gnu/services/docker.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
   3 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
   4 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
   5 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
   6 ;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com>
   7 ;;;
   8 ;;; This file is part of GNU Guix.
   9 ;;;
  10 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  11 ;;; under the terms of the GNU General Public License as published by
  12 ;;; the Free Software Foundation; either version 3 of the License, or (at
  13 ;;; your option) any later version.
  14 ;;;
  15 ;;; GNU Guix is distributed in the hope that it will be useful, but
  16 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ;;; GNU General Public License for more details.
  19 ;;;
  20 ;;; You should have received a copy of the GNU General Public License
  21 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  22
  23 (define-module (gnu services docker)
  24   #:use-module (gnu services)
  25   #:use-module (gnu services configuration)
  26   #:use-module (gnu services base)
  27   #:use-module (gnu services dbus)
  28   #:use-module (gnu services shepherd)
  29   #:use-module (gnu system shadow)
  30   #:use-module (gnu packages docker)
  31   #:use-module (gnu packages linux)               ;singularity
  32   #:use-module (guix records)
  33   #:use-module (guix gexp)
  34   #:use-module (guix packages)
  35
  36   #:export (docker-configuration
  37             docker-service-type
  38             singularity-service-type))
  39
  40 ;;; We're not using serialize-configuration, but we must define this because
  41 ;;; the define-configuration macro validates it exists.
  42 (define (serialize-boolean field-name val)
  43   "")
  44
  45 (define-configuration docker-configuration
  46   (docker
  47    (package docker)
  48    "Docker daemon package.")
  49   (docker-cli
  50    (package docker-cli)
  51    "Docker client package.")
  52   (containerd
  53    (package containerd)
  54    "containerd package.")
  55   (proxy
  56    (package docker-libnetwork-cmd-proxy)
  57    "The proxy package to support inter-container and outside-container
  58 loop-back communications.")
  59   (enable-proxy?
  60    (boolean #t)
  61    "Enable or disable the user-land proxy (enabled by default).")
  62   (debug?
  63    (boolean #f)
  64    "Enable or disable debug output.")
  65   (enable-iptables?
  66    (boolean #t)
  67    "Enable addition of iptables rules (enabled by default)."))
  68
  69 (define %docker-accounts
  70   (list (user-group (name "docker") (system? #t))))
  71
  72 (define (%containerd-activation config)
  73   (let ((state-dir "/var/lib/containerd"))
  74     #~(begin
  75         (use-modules (guix build utils))
  76         (mkdir-p #$state-dir))))
  77
  78 (define (%docker-activation config)
  79   (%containerd-activation config)
  80   (let ((state-dir "/var/lib/docker"))
  81     #~(begin
  82         (use-modules (guix build utils))
  83         (mkdir-p #$state-dir))))
  84
  85 (define (containerd-shepherd-service config)
  86   (let* ((package (docker-configuration-containerd config))
  87          (debug? (docker-configuration-debug? config))
  88          (containerd (docker-configuration-containerd config)))
  89     (shepherd-service
  90            (documentation "containerd daemon.")
  91            (provision '(containerd))
  92            (start #~(make-forkexec-constructor
  93                      (list (string-append #$package "/bin/containerd")
  94                            #$@(if debug?
  95                                   '("--log-level=debug")
  96                                   '()))
  97                      ;; For finding containerd-shim binary.
  98                      #:environment-variables
  99                      (list (string-append "PATH=" #$containerd "/bin"))
 100                      #:log-file "/var/log/containerd.log"))
 101            (stop #~(make-kill-destructor)))))
 102
 103 (define (docker-shepherd-service config)
 104   (let* ((docker (docker-configuration-docker config))
 105          (enable-proxy? (docker-configuration-enable-proxy? config))
 106          (enable-iptables? (docker-configuration-enable-iptables? config))
 107          (proxy (docker-configuration-proxy config))
 108          (debug? (docker-configuration-debug? config)))
 109     (shepherd-service
 110            (documentation "Docker daemon.")
