summaryrefslogtreecommitdiff
path: root/gnu/system/linux-container.scm
AgeCommit message (Collapse)Author
2026-01-27system/linux-container: Re-export %namespaces, %writable-/tmp variables.Maxim Cournoyer
* gnu/system/linux-container.scm: Re-export %namespaces and %writable-/tmp, which are from (guix build linux-container). Change-Id: Iaad362247825e30fb6837af013018f2c472c19fa
2025-12-16system: Reinstate lock-mounts work around for system containers.Rutherther
The underlying problem for system containers still hasn't been solved, the part of issue 78356 that has been solved is only home containers. This reverts commit cbc35fd9aa08a6da9df1ce8463779ad7decaf12a. This is a work around for #4788 (previously https://issues.guix.gnu.org/78356). * gnu/system/linux-container.scm (container-script): Disable lock-mounts? Change-Id: Ib8eacfc1f1f1a858acf19beb6c14e12c4648b8d9
2025-11-13gnu: Add --pid-file option to "guix system container" scripts.Carlo Zancanaro
* gnu/system/linux-container.scm (container-script): Accept pid-file command line option to write out the container's process ID. * doc/guix.texi (Invoking guix system): Document new option. Change-Id: I93e8a99b39c1dd831f116104bf92c723d96c9965 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2025-10-29system: Reinstate lock mounts in `container-script'.Maxim Cournoyer
This issue should now be resolved, with a test guarding it from re-appearing. * gnu/system/linux-container.scm (container-script) [#:lock-mounts]: Delete argument. Change-Id: I93e94a0ee349c53967275b82e1a9a5bcc8e8f65c
2025-10-29Reinstate "linux-container: Remove #:lock-mounts? and related code."Maxim Cournoyer
This reverts commit e0e64be8de3d220a12612b3a2e4aee428277d865.
2025-10-13linux-container: Remove #:lock-mounts? and related code.Ludovic Courtès
This reverts commits 437bb9ece55f37d4b5a62cafc98c0c3b848a53ce and a57ed987ffd1452ba5a4d70feb54893e99b8e076, which were reported in guix/guix#1169 to occasionally cause errors like: guix shell: error: unshare : 268566528: Invalid argument
2025-07-24gnu: system: Replace deprecated dhcp client service.Gabriel Wicki
* gnu/system/examples/asus-c201.tmpl, gnu/system/examples/bare-bones.tmpl, gnu/system/examples/beaglebone-black.tmpl, gnu/system/examples/raspberry-pi-64-nfs-root.tmpl, gnu/system/examples/raspberry-pi-64.tmpl, gnu/system/examples/vm-image.tmpl gnu/system/images/orangepi-r1-plus-lts-rk3328.scm, gnu/system/images/pine64.scm, gnu/system/images/rock64.scm, gnu/system/images/unmatched.scm, gnu/system/images/visionfive2.scm, gnu/system/linux-container.scm (services): Replace dhcp-client-service-type with its replacement dhcpcd-service-type. Change-Id: Ib1f31d0a95dfa8ee64cf8c10d617ee53c8637b26
2025-06-28gnu: Add %dummy-linux-kernel-for-container.Hilton Chain
* gnu/packages/linux.scm (%dummy-linux-kernel-for-container): New variable. * gnu/system/linux-container.scm (containerized-operating-system): Use it. Change-Id: Ica49a0cd0b8ae4a78ba5fca879ae73f94e64474a
2025-06-04linux-container: ‘containerized-operating-system’ provides ↵Ludovic Courtès
‘loopback’ service. Fixes #420. Previously, in systems produced by ‘guix system container’, the ‘loopback’ Shepherd service would fail to start with EEXIST, because the “lo” interface already exists in the container. This commit provides a fake ‘loopback’ Shepherd service that does nothing. * gnu/system/linux-container.scm (dummy-networking-service-type): Change to honor its configuration value. (containerized-operating-system)[services-to-drop]: Add ‘static-networking-service-type’ in the non-‘shared-network?’ case. [services-to-add]: Add ‘dummy-networking-service-type’ for loopback in the non-‘shared-network?’ case. Reported-by: Antonio Carlos Padoan Junior <acpadoanjr@yahoo.com.br> Change-Id: I326b5f3b5e08f67b6613c186497c44b1e887b02e
