* Re: bug#55358: docker containers stopped when doing guix install or guix shell
[not found] ` <875ycb6n3w.fsf@remworks.net>
@ 2023-05-19 15:50 ` Remco van 't Veer
2023-05-19 22:29 ` Csepp
2023-05-23 7:49 ` [PATCH] services: docker: Add 'enable-userns-remap?' argument Remco van 't Veer
0 siblings, 2 replies; 4+ messages in thread
From: Remco van 't Veer @ 2023-05-19 15:50 UTC (permalink / raw)
To: 55358; +Cc: Maxim Cournoyer, zimoun, guix-devel
Hi Maxim and Zimoun,
2023/02/09 13:26, Remco van 't Veer:
> I think I know what is causing the issue. Both the "standard" mysql and
> postgres containers use user-id 999 to run the database service (this
> seems like a common practice because the redis container is configured
> similarly). That user-id is also configured as guixbuilder01 so I guess
> the guix daemon is killing those when processes when it finishes doing
> builds.
I found a solution / workaround for this problem by using
"userns-remap". This feature allows the remapping of uids and guids to
different ranges. I tried it by hacking the required files into my
etc-directory and it works; guix no long kills my database containers.
I'd like to add this feature to docker-service-type having a new
configuration option named enable-userns-remap? which introduces a new
user and group (both named dockremap) to do the remapping by adding some
configurable number to the uids and guids of the running container. In
/etc/subuid and /etc/subgid it would look like:
dockremap:100000:65536
See https://docs.docker.com/engine/security/userns-remap/ for
documentation about this.
WDYT?
Cheers,
Remco
--
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=55358
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: bug#55358: docker containers stopped when doing guix install or guix shell
2023-05-19 15:50 ` bug#55358: docker containers stopped when doing guix install or guix shell Remco van 't Veer
@ 2023-05-19 22:29 ` Csepp
2023-05-23 7:53 ` Remco van 't Veer
2023-05-23 7:49 ` [PATCH] services: docker: Add 'enable-userns-remap?' argument Remco van 't Veer
1 sibling, 1 reply; 4+ messages in thread
From: Csepp @ 2023-05-19 22:29 UTC (permalink / raw)
To: Remco van 't Veer; +Cc: 55358, Maxim Cournoyer, zimoun, guix-devel
Remco van 't Veer <remco@remworks.net> writes:
> Hi Maxim and Zimoun,
>
> 2023/02/09 13:26, Remco van 't Veer:
>
>> I think I know what is causing the issue. Both the "standard" mysql and
>> postgres containers use user-id 999 to run the database service (this
>> seems like a common practice because the redis container is configured
>> similarly). That user-id is also configured as guixbuilder01 so I guess
>> the guix daemon is killing those when processes when it finishes doing
>> builds.
>
> I found a solution / workaround for this problem by using
> "userns-remap". This feature allows the remapping of uids and guids to
> different ranges. I tried it by hacking the required files into my
> etc-directory and it works; guix no long kills my database containers.
>
> I'd like to add this feature to docker-service-type having a new
> configuration option named enable-userns-remap? which introduces a new
> user and group (both named dockremap) to do the remapping by adding some
> configurable number to the uids and guids of the running container. In
> /etc/subuid and /etc/subgid it would look like:
>
> dockremap:100000:65536
>
> See https://docs.docker.com/engine/security/userns-remap/ for
> documentation about this.
>
> WDYT?
>
> Cheers,
> Remco
The rootless podman example that was shared a few months ago could be
relevant to this, since that also adds a subuid/subgid mapping.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] services: docker: Add 'enable-userns-remap?' argument.
2023-05-19 15:50 ` bug#55358: docker containers stopped when doing guix install or guix shell Remco van 't Veer
2023-05-19 22:29 ` Csepp
@ 2023-05-23 7:49 ` Remco van 't Veer
1 sibling, 0 replies; 4+ messages in thread
From: Remco van 't Veer @ 2023-05-23 7:49 UTC (permalink / raw)
To: 55358; +Cc: Maxim Cournoyer, zimoun, guix-devel, Remco van 't Veer
* gnu/services/docker.scm (docker-configuration): Define the argument.
