Docker image not working

Docker image not working

[Stephen Scheck]

Hello,

I'm trying to use the `guix system` command to create a Docker image as
documented here:


https://guix.gnu.org/manual/en/html_node/Invoking-guix-system.html#Invoking-guix-system

However, the created image does not work:

    $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
/run/current-system/profile/bin/bash --login
    docker: Error response from daemon: OCI runtime create failed:
container_linux.go:348: starting container process caused "exec:
\"/run/current-system/profile/bin/bash\": stat
/run/current-system/profile/bin/bash: no such file or directory": unknown.

This is the command I invoked to create the image:

    guix system init --no-bootloader --skip-checks --system=x86_64-linux
guix-docker.scm /tmp/guix/docker-image

And here is the system configuration I used:

    (use-modules (gnu))
    (use-package-modules admin base bash less linux)

    (operating-system
      (host-name "guix")
      (timezone "UTC")
      (locale "en_US.utf8")

      (bootloader (bootloader-configuration
                    (bootloader grub-bootloader)
                    (target "/dev/null")))
      (file-systems (cons (file-system
                            (device (file-system-label "guix-system-dummy"))
                            (mount-point "/")
                            (type "ext4"))
                          %base-file-systems))

      (packages (append (list bash coreutils-minimal inetutils less procps
which) %base-packages)))

Am I missing something?

Re: Docker image not working

[Stephen Scheck]

> This is the command I invoked to create the image:
>
>    guix system init --no-bootloader --skip-checks --system=x86_64-linux guix-docker.scm /tmp/guix/docker-image
Err, paste mistake, actually this:

    guix system docker-image --no-bootloader --skip-checks --system=x86_64-linux guix-docker.scm

Re: Docker image not working

[zimoun]

Hi,

On Sun, 17 Nov 2019 at 18:17, Stephen Scheck <singularsyntax@gmail.com> wrote:

>     $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
> /run/current-system/profile/bin/bash --login
>     docker: Error response from daemon: OCI runtime create failed:
> container_linux.go:348: starting container process caused "exec:
> \"/run/current-system/profile/bin/bash\": stat
> /run/current-system/profile/bin/bash: no such file or directory": unknown.

Does the command

    docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2 bash

work?


All the best,
simon

Re: Docker image not working

[Stephen Scheck]

No, it does not:

$ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2 bash
docker: Error response from daemon: OCI runtime create failed:
container_linux.go:348: starting container process caused "exec: \"bash\":
executable file not found in $PATH": unknown.

It seems like some things which get set up when creating a regular system
via `guix system` do not when specifying output as a Docker image.
Unfortunately, the documentation doesn't explain much about how the system
profile works, and I'm not knowledgeable enough about Guix to make an
informed guess.

On Wed, Nov 27, 2019 at 9:39 AM zimoun <zimon.toutoune@gmail.com> wrote:

> Hi,
>
> On Sun, 17 Nov 2019 at 18:17, Stephen Scheck <singularsyntax@gmail.com>
> wrote:
>
> >     $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
> > /run/current-system/profile/bin/bash --login
> >     docker: Error response from daemon: OCI runtime create failed:
> > container_linux.go:348: starting container process caused "exec:
> > \"/run/current-system/profile/bin/bash\": stat
> > /run/current-system/profile/bin/bash: no such file or directory":
> unknown.
>
> Does the command
>
>     docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2 bash
>
> work?
>
>
> All the best,
> simon
>

Re: Docker image not working

[Stephen Scheck]

BTW, I saw your comments in the Docker/Guix relationship thread about using
`guix pack` as an alternative means to produce a Docker image. I tried this
also, but I had a few issues:

1) You have to pass it `-S /bin=bin -S /sbin=sbin` flags so that command
binaries can be conveniently located. This is not really an issue, but I
think it does "lock" the resulting image to a particular snapshot of
command binaries, which might be precisely what you want for an immutable
container for a production application. But for other use cases, for
example, for throw-away containers for development and testing, you might
want the capability of being able to upgrade packages, and it's not clear
to me if it's just as simple as replacing the symlinks to the `bin` and
`sbin` directories of a new profile. And also, I guess `guix environment`
addresses that use case.

