gnu/services/docker.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
   3 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
   4 ;;; Copyright © 2020, 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
   5 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com>
   7 ;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
   8 ;;;
   9 ;;; This file is part of GNU Guix.
  10 ;;;
  11 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  12 ;;; under the terms of the GNU General Public License as published by
  13 ;;; the Free Software Foundation; either version 3 of the License, or (at
  14 ;;; your option) any later version.
  15 ;;;
  16 ;;; GNU Guix is distributed in the hope that it will be useful, but
  17 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  18 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 ;;; GNU General Public License for more details.
  20 ;;;
  21 ;;; You should have received a copy of the GNU General Public License
  22 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  23
  24 (define-module (gnu services docker)
  25   #:use-module (gnu services)
  26   #:use-module (gnu services configuration)
  27   #:use-module (gnu services base)
  28   #:use-module (gnu services dbus)
  29   #:use-module (gnu services shepherd)
  30   #:use-module (gnu system setuid)
  31   #:use-module (gnu system shadow)
  32   #:use-module (gnu packages docker)
  33   #:use-module (gnu packages linux)               ;singularity
  34   #:use-module (guix records)
  35   #:use-module (guix gexp)
  36   #:use-module (guix packages)
  37
  38   #:export (docker-configuration
  39             docker-service-type
  40             singularity-service-type))
  41
  42 (define-configuration docker-configuration
  43   (docker
  44    (file-like docker)
  45    "Docker daemon package.")
  46   (docker-cli
  47    (file-like docker-cli)
  48    "Docker client package.")
  49   (containerd
  50    (file-like containerd)
  51    "containerd package.")
  52   (proxy
  53    (file-like docker-libnetwork-cmd-proxy)
  54    "The proxy package to support inter-container and outside-container
  55 loop-back communications.")
  56   (enable-proxy?
  57    (boolean #t)
  58    "Enable or disable the user-land proxy (enabled by default).")
  59   (debug?
  60    (boolean #f)
  61    "Enable or disable debug output.")
  62   (enable-iptables?
  63    (boolean #t)
  64    "Enable addition of iptables rules (enabled by default).")
  65   (environment-variables
  66    (list '())
  67    "Environment variables to set for dockerd")
  68   (no-serialization))
  69
  70 (define %docker-accounts
  71   (list (user-group (name "docker") (system? #t))))
  72
  73 (define (%containerd-activation config)
  74   (let ((state-dir "/var/lib/containerd"))
  75     #~(begin
  76         (use-modules (guix build utils))
  77         (mkdir-p #$state-dir))))
  78
  79 (define (%docker-activation config)
  80   (%containerd-activation config)
  81   (let ((state-dir "/var/lib/docker"))
  82     #~(begin
  83         (use-modules (guix build utils))
  84         (mkdir-p #$state-dir))))
  85
  86 (define (containerd-shepherd-service config)
  87   (let* ((package (docker-configuration-containerd config))
  88          (debug? (docker-configuration-debug? config))
  89          (containerd (docker-configuration-containerd config)))
  90     (shepherd-service
  91            (documentation "containerd daemon.")
  92            (provision '(containerd))
  93            (start #~(make-forkexec-constructor
  94                      (list (string-append #$package "/bin/containerd")
  95                            #$@(if debug?
  96                                   '("--log-level=debug")
  97                                   '()))
  98                      ;; For finding containerd-shim binary.
  99                      #:environment-variables
 100                      (list (string-append "PATH=" #$containerd "/bin"))
 101                      #:log-file "/var/log/containerd.log"))
 102            (stop #~(make-kill-destructor)))))
 103
 104 (define (docker-shepherd-service config)
 105   (let* ((docker (docker-configuration-docker config))
 106          (enable-proxy? (docker-configuration-enable-proxy? config))
 107          (enable-iptables? (docker-configuration-enable-iptables? config))
 108          (environment-variables (docker-configuration-environment-variables config))
 109          (proxy (docker-configuration-proxy config))
 110          (debug? (docker-configuration-debug? config)))
 111     (shepherd-service
 112            (documentation "Docker daemon.")
