From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Thompson, David" Subject: Re: Running guix-daemon as an unprivileged user (Was: [PATCH] syscalls: setns: Skip binding if there is no such C function.) Date: Mon, 17 Aug 2015 10:34:04 -0400 Message-ID: References: <20150817033358.580a0cdc@openmailbox.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48208) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRLUL-0001CB-6B for guix-devel@gnu.org; Mon, 17 Aug 2015 10:34:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZRLUD-000823-50 for guix-devel@gnu.org; Mon, 17 Aug 2015 10:34:13 -0400 Received: from mail-yk0-f181.google.com ([209.85.160.181]:36000) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRLUD-00081s-0V for guix-devel@gnu.org; Mon, 17 Aug 2015 10:34:05 -0400 Received: by ykfw73 with SMTP id w73so74406175ykf.3 for ; Mon, 17 Aug 2015 07:34:04 -0700 (PDT) In-Reply-To: <20150817033358.580a0cdc@openmailbox.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Eric Bavier Cc: guix-devel , David Thompson On Mon, Aug 17, 2015 at 4:33 AM, Eric Bavier w= rote: > On Mon, 17 Aug 2015 14:45:28 +0200 > Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA=A0) wrote: > >> On Sun, Aug 16, 2015 at 4:01 PM, Claes Wallin (=E9=9F=8B=E5=98=89=E8=AA= =A0) >> wrote: >> > [Reposting with correct sender. Sorry, David.] >> > >> > Great! I ran into this when trying to compile and run guix on a >> > machine at work, where I'm not root. >> > >> > I was planning to run guix as a stow of steroids. But I'm still >> > wondering whether what I'm attempting is even intended to be >> > possible? Of course, I would lose the benefits of user separation, >> > chroot, hydra (because I can't write to /gnu) etc, but is guix even >> > made to be able to downgrade to this situation? >> >> Answering myself: It is there in the Fine Manual. So it's intended to >> work. I will try this and see how far I come. >> >> https://www.gnu.org/software/guix/manual/guix.html#Build-Environment-Set= up >> >> "If you are installing Guix as an unprivileged user, it is still >> possible to run guix-daemon provided you pass --disable-chroot." >> > > I have experimented with this a bit lately. It works to some extent, > but I have had to apply a few patches to some package recipes. Some > packages have failing tests (where presumably they would pass or be > skipped in the chroot), which I have disabled for the time being just > to move along. I think that to really make unprivileged use of Guix work acceptably, we need to use the user namespaces feature first introduced in Linux 3.8. This would allow unprivileged users to build software in the same type of isolated environments that are used when running the daemon as root. - Dave