summaryrefslogtreecommitdiff
path: root/gnu/build/linux-container.scm
AgeCommit message (Collapse)Author
2025-10-29build/syscalls: Introduce new safe-clone and use it.Maxim Cournoyer
* guix/build/syscalls.scm (without-automatic-finalization): Accept multiple expressions. (without-garbage-collection): New syntax. (without-threads): Likewise. (ensure-signal-delivery-thread, safe-clone): New procedures. * tests/syscalls.scm: ("clone and unshare triggers EINVAL") ("safe-clone and unshare succeeds"): New tests. * gnu/build/linux-container.scm (run-container): Adjust to use 'safe-clone'. Relates-to: #1169 Change-Id: I044c11a899e24e547a7aed97f30c8e7250ab5363
2025-10-29linux-container: Inhibit GC thread creation in child.W. Kosior
The `unshare' system call with `CLONE_NEWUSER' cannot be used in multithreaded programs. Guile VM's automatic GC thread creation used to lead to nondeterministic failures in container creation, which uses this system call. * gnu/build/linux-container.scm (run-container): Disable GC in child after `(clone)' and re-enable after `(unshare)'. Fixes: #1169 Change-Id: I9df5412102509c13f74ab9911f6f06c0152d0a4f Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-10-29Reinstate "linux-container: Remove #:lock-mounts? and related code."Maxim Cournoyer
This reverts commit e0e64be8de3d220a12612b3a2e4aee428277d865.
2025-10-13linux-container: Remove #:lock-mounts? and related code.Ludovic Courtès
This reverts commits 437bb9ece55f37d4b5a62cafc98c0c3b848a53ce and a57ed987ffd1452ba5a4d70feb54893e99b8e076, which were reported in guix/guix#1169 to occasionally cause errors like: guix shell: error: unshare : 268566528: Invalid argument
2025-09-17linux-container: Export ‘%writable-/tmp’ and use it.Ludovic Courtès
Fixes guix/guix#1994. * gnu/build/linux-container.scm (%writable-/tmp): New variable. * guix/scripts/environment.scm (launch-environment/container): Remove ‘tmpfs’ and use it. Adjust ‘file-system’ declaration for /run/user/$UID. * guix/scripts/home.scm (spawn-home-container): Likewise. Reported-by: Romain GARBAGE <romain.garbage@inria.fr> Change-Id: Ia8289fb5386971738caf2ccc1e815daa6ac28459
2025-07-12linux-container: Fix typo in docstring.cdr-shdr-wdr
* gnu/build/linux-container.scm (mount-file-systems): Fix typo in docstring. Change-Id: I973a65a6574078bc72fd9e1aa7424a68e2b21268 Signed-off-by: Danny Milosavljevic <dannym@friendly-machines.com>
2025-05-05linux-container: Lock mounts by default.Ludovic Courtès
This makes it impossible to unmount or remount things from within ‘call-with-container’. * gnu/build/linux-container.scm (initialize-user-namespace): Add #:host-uid and #:host-gid. and honor them. (run-container): Add #:lock-mounts?. Honor it by calling ‘unshare’ followed by ‘initialize-user-namespace’. (call-with-container): Add #:lock-mounts? and pass it down. (container-excursion): Get the user namespace owning the PID namespace and join it, then join the remaining namespaces. * tests/containers.scm ("call-with-container, mnt namespace, locked mounts"): New test. ("container-excursion"): Pass #:lock-mounts? #f. Change-Id: I13be982aef99e68a653d472f0e595c81cfcfa392
2025-05-05linux-container: Set up “lo” and generate /etc/hosts by default.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Add #:loopback-network? and honor it via #:populate-file-system. (call-with-container): Add #:loopback-network? and pass it to ‘run-container’. * guix/scripts/environment.scm (launch-environment/container): Remove call to ‘set-network-interface-up’ and remove generation of /etc/hosts. * guix/scripts/home.scm (spawn-home-container): Likewise. Change-Id: I5933a4e8dc6d8e19235a79696b62299d74d1ba21
2025-05-05linux-container: Support having a read-only root file system.Ludovic Courtès
