bug#46782: guix environment --expose options cannot be layered onto $PWD

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Maxim Cournoyer]

Hello Guix!

I noticed, while trying to expose the SSL environment variable inside a
container and doing things such as:

--8<---------------cut here---------------start------------->8---
guix environment --container --network -E SSL --expose=$SSL_CERT_FILE \
     --expose=$SSL_CERT_DIR --ad-hoc [...]
--8<---------------cut here---------------end--------------->8---

that it wasn't possible to expose things onto the implicitly mounted
current working directory.  No error message would be shown, yet the
--expose arguments wouldn't go through unless using --no-cwd.

Here's a minimal example:

--8<---------------cut here---------------start------------->8---
$ guix environment -C --expose=/tmp=$PWD/tmp \
  --ad-hoc bash coreutils -- bash -c 'stat $PWD/tmp'
stat: cannot statx '/var/lib/jenkins/tmp': No such file or directory
--8<---------------cut here---------------end--------------->8---

but,

--8<---------------cut here---------------start------------->8---
$ guix environment --no-cwd -C --expose=/tmp=$PWD/tmp \
  --ad-hoc bash coreutils -- bash -c 'stat $PWD/tmp'
  File: /var/lib/jenkins/tmp
  Size: 73728           Blocks: 152        IO Block: 4096   directory
Device: fd00h/64768d    Inode: 1966081     Links: 397
Access: (1777/drwxrwxrwt)  Uid: (65534/ UNKNOWN)   Gid: (65534/overflow)
Access: 2021-02-25 20:40:08.534757708 +0000
Modify: 2021-02-25 21:10:49.205636074 +0000
Change: 2021-02-25 21:10:49.205636074 +0000
 Birth: 2016-12-07 20:43:16.029221570 +0000
--8<---------------cut here---------------end--------------->8---

succeeds.

I can't think of a technical reason why layering bind mounts wouldn't
work; in fact it already appear to work for multiple --expose options
touching the same hierarchy of files.

If there's a technical reason this cannot/shouldn't happen, we should
warn the user about it.

Thanks,

Maxim

bug#46782:

[bbb ee]

[-- Attachment #1: Type: text/plain, Size: 75 bytes --]

There is a similar issue that is solved: https://issues.guix.gnu.org/59425

[-- Attachment #2: Type: text/html, Size: 144 bytes --]

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Maxim Cournoyer]

Hi,

bbb ee <blasforr@gmail.com> writes:

> There is a similar issue that is solved: https://issues.guix.gnu.org/59425

I can still reproduce the original problem with:

--8<---------------cut here---------------start------------->8---
guix environment -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils \
 -- bash -c 'stat $PWD/tmp'
--8<---------------cut here---------------end--------------->8---

So it seems the issue at hand is unrelated/different.

-- 
Thanks,
Maxim

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Simon Tournier]

Hi Maxim,

A naive question since it works when using the --no-cwd option.

On ven., 27 janv. 2023 at 11:19, Maxim Cournoyer <maxim.cournoyer@gmail.com> wrote:

> --8<---------------cut here---------------start------------->8---
> guix environment -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils \
>  -- bash -c 'stat $PWD/tmp'
> --8<---------------cut here---------------end--------------->8---

Is $PWD referring to the same thing?  Because one is outside and the
other is inside.

Cheers,
simon

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Maxim Cournoyer]

Hi,

Simon Tournier <zimon.toutoune@gmail.com> writes:

> Hi Maxim,
>
> A naive question since it works when using the --no-cwd option.
>
> On ven., 27 janv. 2023 at 11:19, Maxim Cournoyer <maxim.cournoyer@gmail.com> wrote:
>
>> --8<---------------cut here---------------start------------->8---
>> guix environment -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils \
>>  -- bash -c 'stat $PWD/tmp'
>> --8<---------------cut here---------------end--------------->8---
>
> Is $PWD referring to the same thing?  Because one is outside and the
> other is inside.

