summaryrefslogtreecommitdiff
path: root/gnu/build/linux-container.scm
AgeCommit message (Collapse)Author
2022-09-24linux-container: Mark socket pair as SOCK_CLOEXEC.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Pass SOCK_CLOEXEC to 'socketpair'.
2022-09-20linux-container: 'container-excursion*' marks its FDs as FD_CLOEXEC.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/57827>. Reported by Mathieu Othacehe <othacehe@gnu.org>. Fixes a regression introduced with the Shepherd 0.9.2 upgrade in 1ba0e38267c9ff8bb476285091be6e297bbf136e, whereby IN and OUT would no longer be closed when 'fork+exec-command/container' would call 'exec-command*' as part of the THUNK passed to 'container-excursion*'. This is because the Shepherd 0.9.2 assumes file descriptors are properly marked as O_CLOEXEC and, consequently, 'exec-command' no longer run the close(2) loop prior to 'exec'. * gnu/build/linux-container.scm (container-excursion*): Add calls to 'fcntl'.
2022-05-01linux-container: Add #:child-is-pid1? parameter to 'call-with-container'.Ludovic Courtès
* gnu/build/linux-container.scm (wait-child-process) (status->exit-status): New procedures. (call-with-container): Add #:child-is-pid1? parameter and honor it. [thunk*]: New variable. Pass it to 'run-container'.
2022-05-01linux-container: Ensure signal-handling asyncs get a chance to run.Ludovic Courtès
Previously we could enter the blocking 'waitpid' call and miss an opportunity to run the signal handler async. * gnu/build/linux-container.scm (call-with-container) [periodically-schedule-asyncs]: New procedure. [install-signal-handlers]: Call it.
2022-05-01linux-container: 'call-with-container' relays SIGTERM and SIGINT.Ludovic Courtès
* gnu/build/linux-container.scm (call-with-container): Add #:relayed-signals. [install-signal-handlers]: New procedure. Call it.
2022-01-05linux-container: Handle CLONE_NEWCGROUP and use it by default.Ryan Sundberg
Adds low-level support for launching Linux containers with cgroup namespaces. * gnu/build/linux-container.scm (%namespaces): Add 'cgroup. (namespaces->bit-mask): Handle it. * guix/build/syscalls.scm (CLONE_NEWCGROUP): New variable. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2020-12-06Revert "linux-container: Correct test for unprivileged user namespace support."Marius Bakke
This broke 'guix environment --container' on non-Debian distributions. Fixes <https://bugs.gnu.org/45066>. Reported by luhux <luhux@outlook.com>. This reverts commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
2020-12-03linux-container: Correct test for unprivileged user namespace support.Paul Garlick
Fixes <https://bugs.gnu.org/31977>. Reported by Paul Garlick <pgarlick@tourbillion-technology.com>. * gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Return #f when the 'userns-file' does not exist.
2020-10-01linux-container: Reset jailed root permissions.Jelle Licht
* gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call. * tests/containers.scm ("call-with-container, mnt namespace, root permissions"): New test.
2020-09-10build: linux-container: Fix run-container.Mathieu Othacehe
This is a follow-up of 5316dfc0f125b658e4a2acf7f00f49501663d943. Some users of run-container may expect that the container is jailed, even if there are no mounts. This is the case for some Guix tests. * gnu/build/linux-container.scm (run-container): Do not jail the container when the requested root is "/".
2020-09-02linux-container: Do not jail the container unconditionally.Mathieu Othacehe
We may want to run a container inside the MNT namespace, without jailing the container. If RUN-CONTAINER is passed a null MOUNTS list, do not jail the container. * gnu/build/linux-container.scm (run-container): Do not call MOUNT-FILE-SYSTEMS if MOUNTS list is empty.
2019-09-12linux-container: "run-container" scripts shows the container's PID.Ludovic Courtès
* gnu/build/linux-container.scm (call-with-container): Add #:process-spawned-hook and honor it. * gnu/system/linux-container.scm (container-script)[script]: Define 'explain' and pass it as #:process-spawned-hook'.
2019-07-06linux-container: Mount a new /dev/pts instance in the container.Ludovic Courtès
Fixes <https://bugs.gnu.org/36463>. Reported by Steffen Rytter Postas <nc@scalehost.eu>. * gnu/build/linux-container.scm (mount-file-systems): When /dev/ptmx exists on the host, explicitly mount a new instance of devpts and make /dev/ptmx a symlink to /dev/pts/ptmx.
2019-06-23linux-container: Remove dependency on (guix utils).Ludovic Courtès
Fixes a bug whereby derivations importing (gnu build linux-container), such as the 'bitlbee' and 'tor' services, would depend on the user's (guix config) file, which was pulled as a dependency of (guix utils). As a result, those derivations would vary from user to user. * gnu/build/linux-container.scm (call-with-temporary-directory): New procedure.
2019-04-02linux-container: Make the guest UID and GID a parameter.Ludovic Courtès
* gnu/build/linux-container.scm (initialize-user-namespace): Add #:guest-uid and #:guest-gid parameters and honor them. (run-container): Likewise. (call-with-container): Likewise. * tests/containers.scm ("call-with-container, user namespace, guest UID/GID"): New test.
2018-01-15linux-container: Work around EBADF errors upon exit.Ludovic Courtès
Typically 'read-pid-file/container' would fail when starting services in containers such as BitlBee. * gnu/build/linux-container.scm (call-with-clean-exit): Use 'primitive-_exit' instead of 'primitive-exit'. (container-excursion*): Close OUT.
