{"id":51423935,"url":"https://github.com/dashaun/cloudfoundry-docker-cpi","last_synced_at":"2026-07-05T01:30:35.811Z","repository":{"id":358305441,"uuid":"1240851648","full_name":"dashaun/cloudfoundry-docker-cpi","owner":"dashaun","description":null,"archived":false,"fork":false,"pushed_at":"2026-05-16T17:44:04.000Z","size":53,"stargazers_count":0,"open_issues_count":9,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-16T19:24:35.601Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dashaun.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-16T16:43:55.000Z","updated_at":"2026-05-16T17:44:07.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/dashaun/cloudfoundry-docker-cpi","commit_stats":null,"previous_names":["dashaun/cloudfoundry-docker-cpi"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/dashaun/cloudfoundry-docker-cpi","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fcloudfoundry-docker-cpi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fcloudfoundry-docker-cpi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fcloudfoundry-docker-cpi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fcloudfoundry-docker-cpi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dashaun","download_url":"https://codeload.github.com/dashaun/cloudfoundry-docker-cpi/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fcloudfoundry-docker-cpi/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35141083,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-05T01:30:35.136Z","updated_at":"2026-07-05T01:30:35.777Z","avatar_url":"https://github.com/dashaun.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cf-docker-cpi\n\nA Spring Shell 4 CLI that deploys Cloud Foundry (OSS) onto a single x86_64 Linux host running Docker, via the bosh-docker-cpi. Targets the local Docker daemon or a remote host over SSH and drives the whole BOSH lifecycle end-to-end — `verify-docker → … → cf push a Spring Boot app`.\n\nBuilt with Spring Boot 4 + Spring Shell 4. Requires Java 17.\n\n## What it does\n\nThirteen idempotent, resumable steps that go from a freshly-installed Docker host to a deployed Cloud Foundry serving HTTP 200 on `cf-smoke.bosh-lite.com/actuator/health`:\n\n```\nverify-docker          host meets the bosh-docker-cpi prereqs\nhost-setup             bump inotify sysctls, disable noble's nc.openbsd AppArmor profile\ninstall-tools          fetch pinned bosh + cf CLIs\nfetch-manifests        clone bosh-deployment + cf-deployment at pinned SHAs\ngenerate-director-vars write director-vars.yml\ndeploy-director        bosh create-env the BOSH director (with UAA + CredHub)\nlogin-director         alias the env, log in as admin\nupload-stemcell        pinned ubuntu-noble stemcell\nupdate-cloud-config    cf-deployment's bosh-lite cloud-config + docker-CPI overrides\nupdate-runtime-config  bosh-dns addon + dns-recursors override + the dns-wait addon\ndeploy-cf              bosh deploy cf-deployment (the long one, 25-35 min)\nconfigure-cf-cli       cf api + auth + create system/dev — running on the docker host\nsmoke-push             build a Spring Boot starter locally, scp + cf push, probe 200\n```\n\nPer-step reference (inputs, outputs, cheap/deep checks, failure modes) is in [docs/setup-pipeline.md](docs/setup-pipeline.md). Architectural notes (resumable orchestrator, SSH transport, state directory) are in [docs/architecture.md](docs/architecture.md). For a guided walk-through, open the presentation at [docs/index.html](docs/index.html) (any static server — `jwebserver -d \"$(pwd)/docs\" -p 8000`).