Until now, the read-only file system set up by ‘call-with-container’ would always be writable. With this change, it can be made read-only. With this patch, only ‘least-authority-wrapper’ switches to a read-only root file system. * gnu/build/linux-container.scm (remount-read-only): New procedure. (mount-file-systems): Add #:writable-root? and #:populate-file-system and honor them. (run-container): Likewise. (call-with-container): Likewise. * gnu/system/linux-container.scm (container-script): Pass #:writable-root? to ‘call-with-container’. (eval/container): Add #:populate-file-system and #:writable-root? and honor them. * guix/scripts/environment.scm (launch-environment/container): Pass #:writable-root? to ‘call-with-container’. * guix/scripts/home.scm (spawn-home-container): Likewise. * tests/containers.scm ("call-with-container, mnt namespace, read-only root") ("call-with-container, mnt namespace, writable root"): New tests. Change-Id: I603e2fd08851338b737bb16c8af3f765e2538906
2025-03-26linux-container: ‘unprivileged-user-namespace-supported?’ returns #f on ↵Ludovic Courtès
non-Linux. Previously this procedure would return #t on non-Linux systems. * gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): When USERNS-FILE doesn’t exist, return (user-namespace-supported?). Reported-by: Reepca Russelstein <reepca@russelstein.xyz> Change-Id: I92050338b8b68bc3bd87100317eba69fcdf14a0a
2025-01-27linux-container: Ignore EPERM when attempting to mount /sys.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/61690>. Until now, this would work: guix shell --no-cwd -CWP -- guix shell -C coreutils -- ls -R /home … but this would not: $ guix shell --no-cwd -CWPN -- guix shell -C coreutils -- ls -R /home guix shell: error: mount: mount "none" on "/tmp/guix-directory.Wnc2OI/sys": Operation not permitted This is annoying and hardly understandable. Since we already disable /sys mounts when sharing the global network namespace is asked (as in ‘guix shell -CN‘), for the very same reason, we can just as well disable /sys mounts anytime it fails with EPERM. * gnu/build/linux-container.scm (mount-file-systems): Silently ignore EPERM when attempting to mount /sys. Change-Id: If85b1d703ab58a98ea9873f4f8fed71a06b7aa63
2023-01-30linux-container: 'container-excursion' forks to join the PID namespace.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/61156>. * gnu/build/linux-container.scm (container-excursion): Add extra call to 'primitive-fork' and invoke THUNK in the child process. * tests/containers.scm ("container-excursion"): Remove extra 'primitive-fork' call, now unnecessary. ("container-excursion*, /proc"): New test.
2023-01-30container: Correctly report exit status.Ludovic Courtès
* gnu/build/linux-container.scm (container-excursion): Return the raw status value. * tests/containers.scm ("container-excursion, same namespaces"): Add 'status:exit-val' call. * guix/scripts/container/exec.scm (guix-container-exec): Correctly handle the different cases.
2022-09-24linux-container: Mark socket pair as SOCK_CLOEXEC.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Pass SOCK_CLOEXEC to 'socketpair'.
2022-09-20linux-container: 'container-excursion*' marks its FDs as FD_CLOEXEC.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/57827>. Reported by Mathieu Othacehe <othacehe@gnu.org>. Fixes a regression introduced with the Shepherd 0.9.2 upgrade in 1ba0e38267c9ff8bb476285091be6e297bbf136e, whereby IN and OUT would no longer be closed when 'fork+exec-command/container' would call 'exec-command*' as part of the THUNK passed to 'container-excursion*'. This is because the Shepherd 0.9.2 assumes file descriptors are properly marked as O_CLOEXEC and, consequently, 'exec-command' no longer run the close(2) loop prior to 'exec'. * gnu/build/linux-container.scm (container-excursion*): Add calls to 'fcntl'.
2022-05-01linux-container: Add #:child-is-pid1? parameter to 'call-with-container'.Ludovic Courtès
* gnu/build/linux-container.scm (wait-child-process) (status->exit-status): New procedures. (call-with-container): Add #:child-is-pid1? parameter and honor it. [thunk*]: New variable. Pass it to 'run-container'.
2022-05-01linux-container: Ensure signal-handling asyncs get a chance to run.Ludovic Courtès
Previously we could enter the blocking 'waitpid' call and miss an opportunity to run the signal handler async. * gnu/build/linux-container.scm (call-with-container) [periodically-schedule-asyncs]: New procedure. [install-signal-handlers]: Call it.
2022-05-01linux-container: 'call-with-container' relays SIGTERM and SIGINT.Ludovic Courtès
* gnu/build/linux-container.scm (call-with-container): Add #:relayed-signals. [install-signal-handlers]: New procedure. Call it.
