Commit Graph

19 Commits (5cc1075a76392666d3d733837f5c6252b1e48002)

Author SHA1 Message Date
Ludovic Courtès 40c369b234
linux-container: Remove dependency on (guix utils).
Fixes a bug whereby derivations importing (gnu build linux-container),
such as the 'bitlbee' and 'tor' services, would depend on the
user's (guix config) file, which was pulled as a dependency of (guix
utils).  As a result, those derivations would vary from user to user.

* gnu/build/linux-container.scm (call-with-temporary-directory): New
procedure.
2019-06-23 19:53:03 +02:00
Ludovic Courtès af76c020bf
linux-container: Make the guest UID and GID a parameter.
* gnu/build/linux-container.scm (initialize-user-namespace): Add
 #:guest-uid and #:guest-gid parameters and honor them.
(run-container): Likewise.
(call-with-container): Likewise.
* tests/containers.scm ("call-with-container, user namespace, guest UID/GID"):
New test.
2019-04-02 18:15:37 +02:00
Ludovic Courtès 95aa64bc48
linux-container: Work around EBADF errors upon exit.
Typically 'read-pid-file/container' would fail when starting services in
containers such as BitlBee.

* gnu/build/linux-container.scm (call-with-clean-exit): Use
'primitive-_exit' instead of 'primitive-exit'.
(container-excursion*): Close OUT.
2018-01-15 23:29:33 +01:00
Ludovic Courtès 1c65cca574
file-systems: 'mount-file-system' now takes a <file-system> object.
* gnu/build/file-systems.scm (mount-file-system): Rename 'spec' to 'fs'
and assume it's a <file-system>.
* gnu/build/linux-boot.scm (boot-system): Assume MOUNTS is a list of
<file-system> and adjust accordingly.
* gnu/build/linux-container.scm (mount-file-systems): Remove
'file-system->spec' call.
* gnu/services/base.scm (file-system-shepherd-service): Add
'spec->file-system' call.  Add (gnu system file-systems) to 'modules'.
* gnu/system/linux-initrd.scm (raw-initrd): Use (gnu system
file-systems).  Add 'spec->file-system' call for #:mounts.
2017-10-11 11:12:33 +02:00
Ludovic Courtès c90db25f4c
linux-container: Add 'container-excursion*'.
* gnu/build/linux-container.scm (container-excursion*): New procedure.
* tests/containers.scm ("container-excursion*")
("container-excursion*, same namespaces"): New tests.
2017-02-07 00:08:10 +01:00
Ludovic Courtès 36c4917c91
linux-container: Add comment on exception handling.
* gnu/build/linux-container.scm (run-container): Add note about writing
the exceptions.
2017-02-06 10:51:25 +01:00
Ludovic Courtès 168aba2978
linux-container: Do not rely on 'isatty?'.
This avoids problems where 'isatty?' return #t but 'ttyname' fails with
ENOTTY or such.

* gnu/build/linux-container.scm (mount-file-systems): Remove call of
'isatty?'.  Directly call 'ttyname' and catch 'system-error'.
2017-02-06 10:51:25 +01:00
Ludovic Courtès 5970e8e248
container: Pass a list of <file-system> objects as things to mount.
* gnu/build/linux-container.scm (mount-file-systems): 'mounts' is now a
list of <file-system> objects instead of a list of lists ("specs").
Add call to 'file-system->spec' as the argument to 'mount-file-system'.
(run-container, call-with-container): Adjust docstring accordingly.
* gnu/system/file-systems.scm (spec->file-system): New procedure.
* gnu/system/linux-container.scm (container-script)[script]: Call
'spec->file-system' inside gexp.
* guix/scripts/environment.scm (launch-environment/container): Remove
call to 'file-system->spec'.
* tests/containers.scm ("call-with-container, mnt namespace")
("call-with-container, mnt namespace, wrong bind mount"): Pass a list of
<file-system> objects.
2016-11-10 18:01:44 +01:00
Ludovic Courtès 7fee5b5397
container: Allow 'container-excursion' to the same namespaces.
Before that, 'container-excursion' would call 'setns' even when the
target namespace is the one the caller is already in, which would fail.

