From: "Thompson, David" <dthompson2@worcester.edu>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: guix-devel <guix-devel@gnu.org>, David Thompson <davet@gnu.org>
Subject: Re: [PATCH 14/15] scripts: environment: Add --container option.
Date: Thu, 9 Jul 2015 09:16:53 -0400 [thread overview]
Message-ID: <CAJ=RwfbaavC5rCY_2PQwX0U85vere1eBT44cUb46r+fQ4gVifg@mail.gmail.com> (raw)
In-Reply-To: <87zj38f326.fsf@gnu.org>
On Tue, Jul 7, 2015 at 10:35 AM, Ludovic Courtès <ludo@gnu.org> wrote:
> David Thompson <dthompson2@worcester.edu> skribis:
>
>> * guix/scripts/enviroment.scm (show-help): Show help for new option.
>> (%options): Add --container option.
>> (launch-environment, launch-environment/container): New procedures.
>> (guix-environment): Spawn new process in a container when requested.
>> * doc/guix.texi (Invoking guix environment): Document it.
>
> [...]
>
>> --- a/doc/guix.texi
>> +++ b/doc/guix.texi
>> @@ -4191,6 +4191,15 @@ NumPy:
>> guix environment --ad-hoc python2-numpy python-2.7 -E python
>> @end example
>>
>> +Sometimes it is desirable to isolate the environment as much as
>> +possible, for maximal purity and reproducibility.
>
> + “In particular, when using Guix on a host distro that is not GuixSD,
> it is desirable to prevent access to @file{/usr/bin} and other
> system-wide resources from the development environment.”
>
>> +following command spawns a Guile REPL in a ``container'' where only the
>> +store and the current working directory are mounted:
>
> @cindex container
>
>> +@item --container
>> +@itemx -C
>> +Run command within an isolated container. The current working directory
>
> @var{command}
>
> Since this works without root privileges, what about adding a test in
> tests/guix-environment.sh?
>
> Basically something similar to one of the existing tests, but
> additionally checking from within the container that ‘id -u’ returns 0,
> that ‘$$’ is 2, and that files outside of $PWD are not in the container.
For some reason that I haven't figured out, the existing tests do not
pass on my machine when I run:
make check TESTS=tests/guix-environment.sh
I'm finding it difficult to debug our tests because the test runner
eats backtraces and other useful info.
> Which reminds me: In a separate commit, it Would Be Nice to document our
> minimal kernel requirements for the container functionality. Could you
> look into that?
AFAIK the recommended minimal kernel version that folks should be
using for this stuff is 3.13, and the kernel needs to be configured
with that DEVPTS_MULTIPLE_INSTANCES flag. Where would you put this
information?
Thanks,
- Dave
next prev parent reply other threads:[~2015-07-09 13:16 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-06 13:16 [PATCH 01/15] build: syscalls: Add additional mount flags David Thompson
2015-07-06 13:16 ` [PATCH 02/15] build: syscalls: Add unmount flags David Thompson
2015-07-07 14:50 ` Ludovic Courtès
2015-07-07 22:44 ` Thompson, David
2015-07-06 13:16 ` [PATCH 03/15] build: syscalls: Add mkdtemp! David Thompson
2015-07-07 13:15 ` Ludovic Courtès
2015-07-07 22:52 ` Thompson, David
2015-07-06 13:16 ` [PATCH 04/15] utils: Add call-with-temporary-directory David Thompson
2015-07-07 13:15 ` Ludovic Courtès
2015-07-07 22:54 ` Thompson, David
2015-07-06 13:16 ` [PATCH 05/15] build: syscalls: Add clone syscall wrapper David Thompson
2015-07-07 13:23 ` Ludovic Courtès
2015-07-08 0:28 ` Thompson, David
2015-07-11 10:18 ` Ludovic Courtès
2015-07-06 13:16 ` [PATCH 06/15] build: syscalls: Add setns " David Thompson
2015-07-07 13:28 ` Ludovic Courtès
2015-07-08 0:57 ` Thompson, David
2015-07-06 13:16 ` [PATCH 07/15] build: syscalls: Add pivot-root David Thompson
2015-07-07 13:35 ` Ludovic Courtès
2015-07-08 1:18 ` Thompson, David
2015-07-08 12:47 ` Ludovic Courtès
2015-07-06 13:16 ` [PATCH 08/15] gnu: build: Add Linux container module David Thompson
2015-07-07 13:51 ` Ludovic Courtès
2015-07-08 12:38 ` Thompson, David
2015-07-08 21:57 ` Ludovic Courtès
2015-07-09 12:56 ` Thompson, David
2015-07-06 13:16 ` [PATCH 09/15] gnu: system: Move <file-system-mapping> into (gnu system file-systems) David Thompson
2015-07-07 13:51 ` Ludovic Courtès
2015-07-08 1:21 ` Thompson, David
2015-07-06 13:16 ` [PATCH 10/15] gnu: system: Move file-system->spec to " David Thompson
2015-07-07 13:51 ` Ludovic Courtès
2015-07-08 1:22 ` Thompson, David
2015-07-06 13:16 ` [PATCH 11/15] gnu: system: Add Linux container module David Thompson
2015-07-07 13:55 ` Ludovic Courtès
2015-07-09 13:00 ` Thompson, David
2015-07-10 17:57 ` Ludovic Courtès
2015-07-06 13:16 ` [PATCH 12/15] gnu: system: Add Linux container file systems David Thompson
2015-07-07 13:56 ` Ludovic Courtès
2015-07-09 12:56 ` Thompson, David
2015-07-06 13:16 ` [PATCH 13/15] scripts: system: Add 'container' action David Thompson
2015-07-07 14:05 ` Ludovic Courtès
2015-10-27 0:24 ` Thompson, David
2015-10-27 17:41 ` Ludovic Courtès
2015-10-30 17:28 ` Thompson, David
2015-07-06 13:16 ` [PATCH 14/15] scripts: environment: Add --container option David Thompson
2015-07-07 14:35 ` Ludovic Courtès
2015-07-09 13:16 ` Thompson, David [this message]
2015-07-10 18:03 ` Ludovic Courtès
2015-09-05 23:45 ` Thompson, David
2015-09-11 12:39 ` Ludovic Courtès
2015-10-10 21:11 ` Thompson, David
2015-10-11 19:34 ` Ludovic Courtès
2015-10-17 10:05 ` Ludovic Courtès
2015-10-22 1:23 ` Thompson, David
2015-10-25 21:38 ` Ludovic Courtès
2015-10-26 0:35 ` Thompson, David
2015-10-27 10:13 ` Ludovic Courtès
2015-10-31 1:25 ` Thompson, David
2015-10-31 10:28 ` Ludovic Courtès
2015-07-06 13:16 ` [PATCH 15/15] scripts: Add 'container' subcommand David Thompson
2015-07-07 14:50 ` Ludovic Courtès
2015-10-27 0:31 ` Thompson, David
2015-10-27 17:46 ` Ludovic Courtès
2015-07-07 13:14 ` [PATCH 01/15] build: syscalls: Add additional mount flags Ludovic Courtès
2015-07-07 22:42 ` Thompson, David
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJ=RwfbaavC5rCY_2PQwX0U85vere1eBT44cUb46r+fQ4gVifg@mail.gmail.com' \
--to=dthompson2@worcester.edu \
--cc=davet@gnu.org \
--cc=guix-devel@gnu.org \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).