2025-05-12linux-container: Do not attempt to lock mounts for ‘guix system container’.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/78356>. * gnu/system/linux-container.scm (container-script): Pass #:lock-mounts? #f to ‘call-with-container’. Reported-by: Rutherther <rutherther@ditigal.xyz> Change-Id: Ie670868147f32baf2c2a94c9c7b1636bc84d0a0a
2025-05-05linux-container: Support having a read-only root file system.Ludovic Courtès
Until now, the read-only file system set up by ‘call-with-container’ would always be writable. With this change, it can be made read-only. With this patch, only ‘least-authority-wrapper’ switches to a read-only root file system. * gnu/build/linux-container.scm (remount-read-only): New procedure. (mount-file-systems): Add #:writable-root? and #:populate-file-system and honor them. (run-container): Likewise. (call-with-container): Likewise. * gnu/system/linux-container.scm (container-script): Pass #:writable-root? to ‘call-with-container’. (eval/container): Add #:populate-file-system and #:writable-root? and honor them. * guix/scripts/environment.scm (launch-environment/container): Pass #:writable-root? to ‘call-with-container’. * guix/scripts/home.scm (spawn-home-container): Likewise. * tests/containers.scm ("call-with-container, mnt namespace, read-only root") ("call-with-container, mnt namespace, writable root"): New tests. Change-Id: I603e2fd08851338b737bb16c8af3f765e2538906
2025-05-05linux-container: Add #:mounts to ‘eval/container’.Ludovic Courtès
* gnu/system/linux-container.scm (eval/container): Add #:mounts parameter and honor it. Change-Id: I1d5970f53a3d67db93e937e392f9bf36e75d1573
2025-02-17gnu: guix-configuration: Add a chroot? parameter.Andreas Enge
The parameter should take the values #t, #f or 'default. In a container environment, 'default amounts to #f, otherwise it amounts to #t. * gnu/services/base.scm (guix-configuration)<chroot?>: New field. (guix-shepherd-service): If chroot? is #f, add "--disable-chroot". If it is #t or 'default, do nothing. * gnu/system/linux-container.scm (containerized-operating-system): If chroot? is 'default, replace it by #f. * doc/guix.texi: Document the parameter. Change-Id: I8b9c3f46ad8650fa6ed4acee947b4ae5d002d03d
2024-02-05linux-container: Inherit essential services.Leo Nikkilä
Currently it's not possible to set `essential-services' when building operating systems for containers, since `container-essential-services' always uses the defaults. It's possible to reference `essential-services' from the operating system that's passed in, but since it's thunked, the operating system needs to be defined in two passes to avoid an infinite loop. * gnu/system/linux-container.scm (container-essential-services): Use operating-system-essential-services instead of the defaults to allow overriding the base services. (containerized-operating-system): Update accordingly. Signed-off-by: Ludovic Courtès <ludo@gnu.org> Change-Id: I81452487ef1ad01d3fa874c26d93a67d58ce6062
2023-06-24linux-container: Pass '--disable-chroot' to 'guix-daemon'.Ludovic Courtès
This allows for the use of Guix within a non-privileged Docker container produced by 'guix system image -t docker'. * gnu/system/linux-container.scm (containerized-operating-system): Change 'guix-configuration' to add "--disable-chroot".
2023-06-09linux-container: Adjust to 'modify-services' semantic change.Ludovic Courtès
This is a followup to dbbc7e946131ba257728f1d05b96c4339b7ee88b: 'nscd-service-type' isn't necessarily present in OS, so we cannot use the 'modify-services' as it would now error out. This was happening with the "guix system docker-image" test in 'tests/guix-system.sh'. * gnu/system/linux-container.scm (containerized-operating-system): Use 'filter-map' instead of 'remove' + 'modify-services'.
