| 1 | ;;; GNU Guix --- Functional package management for GNU |
| 2 | ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org> |
| 3 | ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net> |
| 4 | ;;; |
| 5 | ;;; This file is part of GNU Guix. |
| 6 | ;;; |
| 7 | ;;; GNU Guix is free software; you can redistribute it and/or modify it |
| 8 | ;;; under the terms of the GNU General Public License as published by |
| 9 | ;;; the Free Software Foundation; either version 3 of the License, or (at |
| 10 | ;;; your option) any later version. |
| 11 | ;;; |
| 12 | ;;; GNU Guix is distributed in the hope that it will be useful, but |
| 13 | ;;; WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | ;;; GNU General Public License for more details. |
| 16 | ;;; |
| 17 | ;;; You should have received a copy of the GNU General Public License |
| 18 | ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>. |
| 19 | |
| 20 | (define-module (gnu services docker) |
| 21 | #:use-module (gnu services) |
| 22 | #:use-module (gnu services configuration) |
| 23 | #:use-module (gnu services base) |
| 24 | #:use-module (gnu services dbus) |
| 25 | #:use-module (gnu services shepherd) |
| 26 | #:use-module (gnu system shadow) |
| 27 | #:use-module (gnu packages docker) |
| 28 | #:use-module (gnu packages linux) ;singularity |
| 29 | #:use-module (guix records) |
| 30 | #:use-module (guix gexp) |
| 31 | #:use-module (guix packages) |
| 32 | |
| 33 | #:export (docker-configuration |
| 34 | docker-service-type |
| 35 | singularity-service-type)) |
| 36 | |
| 37 | ;;; We're not using serialize-configuration, but we must define this because |
| 38 | ;;; the define-configuration macro validates it exists. |
| 39 | (define (serialize-boolean field-name val) |
| 40 | "") |
| 41 | |
| 42 | (define-configuration docker-configuration |
| 43 | (docker |
| 44 | (package docker) |
| 45 | "Docker daemon package.") |
| 46 | (containerd |
| 47 | (package containerd) |
| 48 | "containerd package.") |
| 49 | (proxy |
| 50 | (package docker-libnetwork-cmd-proxy) |
| 51 | "The proxy package to support inter-container and outside-container |
| 52 | loop-back communications.") |
| 53 | (enable-proxy? |
| 54 | (boolean #t) |
| 55 | "Enable or disable the user-land proxy (enabled by default).")) |
| 56 | |
| 57 | (define %docker-accounts |
| 58 | (list (user-group (name "docker") (system? #t)))) |
| 59 | |
| 60 | (define (%containerd-activation config) |
| 61 | (let ((state-dir "/var/lib/containerd")) |
| 62 | #~(begin |
| 63 | (use-modules (guix build utils)) |
| 64 | (mkdir-p #$state-dir)))) |
| 65 | |
| 66 | (define (%docker-activation config) |
| 67 | (%containerd-activation config) |
| 68 | (let ((state-dir "/var/lib/docker")) |
| 69 | #~(begin |
| 70 | (use-modules (guix build utils)) |
| 71 | (mkdir-p #$state-dir)))) |
| 72 | |
| 73 | (define (containerd-shepherd-service config) |
| 74 | (let* ((package (docker-configuration-containerd config))) |
| 75 | (shepherd-service |
| 76 | (documentation "containerd daemon.") |
| 77 | (provision '(containerd)) |
| 78 | (start #~(make-forkexec-constructor |
| 79 | (list (string-append #$package "/bin/containerd")) |
| 80 | #:log-file "/var/log/containerd.log")) |
| 81 | (stop #~(make-kill-destructor))))) |
| 82 | |
| 83 | (define (docker-shepherd-service config) |
| 84 | (let* ((docker (docker-configuration-docker config)) |
| 85 | (enable-proxy? (docker-configuration-enable-proxy? config)) |
| 86 | (proxy (docker-configuration-proxy config))) |
| 87 | (shepherd-service |
| 88 | (documentation "Docker daemon.") |
| 89 | (provision '(dockerd)) |
| 90 | (requirement '(containerd |
| 91 | dbus-system |
| 92 | elogind |
| 93 | file-system-/sys/fs/cgroup/blkio |
| 94 | file-system-/sys/fs/cgroup/cpu |
| 95 | file-system-/sys/fs/cgroup/cpuset |
| 96 | file-system-/sys/fs/cgroup/devices |
| 97 | file-system-/sys/fs/cgroup/memory |
| 98 | file-system-/sys/fs/cgroup/pids |
| 99 | networking |
| 100 | udev)) |
| 101 | (start #~(make-forkexec-constructor |
| 102 | (list (string-append #$docker "/bin/dockerd") |
| 103 | "-p" "/var/run/docker.pid" |
| 104 | (if #$enable-proxy? "--userland-proxy" "") |
| 105 | "--userland-proxy-path" (string-append #$proxy |
| 106 | "/bin/proxy")) |
| 107 | #:pid-file "/var/run/docker.pid" |
| 108 | #:log-file "/var/log/docker.log")) |
| 109 | (stop #~(make-kill-destructor))))) |
| 110 | |
| 111 | (define docker-service-type |
| 112 | (service-type (name 'docker) |
| 113 | (description "Provide capability to run Docker application |
| 114 | bundles in Docker containers.") |
| 115 | (extensions |
| 116 | (list |
| 117 | (service-extension activation-service-type |
| 118 | %docker-activation) |
| 119 | (service-extension shepherd-root-service-type |
| 120 | (lambda (config) |
| 121 | (list (containerd-shepherd-service config) |
| 122 | (docker-shepherd-service config)))) |
| 123 | (service-extension account-service-type |
| 124 | (const %docker-accounts)))) |
| 125 | (default-value (docker-configuration)))) |
| 126 | |
| 127 | \f |
| 128 | ;;; |
| 129 | ;;; Singularity. |
| 130 | ;;; |
| 131 | |
| 132 | (define %singularity-activation |
| 133 | (with-imported-modules '((guix build utils)) |
| 134 | #~(begin |
| 135 | (use-modules (guix build utils)) |
| 136 | |
| 137 | (define %mount-directory |
| 138 | "/var/singularity/mnt/") |
| 139 | |
| 140 | ;; Create the directories that Singularity 2.6 expects to find. Make |
| 141 | ;; them #o755 like the 'install-data-hook' rule in 'Makefile.am' of |
| 142 | ;; Singularity 2.6.1. |
| 143 | (for-each (lambda (directory) |
| 144 | (let ((directory (string-append %mount-directory |
| 145 | directory))) |
| 146 | (mkdir-p directory) |
| 147 | (chmod directory #o755))) |
| 148 | '("container" "final" "overlay" "session")) |
| 149 | (chmod %mount-directory #o755)))) |
| 150 | |
| 151 | (define (singularity-setuid-programs singularity) |
| 152 | "Return the setuid-root programs that SINGULARITY needs." |
| 153 | (define helpers |
| 154 | ;; The helpers, under a meaningful name. |
| 155 | (computed-file "singularity-setuid-helpers" |
| 156 | #~(begin |
| 157 | (mkdir #$output) |
| 158 | (for-each (lambda (program) |
| 159 | (symlink (string-append #$singularity |
| 160 | "/libexec/singularity" |
| 161 | "/bin/" |
| 162 | program "-suid") |
| 163 | (string-append #$output |
| 164 | "/singularity-" |
| 165 | program |
| 166 | "-helper"))) |
| 167 | '("action" "mount" "start"))))) |
| 168 | |
| 169 | (list (file-append helpers "/singularity-action-helper") |
| 170 | (file-append helpers "/singularity-mount-helper") |
| 171 | (file-append helpers "/singularity-start-helper"))) |
| 172 | |
| 173 | (define singularity-service-type |
| 174 | (service-type (name 'singularity) |
| 175 | (description |
| 176 | "Install the Singularity application bundle tool.") |
| 177 | (extensions |
| 178 | (list (service-extension setuid-program-service-type |
| 179 | singularity-setuid-programs) |
| 180 | (service-extension activation-service-type |
| 181 | (const %singularity-activation)))) |
| 182 | (default-value singularity))) |