From: Giacomo Leidi via Guix-patches via <guix-patches@gnu.org>
To: 67613@debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul@autistici.org>
Subject: [bug#67613] [PATCH v3 2/5] gnu: docker: Allow setting host environment variables in oci-container-configuration.
Date: Sat, 4 May 2024 00:11:14 +0200 [thread overview]
Message-ID: <0136493778f7159c4cdddf460b71f9d9f5094115.1714774277.git.goodoldpaul@autistici.org> (raw)
In-Reply-To: <306393d4c3b28f242fb735d793ef127427f3d072.1714774276.git.goodoldpaul@autistici.org>
* gnu/services/docker.scm (oci-container-configuration)
[host-environment]: New field;
(oci-sanitize-host-environment): sanitize it;
(oci-container-shepherd-service): use it.
* doc/guix.texi: Document it.
Change-Id: I4d54d37736cf09f042a71cb0b6e673abc0948d9c
---
doc/guix.texi | 17 +++++++++++++++++
gnu/services/docker.scm | 31 +++++++++++++++++++++++++++++--
2 files changed, 46 insertions(+), 2 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index 19b7563916..fad0bf8c7c 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -40436,6 +40436,23 @@ Miscellaneous Services
@item @code{entrypoint} (default: @code{""}) (type: string)
Overwrite the default entrypoint (@code{ENTRYPOINT}) of the image.
+@item @code{host-environment} (default: @code{'()}) (type: list)
+Set environment variables in the host environment where @command{docker
+run} is invoked. This is especially useful to pass secrets from the
+host to the container without having them on the @command{docker run}'s
+command line: by setting the @code{MYSQL_PASSWORD} on the host and by passing
+@code{--env MYSQL_PASSWORD} through the @code{extra-arguments} field, it is
+possible to securely set values in the container environment. This field's
+value can be a list of pairs or strings, even mixed:
+
+@lisp
+(list '(\"LANGUAGE\" . \"eo:ca:eu\")
+ \"JAVA_HOME=/opt/java\")
+@end lisp
+
+Pair members can be strings, gexps or file-like objects. Strings are passed
+directly to @code{make-forkexec-constructor}.
+
@item @code{environment} (default: @code{'()}) (type: list)
Set environment variables. This can be a list of pairs or strings, even mixed:
diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm
index 824c4ecbe6..df5884aca1 100644
--- a/gnu/services/docker.scm
+++ b/gnu/services/docker.scm
@@ -5,7 +5,7 @@
;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
;;; Copyright © 2020 Jesse Dowell <jessedowell@gmail.com>
;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
-;;; Copyright © 2023 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2023, 2024 Giacomo Leidi <goodoldpaul@autistici.org>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -285,6 +285,11 @@ (define (oci-sanitize-mixed-list name value delimiter)
name el)))))
value))
+(define (oci-sanitize-host-environment value)
+ ;; Expected spec format:
+ ;; '(("HOME" . "/home/nobody") "JAVA_HOME=/java")
+ (oci-sanitize-mixed-list "host-environment" value "="))
+
(define (oci-sanitize-environment value)
;; Expected spec format:
;; '(("HOME" . "/home/nobody") "JAVA_HOME=/java")
@@ -330,6 +335,24 @@ (define-configuration/no-serialization oci-container-configuration
(entrypoint
(maybe-string)
"Overwrite the default entrypoint (@code{ENTRYPOINT}) of the image.")
+ (host-environment
+ (list '())
+ "Set environment variables in the host environment where @command{docker run}
+is invoked. This is especially useful to pass secrets from the host to the
+container without having them on the @command{docker run}'s command line: by
+setting the @code{MYSQL_PASSWORD} on the host and by passing
+@code{--env MYSQL_PASSWORD} through the @code{extra-arguments} field, it is
+possible to securely set values in the container environment. This field's
+value can be a list of pairs or strings, even mixed:
+
+@lisp
+(list '(\"LANGUAGE\" . \"eo:ca:eu\")
+ \"JAVA_HOME=/opt/java\")
+@end lisp
+
+Pair members can be strings, gexps or file-like objects. Strings are passed
+directly to @code{make-forkexec-constructor}."
+ (sanitizer oci-sanitize-host-environment))
(environment
(list '())
"Set environment variables inside the container. This can be a list of pairs
@@ -450,6 +473,8 @@ (define (oci-container-shepherd-service config)
(let* ((docker-command (file-append docker-cli "/bin/docker"))
(user (oci-container-configuration-user config))
(group (oci-container-configuration-group config))
+ (host-environment
+ (oci-container-configuration-host-environment config))
(command (oci-container-configuration-command config))
(provision (oci-container-configuration-provision config))
(image (oci-container-configuration-image config))
@@ -471,7 +496,9 @@ (define (oci-container-shepherd-service config)
"--name" #$name
#$@options #$@extra-arguments #$image #$@command)
#:user #$user
- #:group #$group))
+ #:group #$group
+ #:environment-variables
+ (list #$@host-environment)))
(stop
#~(lambda _
(invoke #$docker-command "rm" "-f" #$name)))
--
2.41.0
next prev parent reply other threads:[~2024-05-03 22:13 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-03 21:53 [bug#67613] Introduce unit tests for oci-container-service-type paul via Guix-patches via
2023-12-03 21:56 ` [bug#67613] [PATCH] tests: Add oci-container-service-type unit tests Giacomo Leidi via Guix-patches via
2023-12-10 21:47 ` [bug#67613] Introduce unit tests for oci-container-service-type Ludovic Courtès
2023-12-10 22:10 ` paul via Guix-patches via
2023-12-14 18:34 ` Ludovic Courtès
2024-01-11 20:39 ` paul via Guix-patches via
2024-05-03 22:10 ` paul via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 1/5] gnu: docker: Provide escape hatch in oci-container-configuration Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 2/5] gnu: docker: Allow setting host environment variables " Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 3/5] gnu: docker: Allow setting Shepherd dependencies " Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 4/5] gnu: docker: Allow passing tarballs for images " Giacomo Leidi via Guix-patches via
2024-01-11 20:39 ` [bug#67613] [PATCH v2 5/5] gnu: Add tests and documentation for oci-container-service-type Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 1/5] gnu: docker: Provide escape hatch in oci-container-configuration Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` Giacomo Leidi via Guix-patches via [this message]
2024-05-03 22:11 ` [bug#67613] [PATCH v3 3/5] gnu: docker: Allow setting Shepherd dependencies " Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 4/5] gnu: docker: Allow passing tarballs for images " Giacomo Leidi via Guix-patches via
2024-05-03 22:11 ` [bug#67613] [PATCH v3 5/5] gnu: Add tests for oci-container-service-type Giacomo Leidi via Guix-patches via
2024-05-25 13:58 ` bug#67613: Introduce unit " Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0136493778f7159c4cdddf460b71f9d9f5094115.1714774277.git.goodoldpaul@autistici.org \
--to=guix-patches@gnu.org \
--cc=67613@debbugs.gnu.org \
--cc=goodoldpaul@autistici.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.