[bug#43540] [PATCH] Instantiate nscd in each system container instead of using the container host's service.

[Jason Conroy <conjaroy@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1252 bytes --]

Hello Guix,

Currently, Guix system containers hosted on machines that run nscd are
configured to use that daemon's socket by bind-mounting /var/run/nscd into
the container's filesystem. As discussed in bug#41575, there are certain
nscd configurations that expose information from the host's /etc files into
the container's processes, and aside from the security implications, this
exposure can lead to anomalous behavior inside the containers, including
failure to boot.

The following patch gives each container a private nscd instance. While
Guix's default nscd configuration caches pretty aggressively (for
hostnames, up to 32MB with a 12h TTL), the per-container nscd uses a
smaller cache size of 256kB, which means that the overhead of this change
should be modest even on systems with many containers.

This patch has been lightly tested by verifying the following:

- `make check` and `guix pull`
- successful boot and operation of a system container
- presence of nscd in the container
- correct cache sizes in nscd.conf

Per my employer's guidelines for OSS contributors, this patch contains:

- My corporate email address in the "From" line
- My employer listed as copyright holder (this has already been cleared
with Ludo')

Thanks!

Jason

[-- Attachment #1.2: Type: text/html, Size: 1587 bytes --]

[-- Attachment #2: one-nscd-per-container.patch --]
[-- Type: application/x-patch, Size: 6669 bytes --]