From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Update on GuixSD containers Date: Sat, 13 Jun 2015 22:19:05 +0200 Message-ID: <87381vbbuu.fsf@gnu.org> References: <87bngok1vt.fsf@gnu.org> <87381xklk6.fsf@gnu.org> <877fr7dah1.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:46335) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z3rtg-0000MC-Fk for guix-devel@gnu.org; Sat, 13 Jun 2015 16:19:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z3rtU-00056Q-5P for guix-devel@gnu.org; Sat, 13 Jun 2015 16:19:20 -0400 In-Reply-To: (David Thompson's message of "Sat, 13 Jun 2015 09:14:20 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: "Thompson, David" Cc: guix-devel "Thompson, David" skribis: > On Sat, Jun 13, 2015 at 9:06 AM, Ludovic Court=C3=A8s wrot= e: >> "Thompson, David" skribis: >> >>> On Fri, Jun 12, 2015 at 11:12 AM, Ludovic Court=C3=A8s w= rote: >>>> "Thompson, David" skribis: >>>> >>>>> Yeah, our daemon would do the same thing. We could maybe even have a >>>>> little Guile library that allows one to evaluate arbitrary scheme code >>>>> from within the container. :) >>>> >>>> Actually, something quite easily feasible would be this: >>>> >>>> (eval-in-container #~(system* #$evil-program >>>> #$(local-file "important-data.txt")) >>>> #:networking? #f) >>>> >>>> ... where the container=E2=80=99s store would be populated with just >>>> EVIL-PROGRAM and the local file. >>>> >>>> Food for thought... >>> >>> Ooooh yeah! That would be cool. Though I think we should still spawn >>> a dmd process as PID 1 to deal with reaping zombie processes. We >>> could generate a single service that runs the gexp script. How does >>> that sound? >> >> Wouldn=E2=80=99t it be enough to have the Guile process that evaluates t= he >> expression be PID 1 in the container, as is the case in guix-daemon >> containers? > > Sure, it would work, but my concern is that a long-running process on > a user's machine could create and orphan tons of child processes and > nothing would be able to clean them up until the PID namespace is > garbage collected. My understanding was that killing a container=E2=80=99s PID 1 (from the out= side) effectively killed all the processes of that PID name space. Isn=E2=80=99t= it the case? (The daemon works around that by running processes under a separate UID and doing kill(-1, SIGKILL) under that UID.) Ludo=E2=80=99.