From: "Ludovic Courtès" <ludo@gnu.org>
To: paul <goodoldpaul@autistici.org>
Cc: 66160@debbugs.gnu.org
Subject: [bug#66160] [PATCH] gnu: Add oci-container-service-type.
Date: Thu, 19 Oct 2023 22:13:54 +0200 [thread overview]
Message-ID: <874jimz7y5.fsf@gnu.org> (raw)
In-Reply-To: <604138b9-a567-68eb-82fe-d205390636e7@autistici.org> (paul's message of "Sat, 14 Oct 2023 23:29:59 +0200")
Hello,
paul <goodoldpaul@autistici.org> skribis:
[...]
>> Does ‘docker run’ necessarily need to run as root, or are there cases
>> where one might want to run it as non-root? (I expect the latter.)
>
> yes you are right, it's only required to be in the docker group or in
> general have enough permission to operate on the docker daemon
> socket. I added a new service extension setting up an oci-container
> user, that it's just in the docker group and can not login, that runs
> oci backed services. it is also overridable by the user
In that case, maybe create an “oci-service” account part of the “docker”
group, and run ‘docker run’ as that user instead of running it as root?
Would that be OK or am I overlooking something?
>>> +(define oci-container-service-type
>>> + (service-type (name 'oci-container)
>>> + (extensions (list (service-extension profile-service-type
>>> + (lambda _ (list docker-cli)))
>>> + (service-extension shepherd-root-service-type
>>> + configs->shepherd-services)))
>>> + (default-value '())
>> I wonder if it should take a list of configs and be extensible, or
>> simply take a single config. Users would write:
>>
>> (service oci-container-service-type
>> (oci-container-configuration …))
>>
>> WDYT?
[...]
> Right now we can already do:
>
> (service oci-container-service-type
> (list
> (oci-container-configuration …)))
>
> and i updated the documentation accordingly. do you have any
> suggestion for changing the api of oci-container-configuration to
> support having different shepherd oci backed services behind a guix
> system service? This way we could remove the (list) call.
What I’m suggesting above is that one would build a list of
‘oci-container-service-type’ instances, like:
(list (service oci-container-service-type
(oci-container-configuration …))
(service oci-container-service-type
(oci-container-configuration …))
…)
Each instance above would correspond to exactly one program in a Docker
image.
I feel it’s slightly more natural than having a service type that
implements support for multiple OCI services at once.
> I actually looked around but didn't find them, but it was a long time
> ago and I certainly didn't look very well. I'm definitely up for
> testing this (maybe it's possible to use swineherd? could we use it
> for automating integration tests?), could you point me to something
> similar i can look to as an example?
Check out under gnu/tests/*.scm, in particular (gnu tests docker).
HTH!
Ludo’.
next prev parent reply other threads:[~2023-10-19 20:15 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-22 20:32 [bug#66160] [PATCH] gnu: Add oci-container-service-type paul via Guix-patches via
2023-09-22 20:34 ` Giacomo Leidi via Guix-patches via
2023-10-05 14:30 ` Ludovic Courtès
2023-10-05 17:30 ` paul via Guix-patches via
2023-10-13 22:53 ` paul via Guix-patches via
2023-10-06 19:09 ` Giacomo Leidi via Guix-patches via
2023-10-14 16:09 ` Ludovic Courtès
2023-10-14 21:29 ` paul via Guix-patches via
2023-10-19 20:13 ` Ludovic Courtès [this message]
2023-10-19 21:16 ` paul via Guix-patches via
2023-10-24 15:41 ` Ludovic Courtès
2023-10-24 20:22 ` paul via Guix-patches via
2023-10-13 22:57 ` Giacomo Leidi via Guix-patches via
2023-10-14 21:36 ` Giacomo Leidi via Guix-patches via
2023-10-14 21:47 ` Giacomo Leidi via Guix-patches via
2023-10-24 20:59 ` [bug#66160] [PATCH v2] " Giacomo Leidi via Guix-patches via
2023-11-23 10:02 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874jimz7y5.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=66160@debbugs.gnu.org \
--cc=goodoldpaul@autistici.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).