From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:56059) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hHU8b-0004ap-Qq for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hHU8Z-0005u1-B8 for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:09 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:59111) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hHU8W-0005nP-R0 for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:05 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hHU8U-0002SG-LN for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:04 -0400 Subject: [bug#34638] [PATCH v2 2/4] linux-container: Add 'start-child-in-container'. Resent-Message-ID: From: Christopher Baines Date: Fri, 19 Apr 2019 15:04:25 +0100 Message-Id: <20190419140427.15183-2-mail@cbaines.net> In-Reply-To: <20190419140427.15183-1-mail@cbaines.net> References: <20190419140427.15183-1-mail@cbaines.net> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 34638@debbugs.gnu.org This new procedure is similar to open-pipe* in (ice-9 popen), but using run-container from (gnu build linux-container). * gnu/build/linux-container.scm (start-child-in-container): New procedure. --- gnu/build/linux-container.scm | 83 +++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 3d7b52f098..88b00e00f6 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -32,6 +32,7 @@ setgroups-supported? %namespaces run-container + start-child-in-container call-with-container container-excursion container-excursion*)) @@ -213,6 +214,88 @@ corresponds to the symbols in NAMESPACES." ('net CLONE_NEWNET)) namespaces))) +(define* (start-child-in-container command + #:key read? write? + (root 'temporary) + (mounts '()) + (namespaces %namespaces) + (host-uids 1) + (extra-environment-variables '())) + (define (with-root-directory f) + (if (eq? root 'temporary) + (call-with-temporary-directory f) + (f root))) + + (define (make-rw-port read-port write-port) + (make-soft-port + (vector + (lambda (c) (write-char c write-port)) + (lambda (s) (display s write-port)) + (lambda () (force-output write-port)) + (lambda () (read-char read-port)) + (lambda () (close-port read-port) (close-port write-port))) + "r+")) + + ;; car is the inport port, cdr is the output port. You write to the output + ;; port, and read from the input port. + (define child-to-parent-pipe + (if read? + (pipe) + #f)) + + (define parent-to-child-pipe + (if write? + (pipe) + #f)) + + (define (run-program) + (when read? + (match child-to-parent-pipe + ((input-port . output-port) + ;; close the output part of the child-to-parent-pipe, as this is used + ;; by the parent process + (close-port input-port) + + ;; Make the input part of the child-to-parent-pipe the standard + ;; output of this process + (dup2 (fileno output-port) 1)))) + + (when write? + (match parent-to-child-pipe + ((input-port . output-port) + ;; close the input part of the parent-to-child-pipe, as this is used + ;; by the parent processs + (close-port output-port) + + ;; Make the output part of the parent-to-child-pipe the standard + ;; input of this process + (dup2 (fileno input-port) 0)))) + + ;; TODO Maybe close all file descriptors, as start_child in Guile does? + + (for-each putenv extra-environment-variables) + + (apply execlp command)) + + (with-root-directory + (lambda (root) + (let ((pid (run-container root mounts namespaces host-uids run-program))) + ;; Catch SIGINT and kill the container process. + (sigaction SIGINT + (lambda (signum) + (false-if-exception + (kill pid SIGKILL)))) + + (let* ((read-port (and=> child-to-parent-pipe car)) + (write-port (and=> parent-to-child-pipe cdr)) + + (port (or (and read-port write-port + (make-rw-port read-port write-port)) + read-port + write-port))) + + (values port pid)))))) + (define* (run-container root mounts namespaces host-uids thunk #:key (guest-uid 0) (guest-gid 0)) "Run THUNK in a new container process and return its PID. ROOT specifies -- 2.21.0