Overlayroot and initramfs

[mjseppa]

Writing here as had some problems enabling overlayroot.
This should work on the ubuntu image, on debian I only got the bilibop-lockfs to work but overlayroot is a lot simpler and easier.

First install overlayroot package. I setup it to read the overlayroot.conf from the boot partition and left boot partition without overlay so enabling/disabling is easy incase overlayroot-chroot doesnt work.
/boot/overlayroot.conf:

#overlayroot="tmpfs:swap=0,recurse=0"
overlayroot=""

/etc/overlayroot.conf:

overlayroot_cfgdisk="/dev/sda1"
overlayroot="tmpfs:swap=0,recurse=0"

Maybe setup label for drive, but single usb drive works fine for now.

Next problem is that the configs are setup for init image, but it seems by default the generation doesn't do conversions. I added single script to do it:
generate_initramfs.sh:

#!/bin/bash
KERN=$(uname -r)

update-initramfs -c -k ${KERN}
mv /boot/initrd.img-${KERN} /boot/initrd.img-${KERN}.zst
unzstd /boot/initrd.img-${KERN}.zst
rm /boot/initrd.img-${KERN}.zst
bash /etc/initramfs/post-update.d/99-uboot ${KERN} /boot/initrd.img-${KERN}

Once done it should leave you with uInitrd.img-KERNEL image on boot partition, set that into the boot.script, eg rd_img=uInitrd.img-6.12.11-meson64

[nehtnet]

@mjseppa, Do you think this solves #125?
Thanks

[mjseppa]

This should be nothing to do with docker. Apart from docker not being able to run by default on top of overlayroot.

Testing images on ubuntu I can run ubuntu:latest with mounted volumes without any log output.
On debian image I had to install apparmor-utils first and I get the messages:

[  802.385629] docker0: port 1(veth260ea71) entered disabled state
[  914.875632] audit: type=1400 audit(1741025218.359:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="lsb_release" pid=5175 comm="apparmor_parser"
[  915.366096] audit: type=1400 audit(1741025218.851:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=5181 comm="apparmor_parser"
[  915.371380] audit: type=1400 audit(1741025218.855:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=5181 comm="apparmor_parser"
[  921.575764] audit: type=1400 audit(1741025225.059:5): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="nvidia_modprobe" pid=5217 comm="apparmor_parser"
[  921.606165] audit: type=1400 audit(1741025225.091:6): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="nvidia_modprobe//kmod" pid=5217 comm="apparmor_parser"
[  921.621587] audit: type=1400 audit(1741025225.091:7): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="lsb_release" pid=5216 comm="apparmor_parser"
[  922.965580] audit: type=1400 audit(1741025226.447:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=5218 comm="apparmor_parser"
[  922.973210] audit: type=1400 audit(1741025226.455:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-helper" pid=5218 comm="apparmor_parser"
[  922.980738] audit: type=1400 audit(1741025226.459:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/connman/scripts/dhclient-script" pid=5218 comm="apparmor_parser"
[  922.988699] audit: type=1400 audit(1741025226.471:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/{,usr/}sbin/dhclient" pid=5218 comm="apparmor_parser"
[  933.709576] overlayfs: disabling nfs_export due to index=off
[  948.841324] overlayfs: disabling nfs_export due to index=off
[  953.934109] overlayfs: disabling nfs_export due to index=off
[  953.956648] docker0: port 1(veth3b747c1) entered blocking state
[  953.962434] docker0: port 1(veth3b747c1) entered disabled state
[  953.968345] veth3b747c1: entered allmulticast mode
[  953.974133] veth3b747c1: entered promiscuous mode
[  955.874074] audit: type=1400 audit(1741025259.354:12): apparmor="STATUS" operation="profile_load" profile="unconfined" name="docker-default" pid=5258 comm="apparmor_parser"
[  960.747660] eth0: renamed from veth5cce081
[  960.755802] docker0: port 1(veth3b747c1) entered blocking state
[  960.760173] docker0: port 1(veth3b747c1) entered forwarding state

Im not getting the overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. but I'm not attempting anything complex.

Is problem just the logging of the overlayfs nfs export off as docker runs?
Just set the default off?
echo N > /sys/module/overlay/parameters/nfs_export

[nehtnet]

Thanks, that worked but it turns Y again when rebooted.