* gnu/services/docker.scm (docker-shepherd-service): Use it.
* doc/guix.texi (Docker Service): Document it.
---
doc/guix.texi | 27 ++++++++++++++++++++++++++-
gnu/services/docker.scm | 28 +++++++++++++++++++++++++++-
2 files changed, 53 insertions(+), 2 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index f4cca66d76..ae185ced61 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -100,7 +100,7 @@
Copyright @copyright{} 2021 muradm@*
Copyright @copyright{} 2021, 2022 Andrew Tropin@*
Copyright @copyright{} 2021 Sarah Morgensen@*
-Copyright @copyright{} 2022 Remco van 't Veer@*
+Copyright @copyright{} 2022, 2023 Remco van 't Veer@*
Copyright @copyright{} 2022 Aleksandr Vityazev@*
Copyright @copyright{} 2022 Philip M@sup{c}Grath@*
Copyright @copyright{} 2022 Karl Hallsby@*
@@ -38533,6 +38533,31 @@ Miscellaneous Services
@item @code{enable-iptables?} (default @code{#t})
Enable or disable the addition of iptables rules.
+@item @code{enable-userns-remap?} (default @code{#f})
+Enable remapping and subordinate user and group IDs.
+
+A system user account named @code{dockremap} and user group named
+@code{dockremap} will be created. They must be mapped using the
+@file{/etc/subuid} and @file{/etc/subguid} files otherwise docker fail
+to startup.
+
+Here's an example service to setup both files:
+
+@lisp
+(simple-service
+ 'subuid-subgid etc-service-type
+ (list `("subuid"
+ ,(plain-file "subuid"
+ "dockremap:65536:65536\n"))
+ `("subgid"
+ ,(plain-file "subgid"
+ "dockremap:65536:65536\n"))))
+@end lisp
+
+The above will remap to UID 0 (root) to 65536, UID 1 to 65537 etc. For
+more information regarding the format of these files, consult
+@command{man 5 subuid} and @command{man 5 subgid}.
+
@item @code{environment-variables} (default: @code{()})
List of environment variables to set for @command{dockerd}.
diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm
index 741bab5a8c..e138a6be7e 100644
--- a/gnu/services/docker.scm
+++ b/gnu/services/docker.scm
@@ -5,6 +5,7 @@
;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com>
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
+;;; Copyright © 2023 Remco van 't Veer <remco@remworks.net>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -29,6 +30,7 @@ (define-module (gnu services docker)
#:use-module (gnu services shepherd)
#:use-module (gnu system setuid)
#:use-module (gnu system shadow)
+ #:use-module (gnu packages admin)
#:use-module (gnu packages docker)
#:use-module (gnu packages linux) ;singularity
#:use-module (guix records)
@@ -62,6 +64,9 @@ (define-configuration docker-configuration
(enable-iptables?
(boolean #t)
"Enable addition of iptables rules (enabled by default).")
+ (enable-userns-remap?
+ (boolean #f)
+ "Enable remapping and subordinate user and group IDs (disabled by default).")
(environment-variables
(list '())
"Environment variables to set for dockerd")
@@ -107,6 +112,7 @@ (define (docker-shepherd-service config)
(let* ((docker (docker-configuration-docker config))
(enable-proxy? (docker-configuration-enable-proxy? config))
(enable-iptables? (docker-configuration-enable-iptables? config))
+ (enable-userns-remap? (docker-configuration-enable-userns-remap? config))
(environment-variables (docker-configuration-environment-variables config))
(proxy (docker-configuration-proxy config))
(debug? (docker-configuration-debug? config)))
@@ -135,6 +141,9 @@ (define (docker-shepherd-service config)
#~(string-append
"--userland-proxy-path=" #$proxy "/bin/proxy"))
'("--userland-proxy=false"))
+ #$@(if enable-userns-remap?
