Re: Is anyone using `guix system container` in production?

[conjaroy <conjaroy@gmail.com>]

Hi Efraim, thanks for sharing your experience. Was your change in order to
adopt more Guix-centric tools, or to address specific bugs/limitations of
systemd in the initial approach?

Jason


On Sun, Aug 2, 2020 at 4:35 AM Efraim Flashner <efraim@flashner.co.il>
wrote:

> We've switched from using systemd to manage guix containers and services
> to using systemd user services to launch an instance of shepherd which
> manages guix containers and services, with some custom sudo rules. As
> far as using systemd and guix containers, here's one config that I still
> have around¹
>
> Our upgrade scheme was to run 'guix pull' about weekly and then restart
> the container. Assuming it didn't break we'd let it ride. If it did
> break then we'd have 'guix pull --roll-back' to roll-back and wait it
> out or fix it.
>
> On Wed, Jul 29, 2020 at 06:17:44PM -0400, conjaroy wrote:
> > I'm interested in deploying several system containers to a single cloud
> > VPS, and I had originally planned to build those via `guix system
> > docker-image`. Although Docker has some nice CLI tools for
> > starting/stopping/listing active containers, it occurs to me that an
> > alternative (`guix system container`) has at least one significant
> > advantage: containers come online in seconds, as opposed to the minutes
> it
> > takes to build and import a Docker image (or tens of minutes, if the
> build
> > host is a VM without /dev/kvm.) It might also be the case that using
> > /gnu/store for all containers is more disk-space-efficient than creating
> > self-contained Docker images for each one.
> >
> > So I was wondering if anyone has experience running long-lived containers
> > built via `guix system container` in a production setting. Since I'm
> > running Guix on a foreign distro (Debian 10), it seems reasonable to
> build
> > a systemd service around the container script, but there may be pitfalls
> I
> > haven't considered:
> >
> > # build container script and register it as a gc root with a well-known
> > name.
> > guix build --root=/home/guix/my-awesome-container $(guix system container
> > -d my-awesome-container.scm)
> >
> > cat << EOF > /etc/systemd/system/my-awesome-container.service
> > [Unit]
> > Description=My Awesome Container
> >
> > [Service]
> > ExecStart=/home/guix/my-awesome-container
> > TimeoutStopSec=30
> > StandardOutput=syslog
> > StandardError=syslog
> >
> > [Install]
> > WantedBy=multi-user.target
> > EOF
>
> ¹
> http://git.genenetwork.org/guix-bioinformatics/guix-bioinformatics/src/branch/master/gn/services/bnw.service
>
>
> --
> Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
> GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
> Confidentiality cannot be guaranteed on emails sent or received unencrypted
>