* bug#52517: inconstency with offloading @ 2021-12-15 17:02 zimoun 2021-12-16 4:09 ` Maxim Cournoyer 2022-01-03 16:52 ` Ludovic Courtès 0 siblings, 2 replies; 6+ messages in thread From: zimoun @ 2021-12-15 17:02 UTC (permalink / raw) To: 52517 Hi, The manual provides [1] the example: --8<---------------cut here---------------start------------->8--- (build-machine (name "armeight.example.org") (systems (list "aarch64-linux")) (host-key "ssh-rsa AAAAB3Nza…") (user "alice") (private-key (string-append (getenv "HOME") "/.ssh/identity-for-guix"))) --8<---------------cut here---------------end--------------->8--- but what is not clear is 'getenv' from who. Concretly, adding 'pk' it reads: --8<---------------cut here---------------start------------->8--- $ guix offload test ;;; ("/home/simon") guix offload: testing 2 build machines defined in '/etc/guix/machines.scm'... --8<---------------cut here---------------end--------------->8--- however, when really building with offload: --8<---------------cut here---------------start------------->8--- $ guix build -L /tmp/mine r-cipr The following derivation will be built: /gnu/store/mzixy5hhx79xx33k03acaasml87c0knc-r-cipr-0.1.0-1.4b01bb8.drv ;;; ("/root") process 6815 acquired build slot '/var/guix/offload/x.x.x.x:22/0' process 6815 acquired build slot '/var/guix/offload/x.x.x.x:22/0' normalized load on machine 'x.x.x.x' is 0.00 --8<---------------cut here---------------end--------------->8--- "guix offload tes" does the correct thing, not "guix build". Cheers, simon 1: <https://guix.gnu.org/en/manual/devel/en/guix.html#Daemon-Offload-Setup> ^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#52517: inconstency with offloading 2021-12-15 17:02 bug#52517: inconstency with offloading zimoun @ 2021-12-16 4:09 ` Maxim Cournoyer 2022-01-03 16:52 ` Ludovic Courtès 1 sibling, 0 replies; 6+ messages in thread From: Maxim Cournoyer @ 2021-12-16 4:09 UTC (permalink / raw) To: zimoun; +Cc: 52517 Hello Simon! zimoun <zimon.toutoune@gmail.com> writes: > Hi, > > The manual provides [1] the example: > > (build-machine > (name "armeight.example.org") > (systems (list "aarch64-linux")) > (host-key "ssh-rsa AAAAB3Nza…") > (user "alice") > (private-key > (string-append (getenv "HOME") > "/.ssh/identity-for-guix"))) > > > but what is not clear is 'getenv' from who. Concretly, adding 'pk' it > reads: > > $ guix offload test > > ;;; ("/home/simon") > guix offload: testing 2 build machines defined in '/etc/guix/machines.scm'... > > > however, when really building with offload: > > $ guix build -L /tmp/mine r-cipr > The following derivation will be built: > /gnu/store/mzixy5hhx79xx33k03acaasml87c0knc-r-cipr-0.1.0-1.4b01bb8.drv > > ;;; ("/root") Good observation; a similar issue I had reported is https://issues.guix.gnu.org/39366. Maxim ^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#52517: inconstency with offloading 2021-12-15 17:02 bug#52517: inconstency with offloading zimoun 2021-12-16 4:09 ` Maxim Cournoyer @ 2022-01-03 16:52 ` Ludovic Courtès 2022-01-03 17:16 ` zimoun 1 sibling, 1 reply; 6+ messages in thread From: Ludovic Courtès @ 2022-01-03 16:52 UTC (permalink / raw) To: zimoun; +Cc: 52517 [-- Attachment #1: Type: text/plain, Size: 1051 bytes --] Hi, zimoun <zimon.toutoune@gmail.com> skribis: > The manual provides [1] the example: > > (build-machine > (name "armeight.example.org") > (systems (list "aarch64-linux")) > (host-key "ssh-rsa AAAAB3Nza…") > (user "alice") > (private-key > (string-append (getenv "HOME") > "/.ssh/identity-for-guix"))) > > > but what is not clear is 'getenv' from who. Concretly, adding 'pk' it > reads: > > $ guix offload test > > ;;; ("/home/simon") > guix offload: testing 2 build machines defined in '/etc/guix/machines.scm'... > > > however, when really building with offload: > > $ guix build -L /tmp/mine r-cipr > The following derivation will be built: > /gnu/store/mzixy5hhx79xx33k03acaasml87c0knc-r-cipr-0.1.0-1.4b01bb8.drv > > ;;; ("/root") This is because guix-daemon spawns ‘guix offload’ as root. But yeah, I agree that the example contributes to the confusion. How about changing the manual as shown below? Ludo’. [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #2: Type: text/x-patch, Size: 606 bytes --] diff --git a/doc/guix.texi b/doc/guix.texi index 43549da388..9c1f30e83f 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -1250,9 +1250,10 @@ The @file{/etc/guix/machines.scm} file typically looks like this: (systems (list "aarch64-linux")) (host-key "ssh-rsa AAAAB3Nza@dots{}") (user "alice") - (private-key - (string-append (getenv "HOME") - "/.ssh/identity-for-guix")))) + + ;; Remember 'guix offload' is spawned by + ;; 'guix-daemon' as root. + (private-key "/root/.ssh/identity-for-guix"))) @end lisp @noindent ^ permalink raw reply related [flat|nested] 6+ messages in thread