2) In order to get a lot of basic functionality working, I had to install a
Guix System into a VM from the distribution ISO, then copy various bits of
its `/etc` (protocols, services, nsswitch.conf, pam.d, etc.) tree into an
image to get network diagnostics (ping, etc.) and user management commands,
among others, working. It seems like leveraging the `guix system`
infrastructure to build a working, reproducible, and standard `/etc` tree
is the way to go, but as already noted I'm not having any luck with the
Docker images it produces.

On Wed, Nov 27, 2019 at 11:40 PM Stephen Scheck <singularsyntax@gmail.com>
wrote:

> No, it does not:
>
> $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2 bash
> docker: Error response from daemon: OCI runtime create failed:
> container_linux.go:348: starting container process caused "exec: \"bash\":
> executable file not found in $PATH": unknown.
>
> It seems like some things which get set up when creating a regular system
> via `guix system` do not when specifying output as a Docker image.
> Unfortunately, the documentation doesn't explain much about how the system
> profile works, and I'm not knowledgeable enough about Guix to make an
> informed guess.
>
> On Wed, Nov 27, 2019 at 9:39 AM zimoun <zimon.toutoune@gmail.com> wrote:
>
>> Hi,
>>
>> On Sun, 17 Nov 2019 at 18:17, Stephen Scheck <singularsyntax@gmail.com>
>> wrote:
>>
>> >     $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
>> > /run/current-system/profile/bin/bash --login
>> >     docker: Error response from daemon: OCI runtime create failed:
>> > container_linux.go:348: starting container process caused "exec:
>> > \"/run/current-system/profile/bin/bash\": stat
>> > /run/current-system/profile/bin/bash: no such file or directory":
>> unknown.
>>
>> Does the command
>>
>>     docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2 bash
>>
>> work?
>>
>>
>> All the best,
>> simon
>>
>

Re: Docker image not working

[Maxim Cournoyer]

Hello Stephen,

Stephen Scheck <singularsyntax@gmail.com> writes:

> Hello,
>
> I'm trying to use the `guix system` command to create a Docker image as
> documented here:
>
>
> https://guix.gnu.org/manual/en/html_node/Invoking-guix-system.html#Invoking-guix-system
>
> However, the created image does not work:
>
>     $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
> /run/current-system/profile/bin/bash --login
>     docker: Error response from daemon: OCI runtime create failed:
> container_linux.go:348: starting container process caused "exec:
> \"/run/current-system/profile/bin/bash\": stat
> /run/current-system/profile/bin/bash: no such file or directory": unknown.
>
> This is the command I invoked to create the image:
>
>     guix system init --no-bootloader --skip-checks --system=x86_64-linux
> guix-docker.scm /tmp/guix/docker-image
>
> And here is the system configuration I used:
>
>     (use-modules (gnu))
>     (use-package-modules admin base bash less linux)
>
>     (operating-system
>       (host-name "guix")
>       (timezone "UTC")
>       (locale "en_US.utf8")
>
>       (bootloader (bootloader-configuration
>                     (bootloader grub-bootloader)
>                     (target "/dev/null")))
>       (file-systems (cons (file-system
>                             (device (file-system-label "guix-system-dummy"))
>                             (mount-point "/")
>                             (type "ext4"))
>                           %base-file-systems))
>
>       (packages (append (list bash coreutils-minimal inetutils less procps
> which) %base-packages)))
>
> Am I missing something?

Yes!  The /run/current-system/profile/bin/bash symlink you are trying to
invoke is setup by one of the Shepherd services when the Guix system is
initialized.  Here the system hasn't booted up yet.  Currently the
system is initialized as part of the default entry point produced by
Guix, but such initialization only spawns Shepherd as PID 1 and leaves
you with a useless, non-interactive session that is not useful when
simply running 'docker run -it $your-image'.

