Alpine FAQ

# 即可
apk fix

if [ -f "/boot/intel-ucode.img" ]; then
  everbose "Found microcode for Intel CPUs: /boot/intel-ucode.img"
  echo "  INITRD intel-ucode.img,initramfs-$tag" >> $conf.new
else
  echo "  INITRD initramfs-$tag" >> $conf.new
fi

# 启动后会看到 microcode 升级的信息
dmesg | grep microcode

microcode: sig=0x906e9, pf=0x2, reversion=0x84
microcode: Microcode Update Driver: v2.2

mount UUID=x-x-x-x /sysroot
# 挂载完成后退出会继续启动
# exit

apk add utmps
service utmpd start
rc-update add utmpd boot

sudo sysctl kernel.dmesg_restrict=0

echo previous_dmesg=yes | tee -a /etc/conf.d/bootmisc

mkdir -p /etc/udhcpc
echo 'RESOLV_CONF=no' > /etc/udhcpc/udhcpc.conf

apk add tailscale -X https://mirrors.sjtug.sjtu.edu.cn/alpine/edge/community

sudo update-ca-certificates # 更新 CA 时出现

mkdir /usr/local/share/ca-certificates/extra

# 1. 确认系统时间
date
chronyc tracking    # 查看当前状态
chronyc sources     # 查看同步源
chronyc -a makestep # 主动同步

# 2.
openssl s_client -connect wener.me:443 # 测试证书是否正确

echo "https://mirrors.tuna.tsinghua.edu.cn/alpine/v$(sed -n 's/\.\d\+$//p' /etc/alpine-release)/main
https://mirrors.tuna.tsinghua.edu.cn/alpine/v$(sed -n 's/\.\d\+$//p' /etc/alpine-release)/community" > /etc/apk/repositories

curl -k -f -# https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/vmlinuz-lts -o /boot/vmlinuz-netboot
curl -k -f -# https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/initramfs-lts -o /boot/initramfs-netboot

#!/bin/sh
exec tail -n +3 \$0

menuentry 'Alpine' {
    linux /boot/vmlinuz-netboot alpine_repo="https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/main" modloop="https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/modloop-lts" modules="loop,squashfs" initrd="initramfs-netboot" console="tty0" ssh_key="https://github.com/wenerme.keys"
    initrd /boot/initramfs-netboot
}

curl -k -f -# https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/vmlinuz-virt -o /boot/vmlinuz-netboot
curl -k -f -# https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/initramfs-virt -o /boot/initramfs-netboot

#!/bin/sh
exec tail -n +3 \$0

menuentry 'Alpine' {
    linux /boot/vmlinuz-netboot alpine_repo="https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/main" modloop="https://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/releases/x86_64/netboot/modloop-virt" modules="loop,squashfs" initrd="initramfs-netboot" console="tty0" ssh_key="https://github.com/wenerme.keys"
    initrd /boot/initramfs-netboot
}

# 确保时间正确
setup-ntp chrony

# 确保有 ca
apk add \
  --no-cache \
  --repository http://mirrors.tuna.tsinghua.edu.cn/alpine/latest-stable/main/ \
  ca-certificates

# 能通
openssl s_client -connect google.com:443

apk update

find /etc -name '*.apk-new'

# 这些可以考虑直接清理
rm /etc/{hosts,hostname,rc.conf,passwd,shadow,group,sudoers,fstab,sysctl.conf,profile}.apk-new

# 这些可以观察下，看是否保留或者参考下做调整
diff /etc/inittab{,.apk-new}

# rebase
mv /etc/conf.d/k3s{.apk-new,}

# 总是保留这些
mv /etc/os-release{.apk-new,}

for f in /etc/init.d/*.apk-new; do
  echo "=== $f ==="
  diff "${f%.apk-new}" "$f"
done

# 检查包是否有修改情况
apk.static audit --system

# 完整检查是不是有遗留的 lib 导致的
apk.static audit --full --check-permissions --ignore-busybox-symlinks > audit.log

# 检查不要是因为多出来的  lib 导致的
grep '^A lib'

# 推荐
apk add iputils
realpath $(which ping) # /bin/ping
ping 1.1.1.1

# 原因
realpath $(which ping) # /bin/busybox
# ping 需要 suid bit
# chmod u+s /bin/ping # 不建议给 busybox 太高的权限
# setcap cap_net_raw+p $(which ping) # 可以使用 cap 方式
getcap $(which ping)

stat /bin/busybox # 0755
stat /bin/ping    # 4755 - with suid

getent group uucp
id uucp
# ttyS[0-9]*	root:uucp 0660
cat /etc/mdev.conf | grep uucp

# 如果没修改过 mdef.conf, 直接使用新版本覆盖
mv /etc/mdev.conf{.apk-new,}
# 重新制作 initramfs
mkinitfs