* bug#52517: inconstency with offloading 2022-01-03 16:52 ` Ludovic Courtès @ 2022-01-03 17:16 ` zimoun 2022-01-03 18:30 ` Ludovic Courtès 0 siblings, 1 reply; 6+ messages in thread From: zimoun @ 2022-01-03 17:16 UTC (permalink / raw) To: Ludovic Courtès; +Cc: 52517 Hi, On Mon, 03 Jan 2022 at 17:52, Ludovic Courtès <ludo@gnu.org> wrote: > This is because guix-daemon spawns ‘guix offload’ as root. Yes. The issue is I cannot offload to a machine where I have an SSH account and where Guix is installed if the sysadmin does not configure correctly this /root/.ssh/. > diff --git a/doc/guix.texi b/doc/guix.texi > index 43549da388..9c1f30e83f 100644 > --- a/doc/guix.texi > +++ b/doc/guix.texi > @@ -1250,9 +1250,10 @@ The @file{/etc/guix/machines.scm} file typically looks like this: > (systems (list "aarch64-linux")) > (host-key "ssh-rsa AAAAB3Nza@dots{}") > (user "alice") > - (private-key > - (string-append (getenv "HOME") > - "/.ssh/identity-for-guix")))) > + > + ;; Remember 'guix offload' is spawned by > + ;; 'guix-daemon' as root. > + (private-key "/root/.ssh/identity-for-guix"))) This patch LGTM. At least, it could save time for people configuring offload. :-) I am fine to close the issue but, as I said, the fix seems to be able to offload without root access but just an SSH access. Cheers, simon ^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#52517: inconstency with offloading 2022-01-03 17:16 ` zimoun @ 2022-01-03 18:30 ` Ludovic Courtès 2022-01-03 19:19 ` zimoun 0 siblings, 1 reply; 6+ messages in thread From: Ludovic Courtès @ 2022-01-03 18:30 UTC (permalink / raw) To: zimoun; +Cc: 52517-done Hi, zimoun <zimon.toutoune@gmail.com> skribis: > On Mon, 03 Jan 2022 at 17:52, Ludovic Courtès <ludo@gnu.org> wrote: > >> This is because guix-daemon spawns ‘guix offload’ as root. > > Yes. The issue is I cannot offload to a machine where I have an SSH > account and where Guix is installed if the sysadmin does not configure > correctly this /root/.ssh/. True. That’s admittedly not as flexible as it could be. Interestingly, GUIX_DAEMON_SOCKET=ssh://… almost achieves that. Perhaps we could implement “user-level offloading”, probably in addition to system-wide offloading? Food for thought… >> diff --git a/doc/guix.texi b/doc/guix.texi >> index 43549da388..9c1f30e83f 100644 >> --- a/doc/guix.texi >> +++ b/doc/guix.texi >> @@ -1250,9 +1250,10 @@ The @file{/etc/guix/machines.scm} file typically looks like this: >> (systems (list "aarch64-linux")) >> (host-key "ssh-rsa AAAAB3Nza@dots{}") >> (user "alice") >> - (private-key >> - (string-append (getenv "HOME") >> - "/.ssh/identity-for-guix")))) >> + >> + ;; Remember 'guix offload' is spawned by >> + ;; 'guix-daemon' as root. >> + (private-key "/root/.ssh/identity-for-guix"))) > > This patch LGTM. At least, it could save time for people configuring > offload. :-) Alright, committing. > I am fine to close the issue but, as I said, the fix seems to be able to > offload without root access but just an SSH access. Yes, we can discuss that separately. A simple design would be to have clients install a “build handler”; when the handler is called, it selects a machine, open a remote store connection, copies missing inputs, starts the build, retrieves outputs—all that from the client. Of course admins still have to authorize keys both ways, but at least that gives more flexibility. (We could also have a model where keys are authorized just one-way.) Thanks, Ludo’. ^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#52517: inconstency with offloading 2022-01-03 18:30 ` Ludovic Courtès @ 2022-01-03 19:19 ` zimoun 0 siblings, 0 replies; 6+ messages in thread From: zimoun @ 2022-01-03 19:19 UTC (permalink / raw) To: Ludovic Courtès; +Cc: 52517-done Hi Ludo, On Mon, 03 Jan 2022 at 19:30, Ludovic Courtès <ludo@gnu.org> wrote: > Interestingly, GUIX_DAEMON_SOCKET=ssh://… almost achieves that. Thanks for the hint. > Alright, committing. Cool! Thanks. >> I am fine to close the issue but, as I said, the fix seems to be able to >> offload without root access but just an SSH access. > > Yes, we can discuss that separately. Yes… > A simple design would be to have clients install a “build handler”; when > the handler is called, it selects a machine, open a remote store > connection, copies missing inputs, starts the build, retrieves > outputs—all that from the client. Of course admins still have to > authorize keys both ways, but at least that gives more flexibility. (We > could also have a model where keys are authorized just one-way.) …and it is not easy. And somehow it is similar as the issue of «Public guix offload server» discussed [1] recently (Oct. 2021). 1: <https://yhetil.org/guix/878rynh0yq.fsf@systemreboot.net> Cheers, simon ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-01-03 19:34 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-12-15 17:02 bug#52517: inconstency with offloading zimoun 2021-12-16 4:09 ` Maxim Cournoyer 2022-01-03 16:52 ` Ludovic Courtès 2022-01-03 17:16 ` zimoun 2022-01-03 18:30 ` Ludovic Courtès 2022-01-03 19:19 ` zimoun
Code repositories for project(s) associated with this public inbox https://git.savannah.gnu.org/cgit/guix.git This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).