mirror of
https://https.git.savannah.gnu.org/git/guix.git/
synced 2025-07-14 11:00:36 +02:00
bd7b9e6a60
Fixes <https://issues.guix.gnu.org/76368>. * gnu/services/auditd.scm (auditd-shepherd-service): * gnu/services/base.scm (rngd-service-type): (gpm-shepherd-service): * gnu/services/ci.scm (laminar-shepherd-service): * gnu/services/containers.scm (rootless-podman-cgroups-fs-owner-service): (rootless-podman-cgroups-limits-service): * gnu/services/cups.scm (cups-shepherd-service): * gnu/services/databases.scm (postgresql-role-shepherd-service): * gnu/services/desktop.scm (upower-shepherd-service): (bluetooth-shepherd-service): (elogind-shepherd-service): (inputattach-shepherd-service): (seatd-shepherd-service): * gnu/services/dns.scm (knot-resolver-shepherd-services): (dnsmasq-shepherd-service): * gnu/services/docker.scm (containerd-shepherd-service): (docker-shepherd-service): * gnu/services/file-sharing.scm (transmission-daemon-shepherd-service): * gnu/services/games.scm (joycond-shepherd-service): (wesnothd-shepherd-service): * gnu/services/guix.scm (guix-build-coordinator-shepherd-services): (guix-data-service-shepherd-services): (nar-herder-shepherd-services): (bffe-shepherd-services): * gnu/services/ldap.scm (directory-server-shepherd-service): * gnu/services/linux.scm (cachefilesd-shepherd-service): (rasdaemon-shepherd-service): * gnu/services/mail.scm (dovecot-shepherd-service): (imap4d-shepherd-service): (radicale-shepherd-service): (rspamd-configuration): * gnu/services/monitoring.scm (prometheus-node-exporter-shepherd-service): (vnstat-shepherd-service): * gnu/services/networking.scm (opendht-shepherd-service): (openvswitch-shepherd-service): (pagekite-shepherd-service): (ipfs-shepherd-service): * gnu/services/nfs.scm (rpcbind-service-type): (gss-service-type): (idmap-service-type): * gnu/services/pm.scm (thermald-shepherd-service): * gnu/services/rsync.scm (rsync-shepherd-service): * gnu/services/samba.scm (samba-samba-shepherd-service): (samba-nmbd-shepherd-service): (samba-smbd-shepherd-service): (samba-winbindd-shepherd-service): (wsdd-shepherd-service): * gnu/services/security-token.scm (pcscd-shepherd-service): * gnu/services/sound.scm (speakersafetyd-shepherd-service): * gnu/services/spice.scm (spice-vdagent-shepherd-service): * gnu/services/ssh.scm (lsh-shepherd-service): (openssh-shepherd-service): (dropbear-shepherd-service): (autossh-shepherd-service): * gnu/services/telephony.scm (jami-shepherd-services): (mumble-server-shepherd-service): * gnu/services/version-control.scm (git-daemon-shepherd-service): * gnu/services/virtualization.scm (virtlogd-shepherd-service): * gnu/services/vnc.scm (xvnc-shepherd-service): * gnu/services/vpn.scm (openvpn-shepherd-service): (strongswan-shepherd-service): * gnu/services/web.scm (httpd-shepherd-services): (fcgiwrap-shepherd-service): (php-fpm-shepherd-service): (hpcguix-web-shepherd-service): (tailon-shepherd-service): (varnish-shepherd-service): (whoogle-shepherd-service): (mumi-shepherd-services): (gmnisrv-shepherd-service): (agate-shepherd-service): Add ‘user-processes’ requirement. * doc/guix.texi (Mail Services): Update accordingly. Reported-by: Dariqq <dariqq@posteo.net> Change-Id: I947bd2afc83b786cb17c555cfe73ab586b806618
246 lines
9.9 KiB
Scheme
246 lines
9.9 KiB
Scheme
;;; GNU Guix --- Functional package management for GNU
|
|
;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
|
|
;;;
|
|
;;; This file is part of GNU Guix.
|
|
;;;
|
|
;;; GNU Guix is free software; you can redistribute it and/or modify it
|
|
;;; under the terms of the GNU General Public License as published by
|
|
;;; the Free Software Foundation; either version 3 of the License, or (at
|
|
;;; your option) any later version.
|
|
;;;
|
|
;;; GNU Guix is distributed in the hope that it will be useful, but
|
|
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
;;; GNU General Public License for more details.