2022-01-05linux-container: Handle CLONE_NEWCGROUP and use it by default.Ryan Sundberg
Adds low-level support for launching Linux containers with cgroup namespaces. * gnu/build/linux-container.scm (%namespaces): Add 'cgroup. (namespaces->bit-mask): Handle it. * guix/build/syscalls.scm (CLONE_NEWCGROUP): New variable. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2020-12-06Revert "linux-container: Correct test for unprivileged user namespace support."Marius Bakke
This broke 'guix environment --container' on non-Debian distributions. Fixes <https://bugs.gnu.org/45066>. Reported by luhux <luhux@outlook.com>. This reverts commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
2020-12-03linux-container: Correct test for unprivileged user namespace support.Paul Garlick
Fixes <https://bugs.gnu.org/31977>. Reported by Paul Garlick <pgarlick@tourbillion-technology.com>. * gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Return #f when the 'userns-file' does not exist.
2020-10-01linux-container: Reset jailed root permissions.Jelle Licht
* gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call. * tests/containers.scm ("call-with-container, mnt namespace, root permissions"): New test.
2020-09-10build: linux-container: Fix run-container.Mathieu Othacehe
This is a follow-up of 5316dfc0f125b658e4a2acf7f00f49501663d943. Some users of run-container may expect that the container is jailed, even if there are no mounts. This is the case for some Guix tests. * gnu/build/linux-container.scm (run-container): Do not jail the container when the requested root is "/".
2020-09-02linux-container: Do not jail the container unconditionally.Mathieu Othacehe
We may want to run a container inside the MNT namespace, without jailing the container. If RUN-CONTAINER is passed a null MOUNTS list, do not jail the container. * gnu/build/linux-container.scm (run-container): Do not call MOUNT-FILE-SYSTEMS if MOUNTS list is empty.
2019-09-12linux-container: "run-container" scripts shows the container's PID.Ludovic Courtès
* gnu/build/linux-container.scm (call-with-container): Add #:process-spawned-hook and honor it. * gnu/system/linux-container.scm (container-script)[script]: Define 'explain' and pass it as #:process-spawned-hook'.
2019-07-06linux-container: Mount a new /dev/pts instance in the container.Ludovic Courtès
Fixes <https://bugs.gnu.org/36463>. Reported by Steffen Rytter Postas <nc@scalehost.eu>. * gnu/build/linux-container.scm (mount-file-systems): When /dev/ptmx exists on the host, explicitly mount a new instance of devpts and make /dev/ptmx a symlink to /dev/pts/ptmx.
2019-06-23linux-container: Remove dependency on (guix utils).Ludovic Courtès
Fixes a bug whereby derivations importing (gnu build linux-container), such as the 'bitlbee' and 'tor' services, would depend on the user's (guix config) file, which was pulled as a dependency of (guix utils). As a result, those derivations would vary from user to user. * gnu/build/linux-container.scm (call-with-temporary-directory): New procedure.
2019-04-02linux-container: Make the guest UID and GID a parameter.Ludovic Courtès
* gnu/build/linux-container.scm (initialize-user-namespace): Add #:guest-uid and #:guest-gid parameters and honor them. (run-container): Likewise. (call-with-container): Likewise. * tests/containers.scm ("call-with-container, user namespace, guest UID/GID"): New test.
2018-01-15linux-container: Work around EBADF errors upon exit.Ludovic Courtès
Typically 'read-pid-file/container' would fail when starting services in containers such as BitlBee. * gnu/build/linux-container.scm (call-with-clean-exit): Use 'primitive-_exit' instead of 'primitive-exit'. (container-excursion*): Close OUT.
2017-10-11file-systems: 'mount-file-system' now takes a <file-system> object.Ludovic Courtès
* gnu/build/file-systems.scm (mount-file-system): Rename 'spec' to 'fs' and assume it's a <file-system>. * gnu/build/linux-boot.scm (boot-system): Assume MOUNTS is a list of <file-system> and adjust accordingly. * gnu/build/linux-container.scm (mount-file-systems): Remove 'file-system->spec' call. * gnu/services/base.scm (file-system-shepherd-service): Add 'spec->file-system' call. Add (gnu system file-systems) to 'modules'. * gnu/system/linux-initrd.scm (raw-initrd): Use (gnu system file-systems). Add 'spec->file-system' call for #:mounts.
2017-02-07linux-container: Add 'container-excursion*'.Ludovic Courtès
* gnu/build/linux-container.scm (container-excursion*): New procedure. * tests/containers.scm ("container-excursion*") ("container-excursion*, same namespaces"): New tests.
2017-02-06linux-container: Add comment on exception handling.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Add note about writing the exceptions.
2017-02-06linux-container: Do not rely on 'isatty?'.Ludovic Courtès
This avoids problems where 'isatty?' return #t but 'ttyname' fails with ENOTTY or such. * gnu/build/linux-container.scm (mount-file-systems): Remove call of 'isatty?'. Directly call 'ttyname' and catch 'system-error'.
