;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2015 David Thompson <davet@gnu.org>
;;; Copyright © 2016-2017, 2019-2023 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2019 Arun Isaac <arunisaac@systemreboot.net>
;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2020 Google LLC
;;; Copyright © 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2023 Pierre Langlois <pierre.langlois@gmx.com>
;;; Copyright © 2024 Leo Nikkilä <hello@lnikki.la>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
(define-module (gnu system linux-container)
#:use-module (ice-9 match)
#:use-module (srfi srfi-1)
#:use-module (guix config)
#:use-module (guix store)
#:use-module (guix gexp)
#:use-module (guix derivations)
#:use-module (guix monads)
#:use-module (guix modules)
#:use-module (gnu build linux-container)
#:use-module (gnu services)
#:use-module (gnu services base)
#:use-module (gnu services networking)
#:use-module (gnu services shepherd)
#:use-module (gnu system)
#:use-module (gnu system file-systems)
#:export (system-container
containerized-operating-system
container-script
eval/container))
(define* (container-essential-services os #:key shared-network?)
"Return a list of essential services corresponding to OS, a
non-containerized OS. This procedure essentially strips essential services
from OS that are needed on the bare metal and not in a container."
(define base
(remove (lambda (service)
(memq (service-kind service)
(cons* (service-kind %linux-bare-metal-service)
firmware-service-type
system-service-type
(if shared-network?
(list hosts-service-type)
'()))))
(operating-system-essential-services os)))
(cons (service system-service-type
`(("locale" ,(operating-system-locale-directory os))))
;; If network is to be shared with the host, remove network
;; configuration files from etc-service.
(if shared-network?
(modify-services base
(etc-service-type
files => (remove
(match-lambda
((filename _)
(member filename
(map basename %network-configuration-files))))
files)))
base)))
(define dummy-networking-service-type
(shepherd-service-type
'dummy-networking
(const (shepherd-service
(documentation "Provide loopback and networking without actually
doing anything.")
(provision '(loopback networking))
(start #~(const #t))))
#f
(description "Provide loopback and networking without actually doing
anything. This service is used by guest systems running in containers, where
networking support is provided by the host.")))
(define %nscd-container-caches
;; Similar to %nscd-default-caches but with smaller cache sizes. This allows
;; many containers to coexist on the same machine without exhausting RAM.
(map (lambda (cache)
(nscd-cache
(inherit cache)
(max-database-size (expt 2 18)))) ;256KiB
%nscd-default-caches))
(define* (containerized-operating-system os mappings
#:key
shared-network?
(extra-file-systems '()))
"Return an operating system based on OS for use in a Linux container
environment. MAPPINGS is a list of <file-system-mapping> to realize in the
containerized OS. EXTRA-FILE-SYSTEMS is a list of file systems to add to OS."
(define user-file-systems
(remove (lambda (fs)
(let ((target (file-system-mount-point fs))
(source (file-system-device fs)))
(or (string=? target (%store-prefix))
(string=? target "/")
(and (string? source)
(string-prefix? "/dev/" source))
(string-prefix? "/dev/" target)
(string-prefix? "/sys/" target))))
(operating-system-file-systems os)))
(define (mapping->fs fs)
(file-system (inherit (file-system-mapping->bind-mount fs))
(needed-for-boot? #t)))
(define services-to-drop
;; Service types to filter from the original operating-system. Some of
;; these make no sense in a container (e.g., those that access
;; /dev/tty[0-9]), while others just need to be reinstantiated with
;; different configs that are better suited to containers.
(append (list console-font-service-type
mingetty-service-type
agetty-service-type)
(if shared-network?
;; Replace these with dummy-networking-service-type below.
(list
static-networking-service-type
dhcp-client-service-type
network-manager-service-type
connman-service-type)
(list))))
(define services-to-add
;; Many Guix services depend on a 'networking' shepherd
;; service, so make sure to provide a dummy 'networking'
;; service when we are sure that networking is already set up
;; in the host and can be used. That prevents double setup.
(if shared-network?