2023-03-26linux-container: Remove hosts-service-type when network is shared.Pierre Langlois
Fixes <https://issues.guix.gnu.org/61627>. * gnu/system/linux-container.scm (container-essential-services): When shared-network? is true, remove the hosts-service-type service kind.
2022-12-01linux-container: Do not replace nscd-service-type.Ricardo Wurmus
* gnu/system/linux-container.scm (containerized-operating-system): Respect customizations to the nscd-service-type and only modify the caches field.
2022-08-09linux-container: container-script: Parse command line options.Ricardo Wurmus
* gnu/system/linux-container.scm (container-script): Accept command line options to bind mount host directories into the container. * doc/guix.texi (Invoking guix system): Document options.
2022-05-31gnu: Remove wicd.Maxim Cournoyer
The last release is from 2017, stuck on Python 2. * gnu/packages/wicd.scm: Delete file. * gnu/packages/patches/wicd-bitrate-none-fix.patch: Delete file. * gnu/packages/patches/wicd-get-selected-profile-fix.patch: Likewise. * gnu/packages/patches/wicd-urwid-1.3.patch: Likewise. * gnu/packages/patches/wicd-wpa2-ttls.patch: Likewise. * gnu/local.mk: De-register them. * gnu/services/networking.scm: Remove wicd service... * doc/guix.texi: ... and its documentation. * gnu/system/linux-container.scm (containerized-operating-system) <services-to-drop>: Remove wicd-service-type.
2022-03-19linux-container: Add #:guest-uid and #:guest-gid to 'eval/container'.Ludovic Courtès
* gnu/system/linux-container.scm (eval/container): Add #:guest-uid and #:guest-gid and honor them.
2022-03-19linux-container: 'eval/container' honors #:namespaces.Ludovic Courtès
* gnu/system/linux-container.scm (eval/container): Pass #:namespaces to 'call-with-container'.
2021-01-13services: shepherd: 'shepherd-service-type' requires documentation.Ludovic Courtès
* gnu/services/shepherd.scm (shepherd-service-type): Require a 'description' form. * gnu/services/base.scm (root-file-system-service-type) (rngd-service-type, host-name-service-type): (virtual-terminal-service-type, console-keymap-service-type) (syslog-service-type, swap-service-type) (kmscon-service-type): Add description. * gnu/services/networking.scm (dhcp-client-service-type): Likewise. * gnu/system/install.scm (cow-store-service-type): Likewise. * gnu/system/linux-container.scm (dummy-networking-service-type): Likewise. * gnu/system/mapped-devices.scm (device-mapping-service-type): Likewise. * tests/guix-system.sh: Likewise.
2020-10-01Instantiate nscd in each system container.Jason Conroy
* gnu/system/linux-container.scm (%nscd-container-caches): New variable. (containerized-operating-system): Instantiate nscd-service with smaller caches and add it to the generated operating-system, replacing any nscd-service specified by the caller. * gnu/system/file-systems.scm: (%network-file-mappings): Remove "/var/run/nscd". Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
2020-04-26services: system: Initial entries are non-monadic.Ludovic Courtès
* gnu/system.scm (operating-system-directory-base-entries): Return a regular, non-monadic value. * gnu/services.scm (system-derivation): Adjust accordingly. * gnu/system/linux-container.scm (container-essential-services): Likewise.
2020-01-06system: linux-container: Recommend guix container.Efraim Flashner
* gnu/system/linux-container.scm (container-script)[script]: Recommend using 'guix container' to get a shell inside the running container.
2019-09-18linux-container: 'eval/container' correctly passes -L and -C flags.Ludovic Courtès
This fixes a type error. * gnu/system/linux-container.scm (eval/container): Use 'append-map', not 'map'. * tests/containers.scm ("eval/container, non-empty load path"): New test.
