| Age | Commit message (Expand) | Author |
|---|
| 2023-01-30 | linux-container: 'container-excursion' forks to join the PID namespace....Fixes <https://issues.guix.gnu.org/61156>.
* gnu/build/linux-container.scm (container-excursion): Add extra call to
'primitive-fork' and invoke THUNK in the child process.
* tests/containers.scm ("container-excursion"): Remove extra
'primitive-fork' call, now unnecessary.
("container-excursion*, /proc"): New test.
| Ludovic Courtès |
| 2023-01-30 | container: Correctly report exit status....* gnu/build/linux-container.scm (container-excursion): Return the raw
status value.
* tests/containers.scm ("container-excursion, same namespaces"): Add
'status:exit-val' call.
* guix/scripts/container/exec.scm (guix-container-exec): Correctly
handle the different cases.
| Ludovic Courtès |
| 2022-09-24 | linux-container: Mark socket pair as SOCK_CLOEXEC....* gnu/build/linux-container.scm (run-container): Pass SOCK_CLOEXEC to
'socketpair'.
| Ludovic Courtès |
| 2022-09-20 | linux-container: 'container-excursion*' marks its FDs as FD_CLOEXEC....Fixes <https://issues.guix.gnu.org/57827>.
Reported by Mathieu Othacehe <othacehe@gnu.org>.
Fixes a regression introduced with the Shepherd 0.9.2 upgrade in
1ba0e38267c9ff8bb476285091be6e297bbf136e, whereby IN and OUT would no
longer be closed when 'fork+exec-command/container' would call
'exec-command*' as part of the THUNK passed to 'container-excursion*'.
This is because the Shepherd 0.9.2 assumes file descriptors are properly
marked as O_CLOEXEC and, consequently, 'exec-command' no longer run the
close(2) loop prior to 'exec'.
* gnu/build/linux-container.scm (container-excursion*): Add calls to
'fcntl'.
| Ludovic Courtès |
| 2022-05-01 | linux-container: Add #:child-is-pid1? parameter to 'call-with-container'....* gnu/build/linux-container.scm (wait-child-process)
(status->exit-status): New procedures.
(call-with-container): Add #:child-is-pid1? parameter and honor it.
[thunk*]: New variable. Pass it to 'run-container'.
| Ludovic Courtès |
| 2022-05-01 | linux-container: Ensure signal-handling asyncs get a chance to run....Previously we could enter the blocking 'waitpid' call and miss an
opportunity to run the signal handler async.
* gnu/build/linux-container.scm (call-with-container)
[periodically-schedule-asyncs]: New procedure.
[install-signal-handlers]: Call it.
| Ludovic Courtès |
| 2022-05-01 | linux-container: 'call-with-container' relays SIGTERM and SIGINT....* gnu/build/linux-container.scm (call-with-container): Add #:relayed-signals.
[install-signal-handlers]: New procedure.
Call it.
| Ludovic Courtès |
| 2022-01-05 | linux-container: Handle CLONE_NEWCGROUP and use it by default....Adds low-level support for launching Linux containers with cgroup namespaces.
* gnu/build/linux-container.scm (%namespaces): Add 'cgroup.
(namespaces->bit-mask): Handle it.
* guix/build/syscalls.scm (CLONE_NEWCGROUP): New variable.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| Ryan Sundberg |
| 2020-12-06 | Revert "linux-container: Correct test for unprivileged user namespace support."...This broke 'guix environment --container' on non-Debian distributions.
Fixes <https://bugs.gnu.org/45066>. Reported by luhux <luhux@outlook.com>.
This reverts commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
| Marius Bakke |
| 2020-12-03 | linux-container: Correct test for unprivileged user namespace support....Fixes <https://bugs.gnu.org/31977>.
Reported by Paul Garlick <pgarlick@tourbillion-technology.com>.
* gnu/build/linux-container.scm (unprivileged-user-namespace-supported?):
Return #f when the 'userns-file' does not exist.
| Paul Garlick |
| 2020-10-01 | linux-container: Reset jailed root permissions....* gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.
* tests/containers.scm
("call-with-container, mnt namespace, root permissions"): New test.
| Jelle Licht |
| 2020-09-10 | build: linux-container: Fix run-container....This is a follow-up of 5316dfc0f125b658e4a2acf7f00f49501663d943. Some users of
run-container may expect that the container is jailed, even if there are no
mounts. This is the case for some Guix tests.
* gnu/build/linux-container.scm (run-container): Do not jail the container
when the requested root is "/".
| Mathieu Othacehe |
| 2020-09-02 | linux-container: Do not jail the container unconditionally....We may want to run a container inside the MNT namespace, without jailing the
container. If RUN-CONTAINER is passed a null MOUNTS list, do not jail the
container.
* gnu/build/linux-container.scm (run-container): Do not call
MOUNT-FILE-SYSTEMS if MOUNTS list is empty.
| Mathieu Othacehe |
| 2019-09-12 | linux-container: "run-container" scripts shows the container's PID....* gnu/build/linux-container.scm (call-with-container): Add
#:process-spawned-hook and honor it.
* gnu/system/linux-container.scm (container-script)[script]:
Define 'explain' and pass it as #:process-spawned-hook'.
| Ludovic Courtès |
| 2019-07-06 | linux-container: Mount a new /dev/pts instance in the container....Fixes <https://bugs.gnu.org/36463>.
Reported by Steffen Rytter Postas <nc@scalehost.eu>.
* gnu/build/linux-container.scm (mount-file-systems): When /dev/ptmx
exists on the host, explicitly mount a new instance of devpts and make
/dev/ptmx a symlink to /dev/pts/ptmx.
| Ludovic Courtès |
| 2019-06-23 | linux-container: Remove dependency on (guix utils)....Fixes a bug whereby derivations importing (gnu build linux-container),
such as the 'bitlbee' and 'tor' services, would depend on the
user's (guix config) file, which was pulled as a dependency of (guix
utils). As a result, those derivations would vary from user to user.
* gnu/build/linux-container.scm (call-with-temporary-directory): New
procedure.
| Ludovic Courtès |
| 2019-04-02 | linux-container: Make the guest UID and GID a parameter....* gnu/build/linux-container.scm (initialize-user-namespace): Add
#:guest-uid and #:guest-gid parameters and honor them.
(run-container): Likewise.
(call-with-container): Likewise.
* tests/containers.scm ("call-with-container, user namespace, guest UID/GID"):
New test.
| Ludovic Courtès |
| 2018-01-15 | linux-container: Work around EBADF errors upon exit....Typically 'read-pid-file/container' would fail when starting services in
containers such as BitlBee.
* gnu/build/linux-container.scm (call-with-clean-exit): Use
'primitive-_exit' instead of 'primitive-exit'.
(container-excursion*): Close OUT.
| Ludovic Courtès |
| 2017-10-11 | file-systems: 'mount-file-system' now takes a <file-system> object....* gnu/build/file-systems.scm (mount-file-system): Rename 'spec' to 'fs'
and assume it's a <file-system>.
* gnu/build/linux-boot.scm (boot-system): Assume MOUNTS is a list of
<file-system> and adjust accordingly.
* gnu/build/linux-container.scm (mount-file-systems): Remove
'file-system->spec' call.
* gnu/services/base.scm (file-system-shepherd-service): Add
'spec->file-system' call. Add (gnu system file-systems) to 'modules'.
* gnu/system/linux-initrd.scm (raw-initrd): Use (gnu system
file-systems). Add 'spec->file-system' call for #:mounts.
| Ludovic Courtès |