2016-11-10container: Pass a list of <file-system> objects as things to mount.Ludovic Courtès
* gnu/build/linux-container.scm (mount-file-systems): 'mounts' is now a list of <file-system> objects instead of a list of lists ("specs"). Add call to 'file-system->spec' as the argument to 'mount-file-system'. (run-container, call-with-container): Adjust docstring accordingly. * gnu/system/file-systems.scm (spec->file-system): New procedure. * gnu/system/linux-container.scm (container-script)[script]: Call 'spec->file-system' inside gexp. * guix/scripts/environment.scm (launch-environment/container): Remove call to 'file-system->spec'. * tests/containers.scm ("call-with-container, mnt namespace") ("call-with-container, mnt namespace, wrong bind mount"): Pass a list of <file-system> objects.
2016-10-19container: Allow 'container-excursion' to the same namespaces.Ludovic Courtès
Before that, 'container-excursion' would call 'setns' even when the target namespace is the one the caller is already in, which would fail. * gnu/build/linux-container.scm (container-excursion): Introduce 'source' and 'target'. Compare the result of 'readlink' on these instead of comparing file descriptors to decide whether to call 'setns'. * tests/containers.scm ("container-excursion, same namespace"): New test.
2016-05-31container: Gracefully report mount errors in the child process.Ludovic Courtès
Fixes <http://bugs.gnu.org/23306>. * gnu/build/linux-container.scm (run-container): Use 'socketpair' instead of 'pipe'. Rename 'in' to 'child' and 'out' to 'parent'. Send a 'ready message or an exception argument list from the child to the parent; adjust the parent accordingly. * tests/containers.scm ("call-with-container, mnt namespace, wrong bind mount"): New test. * tests/guix-environment-container.sh: Add test with --expose=/does-not-exist.
2016-05-31container: Gracefully handle failure to set up user namespaces.Ludovic Courtès
* gnu/build/linux-container.scm (run-container): Exit when the parent process doesn't say 'ready.
2016-01-23build: container: Make 'unprivileged-user-namespace-supported?' more robust.Mark H Weaver
* gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Only read and check the first character, to cope with a possible newline in the (pseudo-)file.
2015-11-03build: container: Add feature test predicates.David Thompson
* gnu/build/linux-container.scm (user-namespace-supported?, unprivileged-user-namespace-supported?, setgroups-supported?): New procedures. * tests/container.scm: Use predicates. * tests/syscalls.scm: Likewise.
2015-10-28container: Remove unnecessary CLONE_CHILD_* flags.Ludovic Courtès
* gnu/build/linux-container.scm (namespaces->bit-mask): Remove CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID, which are unneeded. Discussed at <http://bugs.gnu.org/21694>.
2015-10-10build: container: Fix call-with-clean-exit.David Thompson
Before, call-with-clean-exit would *always* return an exit code of 1. * gnu/build/linux-container.scm (call-with-clean-exit): Exit with status code of 0 if thunk does not throw an exception. * tests/containers.scm: Add test.
2015-09-07build: container: Use the same clone flags as fork(3).David Thompson
The intent is to make 'clone' behave a lot more like 'primitive-fork', which calls clone(2) with SIGCHLD, CLONE_CHILD_CLEARTID, and CLONE_CHILD_SETTID flags. Notably, running 'clone' at the REPL without these flags would break the REPL beyond repair. * guix/build/syscalls.scm (CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID): New variables. * gnu/build/linux-container.scm (namespaces->bit-mask): Add CLONE_CHILD_CLEARTID and CLONE_CHILD_SETTID to bit mask.
2015-09-07build: container: Setup /dev/console.David Thompson
* gnu/build/linux-container.scm (mount-file-systems): Bind mount the controlling terminal as /dev/console.
2015-08-08build: container: Add #:host-uids argument to call-with-container.David Thompson
It's not always possible to map 65536 uids when creating a container as the root user within another user namespace. This is true when building Guix within the build daemon's container. By using a uid range of 1 by default, even as the root user, the tests now pass. * gnu/build/linux-container.scm (initialize-user-namespace, run-container): Add 'host-uids' argument. (call-with-container): Add #:host-uids keyword argument. * tests/containers.scm ("container-excursion"): Update 'run-container' call.
2015-07-09gnu: build: Add Linux container module.David Thompson
* gnu/build/linux-container.scm: New file. * gnu-system.am (GNU_SYSTEM_MODULES): Add it. * .dir-locals.el: Add Scheme indent rules for 'call-with-container', and 'container-excursion'. * tests/containers.scm: New file. * Makefile.am (SCM_TESTS): Add it.
generated by cgit v1.3 (git 2.53.0) at 2026-05-28 02:42:21 +0000