [0], just not the way vagrant-lxc
does it. So chances might be good that it already works with the
current kitchen-lxc driver. But I need it to work with vagrant-lxc, so
I have not tried with kitchen-lxc yet…

Concerning their docker in docker security model, that’s what they say: [1]

Cheers,
Torben

[0] https://github.com/fgrehm/vagrant-lxc/issues/339#issuecomment-70434069
[1] http://blog.circleci.com/continuous-delivery-with-docker-containers/

On Mon, Mar 9, 2015 at 9:12 PM, Ranjib Dey dey.ranjib@gmail.com wrote:

Hi torben,
kitchen-ci dont have any native lxc based driver, i want get that addressed
first. Current LXC driver uses shell-out to do its magic, which is
cumbersome.
Yeah, GoCD is now opensource :slight_smile: . Thats why i am building things on top of
it, instead of jenkins.
I too would love to have a SaaS offering, which give vanilla linux kernel. I
dont know much about circle-ci. But i know for fact that travis uses openvz,
and they dont have any plan to move to mainline kernel anytime soon, so we
wont get containers from them. When i used to work at ThoughtWorks (the
company behind GoCD) we had built DevCloud, an internal SaaS for GoCD farm.
Currently they have Snap CI, but i doubt its anything closer to GoCD (i.e
the pipelines, fan-in, fan-out dependencies etc), but you should definitely
talk to them and check if they have any plans to do it.

Im pretty sure Docker inside LXC will force you to run lxc as root :-(.

It will be awesome if someone starts something like cloudbees, but backed by
GoCD, with multi-tenancy baked in :slight_smile:
Till then, I’ll continue improving these tools, and their integration. i.e.
reduce the entry barrier for CI-CD adoption for infrastructure as code.

cheers
ranjib

On Sun, Mar 8, 2015 at 1:20 AM, Torben Knerr mail@tknerr.de wrote:

Nice work Ranjib!

I’m looking into a solution that lets us fully test cookbooks using
kitchenci and LXC containers, and this looks quite promising
(especially since I found out go ci/cd is free now, right?). I would
love to see something like that being available as a SaaS offering
(like travis-ci or cirlceci).

For open source cookbooks circleci got me quite far (you can run lxc
containers inside docker containers there), but I never got it to work
with vagrant-lxc though (see [0] if anyone with some lxc background
wants to chime in)

Hats off!
Torben

[0] https://github.com/fgrehm/vagrant-lxc/issues/339

On Sun, Mar 8, 2015 at 6:38 AM, Ranjib Dey dey.ranjib@gmail.com wrote:

Hi all,
I am happy to announce an opensource project GoatOS. It provides fully
automated CI/CD setup[1], with agents capable of running unprivileged
LXC
containers. These are full blown system containers (running init, cron
etc),
unlike docker’s app container (which requires process supervision, runs
as
privileged mode etc), running as normal, nono-root user. It also uses
blender, a modular orchestration framework to run tasks against a set of
container or agents.

Together, these technologies allows creating arbitrary artifact (like
debs,
rpms. container images) and publishing them. I have setup a full blown
build
pipeline that tests chef, builds omnibus installers, and then use it to
test
community couple of community cookbooks.

I’ll be more than happy to get some feedback on this. Currently the
whole
stack is tested against ubuntu 14.04 servers.

regards
ranjib

[2]https://github.com/GoatOS/Spec
[1]https://github.com/GoatOS/GoatOS
[3]https://github.com/GoatOS/go_cd
[4]https://github.com/GoatOS/container
[5]https://github.com/PagerDuty/blender