2019-09-12linux-container: "run-container" scripts shows the container's PID.Ludovic Courtès
* gnu/build/linux-container.scm (call-with-container): Add #:process-spawned-hook and honor it. * gnu/system/linux-container.scm (container-script)[script]: Define 'explain' and pass it as #:process-spawned-hook'.
2019-09-12linux-container: Exclude more services when sharing networking with the host.Ludovic Courtès
* gnu/system/linux-container.scm (containerized-operating-system)[useless-services]: Add more services to the list when SHARED-NETWORK? is true.
2019-09-12file-systems: Add /var/run/nscd to '%network-file-mappings'.Ludovic Courtès
This allows containers created by "guix environment -CN" or by "guix system container -N" to talk to the host nscd. * gnu/system/file-systems.scm (%network-file-mappings): Add "/var/run/nscd". * gnu/build/shepherd.scm (default-mounts)[nscd-socket]: Remove. * gnu/system/linux-container.scm (container-script)[nscd-run-directory] [nscd-mapping, nscd-os, nscd-specs]: Remove. [script]: Filter out from SPECS bind-mounts where the device does not exist. * guix/scripts/environment.scm (launch-environment/container) [optional-mapping->fs]: New procedure. [mappings]: Remove %NETWORK-FILE-MAPPINGS. [file-systems]: Add %NETWORK-FILE-MAPPINGS here, filtered through 'optional-mapping->fs'.
2019-07-19linux-container: Add 'eval/container'.Ludovic Courtès
* gnu/system/linux-container.scm (eval/container): New procedure. * tests/containers.scm ("eval/container, exit status") ("eval/container, writable user mapping"): New tests.
2019-06-19linux-container: Remove networking service when network is shared with host.Arun Isaac
* gnu/system/linux-container.scm (dummy-networking-service-type): New variable. (containerized-operating-system): If network is shared with host, replace static-networking-service-type with dummy-networking-service-type.
2019-05-25linux-container: Check if nscd run directory exists when container is run.Arun Isaac
* gnu/system/linux-container.scm (containerized-operating-system): (container-script): Check for existence of the host nscd run directory in the container script. This check should be run when the container is started, not when the container script is created. [network-mappings]: Delete variable. [nscd-run-directory, nscd-mapping]: New variables.
2019-05-15linux-container: Compute essential services for THIS-OPERATING-SYSTEM.Ludovic Courtès
Previously, the 'essential-services' would correspond to the initial, non-containerized OS. Thus, all the file systems removed in 'container-essential-services' would actually still be there because the essential services would be computed on the non-containerized OS. This is a followup to 69cae3d3356a69b7fe69481338f760545995485e. * gnu/system/linux-container.scm (container-essential-services): Call 'operating-system-default-essential-services' to get the baseline services. (containerized-operating-system): Pass THIS-OPERATING-SYSTEM, not OS, to 'container-essential-services'. Add a dummy root file system to 'file-systems'. (container-script)[mountable-file-system?]: New procedure. Use it.
2019-05-15linux-container: Do not add %CONTAINER-FILE-SYSTEMS to Docker image OSes.Ludovic Courtès
Previously, 'guix system docker-image' would end up providing an OS that would try to mount all of %CONTAINER-FILE-SYSTEMS as well as /gnu/store, which is bound to fail in unprivileged Docker. This patch makes it so that 'guix system container' still gets those file systems, but 'guix system docker-image' doesn't. * gnu/system/linux-container.scm (containerized-operating-system): Add #:extra-file-systems parameter and honor it. Do not include %STORE-MAPPING and SHARED-NETWORK-FILE-MAPPINGS. (container-script): Add %STORE-MAPPING and optionally NETWORK-MAPPINGS to MAPPINGS and pass #:extra-file-systems.