The only useful way to use a docker-image currently is to "start" the
container, using

docker start $container_id

And then attaching to it with docker exec

docker exec -ti $container_id /run/current-system/profile/bin/bash
--login

This is explained in the documentation.

I don't find this really convenient, and intend to modify the default
entry point at some point to allow running commands directly from
'docker run', but currently it is the way it works.

What I can recommend for very simple use cases (starting a script, bash,
etc), is to use 'docker pack -f docker' instead to produce the Docker
image.

This command allows you to produce symlinks in the generated image, for
example:

--8<---------------cut here---------------start------------->8---
guix pack --manifest=your-manifest.scm \
    		   -f docker \
	           -S /etc/profile=etc/profile \
		   -S /bin=bin
--8<---------------cut here---------------end--------------->8---

Will set the /etc/profile, /bin and /sbin links in the target to that of
the profile generated from your-manifest.scm.

You could then override the default entry point of the docker image with
a command such as:

docker run -it $your_image /bin/bash --login

This bash session should source /etc/profile and make all of your
manifest installed software available to experiment with.

HTH!

Maxim

Re: Docker image not working

[Stephen Scheck]

I don't think the docs are quite up to date, or perhaps refer to an older
version of Docker. If I do:

    $ docker create system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
    Error response from daemon: No command specified

Looks like `docker create` wants the entry point, hence why I tried to use
`docker run` to fire up the container ... so what should it be to kick off
the Shepherd service you referred to?

Thanks.

On Thu, Nov 28, 2019 at 11:09 AM Maxim Cournoyer <maxim.cournoyer@gmail.com>
wrote:

> Hello Stephen,
>
> Stephen Scheck <singularsyntax@gmail.com> writes:
>
> > Hello,
> >
> > I'm trying to use the `guix system` command to create a Docker image as
> > documented here:
> >
> >
> >
> https://guix.gnu.org/manual/en/html_node/Invoking-guix-system.html#Invoking-guix-system
> >
> > However, the created image does not work:
> >
> >     $ docker run -it system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
> > /run/current-system/profile/bin/bash --login
> >     docker: Error response from daemon: OCI runtime create failed:
> > container_linux.go:348: starting container process caused "exec:
> > \"/run/current-system/profile/bin/bash\": stat
> > /run/current-system/profile/bin/bash: no such file or directory":
> unknown.
> >
> > This is the command I invoked to create the image:
> >
> >     guix system init --no-bootloader --skip-checks --system=x86_64-linux
> > guix-docker.scm /tmp/guix/docker-image
> >
> > And here is the system configuration I used:
> >
> >     (use-modules (gnu))
> >     (use-package-modules admin base bash less linux)
> >
> >     (operating-system
> >       (host-name "guix")
> >       (timezone "UTC")
> >       (locale "en_US.utf8")
> >
> >       (bootloader (bootloader-configuration
> >                     (bootloader grub-bootloader)
> >                     (target "/dev/null")))
> >       (file-systems (cons (file-system
> >                             (device (file-system-label
> "guix-system-dummy"))
> >                             (mount-point "/")
> >                             (type "ext4"))
> >                           %base-file-systems))
> >
> >       (packages (append (list bash coreutils-minimal inetutils less
> procps
> > which) %base-packages)))
> >
> > Am I missing something?
>
> Yes!  The /run/current-system/profile/bin/bash symlink you are trying to
> invoke is setup by one of the Shepherd services when the Guix system is
> initialized.  Here the system hasn't booted up yet.  Currently the
> system is initialized as part of the default entry point produced by
> Guix, but such initialization only spawns Shepherd as PID 1 and leaves
> you with a useless, non-interactive session that is not useful when
> simply running 'docker run -it $your-image'.
>
> The only useful way to use a docker-image currently is to "start" the
> container, using
>
> docker start $container_id
>
> And then attaching to it with docker exec
>
> docker exec -ti $container_id /run/current-system/profile/bin/bash
> --login
>
> This is explained in the documentation.
>
> I don't find this really convenient, and intend to modify the default
> entry point at some point to allow running commands directly from
> 'docker run', but currently it is the way it works.
>
> What I can recommend for very simple use cases (starting a script, bash,
> etc), is to use 'docker pack -f docker' instead to produce the Docker
> image.
>
> This command allows you to produce symlinks in the generated image, for
> example:
>
> --8<---------------cut here---------------start------------->8---
> guix pack --manifest=your-manifest.scm \
>                    -f docker \
>                    -S /etc/profile=etc/profile \
>                    -S /bin=bin
> --8<---------------cut here---------------end--------------->8---
>
> Will set the /etc/profile, /bin and /sbin links in the target to that of
> the profile generated from your-manifest.scm.
>
> You could then override the default entry point of the docker image with
> a command such as:
>
> docker run -it $your_image /bin/bash --login
>
> This bash session should source /etc/profile and make all of your
> manifest installed software available to experiment with.
>
> HTH!
>
> Maxim
>

