Re: Login to a guix container

[Pjotr Prins <pjotr.public12@thebird.nl>]

On Mon, Jan 25, 2021 at 08:29:32AM +0100, Ricardo Wurmus wrote:
> In your requirements for an audit, how does a “Guix container” differ
> from a “Linux container”?  Guix uses the kernel features like cloning
> namespaces and unsharing the filesystem directly.  It merely mounts
> individual store locations into the filesystem namespace.
> 
> “Malpractice” is a very big word for using user namespaces instead of
> chroot without a “serious audit”.

I agree. The alternative is using sftp chroot - if it is for file
transfers only, or a full chroot. A container should be safer as long
as we consider the Linux kernel itself safe. The reason I posed the
question was just that I was thinking the solution may be a bit over
the top.

Maybe more over the top would be to run Linux or even GNU Hurd in
qemu/kvm. The more I read about the GNU Hurd the more I like it (I
read this stuff for relaxation rather than work ;). Maybe we'll
experiment with that a little too. We can easily dedicate 1GB of RAM
for such VMs.

Anyway, off-topic on guix-dev, so I apologise. I must say that 'guix
environment -C' is one of the greatest Guix inventions and I just
start thinking of more applications beyond hosting web servers and
development environments. It is lovely :). Thanks everyone!

Pj.