\n\n## Repo layout\n\nMulti-module Maven build:\n\n```\npom.xml         ← parent (packaging=pom)\ncli/            ← Spring Shell CLI\nbroker/         ← (planned) Spring Cloud Open Service Broker app for the optional marketplace\n```\n\n## Quickstart\n\nBuild (all modules):\n\n```bash\n./mvnw clean package\n```\n\nOne-shot mode (recommended for the pipeline):\n\n```bash\njava -Dspring.shell.interactive.enabled=false \\\n  -jar cli/target/cf-docker-cpi-0.1.0-SNAPSHOT.jar \\\n  setup step --name verify-docker --host ssh://user@host\n```\n\nThen run each subsequent step the same way (`--name host-setup`, `--name install-tools`, …). `setup status --host ssh://user@host` shows where you are.\n\nInteractive shell:\n\n```bash\njava -jar cli/target/cf-docker-cpi-0.1.0-SNAPSHOT.jar\n# at the prompt:\nsetup status --host ssh://user@host\nsetup step --name verify-docker --host ssh://user@host\n```\n\n\u003e In one-shot mode, Spring options must be `-D` system properties (before `-jar`), not `--` flags. Spring Shell 4's `NonInteractiveShellRunner` will otherwise treat the first `--` token as the command name.\n\n`--host` accepts `ssh://user@host`, `tcp://host:2375`, `unix:///path`, or a bare hostname (defaults to `ssh://`). SSH auth uses your existing `~/.ssh/config`, agent, and `known_hosts` — `ssh` must be on `$PATH`.\n\n## Prereqs the tool does NOT automate\n\nThree things you set up by hand on the docker host before the pipeline can run end-to-end. Details in [docs/setup-pipeline.md §6](docs/setup-pipeline.md):\n\n1. **`dockerd` reconfigured for TLS-on-TCP at `:2376`** — bosh-docker-cpi 0.2.12's in-container CPI requires HTTPS to dockerd. Drop a systemd unit override pointing dockerd at `tcp://0.0.0.0:2376 --tlsverify` and install a CA + server cert (with SAN `10.245.0.1, 127.0.0.1`) under `/etc/docker/tls/`.\n2. **Matching CA + client cert/key** under `~/.cf-docker-cpi-work/tls/{ca,client-cert,client-key}.pem` on the docker host. `deploy-director` injects them via `--var-file`.\n3. **Passwordless `sudo`** for the SSH user on the docker host. Used by `host-setup` (sysctls + AppArmor) and `configure-cf-cli --write-hosts`.\n\n`docs/setup-pipeline.md §6` has the exact `openssl` recipe and the dockerd systemd drop-in.\n\n## WSL2 docker host notes\n\n### Known limitation: garden-runc needs `securityfs`\n\nThe full pipeline runs cleanly on WSL2 through `update-runtime-config` (10 of 13 steps) but **`deploy-cf` fails at the diego-cell canary** because garden-runc tries to mount `/sys/kernel/security` inside each container it creates. Microsoft's stock WSL2 kernel ships **without `CONFIG_SECURITYFS`**:\n\n```bash\n$ zcat /proc/config.gz | grep SECURITY\n# CONFIG_SECURITYFS is not set\n# CONFIG_SECURITY_NETWORK is not set\n# CONFIG_SECURITY_APPARMOR is not set\n\n$ ls /sys/kernel/security/lsm\nls: cannot access '/sys/kernel/security/lsm': No such file or directory\n```\n\nSo `cf push` is unreachable on stock WSL2. The only known path forward is to build a [custom WSL2 kernel](https://learn.microsoft.com/en-us/windows/wsl/wsl-config#kernel) from [microsoft/WSL2-Linux-Kernel](https://github.com/microsoft/WSL2-Linux-Kernel) with `CONFIG_SECURITYFS=y`, `CONFIG_SECURITY_APPARMOR=y`, and `CONFIG_SECURITY_NETWORK=y`, then point `.wslconfig` `kernel=` at the resulting `bzImage`. Tracked in [#22](https://github.com/dashaun/cloudfoundry-docker-cpi/issues/22); not supported by this CLI today.\n\nIf you don't need a working CF deploy and just want to validate the early pipeline steps (verify-docker through update-runtime-config), WSL2 with native dockerd is fine.\n\n### Docker Desktop is not supported\n\nUse **native dockerd installed inside the WSL2 distro** (`sudo apt install docker.io` after disabling Docker Desktop's WSL2 integration). bosh-docker-cpi 0.2.12's CPI requires TLS-on-TCP to dockerd; Docker Desktop doesn't expose a TLS-on-TCP endpoint out of the box, and the manual dockerd recipe in `docs/setup-pipeline.md §6` only applies when dockerd is a systemd unit you control.