Re: Docker image not working

[Maxim Cournoyer]

Hello Stephen,

Stephen Scheck <singularsyntax@gmail.com> writes:

> I don't think the docs are quite up to date, or perhaps refer to an older
> version of Docker. If I do:
>
>     $ docker create system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
>     Error response from daemon: No command specified
>
> Looks like `docker create` wants the entry point, hence why I tried to use
> `docker run` to fire up the container ... so what should it be to kick off
> the Shepherd service you referred to?
>
> Thanks.

The documentation works for me, with a minor hiccup: the docker load
doesn't return *just* the image ID: the first two words must be cut out
(by piping it to awk '{ print $3 }' for example).

--8<---------------cut here---------------start------------->8---
guix system docker-image some-system-with-python.scm
[...]
/gnu/store/5ddyv2m6kfjhm0fc3v181ahs35hkf6j6-guix-docker-image.tar.gz

image_id=`docker load < /gnu/store/5ddyv2m6kfjhm0fc3v181ahs35hkf6j6-guix-docker-image.tar.gz`
$ echo $image_id
Loaded image: guix:latest
$ container_id=`docker create $image_id`
invalid reference format: repository name must be lowercase
$ image_id="guix:latest"
$ container_id=`docker create $image_id`
$ echo $container_id
9eabc3cae4bba25848c7f1ced15086232a5b19a2e5d775374e842855890d51f3
$ docker start $container_id
9eabc3cae4bba25848c7f1ced15086232a5b19a2e5d775374e842855890d51f3
$ docker exec -ti $container_id /run/current-system/profile/bin/bash --login
root@9eabc3cae4bb /# which python
which python
/run/current-system/profile/bin/python
root@9eabc3cae4bb /# python --version
python --version
Python 3.7.4
--8<---------------cut here---------------end--------------->8---

I also tested with your operating system declaration and it also worked:

--8<---------------cut here---------------start------------->8---
docker load < /gnu/store/49cgpsq6978j7f9l7fk3pw8f1dldlyv3-guix-docker-image.tar.gz
c2cd1fc572fa: Loading layer [==================================================>]    631MB/631MB
The image guix:latest already exists, renaming the old one with ID sha256:fb0dc0872f71e5051f316b36f1f12ef71a7eb88a77b16fbf86fff66258cce885 to empty string
Loaded image: guix:latest
$ ~/src/guix-master [env]$ docker create guix:latest
25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
$ docker start 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
$ docker exec -ti 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6  /run/current-system/profile/bin/bash --login
root@25c6b88a5782 /#
--8<---------------cut here---------------end--------------->8---

Sorry, I'm not sure what is wrong on your side.  I've seen this error
before but can't remember what the solution was :-/.  Perhaps something
doesn't work right with your Docker daemon?

HTH,

Maxim

Re: Docker image not working

[Stephen Scheck]

I think the problem is that I was using an outdated version of `guix`. I
did a `guix pull` on my Guix system, the re-ran the command to build the
Docker image, and it works now.

