gnu/system/linux-container.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
   4 ;;; Copyright © 2019 Arun Isaac <arunisaac@systemreboot.net>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu system linux-container)
  22   #:use-module (ice-9 match)
  23   #:use-module (srfi srfi-1)
  24   #:use-module (guix config)
  25   #:use-module (guix store)
  26   #:use-module (guix gexp)
  27   #:use-module (guix derivations)
  28   #:use-module (guix monads)
  29   #:use-module (guix modules)
  30   #:use-module (gnu build linux-container)
  31   #:use-module (gnu services)
  32   #:use-module (gnu services base)
  33   #:use-module (gnu system)
  34   #:use-module (gnu system file-systems)
  35   #:export (system-container
  36             containerized-operating-system
  37             container-script))
  38
  39 (define* (container-essential-services os #:key shared-network?)
  40   "Return a list of essential services corresponding to OS, a
  41 non-containerized OS.  This procedure essentially strips essential services
  42 from OS that are needed on the bare metal and not in a container."
  43   (define base
  44     (remove (lambda (service)
  45               (memq (service-kind service)
  46                     (list (service-kind %linux-bare-metal-service)
  47                           firmware-service-type
  48                           system-service-type)))
  49             (operating-system-essential-services os)))
  50
  51   (cons (service system-service-type
  52                  (let ((locale (operating-system-locale-directory os)))
  53                    (with-monad %store-monad
  54                      (return `(("locale" ,locale))))))
  55         ;; If network is to be shared with the host, remove network
  56         ;; configuration files from etc-service.
  57         (if shared-network?
  58             (modify-services base
  59               (etc-service-type
  60                files => (remove
  61                          (match-lambda
  62                            ((filename _)
  63                             (member filename
  64                                     (map basename %network-configuration-files))))
  65                          files)))
  66             base)))
  67
  68 (define* (containerized-operating-system os mappings #:key shared-network?)
  69   "Return an operating system based on OS for use in a Linux container
  70 environment.  MAPPINGS is a list of <file-system-mapping> to realize in the
  71 containerized OS."
  72   (define user-file-systems
  73     (remove (lambda (fs)
  74               (let ((target (file-system-mount-point fs))
  75                     (source (file-system-device fs)))
  76                 (or (string=? target (%store-prefix))
  77                     (string=? target "/")
  78                     (and (string? source)
  79                          (string-prefix? "/dev/" source))
  80                     (string-prefix? "/dev/" target)
  81                     (string-prefix? "/sys/" target))))
  82             (operating-system-file-systems os)))
  83
  84   (define (mapping->fs fs)
  85     (file-system (inherit (file-system-mapping->bind-mount fs))
  86       (needed-for-boot? #t)))
  87
  88   (define useless-services
  89     ;; Services that make no sense in a container.  Those that attempt to
  90     ;; access /dev/tty[0-9] in particular cannot work in a container.
  91     (append (list console-font-service-type
  92                   mingetty-service-type
  93                   agetty-service-type)
  94             ;; Remove nscd service if network is shared with the host.
  95             (if shared-network?
  96                 (list nscd-service-type)
  97                 (list))))
  98
  99   (define shared-network-file-mappings
 100     ;; Files to map if network is to be shared with the host
 101     (append %network-file-mappings
 102             (let ((nscd-run-directory "/var/run/nscd"))
 103               (if (file-exists? nscd-run-directory)
 104                   (list (file-system-mapping
 105                          (source nscd-run-directory)
 106                          (target nscd-run-directory)))
 107                   (list)))))
 108
 109   ;; (write shared-network-file-mappings)
 110   ;; (newline)
 111
 112   (operating-system
 113     (inherit os)
 114     (swap-devices '()) ; disable swap
 115     (essential-services (container-essential-services
 116                          os #:shared-network? shared-network?))
 117     (services (remove (lambda (service)
 118                         (memq (service-kind service)
 119                               useless-services))
 120                       (operating-system-user-services os)))
 121     (file-systems (append (map mapping->fs
 122                                (cons %store-mapping
 123                                      (append mappings
 124                                              (if shared-network?
 125                                                  shared-network-file-mappings
 126                                                  (list)))))
 127                           %container-file-systems
 128                           user-file-systems))))
 129
 130 (define* (container-script os #:key (mappings '()) shared-network?)
 131   "Return a derivation of a script that runs OS as a Linux container.
 132 MAPPINGS is a list of <file-system> objects that specify the files/directories
 133 that will be shared with the host system."
 134   (let* ((os           (containerized-operating-system
 135                         os
 136                         mappings
 137                         #:shared-network? shared-network?))
 138          (file-systems (filter file-system-needed-for-boot?
 139                                (operating-system-file-systems os)))
 140          (specs        (map file-system->spec file-systems)))
 141
 142     (define script
 143       (with-imported-modules (source-module-closure
 144                               '((guix build utils)
 145                                 (gnu build linux-container)))
 146         #~(begin
 147             (use-modules (gnu build linux-container)
 148                          (gnu system file-systems) ;spec->file-system
 149                          (guix build utils))
 150
 151             (call-with-container (map spec->file-system '#$specs)
 152               (lambda ()
 153                 (setenv "HOME" "/root")
 154                 (setenv "TMPDIR" "/tmp")
 155                 (setenv "GUIX_NEW_SYSTEM" #$os)
 156                 (for-each mkdir-p '("/run" "/bin" "/etc" "/home" "/var"))
 157                 (primitive-load (string-append #$os "/boot")))
 158               ;; A range of 65536 uid/gids is used to cover 16 bits worth of
 159               ;; users and groups, which is sufficient for most cases.
 160               ;;
 161               ;; See: http://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--private-users=
 162               #:host-uids 65536
 163               #:namespaces (if #$shared-network?
 164                                (delq 'net %namespaces)
 165                                %namespaces)))))
 166
 167     (gexp->script "run-container" script)))