From: "Thompson, David" <dthompson2@worcester.edu>
To: guix-devel <guix-devel@gnu.org>
Subject: Update on GuixSD containers
Date: Mon, 8 Jun 2015 11:20:41 -0400 [thread overview]
Message-ID: <CAJ=RwfaX2P+VBfCVxH+LnHVNXZZPwebAi7xhE2GvUG5-SDhZGA@mail.gmail.com> (raw)
Hey folks,
I'd like to give a quick update on the state of wip-container branch.
As of this morning, one can run the below commands and have a somewhat
functional GuixSD container:
# Hardcoded /tmp/container as the container root directory until I
# add a command line switch.
mkdir /tmp/container
guix system container container-config.scm
Where 'container-config.scm' is:
(use-modules (gnu))
;; Minimal GuixSD configuration suitable for a Linux container.
(operating-system
(host-name "container-test")
(timezone "America/New_York")
(locale "en_US.UTF-8")
;; Unused
(bootloader (grub-configuration (device "/dev/sdX")))
;; Dummy FS
(file-systems (cons (file-system
(mount-point "/")
(device "dummy")
(type "dummy"))
%base-file-systems))
(users (cons (user-account
(name "alice")
(comment "Bob's sister")
(group "users")
(supplementary-groups '("wheel" "audio" "video"))
(home-directory "/home/alice"))
%base-user-accounts)))
The activation and boot scripts for the system have been tweaked to
DTRT for a container, and DMD is able to start successfully and start
all of the base services, sans the console-font-tty services for some
reason.
So, this is cool, but much work remains to be done. Our containers
operate in 5 of 6 possible Linux namespaces: mount, PID, UTS, IPC, and
network. The remaining namespace to get working is the user
namespace, which is especially tricky. I don't think even Docker can
use user namespaces properly yet, but I might be wrong. Additionally,
our containers have a loopback device, but have no way of accessing an
outside network such as your LAN or a virtual network on the host
system. There's also no support for cgroups, which would allow us to
limit the resource usage of containers like you can with a VM
hypervisor.
For the long term, we'll need a container daemon to keep track of all
containers on the system to allow for easily starting and stopping
them (right now you have to 'sudo kill -9 <dmd pid>'), spawning new
processes within them (for example, launching bash for an interactive
environment), and whatever else we might want.
In closing, things aren't exactly usable, but I encourage
brave/curious people to take 'guix system container' for a spin and
hack on it to make Guix the best container management tool yet! Also,
I think the code is very easy to follow (unlike Docker's
libcontainer), so if you want to understand what containers *really*
are beyond a buzzword, have a look at gnu/build/linux-container.scm
and gnu/system/linux-container.scm.
Happy hacking,
- Dave
next reply other threads:[~2015-06-08 15:20 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-08 15:20 Thompson, David [this message]
2015-06-09 21:28 ` Update on GuixSD containers Ludovic Courtès
2015-06-11 14:51 ` Thompson, David
2015-06-12 15:08 ` Ludovic Courtès
2015-06-13 3:41 ` Thompson, David
2018-07-24 22:22 ` Christopher Lemmer Webber
2015-06-12 15:12 ` Ludovic Courtès
2015-06-13 1:41 ` Thompson, David
2015-06-13 13:06 ` Ludovic Courtès
2015-06-13 13:14 ` Thompson, David
2015-06-13 20:19 ` Ludovic Courtès
2015-06-16 16:39 ` Thompson, David
2015-06-19 12:08 ` Ludovic Courtès
2015-06-19 12:29 ` Thompson, David
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJ=RwfaX2P+VBfCVxH+LnHVNXZZPwebAi7xhE2GvUG5-SDhZGA@mail.gmail.com' \
--to=dthompson2@worcester.edu \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).