 113            (provision '(dockerd))
 114            (requirement '(containerd
 115                           dbus-system
 116                           elogind
 117                           file-system-/sys/fs/cgroup/blkio
 118                           file-system-/sys/fs/cgroup/cpu
 119                           file-system-/sys/fs/cgroup/cpuset
 120                           file-system-/sys/fs/cgroup/devices
 121                           file-system-/sys/fs/cgroup/memory
 122                           file-system-/sys/fs/cgroup/pids
 123                           networking
 124                           udev))
 125            (start #~(make-forkexec-constructor
 126                      (list (string-append #$docker "/bin/dockerd")
 127                            "-p" "/var/run/docker.pid"
 128                            #$@(if debug?
 129                                   '("--debug" "--log-level=debug")
 130                                   '())
 131                            #$@(if enable-proxy?
 132                                   (list "--userland-proxy=true"
 133                                         #~(string-append
 134                                            "--userland-proxy-path=" #$proxy "/bin/proxy"))
 135                                   '("--userland-proxy=false"))
 136                            (if #$enable-iptables?
 137                                "--iptables"
 138                                "--iptables=false"))
 139                      #:environment-variables
 140                      (list #$@environment-variables)
 141                      #:pid-file "/var/run/docker.pid"
 142                      #:log-file "/var/log/docker.log"))
 143            (stop #~(make-kill-destructor)))))
 144
 145 (define docker-service-type
 146   (service-type (name 'docker)
 147                 (description "Provide capability to run Docker application
 148 bundles in Docker containers.")
 149                 (extensions
 150                  (list
 151                   ;; Make sure the 'docker' command is available.
 152                   (service-extension profile-service-type
 153                                      (compose list docker-configuration-docker-cli))
 154                   (service-extension activation-service-type
 155                                      %docker-activation)
 156                   (service-extension shepherd-root-service-type
 157                                      (lambda (config)
 158                                        (list (containerd-shepherd-service config)
 159                                              (docker-shepherd-service config))))
 160                   (service-extension account-service-type
 161                                      (const %docker-accounts))))
 162                 (default-value (docker-configuration))))
 163
 164 \f
 165 ;;;
 166 ;;; Singularity.
 167 ;;;
 168
 169 (define %singularity-activation
 170   (with-imported-modules '((guix build utils))
 171     #~(begin
 172         (use-modules (guix build utils))
 173
 174         (define %mount-directory
 175           "/var/singularity/mnt/")
 176
 177         ;; Create the directories that Singularity 2.6 expects to find.  Make
 178         ;; them #o755 like the 'install-data-hook' rule in 'Makefile.am' of
 179         ;; Singularity 2.6.1.
 180         (for-each (lambda (directory)
 181                     (let ((directory (string-append %mount-directory
 182                                                     directory)))
 183                       (mkdir-p directory)
 184                       (chmod directory #o755)))
 185                   '("container" "final" "overlay" "session"))
 186         (chmod %mount-directory #o755))))
 187
 188 (define (singularity-setuid-programs singularity)
 189   "Return the setuid-root programs that SINGULARITY needs."
 190   (define helpers
 191     ;; The helpers, under a meaningful name.
 192     (computed-file "singularity-setuid-helpers"
 193                    #~(begin
 194                        (mkdir #$output)
 195                        (for-each (lambda (program)
 196                                    (symlink (string-append #$singularity
 197                                                            "/libexec/singularity"
 198                                                            "/bin/"
 199                                                            program "-suid")
 200                                             (string-append #$output
 201                                                            "/singularity-"
 202                                                            program
 203                                                            "-helper")))
 204                                  '("action" "mount" "start")))))
 205
 206   (map file-like->setuid-program
 207        (list (file-append helpers "/singularity-action-helper")
 208              (file-append helpers "/singularity-mount-helper")
 209              (file-append helpers "/singularity-start-helper"))))
 210
 211 (define singularity-service-type
 212   (service-type (name 'singularity)
 213                 (description
 214                  "Install the Singularity application bundle tool.")
 215                 (extensions
 216                  (list (service-extension setuid-program-service-type
 217                                           singularity-setuid-programs)
 218                        (service-extension activation-service-type
 219                                           (const %singularity-activation))))
 220                 (default-value singularity)))