gnu/services/docker.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
   3 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
   4 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
   5 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
   6 ;;;
   7 ;;; This file is part of GNU Guix.
   8 ;;;
   9 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  10 ;;; under the terms of the GNU General Public License as published by
  11 ;;; the Free Software Foundation; either version 3 of the License, or (at
  12 ;;; your option) any later version.
  13 ;;;
  14 ;;; GNU Guix is distributed in the hope that it will be useful, but
  15 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  16 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 ;;; GNU General Public License for more details.
  18 ;;;
  19 ;;; You should have received a copy of the GNU General Public License
  20 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 (define-module (gnu services docker)
  23   #:use-module (gnu services)
  24   #:use-module (gnu services configuration)
  25   #:use-module (gnu services base)
  26   #:use-module (gnu services dbus)
  27   #:use-module (gnu services shepherd)
  28   #:use-module (gnu system shadow)
  29   #:use-module (gnu packages docker)
  30   #:use-module (gnu packages linux)               ;singularity
  31   #:use-module (guix records)
  32   #:use-module (guix gexp)
  33   #:use-module (guix packages)
  34
  35   #:export (docker-configuration
  36             docker-service-type
  37             singularity-service-type))
  38
  39 ;;; We're not using serialize-configuration, but we must define this because
  40 ;;; the define-configuration macro validates it exists.
  41 (define (serialize-boolean field-name val)
  42   "")
  43
  44 (define-configuration docker-configuration
  45   (docker
  46    (package docker)
  47    "Docker daemon package.")
  48   (docker-cli
  49    (package docker-cli)
  50    "Docker client package.")
  51   (containerd
  52    (package containerd)
  53    "containerd package.")
  54   (proxy
  55    (package docker-libnetwork-cmd-proxy)
  56    "The proxy package to support inter-container and outside-container
  57 loop-back communications.")
  58   (enable-proxy?
  59    (boolean #t)
  60    "Enable or disable the user-land proxy (enabled by default).")
  61   (debug?
  62    (boolean #f)
  63    "Enable or disable debug output.")
  64   (enable-iptables?
  65    (boolean #t)
  66    "Enable addition of iptables rules (enabled by default)."))
  67
  68 (define %docker-accounts
  69   (list (user-group (name "docker") (system? #t))))
  70
  71 (define (%containerd-activation config)
  72   (let ((state-dir "/var/lib/containerd"))
  73     #~(begin
  74         (use-modules (guix build utils))
  75         (mkdir-p #$state-dir))))
  76
  77 (define (%docker-activation config)
  78   (%containerd-activation config)
  79   (let ((state-dir "/var/lib/docker"))
  80     #~(begin
  81         (use-modules (guix build utils))
  82         (mkdir-p #$state-dir))))
  83
  84 (define (containerd-shepherd-service config)
  85   (let* ((package (docker-configuration-containerd config))
  86          (debug? (docker-configuration-debug? config)))
  87     (shepherd-service
  88            (documentation "containerd daemon.")
  89            (provision '(containerd))
  90            (start #~(make-forkexec-constructor
  91                      (list (string-append #$package "/bin/containerd")
  92                            #$@(if debug?
  93                                   '("--log-level=debug")
  94                                   '()))
  95                      #:log-file "/var/log/containerd.log"))
  96            (stop #~(make-kill-destructor)))))
  97
  98 (define (docker-shepherd-service config)
  99   (let* ((docker (docker-configuration-docker config))
 100          (enable-proxy? (docker-configuration-enable-proxy? config))
 101          (enable-iptables? (docker-configuration-enable-iptables? config))
 102          (proxy (docker-configuration-proxy config))
 103          (debug? (docker-configuration-debug? config)))
 104     (shepherd-service
 105            (documentation "Docker daemon.")