|
|
;;;
|
|
;;; You should have received a copy of the GNU General Public License
|
|
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
(define-module (gnu services containers)
|
|
#:use-module (gnu packages bash)
|
|
#:use-module (gnu packages containers)
|
|
#:use-module (gnu packages file-systems)
|
|
#:use-module (gnu services)
|
|
#:use-module (gnu services base)
|
|
#:use-module (gnu services configuration)
|
|
#:use-module (gnu services shepherd)
|
|
#:use-module (gnu system accounts)
|
|
#:use-module (gnu system shadow)
|
|
#:use-module (gnu system pam)
|
|
#:use-module (guix gexp)
|
|
#:use-module (guix packages)
|
|
#:use-module (srfi srfi-1)
|
|
#:export (rootless-podman-configuration
|
|
rootless-podman-configuration?
|
|
rootless-podman-configuration-fields
|
|
rootless-podman-configuration-podman
|
|
rootless-podman-configuration-group-name
|
|
rootless-podman-configuration-containers-registries
|
|
rootless-podman-configuration-containers-storage
|
|
rootless-podman-configuration-containers-policy
|
|
rootless-podman-configuration-pam-limits
|
|
rootless-podman-configuration-subgids
|
|
rootless-podman-configuration-subuids
|
|
|
|
rootless-podman-service-subids
|
|
rootless-podman-service-accounts
|
|
rootless-podman-service-profile
|
|
rootless-podman-shepherd-services
|
|
rootless-podman-service-etc
|
|
|
|
rootless-podman-service-type))
|
|
|
|
(define (gexp-or-string? value)
|
|
(or (gexp? value)
|
|
(string? value)))
|
|
|
|
(define (lowerable? value)
|
|
(or (file-like? value)
|
|
(gexp-or-string? value)))
|
|
|
|
(define list-of-pam-limits-entries?
|
|
(list-of pam-limits-entry?))
|
|
|
|
(define list-of-subid-ranges?
|
|
(list-of subid-range?))
|
|
|
|
(define (package-or-#f? val)
|
|
(or (not val)
|
|
(package? val)))
|
|
|
|
(define-configuration/no-serialization rootless-podman-configuration
|
|
(podman
|
|
(package-or-#f podman)
|
|
"The Podman package that will be installed in the system profile.
|
|
@code{#f} can be passed to suppress the installation.")
|
|
(group-name
|
|
(string "cgroup")
|
|
"The name of the group that will own /sys/fs/cgroup resources. Users that
|
|
want to use rootless Podman have to be in this group.")
|
|
(containers-registries
|
|
(lowerable
|
|
(plain-file "registries.conf"
|
|
(string-append "unqualified-search-registries = ['docker.io','"
|
|
"registry.fedora.org','registry.opensuse.org']")))
|
|
"A string or a gexp evaluating to the path of Podman's
|
|
@code{containers/registries.conf} configuration file.")
|
|
(containers-storage
|
|
(lowerable
|
|
(plain-file "storage.conf"
|
|
"[storage]
|
|
driver = \"overlay\""))
|
|
"A string or a gexp evaluating to the path of Podman's
|
|
@code{containers/storage.conf} configuration file.")
|
|
(containers-policy
|
|
(lowerable
|
|
(plain-file "policy.json"
|
|
"{\"default\": [{\"type\": \"insecureAcceptAnything\"}]}"))
|
|
"A string or a gexp evaluating to the path of Podman's
|
|
@code{containers/policy.json} configuration file.")
|
|
(pam-limits
|
|
(list-of-pam-limits-entries
|
|
(list (pam-limits-entry "*" 'both 'nofile 100000)))
|
|
"The PAM limits to be set for rootless Podman.")
|
|
(subgids
|
|
(list-of-subid-ranges '())
|
|
"A list of subid ranges representing the subgids that will be
|
|
available for each configured user.")
|
|
(subuids
|
|
(list-of-subid-ranges '())
|
|
"A list of subid ranges representing the subuids that will be
|
|
available for each configured user."))
|
|
|
|
(define rootless-podman-service-profile
|
|
(lambda (config)
|
|
(or (and=> (rootless-podman-configuration-podman config) list)
|
|
(list))))
|
|
|
|
(define rootless-podman-service-etc
|
|
(lambda (config)
|
|
(list `("containers/registries.conf"
|
|
,(rootless-podman-configuration-containers-registries config))
|
|
`("containers/storage.conf"
|
|
,(rootless-podman-configuration-containers-storage config))
|
|
`("containers/policy.json"
|
|
,(rootless-podman-configuration-containers-policy config)))))
|
|
|
|
(define rootless-podman-service-subids
|
|
(lambda (config)
|
|
(subids-extension
|
|
(subgids (rootless-podman-configuration-subgids config))
|
|
(subuids (rootless-podman-configuration-subuids config)))))
|
|
|
|
(define rootless-podman-service-accounts
|
|
(lambda (config)
|
|
(list (user-group (name (rootless-podman-configuration-group-name config))
|
|
(system? #t)))))
|
|
|
|
(define (cgroups-fs-owner-entrypoint config)
|
|
(define group
|
|
(rootless-podman-configuration-group-name config))
|
|
(program-file "cgroups2-fs-owner-entrypoint"
|
|
#~(system*
|
|
(string-append #+bash-minimal "/bin/bash") "-c"
|
|
(string-append "echo Setting /sys/fs/cgroup "
|
|
"group ownership to " #$group " && chown -v "
|
|
"root:" #$group " /sys/fs/cgroup && "
|
|
"chmod -v 775 /sys/fs/cgroup && chown -v "
|
|
"root:" #$group " /sys/fs/cgroup/cgroup."