2019-05-14linux-container: Support container network sharing.Arun Isaac
* gnu/system/linux-container.scm (container-essential-services): If network is to be shared with the host, remove network configuration files from etc service. (containerized-operating-system): If network is to be shared with the host, remove nscd service and map host's /var/run/nscd if it exists. (container-script): If network is to be shared with the host, do not create network namespace. * guix/scripts/system.scm (system-derivation-for-action): Add #:container-shared-network? argument. (perform-action): Add #:container-shared-network? argument. (show-help): Add "-N, --network" help information. (%options): Add network option. (process-action): Call perform-action with #container-shared-network? argument. * doc/guix.texi (Invoking guix system): Document the "-N, --network" option. Co-authored-by: Christopher Baines <mail@cbaines.net>
2019-05-10linux-container: Improve filtering of unnecessary file systems.Ludovic Courtès
* gnu/system/linux-container.scm (containerized-operating-system)[user-file-systems]: Add trailing slash for the "/dev/" and "/sys/" prefixes.
2019-04-23linux-container: Remove '%containerized-shepherd-service' hack.Ludovic Courtès
This hack worked around a defect in the Shepherd 0.5.0 and is no longer needed. * gnu/services/shepherd.scm (%containerized-shepherd-service): Remove. * gnu/system/linux-container.scm (container-essential-services): Don't use it.
2019-03-25system: Add 'essential-services' field to <operating-system>.Ludovic Courtès
* gnu/system.scm (<operating-system>)[essential-services]: New field. (operating-system-directory-base-entries): Remove #:container? keyword and keep only the not-container branch. (essential-services): Likewise. (operating-system-services): Likewise, and call 'operating-system-essential-services' instead of 'essential-services'. (operating-system-activation-script): Remove #:container?. (operating-system-boot-script): Likewise. (operating-system-derivation): Likewise. * gnu/system/linux-container.scm (container-essential-services): New procedure. (containerized-operating-system): Use it and set the 'essential-services' field. (container-script): Remove call to 'operating-system-derivation'. * gnu/system/vm.scm (system-docker-image): Likewise. * doc/guix.texi (operating-system Reference): Document 'essential-services'.
2019-03-13linux-container: 'containerized-operating-system' removes "useless" services.Ludovic Courtès
Fixes <https://bugs.gnu.org/34211>. Reported by Efraim Flashner <efraim@flashner.co.il>. * gnu/system/linux-container.scm (containerized-operating-system) [useless-services]: New variable. Add 'services' field.
2017-02-03file-systems: Add 'file-system-mapping->bind-mount'.Ludovic Courtès
* gnu/system/file-systems.scm (file-system-mapping->bind-mount): New procedure. * gnu/system/linux-container.scm (mapping->file-system): Remove. (containerized-operating-system)[mapping->fs]: Use 'file-system-mapping->bind-mount' instead of 'mapping->file-system'. * guix/scripts/environment.scm (launch-environment/container): Likewise.
2016-11-10container: Pass a list of <file-system> objects as things to mount.Ludovic Courtès
* gnu/build/linux-container.scm (mount-file-systems): 'mounts' is now a list of <file-system> objects instead of a list of lists ("specs"). Add call to 'file-system->spec' as the argument to 'mount-file-system'. (run-container, call-with-container): Adjust docstring accordingly. * gnu/system/file-systems.scm (spec->file-system): New procedure. * gnu/system/linux-container.scm (container-script)[script]: Call 'spec->file-system' inside gexp. * guix/scripts/environment.scm (launch-environment/container): Remove call to 'file-system->spec'. * tests/containers.scm ("call-with-container, mnt namespace") ("call-with-container, mnt namespace, wrong bind mount"): Pass a list of <file-system> objects.
2016-11-10linux-container: Use 'source-module-closure' when generating the script.Ludovic Courtès
* gnu/system/linux-container.scm (container-script)[script]: Use 'source-module-closure' in 'with-imported-modules' form.
2016-07-12linux-container: Fix list of imported modules.Ludovic Courtès
This fixes a regression introduced in 958dd3ce68733bcd5c1231424c7e4ad39e67594a. * gnu/system/linux-container.scm (container-script)[script]: Add (guix combinators) to the list of imported modules.
