Alpine linux for scaleway

Scaleway does not provide alpine Linux images to their ARM instances, neither for cloud kvm nor bare-metal instances.

This is a shell script to deploy an alpine Linux with encrypted file-system to them.

Singularities:

• Target ARM, both armv7 and aarch64
• Boot over your own HTTP server
• Encrypted root file-system with interactif passphrase prompt to unlock
• Btrfs for fun

Prerequisites:

• A working linux system with chroot capability
• Same arch as target, known as build machine
• A http server, known as boot server
• scw-cli
• Scaleway's public infrastructure
• That's all

Usage:

On build machine

Checkout this repo:

git clone https://github.com/juju2013/scw-alpine-encrypted
cd scw-alpine-encrypted

• Check build.sh and adapte it to your needs
• Copy your own ssh public key(s), ending with .pub, to keys/
• run ./build.sh

That's all. In out/ folder, there'll be 2 files:

• ${ARCH}init.tar - your initrd. You''ll need this one every time your target system boots
• ${ARCH}root.tar - your root file-system, you'll need it only for the first installation

On boot server

• Copy those init.tar and root.tar to somewhere you can wget

On the target

• Goto your console, select your target and add following tags:

boot=rescue rescue_image=http://your_boot_server/path_to_your_init.tar

Fire up (or reset) your instance and connect to it's console:

scw attach your_instance

When the boot is finished, you'll reach some point like that:

NAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
vda     253:0    0 46.6G  0 disk 
├─vda1  253:1    0 46.5G  0 part 
└─vda15 253:15   0  100M  0 part 
mount: mounting /dev/mapper/cryptroot on /mnt failed: No such file or directory
Filesystem           1K-blocks      Used Available Use% Mounted on
udev                   1015648         0   1015648   0% /dev
tmpfs                   204048     10140    193908   5% /run
none                   1020228    202340    817888  20% /
bash: cannot set terminal process group (-1): Not a tty
bash: no job control in this shell
bash-5.0# 

From there (you'll lose all your data on /dev/vda1), enter commands after bash-5.0#, the orther lines are command output:

bash-5.0# cryptsetup luksFormat /dev/vda1
WARNING: Device /dev/vda1 already contains a 'ext4' superblock signature.

WARNING!
========
This will overwrite data on /dev/vda1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/vda1: 
Verify passphrase: 
[  193.092325] NET: Registered protocol family 38
[  193.158943] cryptd: max_cpu_qlen set to 1000

Then

cryptsetup open /dev/vda1 cryptroot
Enter passphrase for /dev/vda1: 
bash-5.0# mkfs.btrfs /dev/mapper/cryptroot 
...
bash-5.0# mount /dev/mapper/cryptroot /mnt/
bash-5.0# btrfs sub create /mnt/root
Create subvolume '/mnt/root'
bash-5.0# cd /mnt/root
bash-5.0# wget -O - http://your_boot_server/aarch64root.tar | tar xpf -
bash-5.0# mount --bind /dev dev
bash-5.0# mount --bind /sys sys
bash-5.0# mount --bind /proc proc
bash-5.0# chroot . /bin/bash

At this point, you're going to setup your alpine Linux system. Customize it as you want(most defaults should be ok):

setup-alpine

After the setup:

bash-5.0# exit
exit
bash-5.0# exit
exit
Now switching to real root
switch_root: cannot access /sbin/init: No such file or directory
switch_root: failed to execute /sbin/init: No such file or directory

The new system will panic, that's OK, simply reboot it throu the console.

After a while, your console will show:

[   27.400885] random: crng init done
Loading kernel modules ...
modprobe: module dm-mod not found in modules.dep
[   48.390779] xor: measuring software checksum speed
...
Starting mount real root device:
WARNING: Locking directory /run/cryptsetup is missing!
Enter passphrase for /dev/vda1: 

Enter your passphrase, and you'll see:

[  115.616635] NET: Registered protocol family 38
[  115.681441] cryptd: max_cpu_qlen set to 1000
NAME          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
vda           253:0    0 46.6G  0 disk  
├─vda1        253:1    0 46.5G  0 part  
│ └─cryptroot 252:0    0 46.5G  0 crypt 
└─vda15       253:15   0  100M  0 part  
[  116.031438] BTRFS: device fsid f2fbe983-e033-494c-83cd-72e81b519c1f devid 1 transid 16 /dev/mapper/cryptroot
[  116.041778] BTRFS info (device dm-0): disk space caching is enabled
[  116.046932] BTRFS info (device dm-0): has skinny extents
Filesystem           1K-blocks      Used Available Use% Mounted on
udev                   1015648         0   1015648   0% /dev
tmpfs                   204048     10140    193908   5% /run
none                   1020228    202340    817888  20% /
/dev/mapper/cryptroot
                      48708300     88288  48106176   0% /mnt
bash: cannot set terminal process group (-1): Not a tty
bash: no job control in this shell

Type simply exit, then you'll see:

exit
Now switching to real root

   OpenRC 0.41.2.6fc2696f3e is starting up Linux 4.19.53-mainline-rev1 (aarch64)
...

That's all.

You can now ssh root@your_instance_ip. And next boots will repeat the same sequence, it's done!

Caveats:

• HTTP only, no https. The first wget is from busybox and it seams too complicate to require SSL at the very first stage. Also migitated by the third point.
• No swap with btrfs. If you realy want one, allocate another 50GB SSD (it costs 1€/month) and make your swap partition there. You can allocate the remaining space to your /, after having cryptsetup it.
• Encryption is not bullet proof. Scaleway owns your kernel and first initrd. It's not the right way to prevent any 3 letters agencies, not even your cloud provider's employees to access your data. (But it does prevent most leaks by the eventual fault of any sub-contractors).