\n\n### Docker 29 needs `daemon.json` to disable the containerd snapshotter\n\n`apt install docker.io` on Ubuntu noble lands Docker 29.x, which enables the containerd snapshotter by default. bosh-docker-cpi 0.2.12's `create_stemcell` loads stemcell images but they aren't visible to the CPI's subsequent `docker create` call — the deploy then fails on `No such image: bosh.io/stemcells:img-...`. Fix before running `deploy-director`:\n\n```bash\necho '{\"storage-driver\": \"overlay2\"}' | sudo tee /etc/docker/daemon.json\nsudo systemctl restart docker\n# verify: `docker info` should show `Storage Driver: overlay2` and dockerd logs\n# should show `containerd-snapshotter=false`.\n```\n\n### Mirrored networking — only with Docker Desktop integration\n\nPrior versions of this doc said WSL2 needs `.wslconfig` `networkingMode=mirrored` to make the `cf-docker-cpi-net` bridge routable from the WSL shell. That's true **only when Docker Desktop is in the picture** — Docker Desktop's helper VM hides the bridge. With native dockerd inside the distro (the supported setup), the bridge is created in the WSL distro's own network namespace and is locally routable; no `.wslconfig` change required. If you do happen to be debugging a Docker-Desktop-era setup:\n\n```ini\n[wsl2]\nnetworkingMode=mirrored\n```\n\nthen `wsl --shutdown` from PowerShell.\n\nIf you don't need a working CF deploy and just want to validate the early pipeline steps (verify-docker through update-runtime-config), WSL2 with native dockerd is fine.\n\n### Docker Desktop is not supported\n\nUse **native dockerd installed inside the WSL2 distro** (`sudo apt install docker.io` after disabling Docker Desktop's WSL2 integration). bosh-docker-cpi 0.2.12's CPI requires TLS-on-TCP to dockerd; Docker Desktop doesn't expose a TLS-on-TCP endpoint out of the box, and the manual dockerd recipe in `docs/setup-pipeline.md §6` only applies when dockerd is a systemd unit you control.\n\n### Docker 29 needs `daemon.json` to disable the containerd snapshotter\n\n`apt install docker.io` on Ubuntu noble lands Docker 29.x, which enables the containerd snapshotter by default. bosh-docker-cpi 0.2.12's `create_stemcell` loads stemcell images but they aren't visible to the CPI's subsequent `docker create` call — the deploy then fails on `No such image: bosh.io/stemcells:img-...`. Fix before running `deploy-director`:\n\n```bash\necho '{\"storage-driver\": \"overlay2\"}' | sudo tee /etc/docker/daemon.json\nsudo systemctl restart docker\n# verify: `docker info` should show `Storage Driver: overlay2` and dockerd logs\n# should show `containerd-snapshotter=false`.\n```\n\n### Mirrored networking — only with Docker Desktop integration\n\nPrior versions of this doc said WSL2 needs `.wslconfig` `networkingMode=mirrored` to make the `cf-docker-cpi-net` bridge routable from the WSL shell. That's true **only when Docker Desktop is in the picture** — Docker Desktop's helper VM hides the bridge. With native dockerd inside the distro (the supported setup), the bridge is created in the WSL distro's own network namespace and is locally routable; no `.wslconfig` change required. If you do happen to be debugging a Docker-Desktop-era setup:\n\n```ini\n[wsl2]\nnetworkingMode=mirrored\n```\n\nthen `wsl --shutdown` from PowerShell.\n\n## Status\n\nValidated end-to-end on a noble bare-metal docker host (issue [#1](https://github.com/dashaun/cloudfoundry-docker-cpi/issues/1) closed). The full pipeline takes ~35 min wall-clock from scratch; `cf push` of a Spring Boot starter returns HTTP 200 on `/actuator/health`. Track open work and known limits via [GitHub Issues](https://github.com/dashaun/cloudfoundry-docker-cpi/issues).\n\n## License\n\nApache-2.0. See [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashaun%2Fcloudfoundry-docker-cpi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdashaun%2Fcloudfoundry-docker-cpi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashaun%2Fcloudfoundry-docker-cpi/lists"}