+ '("--userns-remap=dockremap")
+ '())
(if #$enable-iptables?
"--iptables"
"--iptables=false")
@@ -145,6 +154,18 @@ (define (docker-shepherd-service config)
#:log-file "/var/log/docker.log"))
(stop #~(make-kill-destructor)))))
+(define %docker-remap-user-group
+ (user-group (name "dockremap")
+ (system? #t)))
+
+(define %docker-remap-user-account
+ (user-account (name "dockremap")
+ (group "dockremap")
+ (system? #t)
+ (comment "Docker user namespace remap user")
+ (home-directory "/var/empty")
+ (shell (file-append shadow "/sbin/nologin"))))
+
(define docker-service-type
(service-type (name 'docker)
(description "Provide capability to run Docker application
@@ -161,7 +182,12 @@ (define docker-service-type
(list (containerd-shepherd-service config)
(docker-shepherd-service config))))
(service-extension account-service-type
- (const %docker-accounts))))
+ (lambda (config)
+ (if (docker-configuration-enable-userns-remap? config)
+ (cons* %docker-remap-user-group
+ %docker-remap-user-account
+ %docker-accounts)
+ %docker-accounts)))))
(default-value (docker-configuration))))
\f
base-commit: 849286ba66c96534bddc04df1a47d5692cbc977e
--
2.40.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: bug#55358: docker containers stopped when doing guix install or guix shell
2023-05-19 22:29 ` Csepp
@ 2023-05-23 7:53 ` Remco van 't Veer
0 siblings, 0 replies; 4+ messages in thread
From: Remco van 't Veer @ 2023-05-23 7:53 UTC (permalink / raw)
To: Csepp; +Cc: 55358, Maxim Cournoyer, zimoun, guix-devel
Hi Csepp,
2023/05/20 00:29, Csepp:
> Remco van 't Veer <remco@remworks.net> writes:
>
>> Hi Maxim and Zimoun,
>>
>> 2023/02/09 13:26, Remco van 't Veer:
>>
>>> I think I know what is causing the issue. Both the "standard" mysql and
>>> postgres containers use user-id 999 to run the database service (this
>>> seems like a common practice because the redis container is configured
>>> similarly). That user-id is also configured as guixbuilder01 so I guess
>>> the guix daemon is killing those when processes when it finishes doing
>>> builds.
>>
>> I found a solution / workaround for this problem by using
>> "userns-remap". This feature allows the remapping of uids and guids to
>> different ranges. I tried it by hacking the required files into my
>> etc-directory and it works; guix no long kills my database containers.
>>
>> I'd like to add this feature to docker-service-type having a new
>> configuration option named enable-userns-remap? which introduces a new
>> user and group (both named dockremap) to do the remapping by adding some
>> configurable number to the uids and guids of the running container. In
>> /etc/subuid and /etc/subgid it would look like:
>>
>> dockremap:100000:65536
>>
>> See https://docs.docker.com/engine/security/userns-remap/ for
>> documentation about this.
>>
>> WDYT?
>>
>> Cheers,
>> Remco
>
> The rootless podman example that was shared a few months ago could be
> relevant to this, since that also adds a subuid/subgid mapping.
Thanks! Borrowed that.
For future reference:
https://lists.gnu.org/archive/html/guix-devel/2023-03/msg00176.html
Cheers,
Remco
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-05-23 7:54 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <87ilqch79l.fsf@remworks.net>
[not found] ` <87mtde8mrr.fsf@gmail.com>
[not found] ` <87h73m9z3f.fsf@remworks.net>
[not found] ` <875ycb6n3w.fsf@remworks.net>
2023-05-19 15:50 ` bug#55358: docker containers stopped when doing guix install or guix shell Remco van 't Veer
2023-05-19 22:29 ` Csepp
2023-05-23 7:53 ` Remco van 't Veer
2023-05-23 7:49 ` [PATCH] services: docker: Add 'enable-userns-remap?' argument Remco van 't Veer
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).