nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

container: Gracefully handle failure to set up user namespaces. 

* gnu/build/linux-container.scm (run-container): Exit when the parent
process doesn't say 'ready.
This commit is contained in:
Ludovic Courtès 2016-05-30 22:13:09 +02:00
parent 552ffa021c
commit 4c14d4eaa7
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
gnu/build/linux-container.scm
View File

@ -214,15 +214,18 @@ host user identifiers to map into the user namespace."
(lambda () (lambda ()
(close out) (close out)
;; Wait for parent to set things up. ;; Wait for parent to set things up.
(read in) (match (read in)
(close in) ('ready
(purify-environment) (close in)
(when (memq 'mnt namespaces) (purify-environment)
(mount-file-systems root mounts (when (memq 'mnt namespaces)
#:mount-/proc? (memq 'pid namespaces) (mount-file-systems root mounts
#:mount-/sys? (memq 'net namespaces))) #:mount-/proc? (memq 'pid namespaces)
;; TODO: Manage capabilities. #:mount-/sys? (memq 'net namespaces)))
(thunk)))) ;; TODO: Manage capabilities.
(thunk))
(_ ;parent died or something
(primitive-exit 2))))))
(pid (pid
(when (memq 'user namespaces) (when (memq 'user namespaces)
(initialize-user-namespace pid host-uids)) (initialize-user-namespace pid host-uids))