[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
05/16: linux-container: new use-output argument.
From: |
guix-commits |
Subject: |
05/16: linux-container: new use-output argument. |
Date: |
Sat, 20 Apr 2019 17:25:27 -0400 (EDT) |
reepca pushed a commit to branch guile-daemon
in repository guix.
commit 1d820a742a7696131ea9dd2c9ab9d2a68850f7c5
Author: Caleb Ristvedt <address@hidden>
Date: Mon Aug 28 23:44:23 2017 -0500
linux-container: new use-output argument.
* gnu/build/linux-container.scm:
(call-with-container): new use-output argument, attempts to unmount
container root when it exits.
(run-container): container root directory is now visible outside of
container, but anything mounted under it is not. User namespace option
is in a broken state now, needs further investigation.
(try-umount): new procedure.
---
gnu/build/linux-container.scm | 48 +++++++++++++++++++++++++++++++------------
1 file changed, 35 insertions(+), 13 deletions(-)
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index 3d7b52f..bec4f36 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -100,7 +100,9 @@ for the process."
;; The container's file system is completely ephemeral, sans directories
;; bind-mounted from the host.
- (mount "none" root "tmpfs")
+ ;; Make this private in the container namespace so everything mounted under
+ ;; it is local to this namespace.
+ (mount "none" root "none" MS_PRIVATE)
;; A proc mount requires a new pid namespace.
(when mount-/proc?
@@ -224,6 +226,10 @@ ipc, uts, user, and net.
HOST-UIDS specifies the number of host user identifiers to map into the user
namespace. GUEST-UID and GUEST-GID specify the first UID (respectively GID)
that host UIDs (respectively GIDs) map to in the namespace."
+ ;; this needs to be visible outside the namespace if anyone wants to use the
+ ;; file-system output of running THUNK.
+ (when (memq 'mnt namespaces)
+ (mount "none" root "tmpfs"))
;; The parent process must initialize the user namespace for the child
;; before it can boot. To negotiate this, a pipe is used such that the
;; child process blocks until the parent writes to it.
@@ -279,8 +285,16 @@ that host UIDs (respectively GIDs) map to in the
namespace."
(_ ;unexpected termination
#f)))))))))
+(define (try-umount maybe-mountpoint)
+ (catch #t
+ (lambda ()
+ (umount maybe-mountpoint))
+ noop))
+
(define* (call-with-container mounts thunk #:key (namespaces %namespaces)
- (host-uids 1) (guest-uid 0) (guest-gid 0))
+ (host-uids 1) (guest-uid 0) (guest-gid 0)
+ use-output)
+
"Run THUNK in a new container process and return its exit status.
MOUNTS is a list of <file-system> objects that specify file systems to mount
inside the container. NAMESPACES is a list of symbols corresponding to
@@ -301,17 +315,25 @@ module files must be present in one of the mappings in
MOUNTS and the Guile
load path must be adjusted as needed."
(call-with-temporary-directory
(lambda (root)
- (let ((pid (run-container root mounts namespaces host-uids thunk
- #:guest-uid guest-uid
- #:guest-gid guest-gid)))
- ;; Catch SIGINT and kill the container process.
- (sigaction SIGINT
- (lambda (signum)
- (false-if-exception
- (kill pid SIGKILL))))
-
- (match (waitpid pid)
- ((_ . status) status))))))
+ (dynamic-wind
+ (const #t)
+ (lambda ()
+ (let ((pid (run-container root mounts namespaces host-uids thunk
+ #:guest-uid guest-uid
+ #:guest-gid guest-gid)))
+ ;; Catch SIGINT and kill the container process.
+ (sigaction SIGINT
+ (lambda (signum)
+ (false-if-exception
+ (kill pid SIGKILL))))
+
+ (match (waitpid pid)
+ ((_ . status)
+ (when use-output
+ (use-output root))
+ status))))
+ (lambda ()
+ (try-umount root))))))
(define (container-excursion pid thunk)
"Run THUNK as a child process within the namespaces of process PID and
- branch guile-daemon created (now b1ff580), guix-commits, 2019/04/20
- 03/16: guix: store: Register derivation outputs., guix-commits, 2019/04/20
- 08/16: linux-container: don't include /dev/ptmx or /dev/pts from host., guix-commits, 2019/04/20
- 11/16: syscalls: add missing pieces for derivation build environment, guix-commits, 2019/04/20
- 10/16: gnu: linux-container: Make it more suitable for derivation-building., guix-commits, 2019/04/20
- 04/16: guix/store/build-derivations.scm: new module., guix-commits, 2019/04/20
- 05/16: linux-container: new use-output argument.,
guix-commits <=
- 12/16: config: add variables for more directories, %impersonate-linux-2.6?, guix-commits, 2019/04/20
- 14/16: build-derivations: scan for hashes, not full paths., guix-commits, 2019/04/20
- 13/16: derivations: migrate the rest of the non-rpc-related bindings., guix-commits, 2019/04/20
- 01/16: gnu: address@hidden: Honor NIX_STORE., guix-commits, 2019/04/20
- 06/16: build-derivations: use call-with-container, guix-commits, 2019/04/20
- 09/16: build-derivations: Leaked environment variables more robust., guix-commits, 2019/04/20
- 15/16: build-derivations: Adapt docstrings to fit style., guix-commits, 2019/04/20
- 07/16: build-derivations: initial build-group support, guix-commits, 2019/04/20
- 02/16: guix: split (guix store) and (guix derivations)., guix-commits, 2019/04/20
- 16/16: build-derivations: move environment code to (guix store environment), guix-commits, 2019/04/20