gnu/system/linux-container.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
   4 ;;; Copyright © 2019 Arun Isaac <arunisaac@systemreboot.net>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu system linux-container)
  22   #:use-module (ice-9 match)
  23   #:use-module (srfi srfi-1)
  24   #:use-module (guix config)
  25   #:use-module (guix store)
  26   #:use-module (guix gexp)
  27   #:use-module (guix derivations)
  28   #:use-module (guix monads)
  29   #:use-module (guix modules)
  30   #:use-module (gnu build linux-container)
  31   #:use-module (gnu services)
  32   #:use-module (gnu services base)
  33   #:use-module (gnu system)
  34   #:use-module (gnu system file-systems)
  35   #:export (system-container
  36             containerized-operating-system
  37             container-script))
  38
  39 (define* (container-essential-services os #:key shared-network?)
  40   "Return a list of essential services corresponding to OS, a
  41 non-containerized OS.  This procedure essentially strips essential services
  42 from OS that are needed on the bare metal and not in a container."
  43   (define base
  44     (remove (lambda (service)
  45               (memq (service-kind service)
  46                     (list (service-kind %linux-bare-metal-service)
  47                           firmware-service-type
  48                           system-service-type)))
  49             (operating-system-essential-services os)))
  50
  51   (cons (service system-service-type
  52                  (let ((locale (operating-system-locale-directory os)))
  53                    (with-monad %store-monad
  54                      (return `(("locale" ,locale))))))
  55         ;; If network is to be shared with the host, remove network
  56         ;; configuration files from etc-service.
  57         (if shared-network?
  58             (modify-services base
  59               (etc-service-type
  60                files => (remove
  61                          (match-lambda
  62                            ((filename _)
  63                             (member filename
  64                                     (map basename %network-configuration-files))))
  65                          files)))
  66             base)))
  67
  68 (define* (containerized-operating-system os mappings
  69                                          #:key
  70                                          shared-network?
  71                                          (extra-file-systems '()))
  72   "Return an operating system based on OS for use in a Linux container
  73 environment.  MAPPINGS is a list of <file-system-mapping> to realize in the
  74 containerized OS.  EXTRA-FILE-SYSTEMS is a list of file systems to add to OS."
  75   (define user-file-systems
  76     (remove (lambda (fs)
  77               (let ((target (file-system-mount-point fs))
  78                     (source (file-system-device fs)))
  79                 (or (string=? target (%store-prefix))
  80                     (string=? target "/")
  81                     (and (string? source)
  82                          (string-prefix? "/dev/" source))
  83                     (string-prefix? "/dev/" target)
  84                     (string-prefix? "/sys/" target))))
  85             (operating-system-file-systems os)))
  86
  87   (define (mapping->fs fs)
  88     (file-system (inherit (file-system-mapping->bind-mount fs))
  89       (needed-for-boot? #t)))
  90
  91   (define useless-services
  92     ;; Services that make no sense in a container.  Those that attempt to
  93     ;; access /dev/tty[0-9] in particular cannot work in a container.
  94     (append (list console-font-service-type
  95                   mingetty-service-type
  96                   agetty-service-type)
  97             ;; Remove nscd service if network is shared with the host.
  98             (if shared-network?
  99                 (list nscd-service-type)
 100                 (list))))
 101
 102   (operating-system
 103     (inherit os)
 104     (swap-devices '()) ; disable swap
 105     (essential-services (container-essential-services
 106                          os #:shared-network? shared-network?))
 107     (services (remove (lambda (service)
 108                         (memq (service-kind service)
 109                               useless-services))
 110                       (operating-system-user-services os)))
 111     (file-systems (append (map mapping->fs mappings)
 112                           extra-file-systems
 113                           user-file-systems))))
 114
 115 (define* (container-script os #:key (mappings '()) shared-network?)
 116   "Return a derivation of a script that runs OS as a Linux container.
 117 MAPPINGS is a list of <file-system> objects that specify the files/directories
 118 that will be shared with the host system."
 119   (define network-mappings
 120     ;; Files to map if network is to be shared with the host
 121     (append %network-file-mappings
 122             (let ((nscd-run-directory "/var/run/nscd"))
 123               (if (file-exists? nscd-run-directory)
 124                   (list (file-system-mapping
 125                          (source nscd-run-directory)
 126                          (target nscd-run-directory)))
 127                   '()))))
 128
 129   (let* ((os           (containerized-operating-system
 130                         os
 131                         (cons %store-mapping
 132                               (if shared-network?
 133                                   (append network-mappings mappings)
 134                                   mappings))
 135                         #:shared-network? shared-network?
 136                         #:extra-file-systems %container-file-systems))
 137          (file-systems (filter file-system-needed-for-boot?
 138                                (operating-system-file-systems os)))
 139          (specs        (map file-system->spec file-systems)))
 140
 141     (define script
 142       (with-imported-modules (source-module-closure
 143                               '((guix build utils)
 144                                 (gnu build linux-container)))
 145         #~(begin
 146             (use-modules (gnu build linux-container)
 147                          (gnu system file-systems) ;spec->file-system
 148                          (guix build utils))
 149
 150             (call-with-container (map spec->file-system '#$specs)
 151               (lambda ()
 152                 (setenv "HOME" "/root")
 153                 (setenv "TMPDIR" "/tmp")
 154                 (setenv "GUIX_NEW_SYSTEM" #$os)
 155                 (for-each mkdir-p '("/run" "/bin" "/etc" "/home" "/var"))
 156                 (primitive-load (string-append #$os "/boot")))
 157               ;; A range of 65536 uid/gids is used to cover 16 bits worth of
 158               ;; users and groups, which is sufficient for most cases.
 159               ;;
 160               ;; See: http://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--private-users=
 161               #:host-uids 65536
 162               #:namespaces (if #$shared-network?
 163                                (delq 'net %namespaces)
 164                                %namespaces)))))
 165
 166     (gexp->script "run-container" script)))