(list (service dummy-networking-service-type))
'()))
(define os-with-base-essential-services
(operating-system
(inherit os)
(swap-devices '()) ; disable swap
(services
(append services-to-add
(filter-map (lambda (s)
(cond ((memq (service-kind s) services-to-drop)
#f)
((eq? nscd-service-type (service-kind s))
(service nscd-service-type
(nscd-configuration
(inherit (service-value s))
(caches %nscd-container-caches))))
((eq? guix-service-type (service-kind s))
;; Pass '--disable-chroot' so that
;; guix-daemon can bu| -rw-r--r-- | composer.scm | 2912 | logplainabout |
| -rw-r--r-- | containers.scm | 11539 | logplainabout |
| -rw-r--r-- | cpan.scm | 4593 | logplainabout |
| -rw-r--r-- | cpio.scm | 3327 | logplainabout |
| -rw-r--r-- | cran.scm | 4894 | logplainabout |
| -rw-r--r-- | crate.scm | 40282 | logplainabout |
| -rw-r--r-- | cve-sample.json | 46447 | logplainabout |
| -rw-r--r-- | cve.scm | 3672 | logplainabout |
| -rw-r--r-- | debug-link.scm | 6709 | logplainabout |
| -rw-r--r-- | derivations.scm | 71713 | logplainabout |
| -rw-r--r-- | discovery.scm | 2540 | logplainabout |
| -rw-r--r-- | egg.scm | 4099 | logplainabout |
| -rw-r--r-- | elm.scm | 10343 | logplainabout |
| -rw-r--r-- | elpa.scm | 5034 | logplainabout |
| -rw-r--r-- | file-systems.scm | 4717 | logplainabout |
| -rw-r--r-- | gem.scm | 10913 | logplainabout |
| -rw-r--r-- | gexp.scm | 83461 | logplainabout |
| -rw-r--r-- | git-authenticate.scm | 23620 | logplainabout |
| -rw-r--r-- | git.scm | 10481 | logplainabout |
| -rw-r--r-- | glob.scm | 2551 | logplainabout |
| -rw-r--r-- | gnu-maintenance.scm | 7724 | logplainabout |
| -rw-r--r-- | go.scm | 20085 | logplainabout |
| -rw-r--r-- | grafts.scm | 27923 | logplainabout |
| -rw-r--r-- | graph.scm | 24511 | logplainabout |
| -rw-r--r-- | gremlin.scm | 8006 | logplainabout |
| -rw-r--r-- | guix-archive.sh | 2841 | logplainabout |
| -rw-r--r-- | guix-authenticate.sh | 3055 | logplainabout |
| -rw-r--r-- | guix-build-branch.sh | 2222 | logplainabout |
| -rw-r--r-- | guix-build.sh | 12887 | logplainabout |
| -rw-r--r-- | guix-daemon.sh | 8289 | logplainabout |
| -rw-r--r-- | guix-describe.sh | 1412 | logplainabout |
| -rw-r--r-- | guix-download.sh | 3043 | logplainabout |
| -rw-r--r-- | guix-environment-container.sh | 10380 | logplainabout |
| -rw-r--r-- | guix-environment.sh | 9321 | logplainabout |
| -rw-r--r-- | guix-gc.sh | 2714 | logplainabout |
| -rw-r--r-- | guix-git-authenticate.sh | 3049 | logplainabout |
| -rw-r--r-- | guix-graph.sh | 2922 | logplainabout |
| -rw-r--r-- | guix-hash.sh | 3705 | logplainabout |
| -rw-r--r-- | guix-home.sh | 8089 | logplainabout |
| -rw-r--r-- | guix-lint.sh | 3213 | logplainabout |
| -rwxr-xr-x | guix-locate.sh | 2545 | logplainabout |
| -rw-r--r-- | guix-pack-localstatedir.sh | 2565 | logplainabout |
| -rw-r--r-- | guix-pack-relocatable.sh | 9367 | logplainabout |
| -rw-r--r-- | guix-pack.sh | 5333 | logplainabout |
| -rw-r--r-- | guix-package-aliases.sh | 2180 | logplainabout |
| -rw-r--r-- | guix-package-net.sh | 8114 | logplainabout |
| -rw-r--r-- | guix-package.sh | 17728 | logplainabout |
| -rw-r--r-- | guix-refresh.sh | 4204 | logplainabout |
| -rw-r--r-- | guix-repl.sh | 2376 | logplainabout |
