mirror/guix
mirror/guix
1
Fork 0
mirror of https://https.git.savannah.gnu.org/git/guix.git/ synced 2025-07-10 16:50:43 +02:00
Code Releases Activity

gnu: guix-configuration: Add a chroot? parameter.

Browse source 
The parameter should take the values #t, #f or 'default.
In a container environment, 'default amounts to #f, otherwise it
amounts to #t.

* gnu/services/base.scm (guix-configuration)<chroot?>: New field.
(guix-shepherd-service): If chroot? is #f, add "--disable-chroot".
If it is #t or 'default, do nothing.
* gnu/system/linux-container.scm (containerized-operating-system):
If chroot? is 'default, replace it by #f.
* doc/guix.texi: Document the parameter.

Change-Id: I8b9c3f46ad8650fa6ed4acee947b4ae5d002d03d
This commit is contained in:
Andreas Enge 2024-07-05 15:47:13 +02:00
parent f0d4daa13f
commit 9a41ec5762
No known key found for this signature in database
GPG key ID: F7D5C9BF765C61E3
3 changed files with 38 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

7
doc/guix.texi
View file

@ -19940,6 +19940,13 @@ Name of the group for build user accounts.
@item @code{build-accounts} (default: @code{10}) @item @code{build-accounts} (default: @code{10})
Number of build user accounts to create. Number of build user accounts to create.
@item @code{chroot?} (default: @code{'default})
The value should be one of @code{#t} or @code{#f}, in which
case chroot is enabled or disabled, respectively;
or it should be @code{'default}, which amounts to @code{#f} in
Docker containers (so that they can be run in non-privileged mode)
or @code{#t} otherwise.
@item @code{authorize-key?} (default: @code{#t}) @item @code{authorize-key?} (default: @code{#t})
@cindex substitutes, authorization thereof @cindex substitutes, authorization thereof
Whether to authorize the substitute keys listed in Whether to authorize the substitute keys listed in

9
gnu/services/base.scm
View file

@ -22,6 +22,7 @@
;;; Copyright © 2022 ( <paren@disroot.org> ;;; Copyright © 2022 ( <paren@disroot.org>
;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu> ;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
;;; Copyright © 2024 Zheng Junjie <873216071@qq.com> ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
;;; ;;;
;;; This file is part of GNU Guix. ;;; This file is part of GNU Guix.
;;; ;;;
@ -224,6 +225,7 @@
guix-configuration-build-group guix-configuration-build-group
guix-configuration-build-accounts guix-configuration-build-accounts
guix-configuration-build-machines guix-configuration-build-machines
guix-configuration-chroot?
guix-configuration-authorize-key? guix-configuration-authorize-key?
guix-configuration-authorized-keys guix-configuration-authorized-keys
guix-configuration-use-substitutes? guix-configuration-use-substitutes?
@ -1924,6 +1926,8 @@ archive' public keys, with GUIX."
(default "guixbuild")) (default "guixbuild"))
(build-accounts guix-configuration-build-accounts ;integer (build-accounts guix-configuration-build-accounts ;integer
(default 10)) (default 10))
(chroot? guix-configuration-chroot? ;Boolean | 'default
(default 'default))
(authorize-key? guix-configuration-authorize-key? ;Boolean (authorize-key? guix-configuration-authorize-key? ;Boolean
(default #t)) (default #t))
(authorized-keys guix-configuration-authorized-keys ;list of gexps (authorized-keys guix-configuration-authorized-keys ;list of gexps
@ -2025,7 +2029,7 @@ proxy of 'guix-daemon'...~%")
glibc-utf8-locales))) glibc-utf8-locales)))
(match-record config <guix-configuration> (match-record config <guix-configuration>
(guix build-group build-accounts authorize-key? authorized-keys (guix build-group build-accounts chroot? authorize-key? authorized-keys
use-substitutes? substitute-urls max-silent-time timeout use-substitutes? substitute-urls max-silent-time timeout
log-compression discover? extra-options log-file log-compression discover? extra-options log-file
http-proxy tmpdir chroot-directories environment http-proxy tmpdir chroot-directories environment
@ -2095,6 +2099,9 @@ proxy of 'guix-daemon'...~%")
"--substitute-urls" #$(string-join substitute-urls) "--substitute-urls" #$(string-join substitute-urls)
#$@extra-options #$@extra-options
#$@(if chroot?
'()
'("--disable-chroot"))
;; Add CHROOT-DIRECTORIES and all their dependencies ;; Add CHROOT-DIRECTORIES and all their dependencies
;; (if these are store items) to the chroot. ;; (if these are store items) to the chroot.
(append-map (append-map

43
gnu/system/linux-container.scm
View file

@ -7,6 +7,7 @@
;;; Copyright © 2022 Ricardo Wurmus <rekado@elephly.net> ;;; Copyright © 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2023 Pierre Langlois <pierre.langlois@gmx.com> ;;; Copyright © 2023 Pierre Langlois <pierre.langlois@gmx.com>
;;; Copyright © 2024 Leo Nikkilä <hello@lnikki.la> ;;; Copyright © 2024 Leo Nikkilä <hello@lnikki.la>
;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
;;; ;;;
;;; This file is part of GNU Guix. ;;; This file is part of GNU Guix.
;;; ;;;
@ -151,26 +152,28 @@ containerized OS. EXTRA-FILE-SYSTEMS is a list of file systems to add to OS."
(swap-devices '()) ; disable swap (swap-devices '()) ; disable swap
(services (services
(append services-to-add (append services-to-add
(filter-map (lambda (s) (filter-map
(cond ((memq (service-kind s) services-to-drop) (lambda (s)
#f) (let ((kind (service-kind s))
((eq? nscd-service-type (service-kind s)) (value (service-value s)))
(service nscd-service-type (cond ((memq kind services-to-drop)
(nscd-configuration #f)
(inherit (service-value s)) ((eq? nscd-service-type kind)
(caches %nscd-container-caches)))) (service nscd-service-type
((eq? guix-service-type (service-kind s)) (nscd-configuration
;; Pass '--disable-chroot' so that (inherit value)
;; guix-daemon can build thing even in (caches %nscd-container-caches))))
;; Docker without '--privileged'. ((and (eq? guix-service-type kind)
(service guix-service-type (eq? (guix-configuration-chroot? value)
(guix-configuration 'default))
(inherit (service-value s)) ;; If chroot? is 'default, it should become #f
(extra-options ;; so that guix-daemon can build things even in
(cons "--disable-chroot" ;; Docker without '--privileged'.
(guix-configuration-extra-options (service guix-service-type
(service-value s))))))) (guix-configuration
(else s))) (inherit value)
(chroot? #f))))
(else s))))
(operating-system-user-services os)))) (operating-system-user-services os))))
(file-systems (append (map mapping->fs (file-systems (append (map mapping->fs
(if shared-network? (if shared-network?