nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

container: Gracefully handle failure to set up user namespaces. 

* gnu/build/linux-container.scm (run-container): Exit when the parent
process doesn't say 'ready.
master
Ludovic Courtès 2016-05-30 22:13:09 +02:00
parent 552ffa021c
commit 4c14d4eaa7
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
gnu/build/linux-container.scm
View File

@ -214,15 +214,18 @@ host user identifiers to map into the user namespace."
(lambda ()
(close out)
;; Wait for parent to set things up.
(read in)
(close in)
(purify-environment)
(when (memq 'mnt namespaces)
(mount-file-systems root mounts
#:mount-/proc? (memq 'pid namespaces)
#:mount-/sys? (memq 'net namespaces)))
;; TODO: Manage capabilities.
(thunk))))
(match (read in)
('ready
(close in)
(purify-environment)
(when (memq 'mnt namespaces)
(mount-file-systems root mounts
#:mount-/proc? (memq 'pid namespaces)
#:mount-/sys? (memq 'net namespaces)))
;; TODO: Manage capabilities.
(thunk))
(_ ;parent died or something
(primitive-exit 2))))))
(pid
(when (memq 'user namespaces)
(initialize-user-namespace pid host-uids))