 106            (provision '(dockerd))
 107            (requirement '(containerd
 108                           dbus-system
 109                           elogind
 110                           file-system-/sys/fs/cgroup/blkio
 111                           file-system-/sys/fs/cgroup/cpu
 112                           file-system-/sys/fs/cgroup/cpuset
 113                           file-system-/sys/fs/cgroup/devices
 114                           file-system-/sys/fs/cgroup/memory
 115                           file-system-/sys/fs/cgroup/pids
 116                           networking
 117                           udev))
 118            (start #~(make-forkexec-constructor
 119                      (list (string-append #$docker "/bin/dockerd")
 120                            "-p" "/var/run/docker.pid"
 121                            #$@(if debug?
 122                                   '("--debug" "--log-level=debug")
 123                                   '())
 124                            (if #$enable-proxy? "--userland-proxy" "")
 125                            "--userland-proxy-path" (string-append #$proxy
 126                                                                   "/bin/proxy")
 127                            (if #$enable-iptables?
 128                                "--iptables"
 129                                "--iptables=false"))
 130                      #:pid-file "/var/run/docker.pid"
 131                      #:log-file "/var/log/docker.log"))
 132            (stop #~(make-kill-destructor)))))
 133
 134 (define docker-service-type
 135   (service-type (name 'docker)
 136                 (description "Provide capability to run Docker application
 137 bundles in Docker containers.")
 138                 (extensions
 139                  (list
 140                   ;; Make sure the 'docker' command is available.
 141                   (service-extension profile-service-type
 142                                      (compose list docker-configuration-docker-cli))
 143                   (service-extension activation-service-type
 144                                      %docker-activation)
 145                   (service-extension shepherd-root-service-type
 146                                      (lambda (config)
 147                                        (list (containerd-shepherd-service config)
 148                                              (docker-shepherd-service config))))
 149                   (service-extension account-service-type
 150                                      (const %docker-accounts))))
 151                 (default-value (docker-configuration))))
 152
 153 \f
 154 ;;;
 155 ;;; Singularity.
 156 ;;;
 157
 158 (define %singularity-activation
 159   (with-imported-modules '((guix build utils))
 160     #~(begin
 161         (use-modules (guix build utils))
 162
 163         (define %mount-directory
 164           "/var/singularity/mnt/")
 165
 166         ;; Create the directories that Singularity 2.6 expects to find.  Make
 167         ;; them #o755 like the 'install-data-hook' rule in 'Makefile.am' of
 168         ;; Singularity 2.6.1.
 169         (for-each (lambda (directory)
 170                     (let ((directory (string-append %mount-directory
 171                                                     directory)))
 172                       (mkdir-p directory)
 173                       (chmod directory #o755)))
 174                   '("container" "final" "overlay" "session"))
 175         (chmod %mount-directory #o755))))
 176
 177 (define (singularity-setuid-programs singularity)
 178   "Return the setuid-root programs that SINGULARITY needs."
 179   (define helpers
 180     ;; The helpers, under a meaningful name.
 181     (computed-file "singularity-setuid-helpers"
 182                    #~(begin
 183                        (mkdir #$output)
 184                        (for-each (lambda (program)
 185                                    (symlink (string-append #$singularity
 186                                                            "/libexec/singularity"
 187                                                            "/bin/"
 188                                                            program "-suid")
 189                                             (string-append #$output
 190                                                            "/singularity-"
 191                                                            program
 192                                                            "-helper")))
 193                                  '("action" "mount" "start")))))
 194
 195   (list (file-append helpers "/singularity-action-helper")
 196         (file-append helpers "/singularity-mount-helper")
 197         (file-append helpers "/singularity-start-helper")))
 198
 199 (define singularity-service-type
 200   (service-type (name 'singularity)
 201                 (description
 202                  "Install the Singularity application bundle tool.")
 203                 (extensions
 204                  (list (service-extension setuid-program-service-type
 205                                           singularity-setuid-programs)
 206                        (service-extension activation-service-type
 207                                           (const %singularity-activation))))
 208                 (default-value singularity)))