Yes!  See:

--8<---------------cut here---------------start------------->8---
maxim@hurd ~$ echo $PWD/tmp && guix environment \
 -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils -- bash -c 'echo $PWD/tmp'
/home/maxim/tmp
/home/maxim/tmp
--8<---------------cut here---------------end--------------->8---

-- 
Thanks,
Maxim

bug#46782: guix environment --expose options cannot be layered onto $PWD

[bokr]

Hi,

On +2023-02-06 16:54:20 -0500, Maxim Cournoyer wrote:
> Hi,
> 
> Simon Tournier <zimon.toutoune@gmail.com> writes:
> 
> > Hi Maxim,
> >
> > A naive question since it works when using the --no-cwd option.
> >
> > On ven., 27 janv. 2023 at 11:19, Maxim Cournoyer <maxim.cournoyer@gmail.com> wrote:
> >
> >> --8<---------------cut here---------------start------------->8---
> >> guix environment -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils \
> >>  -- bash -c 'stat $PWD/tmp'
> >> --8<---------------cut here---------------end--------------->8---
> >
> > Is $PWD referring to the same thing?  Because one is outside and the
> > other is inside.
> 
> Yes!  See:
> 
> --8<---------------cut here---------------start------------->8---
> maxim@hurd ~$ echo $PWD/tmp && guix environment \
>  -C --expose=/tmp=$PWD/tmp --ad-hoc bash coreutils -- bash -c 'echo $PWD/tmp'
> /home/maxim/tmp
> /home/maxim/tmp
> --8<---------------cut here---------------end--------------->8---
> 
> -- 
> Thanks,
> Maxim
>

I imagine the created environment is COW[1]
[1] <https://en.wikipedia.org/wiki/Copy-on-write>

Then your output above,
--8<---------------cut here---------------start------------->8---
> /home/maxim/tmp
> /home/maxim/tmp
--8<---------------cut here---------------end--------------->8---
looks the same, but IIUC they have different '/' root dirs, the one
in the container being like an initrd separate file system.

Or is --expose meant to be a shared rw reference to the caller's memory
(directory content or regular file etc) from the start?
That would seem hard to keep safe, so I doubt that's the design.

How do the two tmp's stat? (Before and after writing content
like $PWD/tmp/foo ?

And foo doesn't appear in the caller $PWD/tmp/* right?

What is your use case goal for --expose=/tmp=$PWD/tmp ?

SFTN if this is useless distraction.
--
Regards,
Bengt Richter

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Josselin Poiret via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 460 bytes --]

Hello everyone,

A quick strace shows that it's actually an ordering issue: /home/user is
mounted in the container after /home/user/tmp.  The fix is pretty
simple, moving the cwd first, before the explicit --expose arguments.

I'm noticing that the --expose option creates an empty tmp folder in the
user's home in that case though, which I don't like, however I don't
think there's any better option.  Patch following.

Best,
-- 
Josselin Poiret

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 682 bytes --]

bug#46782: [PATCH] scripts: environment: Mount cwd before user specified --expose.

[Josselin Poiret via Bug reports for GNU Guix]

* guix/scripts/environment.scm (launch-environment/container): Put cwd mapping
at front of the file system mappings.

Fixes: #46782
---
 guix/scripts/environment.scm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/guix/scripts/environment.scm b/guix/scripts/environment.scm
index 46435ae48e..8a1fc3c0ee 100644
--- a/guix/scripts/environment.scm
+++ b/guix/scripts/environment.scm
@@ -767,14 +767,14 @@ (define fhs-mappings
              (append
               (override-user-mappings
                user home
-               (append user-mappings
-                       ;; Share current working directory, unless asked not to.
+               (append ;; Share current working directory, unless asked not to.
                        (if map-cwd?
                            (list (file-system-mapping
                                   (source cwd)
                                   (target cwd)
                                   (writable? #t)))
-                           '())))
+                           '())
+                       user-mappings))
               ;; Mappings for the union closure of all inputs.
               (map (lambda (dir)
                      (file-system-mapping

base-commit: dd724cfad45d76b9dcc5b073876c995715c92a07
-- 
2.39.1

bug#46782: guix environment --expose options cannot be layered onto $PWD

[Maxim Cournoyer]

Hello Josselin,

Josselin Poiret <dev@jpoiret.xyz> writes:

> Hello everyone,
>
> A quick strace shows that it's actually an ordering issue: /home/user is
> mounted in the container after /home/user/tmp.  The fix is pretty
> simple, moving the cwd first, before the explicit --expose arguments.

Thanks for the troubleshooting and patch!  I've now applied it.

> I'm noticing that the --expose option creates an empty tmp folder in the
> user's home in that case though, which I don't like, however I don't
> think there's any better option.  Patch following.

At least it's better to be left with an empty directory than with
mysteriously nothing happening and the use case not working as expected
:-).

-- 
Thanks,
Maxim