2017-10-11file-systems: 'mount-file-system' now takes a <file-system> object.Ludovic Courtès
* gnu/build/file-systems.scm (mount-file-system): Rename 'spec' to 'fs' and assume it's a <file-system>. * gnu/build/linux-boot.scm (boot-system): Assume MOUNTS is a list of <file-system> and adjust accordingly. * gnu/build/linux-container.scm (mount-file-systems): Remove 'file-system->spec' call. * gnu/services/base.scm (file-system-shepherd-service): Add 'spec->file-system' call. Add (gnu system file-systems) to 'modules'. * gnu/system/linux-initrd.scm (raw-initrd): Use (gnu system file-systems). Add 'spec->file-system' call for #:mounts.
2017-02-07linux-container: Add 'container-excursion*'.Ludovic Courtès
* gnu/build/linux-container.scm (container-excursion*): New procedure. * tests/containers.scm ("container-excursion*") ("container-excursion*, same namespaces"): New tests.
2017-02-06linux-container: Add comment on exception handling.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Add note about writing the exceptions.
2017-02-06linux-container: Do not rely on 'isatty?'.Ludovic Courtès
This avoids problems where 'isatty?' return #t but 'ttyname' fails with ENOTTY or such. * gnu/build/linux-container.scm (mount-file-systems): Remove call of 'isatty?'. Directly call 'ttyname' and catch 'system-error'.
2016-11-10container: Pass a list of <file-system> objects as things to mount.Ludovic Courtès
* gnu/build/linux-container.scm (mount-file-systems): 'mounts' is now a list of <file-system> objects instead of a list of lists ("specs"). Add call to 'file-system->spec' as the argument to 'mount-file-system'. (run-container, call-with-container): Adjust docstring accordingly. * gnu/system/file-systems.scm (spec->file-system): New procedure. * gnu/system/linux-container.scm (container-script)[script]: Call 'spec->file-system' inside gexp. * guix/scripts/environment.scm (launch-environment/container): Remove call to 'file-system->spec'. * tests/containers.scm ("call-with-container, mnt namespace") ("call-with-container, mnt namespace, wrong bind mount"): Pass a list of <file-system> objects.
2016-10-19container: Allow 'container-excursion' to the same namespaces.Ludovic Courtès
Before that, 'container-excursion' would call 'setns' even when the target namespace is the one the caller is already in, which would fail. * gnu/build/linux-container.scm (container-excursion): Introduce 'source' and 'target'. Compare the result of 'readlink' on these instead of comparing file descriptors to decide whether to call 'setns'. * tests/containers.scm ("container-excursion, same namespace"): New test.
2016-05-31container: Gracefully report mount errors in the child process.Ludovic Courtès
Fixes <http://bugs.gnu.org/23306>. * gnu/build/linux-container.scm (run-container): Use 'socketpair' instead of 'pipe'. Rename 'in' to 'child' and 'out' to 'parent'. Send a 'ready message or an exception argument list from the child to the parent; adjust the parent accordingly. * tests/containers.scm ("call-with-container, mnt namespace, wrong bind mount"): New test. * tests/guix-environment-container.sh: Add test with --expose=/does-not-exist.
2016-05-31container: Gracefully handle failure to set up user namespaces.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Exit when the parent process doesn't say 'ready.
2016-01-23build: container: Make 'unprivileged-user-namespace-supported?' more robust.Mark H Weaver
* gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Only read and check the first character, to cope with a possible newline in the (pseudo-)file.
2015-11-03build: container: Add feature test predicates.David Thompson
* gnu/build/linux-container.scm (user-namespace-supported?, unprivileged-user-namespace-supported?, setgroups-supported?): New procedures. * tests/container.scm: Use predicates. * tests/syscalls.scm: Likewise.
2015-10-28container: Remove unnecessary CLONE_CHILD_* flags.Ludovic Courtès
* gnu/build/linux-container.scm (namespaces->bit-mask): Remove CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID, which are unneeded. Discussed at <http://bugs.gnu.org/21694>.
2015-10-10build: container: Fix call-with-clean-exit.David Thompson
Before, call-with-clean-exit would *always* return an exit code of 1. * gnu/build/linux-container.scm (call-with-clean-exit): Exit with status code of 0 if thunk does not throw an exception. * tests/containers.scm: Add test.
2015-09-07build: container: Use the same clone flags as fork(3).David Thompson
The intent is to make 'clone' behave a lot more like 'primitive-fork', which calls clone(2) with SIGCHLD, CLONE_CHILD_CLEARTID, and CLONE_CHILD_SETTID flags. Notably, running 'clone' at the REPL without these flags would break the REPL beyond repair. * guix/build/syscalls.scm (CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID): New variables. * gnu/build/linux-container.scm (namespaces->bit-mask): Add CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID to bit mask.
2015-09-07build: container: Setup /dev/console.David Thompson
* gnu/build/linux-container.scm (mount-file-systems): Bind mount the controlling terminal as /dev/console.
2015-08-08build: container: Add #:host-uids argument to call-with-container.David Thompson
It's not always possible to map 65536 uids when creating a container as the root user within another user namespace. This is true when building Guix within the build daemon's container. By using a uid range of 1 by default, even as the root user, the tests now pass. * gnu/build/linux-container.scm (initialize-user-namespace, run-container): Add 'host-uids' argument. (call-with-container): Add #:host-uids keyword argument. * tests/containers.scm ("container-excursion"): Update 'run-container' call.
2015-07-09gnu: build: Add Linux container module.David Thompson
* gnu/build/linux-container.scm: New file. * gnu-system.am (GNU_SYSTEM_MODULES): Add it. * .dir-locals.el: Add Scheme indent rules for 'call-with-container', and 'container-excursion'. * tests/containers.scm: New file. * Makefile.am (SCM_TESTS): Add it.
generated by cgit v1.2.3 (git 2.46.2) at 2024-11-19 07:38:56 +0000