From: Josselin Poiret <dev@jpoiret.xyz>
To: bokr@bokr.com
Cc: Zhu Zihao <all_but_last@163.com>, guix-devel@gnu.org
Subject: Re: Building, packaging and updating Guix with confidence
Date: Thu, 21 Jul 2022 18:10:53 +0200 [thread overview]
Message-ID: <871quezbsi.fsf@jpoiret.xyz> (raw)
In-Reply-To: <20220717165219.GA19816@LionPure>
Hello,
bokr@bokr.com writes:
> Naively:
>
> Why does "the" guix daemon per se need root access at all?
The main thing is that all files in the store end up being written by
the guix daemon user. So if we want the files to be easily
substitutable, they'd need to have a fixed uid/gid, and the only one we
can guarantee is root. Other than that, it needs to use a bunch of
Linux namespaces to isolate the builds from the rest of the system,
which depending on the kernel build-time configuration might not be
possible when unprivileged.
Best,
--
Josselin Poiret
next prev parent reply other threads:[~2022-07-21 16:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-06 20:01 Building, packaging and updating Guix with confidence Josselin Poiret
2022-07-07 12:06 ` Zhu Zihao
2022-07-07 14:34 ` Josselin Poiret
2022-07-17 16:52 ` bokr
2022-07-21 16:10 ` Josselin Poiret [this message]
2022-07-21 16:18 ` Maxime Devos
2022-07-26 1:09 ` Bengt Richter
2022-08-18 13:19 ` zimoun
2022-07-18 11:03 ` Ludovic Courtès
2022-08-18 12:52 ` zimoun
2022-08-19 10:21 ` Josselin Poiret
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871quezbsi.fsf@jpoiret.xyz \
--to=dev@jpoiret.xyz \
--cc=all_but_last@163.com \
--cc=bokr@bokr.com \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).