One thing I noticed is that I have to pass the `--privileged` flag, or
subsequent invocations of `guix pull` fail with some error about failure to
clone the process:

    $ docker run -it --privileged --tty guix:latest
    making '/gnu/store/dn2247g52nv2vc3y578fm2ksrh8s00hn-system' the current
system...
    setting up setuid programs in '/run/setuid-programs'...
    populating /etc from /gnu/store/c3z6qji00a216xrjrf10sd3vr97ajr60-etc...
    error in finalization thread: Success
    error in finalization thread: Bad file descriptor
    error in finalization thread: Bad file descriptor
    error in finalization thread: Bad file descriptor

I'm not sure why the finalization errors are reported, but they don't seem
to cause problems. I can then do e.g.

    $ docker exec -it <container-id> /run/current-system/profile/bin/bash
--login
    root@guix /#

Thanks for your help!

On Thu, Nov 28, 2019 at 8:35 PM Maxim Cournoyer <maxim.cournoyer@gmail.com>
wrote:

> Hello Stephen,
>
> Stephen Scheck <singularsyntax@gmail.com> writes:
>
> > I don't think the docs are quite up to date, or perhaps refer to an older
> > version of Docker. If I do:
> >
> >     $ docker create system:0qjxd5ljsh316ki7wqkk2xz9b68lynh2
> >     Error response from daemon: No command specified
> >
> > Looks like `docker create` wants the entry point, hence why I tried to
> use
> > `docker run` to fire up the container ... so what should it be to kick
> off
> > the Shepherd service you referred to?
> >
> > Thanks.
>
> The documentation works for me, with a minor hiccup: the docker load
> doesn't return *just* the image ID: the first two words must be cut out
> (by piping it to awk '{ print $3 }' for example).
>
> --8<---------------cut here---------------start------------->8---
> guix system docker-image some-system-with-python.scm
> [...]
> /gnu/store/5ddyv2m6kfjhm0fc3v181ahs35hkf6j6-guix-docker-image.tar.gz
>
> image_id=`docker load <
> /gnu/store/5ddyv2m6kfjhm0fc3v181ahs35hkf6j6-guix-docker-image.tar.gz`
> $ echo $image_id
> Loaded image: guix:latest
> $ container_id=`docker create $image_id`
> invalid reference format: repository name must be lowercase
> $ image_id="guix:latest"
> $ container_id=`docker create $image_id`
> $ echo $container_id
> 9eabc3cae4bba25848c7f1ced15086232a5b19a2e5d775374e842855890d51f3
> $ docker start $container_id
> 9eabc3cae4bba25848c7f1ced15086232a5b19a2e5d775374e842855890d51f3
> $ docker exec -ti $container_id /run/current-system/profile/bin/bash
> --login
> root@9eabc3cae4bb /# which python
> which python
> /run/current-system/profile/bin/python
> root@9eabc3cae4bb /# python --version
> python --version
> Python 3.7.4
> --8<---------------cut here---------------end--------------->8---
>
> I also tested with your operating system declaration and it also worked:
>
> --8<---------------cut here---------------start------------->8---
> docker load <
> /gnu/store/49cgpsq6978j7f9l7fk3pw8f1dldlyv3-guix-docker-image.tar.gz
> c2cd1fc572fa: Loading layer
> [==================================================>]    631MB/631MB
> The image guix:latest already exists, renaming the old one with ID
> sha256:fb0dc0872f71e5051f316b36f1f12ef71a7eb88a77b16fbf86fff66258cce885 to
> empty string
> Loaded image: guix:latest
> $ ~/src/guix-master [env]$ docker create guix:latest
> 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
> $ docker start
> 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
> 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
> $ docker exec -ti
> 25c6b88a578270aec4bd20f7050f591b9f971397f77282ae826fe6f488b125c6
> /run/current-system/profile/bin/bash --login
> root@25c6b88a5782 /#
> --8<---------------cut here---------------end--------------->8---
>
> Sorry, I'm not sure what is wrong on your side.  I've seen this error
> before but can't remember what the solution was :-/.  Perhaps something
> doesn't work right with your Docker daemon?
>
> HTH,
>
> Maxim
>