mirror of
https://https.git.savannah.gnu.org/git/guix.git/
synced 2025-07-10 16:50:43 +02:00
gnu: guix-configuration: Add a chroot? parameter.
The parameter should take the values #t, #f or 'default. In a container environment, 'default amounts to #f, otherwise it amounts to #t. * gnu/services/base.scm (guix-configuration)<chroot?>: New field. (guix-shepherd-service): If chroot? is #f, add "--disable-chroot". If it is #t or 'default, do nothing. * gnu/system/linux-container.scm (containerized-operating-system): If chroot? is 'default, replace it by #f. * doc/guix.texi: Document the parameter. Change-Id: I8b9c3f46ad8650fa6ed4acee947b4ae5d002d03d
This commit is contained in:
Andreas Enge
parent
f0d4daa13f
commit
9a41ec5762
3 changed files with 38 additions and 21 deletions
|
|
@ -19940,6 +19940,13 @@ Name of the group for build user accounts.
|
|||
@item @code{build-accounts} (default: @code{10})
|
||||
Number of build user accounts to create.
|
||||
|
||||
@item @code{chroot?} (default: @code{'default})
|
||||
The value should be one of @code{#t} or @code{#f}, in which
|
||||
case chroot is enabled or disabled, respectively;
|
||||
or it should be @code{'default}, which amounts to @code{#f} in
|
||||
Docker containers (so that they can be run in non-privileged mode)
|
||||
or @code{#t} otherwise.
|
||||
|
||||
@item @code{authorize-key?} (default: @code{#t})
|
||||
@cindex substitutes, authorization thereof
|
||||
Whether to authorize the substitute keys listed in
|
||||
|
|
|
|||
|
|
@ -22,6 +22,7 @@
|
|||
;;; Copyright © 2022 ( <paren@disroot.org>
|
||||
;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
|
||||
;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
|
||||
;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
|
@ -224,6 +225,7 @@
|
|||
guix-configuration-build-group
|
||||
guix-configuration-build-accounts
|
||||
guix-configuration-build-machines
|
||||
guix-configuration-chroot?
|
||||
guix-configuration-authorize-key?
|
||||
guix-configuration-authorized-keys
|
||||
guix-configuration-use-substitutes?
|
||||
|
|
@ -1924,6 +1926,8 @@ archive' public keys, with GUIX."
|
|||
(default "guixbuild"))
|
||||
(build-accounts guix-configuration-build-accounts ;integer
|
||||
(default 10))
|
||||
(chroot? guix-configuration-chroot? ;Boolean | 'default
|
||||
(default 'default))
|
||||
(authorize-key? guix-configuration-authorize-key? ;Boolean
|
||||
(default #t))
|
||||
(authorized-keys guix-configuration-authorized-keys ;list of gexps
|
||||
|
|
@ -2025,7 +2029,7 @@ proxy of 'guix-daemon'...~%")
|
|||
glibc-utf8-locales)))
|
||||
|
||||
(match-record config <guix-configuration>
|
||||
(guix build-group build-accounts authorize-key? authorized-keys
|
||||
(guix build-group build-accounts chroot? authorize-key? authorized-keys
|
||||
use-substitutes? substitute-urls max-silent-time timeout
|
||||
log-compression discover? extra-options log-file
|
||||
http-proxy tmpdir chroot-directories environment
|
||||
|
|
@ -2095,6 +2099,9 @@ proxy of 'guix-daemon'...~%")
|
|||
"--substitute-urls" #$(string-join substitute-urls)
|
||||
#$@extra-options
|
||||
|
||||
#$@(if chroot?
|
||||
'()
|
||||
'("--disable-chroot"))
|
||||
;; Add CHROOT-DIRECTORIES and all their dependencies
|
||||
;; (if these are store items) to the chroot.
|
||||
(append-map
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@
|
|||
;;; Copyright © 2022 Ricardo Wurmus <rekado@elephly.net>
|
||||
;;; Copyright © 2023 Pierre Langlois <pierre.langlois@gmx.com>
|
||||
;;; Copyright © 2024 Leo Nikkilä <hello@lnikki.la>
|
||||
;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
|
|
@ -151,26 +152,28 @@ containerized OS. EXTRA-FILE-SYSTEMS is a list of file systems to add to OS."
|
|||
(swap-devices '()) ; disable swap
|
||||
(services
|
||||
(append services-to-add
|
||||
(filter-map (lambda (s)
|
||||
(cond ((memq (service-kind s) services-to-drop)
|
||||
#f)
|
||||
((eq? nscd-service-type (service-kind s))
|
||||
(service nscd-service-type
|
||||
(nscd-configuration
|
||||
(inherit (service-value s))
|
||||
(caches %nscd-container-caches))))
|
||||
((eq? guix-service-type (service-kind s))
|
||||
;; Pass '--disable-chroot' so that
|
||||
;; guix-daemon can build thing even in
|
||||
;; Docker without '--privileged'.
|
||||
(service guix-service-type
|
||||
(guix-configuration
|
||||
(inherit (service-value s))
|
||||
(extra-options
|
||||
(cons "--disable-chroot"
|
||||
(guix-configuration-extra-options
|
||||
(service-value s)))))))
|
||||
(else s)))
|
||||
(filter-map
|
||||
(lambda (s)
|
||||
(let ((kind (service-kind s))
|
||||
(value (service-value s)))
|
||||
(cond ((memq kind services-to-drop)
|
||||
#f)
|
||||
((eq? nscd-service-type kind)
|
||||
(service nscd-service-type
|
||||
(nscd-configuration
|
||||
(inherit value)
|
||||
(caches %nscd-container-caches))))
|
||||
((and (eq? guix-service-type kind)
|
||||
(eq? (guix-configuration-chroot? value)
|
||||
'default))
|
||||
;; If chroot? is 'default, it should become #f
|
||||
;; so that guix-daemon can build things even in
|
||||
;; Docker without '--privileged'.
|
||||
(service guix-service-type
|
||||
(guix-configuration
|
||||
(inherit value)
|
||||
(chroot? #f))))
|
||||
(else s))))
|
||||
(operating-system-user-services os))))
|
||||
(file-systems (append (map mapping->fs
|
||||
(if shared-network?
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue