gnu/system/linux-container.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
   4 ;;; Copyright © 2019 Arun Isaac <arunisaac@systemreboot.net>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu system linux-container)
  22   #:use-module (ice-9 match)
  23   #:use-module (srfi srfi-1)
  24   #:use-module (guix config)
  25   #:use-module (guix store)
  26   #:use-module (guix gexp)
  27   #:use-module (guix derivations)
  28   #:use-module (guix monads)
  29   #:use-module (guix modules)
  30   #:use-module (gnu build linux-container)
  31   #:use-module (gnu services)
  32   #:use-module (gnu services base)
  33   #:use-module (gnu system)
  34   #:use-module (gnu system file-systems)
  35   #:export (system-container
  36             containerized-operating-system
  37             container-script))
  38
  39 (define* (container-essential-services os #:key shared-network?)
  40   "Return a list of essential services corresponding to OS, a
  41 non-containerized OS.  This procedure essentially strips essential services
  42 from OS that are needed on the bare metal and not in a container."
  43   (define base
  44     (remove (lambda (service)
  45               (memq (service-kind service)
  46                     (list (service-kind %linux-bare-metal-service)
  47                           firmware-service-type
  48                           system-service-type)))
  49             (operating-system-default-essential-services os)))
  50
  51   (cons (service system-service-type
  52                  (let ((locale (operating-system-locale-directory os)))
  53                    (with-monad %store-monad
  54                      (return `(("locale" ,locale))))))
  55         ;; If network is to be shared with the host, remove network
  56         ;; configuration files from etc-service.
  57         (if shared-network?
  58             (modify-services base
  59               (etc-service-type
  60                files => (remove
  61                          (match-lambda
  62                            ((filename _)
  63                             (member filename
  64                                     (map basename %network-configuration-files))))
  65                          files)))
  66             base)))
  67
  68 (define* (containerized-operating-system os mappings
  69                                          #:key
  70                                          shared-network?
  71                                          (extra-file-systems '()))
  72   "Return an operating system based on OS for use in a Linux container
  73 environment.  MAPPINGS is a list of <file-system-mapping> to realize in the
  74 containerized OS.  EXTRA-FILE-SYSTEMS is a list of file systems to add to OS."
  75   (define user-file-systems
  76     (remove (lambda (fs)
  77               (let ((target (file-system-mount-point fs))
  78                     (source (file-system-device fs)))
  79                 (or (string=? target (%store-prefix))
  80                     (string=? target "/")
  81                     (and (string? source)
  82                          (string-prefix? "/dev/" source))
  83                     (string-prefix? "/dev/" target)
  84                     (string-prefix? "/sys/" target))))
  85             (operating-system-file-systems os)))
  86
  87   (define (mapping->fs fs)
  88     (file-system (inherit (file-system-mapping->bind-mount fs))
  89       (needed-for-boot? #t)))
  90
  91   (define useless-services
  92     ;; Services that make no sense in a container.  Those that attempt to
  93     ;; access /dev/tty[0-9] in particular cannot work in a container.
  94     (append (list console-font-service-type
  95                   mingetty-service-type
  96                   agetty-service-type)
  97             ;; Remove nscd service if network is shared with the host.
  98             (if shared-network?
  99                 (list nscd-service-type)
 100                 (list))))
 101
 102   (operating-system
 103     (inherit os)
 104     (swap-devices '()) ; disable swap
 105     (essential-services (container-essential-services
 106                          this-operating-system
 107                          #:shared-network? shared-network?))
 108     (services (remove (lambda (service)
 109                         (memq (service-kind service)
 110                               useless-services))
 111                       (operating-system-user-services os)))
 112     (file-systems (append (map mapping->fs mappings)
 113                           extra-file-systems
 114                           user-file-systems
 115
 116                           ;; Provide a dummy root file system so we can create
 117                           ;; a 'boot-parameters' file.
 118                           (list (file-system
 119                                   (mount-point "/")
 120                                   (device "nothing")
 121                                   (type "dummy")))))))
 122
 123 (define* (container-script os #:key (mappings '()) shared-network?)
 124   "Return a derivation of a script that runs OS as a Linux container.
 125 MAPPINGS is a list of <file-system> objects that specify the files/directories
 126 that will be shared with the host system."
 127   (define network-mappings
 128     ;; Files to map if network is to be shared with the host
 129     (append %network-file-mappings
 130             (let ((nscd-run-directory "/var/run/nscd"))
 131               (if (file-exists? nscd-run-directory)
 132                   (list (file-system-mapping
 133                          (source nscd-run-directory)
 134                          (target nscd-run-directory)))
 135                   '()))))
 136
 137   (define (mountable-file-system? file-system)
 138     ;; Return #t if FILE-SYSTEM should be mounted in the container.
 139     (and (not (string=? "/" (file-system-mount-point file-system)))
 140          (file-system-needed-for-boot? file-system)))
 141
 142   (let* ((os           (containerized-operating-system
 143                         os
 144                         (cons %store-mapping
 145                               (if shared-network?
 146                                   (append network-mappings mappings)
 147                                   mappings))
 148                         #:shared-network? shared-network?
 149                         #:extra-file-systems %container-file-systems))
 150          (file-systems (filter mountable-file-system?
 151                                (operating-system-file-systems os)))
 152          (specs        (map file-system->spec file-systems)))
 153
 154     (define script
 155       (with-imported-modules (source-module-closure
 156                               '((guix build utils)
 157                                 (gnu build linux-container)))
 158         #~(begin
 159             (use-modules (gnu build linux-container)
 160                          (gnu system file-systems) ;spec->file-system
 161                          (guix build utils))
 162
 163             (call-with-container (map spec->file-system '#$specs)
 164               (lambda ()
 165                 (setenv "HOME" "/root")
 166                 (setenv "TMPDIR" "/tmp")
 167                 (setenv "GUIX_NEW_SYSTEM" #$os)
 168                 (for-each mkdir-p '("/run" "/bin" "/etc" "/home" "/var"))
 169                 (primitive-load (string-append #$os "/boot")))
 170               ;; A range of 65536 uid/gids is used to cover 16 bits worth of
 171               ;; users and groups, which is sufficient for most cases.
 172               ;;
 173               ;; See: http://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--private-users=
 174               #:host-uids 65536
 175               #:namespaces (if #$shared-network?
 176                                (delq 'net %namespaces)
 177                                %namespaces)))))
 178
 179     (gexp->script "run-container" script)))