* gnu/build/linux-container.scm (container-excursion): Introduce
'source' and 'target'.  Compare the result of 'readlink' on these
instead of comparing file descriptors to decide whether to call
'setns'.
* tests/containers.scm ("container-excursion, same namespace"): New test.
2016-10-19 15:54:10 +02:00
Ludovic Courtès c06f6db7a4
container: Gracefully report mount errors in the child process.
Fixes <http://bugs.gnu.org/23306>.

* gnu/build/linux-container.scm (run-container): Use 'socketpair'
instead of 'pipe'.  Rename 'in' to 'child' and 'out' to 'parent'.  Send
a 'ready message or an exception argument list from the child to the
parent; adjust the parent accordingly.
* tests/containers.scm ("call-with-container, mnt namespace, wrong bind
mount"): New test.
* tests/guix-environment-container.sh: Add test with
--expose=/does-not-exist.
2016-05-31 00:11:04 +02:00
Ludovic Courtès 4c14d4eaa7
container: Gracefully handle failure to set up user namespaces.
* gnu/build/linux-container.scm (run-container): Exit when the parent
process doesn't say 'ready.
2016-05-31 00:11:04 +02:00
Mark H Weaver c5184468f5 build: container: Make 'unprivileged-user-namespace-supported?' more robust.
* gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Only
  read and check the first character, to cope with a possible newline in the
  (pseudo-)file.
2016-01-23 18:44:03 -05:00
David Thompson b7d48312bb build: container: Add feature test predicates.
* gnu/build/linux-container.scm (user-namespace-supported?,
  unprivileged-user-namespace-supported?, setgroups-supported?): New
  procedures.
* tests/container.scm: Use predicates.
* tests/syscalls.scm: Likewise.
2015-11-03 11:41:04 -05:00
Ludovic Courtès 35b50a7535 container: Remove unnecessary CLONE_CHILD_* flags.
* gnu/build/linux-container.scm (namespaces->bit-mask): Remove
  CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID, which are unneeded.
  Discussed at <http://bugs.gnu.org/21694>.
2015-10-28 15:31:44 +01:00
David Thompson a72ccbc251 build: container: Fix call-with-clean-exit.
Before, call-with-clean-exit would *always* return an exit code of 1.

* gnu/build/linux-container.scm (call-with-clean-exit): Exit with status
  code of 0 if thunk does not throw an exception.
* tests/containers.scm: Add test.
2015-10-10 09:00:49 -04:00
David Thompson ee78d02452 build: container: Use the same clone flags as fork(3).
The intent is to make 'clone' behave a lot more like 'primitive-fork', which
calls clone(2) with SIGCHLD, CLONE_CHILD_CLEARTID, and CLONE_CHILD_SETTID
flags.  Notably, running 'clone' at the REPL without these flags would break
the REPL beyond repair.

* guix/build/syscalls.scm (CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID): New
  variables.
* gnu/build/linux-container.scm (namespaces->bit-mask): Add
  CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID to bit mask.
2015-09-07 13:09:58 -04:00
David Thompson 4949ada9da build: container: Setup /dev/console.
* gnu/build/linux-container.scm (mount-file-systems): Bind mount the
  controlling terminal as /dev/console.
2015-09-07 13:09:58 -04:00
David Thompson 831bc1468e build: container: Add #:host-uids argument to call-with-container.
It's not always possible to map 65536 uids when creating a container as the
root user within another user namespace.  This is true when building Guix
within the build daemon's container.  By using a uid range of 1 by default,
even as the root user, the tests now pass.

* gnu/build/linux-container.scm (initialize-user-namespace, run-container):
  Add 'host-uids' argument.
  (call-with-container): Add #:host-uids keyword argument.
* tests/containers.scm ("container-excursion"): Update 'run-container' call.
2015-08-08 14:04:13 -04:00
David Thompson c1f6a0c2ed gnu: build: Add Linux container module.
* gnu/build/linux-container.scm: New file.
* gnu-system.am (GNU_SYSTEM_MODULES): Add it.
* .dir-locals.el: Add Scheme indent rules for 'call-with-container', and
  'container-excursion'.
* tests/containers.scm: New file.
* Makefile.am (SCM_TESTS): Add it.
2015-07-09 08:23:03 -04:00