From: Giacomo Leidi via Guix-patches via <guix-patches@gnu.org>
To: 67613@debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul@autistici.org>
Subject: [bug#67613] [PATCH v2 2/5] gnu: docker: Allow setting host environment variables in oci-container-configuration.
Date: Thu, 11 Jan 2024 21:39:50 +0100 [thread overview]
Message-ID: <20240111203954.29335-2-goodoldpaul@autistici.org> (raw)
In-Reply-To: <20240111203954.29335-1-goodoldpaul@autistici.org>
* gnu/services/docker.scm (oci-container-configuration)
[host-environment]: New field;
(oci-sanitize-host-environment): sanitize it;
(oci-container-shepherd-service): use it.
Change-Id: I4d54d37736cf09f042a71cb0b6e673abc0948d9c
---
gnu/services/docker.scm | 31 +++++++++++++++++++++++++++++--
1 file changed, 29 insertions(+), 2 deletions(-)
diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm
index b4fd94d1fd..7706b4a29a 100644
--- a/gnu/services/docker.scm
+++ b/gnu/services/docker.scm
@@ -5,7 +5,7 @@
;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com>
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
-;;; Copyright © 2023 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2023, 2024 Giacomo Leidi <goodoldpaul@autistici.org>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -285,6 +285,11 @@ (define (oci-sanitize-mixed-list name value delimiter)
name el)))))
value))
+(define (oci-sanitize-host-environment value)
+ ;; Expected spec format:
+ ;; '(("HOME" . "/home/nobody") "JAVA_HOME=/java")
+ (oci-sanitize-mixed-list "host-environment" value "="))
+
(define (oci-sanitize-environment value)
;; Expected spec format:
;; '(("HOME" . "/home/nobody") "JAVA_HOME=/java")
@@ -330,6 +335,24 @@ (define-configuration/no-serialization oci-container-configuration
(entrypoint
(maybe-string)
"Overwrite the default entrypoint (@code{ENTRYPOINT}) of the image.")
+ (host-environment
+ (list '())
+ "Set environment variables in the host environment where @command{docker run}
+is invoked. This is especially useful to pass secrets from the host to the
+container without having them on the @command{docker run}'s command line: by
+setting the @{MYSQL_PASSWORD} on the host and by passing
+@code{--env MYSQL_PASSWORD} through the @code{extra-arguments} field, it is
+possible to securely set values in the container environment. This field's
+value can be a list of pairs or strings, even mixed:
+
+@lisp
+(list '(\"LANGUAGE\" . \"eo:ca:eu\")
+ \"JAVA_HOME=/opt/java\")
+@end lisp
+
+Pair members can be strings, gexps or file-like objects. Strings are passed
+directly to @code{make-forkexec-constructor}."
+ (sanitizer oci-sanitize-host-environment))
(environment
(list '())
"Set environment variables. This can be a list of pairs or strings, even
@@ -450,6 +473,8 @@ (define (guess-name name image)
(let* ((docker-command (file-append docker-cli "/bin/docker"))
(user (oci-container-configuration-user config))
(group (oci-container-configuration-group config))
+ (host-environment
+ (oci-container-configuration-host-environment config))
(command (oci-container-configuration-command config))
(provision (oci-container-configuration-provision config))
(image (oci-container-configuration-image config))
@@ -471,7 +496,9 @@ (define (guess-name name image)
"--name" #$name
#$@options #$@extra-arguments #$image #$@command)
#:user #$user
- #:group #$group))
+ #:group #$group
+ #:environment-variables
+ (list #$@host-environment)))
(stop
#~(lambda _
(invoke #$docker-command "rm" "-f" #$name)))
--
2.41.0
next prev parent reply other threads:[~2024-01-11 20:41 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-03 21:53 [bug#67613] Introduce unit tests for oci-container-service-type paul via Guix-patches via
2023-12-03 21:56 ` [bug#67613] [PATCH] tests: Add oci-container-service-type unit tests Giacomo Leidi via Guix-patches via
2023-12-10 21:47 ` [bug#67613] Introduce unit tests for oci-container-service-type Ludovic Courtès
2023-12-10 22:10 ` paul via Guix-patches via
2023-12-14 18:34 ` Ludovic Courtès
2024-01-11 20:39 ` paul via Guix-patches via
2024-05-03 22:10 ` paul via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 1/5] gnu: docker: Provide escape hatch in oci-container-configuration Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` Giacomo Leidi via Guix-patches via [this message]
2024-01-11 20:39 ` [bug#67613] [PATCH v2 3/5] gnu: docker: Allow setting Shepherd dependencies " Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 4/5] gnu: docker: Allow passing tarballs for images " Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 5/5] gnu: Add tests and documentation for oci-container-service-type Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 1/5] gnu: docker: Provide escape hatch in oci-container-configuration Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 2/5] gnu: docker: Allow setting host environment variables " Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 3/5] gnu: docker: Allow setting Shepherd dependencies " Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 4/5] gnu: docker: Allow passing tarballs for images " Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 5/5] gnu: Add tests for oci-container-service-type Giacomo Leidi via Guix-patches via
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240111203954.29335-2-goodoldpaul@autistici.org \
--to=guix-patches@gnu.org \
--cc=67613@debbugs.gnu.org \
--cc=goodoldpaul@autistici.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).