 111            (provision '(dockerd))
 112            (requirement '(containerd
 113                           dbus-system
 114                           elogind
 115                           file-system-/sys/fs/cgroup/blkio
 116                           file-system-/sys/fs/cgroup/cpu
 117                           file-system-/sys/fs/cgroup/cpuset
 118                           file-system-/sys/fs/cgroup/devices
 119                           file-system-/sys/fs/cgroup/memory
 120                           file-system-/sys/fs/cgroup/pids
 121                           networking
 122                           udev))
 123            (start #~(make-forkexec-constructor
 124                      (list (string-append #$docker "/bin/dockerd")
 125                            "-p" "/var/run/docker.pid"
 126                            #$@(if debug?
 127                                   '("--debug" "--log-level=debug")
 128                                   '())
 129                            #$@(if enable-proxy?
 130                                   (list "--userland-proxy=true"
 131                                         #~(string-append
 132                                            "--userland-proxy-path=" #$proxy "/bin/proxy"))
 133                                   '("--userland-proxy=false"))
 134                            (if #$enable-iptables?
 135                                "--iptables"
 136                                "--iptables=false"))
 137                      #:pid-file "/var/run/docker.pid"
 138                      #:log-file "/var/log/docker.log"))
 139            (stop #~(make-kill-destructor)))))
 140
 141 (define docker-service-type
 142   (service-type (name 'docker)
 143                 (description "Provide capability to run Docker application
 144 bundles in Docker containers.")
 145                 (extensions
 146                  (list
 147                   ;; Make sure the 'docker' command is available.
 148                   (service-extension profile-service-type
 149                                      (compose list docker-configuration-docker-cli))
 150                   (service-extension activation-service-type
 151                                      %docker-activation)
 152                   (service-extension shepherd-root-service-type
 153                                      (lambda (config)
 154                                        (list (containerd-shepherd-service config)
 155                                              (docker-shepherd-service config))))
 156                   (service-extension account-service-type
 157                                      (const %docker-accounts))))
 158                 (default-value (docker-configuration))))
 159
 160 \f
 161 ;;;
 162 ;;; Singularity.
 163 ;;;
 164
 165 (define %singularity-activation
 166   (with-imported-modules '((guix build utils))
 167     #~(begin
 168         (use-modules (guix build utils))
 169
 170         (define %mount-directory
 171           "/var/singularity/mnt/")
 172
 173         ;; Create the directories that Singularity 2.6 expects to find.  Make
 174         ;; them #o755 like the 'install-data-hook' rule in 'Makefile.am' of
 175         ;; Singularity 2.6.1.
 176         (for-each (lambda (directory)
 177                     (let ((directory (string-append %mount-directory
 178                                                     directory)))
 179                       (mkdir-p directory)
 180                       (chmod directory #o755)))
 181                   '("container" "final" "overlay" "session"))
 182         (chmod %mount-directory #o755))))
 183
 184 (define (singularity-setuid-programs singularity)
 185   "Return the setuid-root programs that SINGULARITY needs."
 186   (define helpers
 187     ;; The helpers, under a meaningful name.
 188     (computed-file "singularity-setuid-helpers"
 189                    #~(begin
 190                        (mkdir #$output)
 191                        (for-each (lambda (program)
 192                                    (symlink (string-append #$singularity
 193                                                            "/libexec/singularity"
 194                                                            "/bin/"
 195                                                            program "-suid")
 196                                             (string-append #$output
 197                                                            "/singularity-"
 198                                                            program
 199                                                            "-helper")))
 200                                  '("action" "mount" "start")))))
 201
 202   (list (file-append helpers "/singularity-action-helper")
 203         (file-append helpers "/singularity-mount-helper")
 204         (file-append helpers "/singularity-start-helper")))
 205
 206 (define singularity-service-type
 207   (service-type (name 'singularity)
 208                 (description
 209                  "Install the Singularity application bundle tool.")
 210                 (extensions
 211                  (list (service-extension setuid-program-service-type
 212                                           singularity-setuid-programs)
 213                        (service-extension activation-service-type
 214                                           (const %singularity-activation))))
 215                 (default-value singularity)))