|
|
"{procs,subtree_control,threads} && "
|
|
"chmod -v 664 /sys/fs/cgroup/cgroup."
|
|
"{procs,subtree_control,threads}"))))
|
|
|
|
(define (rootless-podman-cgroups-fs-owner-service config)
|
|
(shepherd-service (provision '(cgroups2-fs-owner))
|
|
(requirement
|
|
'(user-processes
|
|
dbus-system
|
|
elogind
|
|
file-system-/sys/fs/cgroup
|
|
networking
|
|
udev
|
|
cgroups2-limits))
|
|
(one-shot? #t)
|
|
(documentation
|
|
"Set ownership of /sys/fs/cgroup to the configured group.")
|
|
(start
|
|
#~(make-forkexec-constructor
|
|
(list
|
|
#$(cgroups-fs-owner-entrypoint config))))
|
|
(stop
|
|
#~(make-kill-destructor))))
|
|
|
|
(define cgroups-limits-entrypoint
|
|
(program-file "cgroups2-limits-entrypoint"
|
|
#~(system*
|
|
(string-append #+bash-minimal "/bin/bash") "-c"
|
|
(string-append "echo Setting cgroups v2 limits && "
|
|
"echo +cpu +cpuset +io +memory +pids"
|
|
" >> /sys/fs/cgroup/cgroup.subtree_control"))))
|
|
|
|
(define (rootless-podman-cgroups-limits-service config)
|
|
(shepherd-service (provision '(cgroups2-limits))
|
|
(requirement
|
|
'(user-processes
|
|
dbus-system
|
|
elogind
|
|
networking
|
|
udev
|
|
file-system-/sys/fs/cgroup
|
|
rootless-podman-shared-root-fs))
|
|
(one-shot? #t)
|
|
(documentation
|
|
"Allow setting cgroups limits: cpu, cpuset, memory and
|
|
pids.")
|
|
(start
|
|
#~(make-forkexec-constructor
|
|
(list
|
|
#$cgroups-limits-entrypoint)))
|
|
(stop
|
|
#~(make-kill-destructor))))
|
|
|
|
(define rootless-podman-shared-root-fs-entrypoint
|
|
(program-file "rootless-podman-shared-root-fs-entrypoint"
|
|
#~(system*
|
|
"/run/privileged/bin/mount" "--make-shared" "/")))
|
|
|
|
(define (rootless-podman-shared-root-fs-service config)
|
|
(shepherd-service (provision '(rootless-podman-shared-root-fs))
|
|
(requirement
|
|
'(user-processes))
|
|
(one-shot? #t)
|
|
(documentation
|
|
"Buildah/Podman running as rootless expects the bind mount
|
|
to be shared. This service sets it so.")
|
|
(start
|
|
#~(make-forkexec-constructor
|
|
(list
|
|
#$rootless-podman-shared-root-fs-entrypoint)))
|
|
(stop
|
|
#~(make-kill-destructor))))
|
|
|
|
(define (rootless-podman-shepherd-services config)
|
|
(list
|
|
(rootless-podman-shared-root-fs-service config)
|
|
(rootless-podman-cgroups-limits-service config)
|
|
(rootless-podman-cgroups-fs-owner-service config)))
|
|
|
|
(define rootless-podman-service-type
|
|
(service-type (name 'rootless-podman)
|
|
(extensions
|
|
(list
|
|
(service-extension subids-service-type
|
|
rootless-podman-service-subids)
|
|
(service-extension account-service-type
|
|
rootless-podman-service-accounts)
|
|
(service-extension profile-service-type
|
|
rootless-podman-service-profile)
|
|
(service-extension shepherd-root-service-type
|
|
rootless-podman-shepherd-services)
|
|
(service-extension pam-limits-service-type
|
|
rootless-podman-configuration-pam-limits)
|
|
(service-extension etc-service-type
|
|
rootless-podman-service-etc)))
|
|
(default-value (rootless-podman-configuration))
|
|
(description
|
|
"This service configures rootless @code{podman} on the Guix System.")))
|