bug#21410: Environment containers

[Alex Vong <alexvong1995@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1498 bytes --]

Hi everyone,

On 27/10/2015, Ludovic Courtès <ludo@gnu.org> wrote:
> Alex Vong <alexvong1995@gmail.com> skribis:
>
>> On 26/10/2015, Thompson, David <dthompson2@worcester.edu> wrote:
>>> On Mon, Oct 26, 2015 at 10:37 AM, Taylan Ulrich Bayırlı/Kammer
>>> <taylanbayirli@gmail.com> wrote:
>>>
>>>> Also, for Debian 8 users and maybe others, this might help:
>>>>
>>>>     sudo sysctl -w kernel.unprivileged_userns_clone=1
>>>
>>> Yes, user namespaces are a must-have for this to work.  I will prepare
>>> patches that mention this in the manual and add a test to 'guix
>>> environment' that can detect if user namespaces are unavailable and
>>> display a more helpful error message.
>>>
>> I think the patch could be considered a fix for
>> <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=21410> as well. How do
>> you think?
>
> Do you still experience the test failures mentioned in that report?  If
> not, could you email 21410@debbugs.gnu.org, specifying which commit
> works for you?
>
Yes, there are 4 tests still failing with the latest master branch
without unprivileged container.
But there is a new problem, tests/guix-environment-container.sh fails
even when running the tests as root. The test log is in the
attachment. I am running Debian 8, could anyone verify this? I would
also like to try it on Debian unstable, but currently my PC cannot
boot, I am using my old laptop.

> I suspect 0e3cc31 helped.
>
> Thanks,
> Ludo’.
>

Cheers,
Alex

[-- Attachment #2: guix-environment-container.log --]
[-- Type: text/x-log, Size: 2326 bytes --]

+ set -e
+ guix environment --version
warning: daemon is running as root, so using `--build-users-group' is highly recommended
guix environment (GNU Guix) 0.9.0
Copyright (C) 2015 the Guix authors
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
+ tmpdir=t-guix-environment-9613
+ trap 'rm -r "$tmpdir"' EXIT
+ mkdir t-guix-environment-9613
+ guix environment --container --ad-hoc --bootstrap guile-bootstrap -- guile -c '(exit 42)'
accepted connection from pid 9621, user root (trusted)
+ test 42 = 42
+ mount_test_code='
(use-modules (ice-9 rdelim)
             (ice-9 match)
             (srfi srfi-1))

(define mappings
  (filter-map (lambda (line)
                (match (string-split line #\space)
                  ;; Empty line.
                  (("") #f)
                  ;; Ignore these types of file systems.
                  ((_ _ (or "tmpfs" "proc" "sysfs" "devtmpfs"
                            "devpts" "cgroup" "mqueue") _ _ _)
                   #f)
                  ((_ mount _ _ _ _)
                   mount)))
              (string-split (call-with-input-file "/proc/mounts" read-string)
                            #\newline)))

(for-each (lambda (mount)
            (display mount)
            (newline))
          mappings)'
+ guix environment --container --ad-hoc --bootstrap guile-bootstrap -- guile -c '
(use-modules (ice-9 rdelim)
             (ice-9 match)
             (srfi srfi-1))

(define mappings
  (filter-map (lambda (line)
                (match (string-split line #\space)
                  ;; Empty line.
                  (("") #f)
                  ;; Ignore these types of file systems.
                  ((_ _ (or "tmpfs" "proc" "sysfs" "devtmpfs"
                            "devpts" "cgroup" "mqueue") _ _ _)
                   #f)
                  ((_ mount _ _ _ _)
                   mount)))
              (string-split (call-with-input-file "/proc/mounts" read-string)
                            #\newline)))

(for-each (lambda (mount)
            (display mount)
            (newline))
          mappings)'
accepted connection from pid 9627, user root (trusted)
++ wc -l
+ test 4 -eq 3
+ rm -r t-guix-environment-9613