OCI containers

OCI containers

[Aleksej via]

Hi,

I’m currently trying to migrate my server to the Guix System, but I’m encountering some issues with OCI containers. Is there a way to run them as a Shepherd service while using Podman and nftables? I know about the oci-container-service-type, but it depends on Docker and iptables, both of which I dislike due to their design. Perhaps the oci-container-service-type could be abstracted from its backend so that it supports both rootless Podman and Docker?

Also, why does the rootless-podman-service-type depend on iptables? Our netavark version has complete nftables support, so maybe we could add an option to choose between iptables and nftables?

I’m willing to write the necessary code if required, but I’d like to hear some advice first.

Best regards,
Lesik Edelweiss

Re: OCI containers

[paul via]

Hi Lesik,

On 12/20/24 00:14, Aleksej via wrote:
> I’m currently trying to migrate my server to the Guix System, but I’m encountering some issues with OCI containers. Is there a way to run them as a Shepherd service while using Podman and nftables? I know about the oci-container-service-type, but it depends on Docker and iptables, both of which I dislike due to their design. Perhaps the oci-container-service-type could be abstracted from its backend so that it supports both rootless Podman and Docker?
It definitely can :) I'm working on an oci-service-type over at gocix 
[0], which will deprecate the oci-container-service-type. It is 
introducing a configurable OCI runtime supporting rootless Podman and 
Docker, and the ability to provision networks and volumes. It still 
isn't well tested as I was waiting for rootless Podman to get into Guix 
mainline before focusing on it. Hopefully during the end of the year 
break I'll be able to test it better and send it upstream. You are 
welcome to try it [1] and open issues if you find problems. It is not 
yet very well documented but you can find API documentation here [2].
> Also, why does the rootless-podman-service-type depend on iptables? Our netavark version has complete nftables support, so maybe we could add an option to choose between iptables and nftables?
There is no specific reason besides being the easiest way I was able to 
find to get Podman up and running. If you could make the firewall 
backend configurable it would be awesome imho.


hope this helps,

giacomo


[0]: 
https://github.com/fishinthecalculator/gocix/blob/main/modules/oci/services/containers.scm#L768
[1]: 
https://github.com/fishinthecalculator/gocix?tab=readme-ov-file#configure
[2]: https://github.com/fishinthecalculator/gocix/tree/main/doc#OCI-Service