Re: Running IceCat in a container

[ludo@gnu.org (Ludovic Courtès)]

Mike Gerwitz <mtg@gnu.org> skribis:

> On Tue, Jan 16, 2018 at 17:30:42 +0100, Ludovic Courtès wrote:

[...]

>> But really, we should make a specific tool for this.
>>
>> Thoughts?
>
> Yes, though I'd be curious how you'd approach it---each package requires
> certain paths be shared, and those paths would further depend on user
> privacy preferences, so need to be able to be overridden.

For a start, we could simply share everything that’s in:

  guix gc -R $(guix build the-package)

plus /tmp/.X11-unix, maybe $PWD, and a few more.

After that we could add the option to let users define what needs to be
shared (like the ‘file-system-mapping’ API we already have).  We could
have a predefined settings for X11 and console apps to minimize
boilerplate.  And like you write, the settings could be added as package
metadata.

Plash (Mark Seaborn’s POLA shell which used to live at
<http://plash.beasts.org/>) would automatically determine what needs to
be mapped based on the command line.  For instance, if you typed:

  gcc -o foo.o ~/src/bar/foo.c

then it would map ~/src/bar/foo.c as read-only and $(dirname foo.o) as
read-write.

Food for thought!

Ludo’.