2016-07-12gnu: Switch to 'with-imported-modules'.Ludovic Courtès
* gnu/services.scm (directory-union): Use 'with-imported-modules' instead of the '#:modules' argument of 'computed-file'. * gnu/services/base.scm (udev-rules-union): Likewise. * gnu/services/dbus.scm (system-service-directory): Likewise. * gnu/services/desktop.scm (wrapped-dbus-service): (polkit-directory): Likewise. * gnu/services/networking.scm (tor-configuration->torrc): Likewise. * gnu/services/xorg.scm (xorg-configuration-directory): Likewise. * gnu/system/install.scm (self-contained-tarball): Likewise. * gnu/system/linux-container.scm (container-script): Likewise. * gnu/system/linux-initrd.scm (expression->initrd): Likewise, and remove #:modules parameter. (flat-linux-module-directory): Use 'with-imported-modules'. (base-initrd): Likewise. * gnu/system/locale.scm (locale-directory): Likewise. * gnu/system/shadow.scm (default-skeletons): Likewise. * gnu/system/vm.scm (expression->derivation-in-linux-vm): Likewise. * gnu/tests/base.scm (run-basic-test): Likewise. * gnu/tests/install.scm (run-install): Likewise. * doc/guix.texi (Initial RAM Disk): Update 'expression->initrd' documentation.
2016-02-08linux-container: Accept file systems with a UUID 'source'.Ludovic Courtès
* gnu/system/linux-container.scm (containerized-operating-system)[user-file-systems]: Check whether SOURCE is a string before calling 'string-prefix?'.
2016-02-08file-systems: Spawn a Bournish REPL upon fsck failure.Ludovic Courtès
Fixes <http://bugs.gnu.org/22588>. Reported by Mark H Weaver <mhw@netris.org>. * gnu/build/file-systems.scm (check-file-system): Pass %BOURNISH-LANGUAGE as the argument to 'start-repl'. * gnu/services.scm (activation-script): Add (guix build bournish). * gnu/services/base.scm (file-system-shepherd-service)[imported-modules]: Likewise. * gnu/system/linux-container.scm (container-script): Likewise. * gnu/system/vm.scm (expression->derivation-in-linux-vm): Likewise.
2015-11-02services: Add 'system-service-type'.Ludovic Courtès
* gnu/services.scm (system-derivation): New procedure. (system-service-type): New variable. (boot-script-entry): New procedure. (boot-service-type): Extend SYSTEM-SERVICE-TYPE. (etc-entry): New procedure. (etc-service-type): Extend SYSTEM-SERVICE-TYPE. (fold-services): Change default #:target-type to SYSTEM-SERVICE-TYPE. * gnu/system.scm (operating-system-directory-base-entries): New procedure. (essential-services): Use it. Add an instance of SYSTEM-SERVICE-TYPE. (operating-system-boot-script): Pass #:target-type to 'fold-services'. (operating-system-derivation): Rewrite in terms of 'fold-services'. * gnu/system/linux-container.scm (system-container): Remove. (container-script): Use 'operating-system-derivation'. * guix/scripts/system.scm (export-extension-graph): Replace BOOT-SERVICE-TYPE by SYSTEM-SERVICE-TYPE. * doc/images/service-graph.dot: Add 'system' node and edges. * doc/guix.texi (Service Composition): Mention SYSTEM-SERVICE-TYPE. (Service Reference): Document it. Update 'fold-services' documentation.
2015-10-30scripts: system: Add 'container' action.David Thompson
* guix/scripts/system.scm (show-help): Display 'container' action. (system-derivation-for-action, guix-system): Add 'container' case. (perform-action): Skip GRUB config generation when building a container. * doc/guix.texi (Invoking guix system): Document it.
2015-10-30system: container: Adjust to changes in gexps.David Thompson
* gnu/system/linux-container.scm (system-container): 'etc' is no longer a monadic value, and the result of 'file-union' must be lowered.
generated by cgit v1.3 (git 2.53.0) at 2026-05-28 09:47:42 +0000