| -rw-r--r-- | guix-shell-export-manifest.sh | 3290 | logplainabout |
| -rw-r--r-- | guix-shell.sh | 5760 | logplainabout |
| -rw-r--r-- | guix-style.sh | 2007 | logplainabout |
| -rw-r--r-- | guix-system.sh | 11553 | logplainabout |
| -rw-r--r-- | guix-time-machine.sh | 1551 | logplainabout |
| -rw-r--r-- | hackage.scm | 17774 | logplainabout |
| -rw-r--r-- | hexpm.scm | 9291 | logplainabout |
| -rw-r--r-- | home-import.scm | 7168 | logplainabout |
| -rw-r--r-- | home-services.scm | 1678 | logplainabout |
| -rw-r--r-- | http-client.scm | 2869 | logplainabout |
| -rw-r--r-- | import-git.scm | 9248 | logplainabout |
| -rw-r--r-- | import-github.scm | 5165 | logplainabout |
| -rw-r--r-- | import-utils.scm | 11048 | logplainabout |
| -rw-r--r-- | inferior.scm | 15074 | logplainabout |
| -rw-r--r-- | ipfs.scm | 2021 | logplainabout |
| d--------- | keys | 437 | logplain |
| -rw-r--r-- | lint.scm | 62308 | logplainabout |
| -rw-r--r-- | minetest.scm | 19410 | logplainabout |
| -rw-r--r-- | modules.scm | 2591 | logplainabout |
| -rw-r--r-- | monads.scm | 9589 | logplainabout |
| -rw-r--r-- | nar.scm | 22167 | logplainabout |
| -rw-r--r-- | networking.scm | 3660 | logplainabout |
| -rwxr-xr-x | npm-binary.scm | 4883 | logplainabout |
| -rw-r--r-- | offload.scm | 2683 | logplainabout |
| -rw-r--r-- | opam.scm | 7344 | logplainabout |
| -rw-r--r-- | openpgp.scm | 10524 | logplainabout |
| -rw-r--r-- | pack.scm | 22012 | logplainabout |
| -rw-r--r-- | packages.scm | 92298 | logplainabout |
| -rw-r--r-- | pki.scm | 5361 | logplainabout |
| -rw-r--r-- | print.scm | 6642 | logplainabout |
| -rw-r--r-- | processes.scm | 4691 | logplainabout |
| -rw-r--r-- | profiles.scm | 40027 | logplainabout |
| -rw-r--r-- | publish.scm | 32462 | logplainabout |
| -rw-r--r-- | pypi.scm | 17739 | logplainabout |
| -rw-r--r-- | read-print.scm | 10090 | logplainabout |
| -rw-r--r-- | records.scm | 19563 | logplainabout |
| -rw-r--r-- | rpm.scm | 3084 | logplainabout |
| -rw-r--r-- | scripts.scm | 2034 | logplainabout |
| -rw-r--r-- | search-paths.scm | 1768 | logplainabout |
| -rw-r--r-- | services.scm | 18643 | logplainabout |
| d--------- | services | 282 | logplain |
| -rw-r--r-- | sets.scm | 1507 | logplainabout |
| -rw-r--r-- | size.scm | 4576 | logplainabout |
| -rw-r--r-- | status.scm | 12718 | logplainabout |
| -rw-r--r-- | store-database.scm | 5454 | logplainabout |
| -rw-r--r-- | store-deduplication.scm | 9723 | logplainabout |
| -rw-r--r-- | store-roots.scm | 2144 | logplainabout |
| -rw-r--r-- | store.scm | 69680 | logplainabout |
| -rw-r--r-- | style.scm | 20913 | logplainabout |
| -rw-r--r-- | substitute.scm | 35928 | logplainabout |
| -rw-r--r-- | swh.scm | 8498 | logplainabout |
| -rw-r--r-- | syscalls.scm | 22800 | logplainabout |
| -rw-r--r-- | system.scm | 5932 | logplainabout |
| -rw-r--r-- | test.drv | 5922 | logplainabout |
| -rw-r--r-- | texlive.scm | 34100 | logplainabout |
| -rw-r--r-- | transformations.scm | 26116 | logplainabout |
| -rw-r--r-- | ui.scm | 12065 | logplainabout |
| -rw-r--r-- | union.scm | 9714 | logplainabout |
| -rw-r--r-- | upstream.scm | 2396 | logplainabout |
| -rw-r--r-- | utils.scm | 14393 | logplainabout |
| -rw-r--r-- | uuid.scm | 2755 | logplainabout |
| -rw-r--r-- | workers.scm | 2172 | logplainabout |
