From patchwork Fri Apr 19 14:04:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christopher Baines X-Patchwork-Id: 8358 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 4B02616ECD; Fri, 19 Apr 2019 15:09:47 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.0 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTP id 858A616EC9 for ; Fri, 19 Apr 2019 15:09:44 +0100 (BST) Received: from localhost ([127.0.0.1]:57043 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hHUD1-00006O-Kr for patchwork@mira.cbaines.net; Fri, 19 Apr 2019 10:09:43 -0400 Received: from eggs.gnu.org ([209.51.188.92]:56059) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hHU8b-0004ap-Qq for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hHU8Z-0005u1-B8 for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:09 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:59111) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hHU8W-0005nP-R0 for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:05 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hHU8U-0002SG-LN for guix-patches@gnu.org; Fri, 19 Apr 2019 10:05:04 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#34638] [PATCH v2 2/4] linux-container: Add 'start-child-in-container'. Resent-From: Christopher Baines Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 19 Apr 2019 14:05:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 34638 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 34638@debbugs.gnu.org Received: via spool by 34638-submit@debbugs.gnu.org id=B34638.15556826719373 (code B ref 34638); Fri, 19 Apr 2019 14:05:02 +0000 Received: (at 34638) by debbugs.gnu.org; 19 Apr 2019 14:04:31 +0000 Received: from localhost ([127.0.0.1]:44416 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hHU7z-0002R1-D2 for submit@debbugs.gnu.org; Fri, 19 Apr 2019 10:04:31 -0400 Received: from mira.cbaines.net ([212.71.252.8]:48050) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hHU7w-0002QT-TL for 34638@debbugs.gnu.org; Fri, 19 Apr 2019 10:04:29 -0400 Received: from localhost (71.38.6.51.dyn.plus.net [51.6.38.71]) by mira.cbaines.net (Postfix) with ESMTPSA id 8AF7116ED1 for <34638@debbugs.gnu.org>; Fri, 19 Apr 2019 15:04:27 +0100 (BST) Received: from localhost (localhost [local]) by localhost (OpenSMTPD) with ESMTPA id ba0d485d for <34638@debbugs.gnu.org>; Fri, 19 Apr 2019 14:04:27 +0000 (UTC) From: Christopher Baines Date: Fri, 19 Apr 2019 15:04:25 +0100 Message-Id: <20190419140427.15183-2-mail@cbaines.net> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190419140427.15183-1-mail@cbaines.net> References: <20190419140427.15183-1-mail@cbaines.net> MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.51.188.43 X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches This new procedure is similar to open-pipe* in (ice-9 popen), but using run-container from (gnu build linux-container). * gnu/build/linux-container.scm (start-child-in-container): New procedure. --- gnu/build/linux-container.scm | 83 +++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 3d7b52f098..88b00e00f6 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -32,6 +32,7 @@ setgroups-supported? %namespaces run-container + start-child-in-container call-with-container container-excursion container-excursion*)) @@ -213,6 +214,88 @@ corresponds to the symbols in NAMESPACES." ('net CLONE_NEWNET)) namespaces))) +(define* (start-child-in-container command + #:key read? write? + (root 'temporary) + (mounts '()) + (namespaces %namespaces) + (host-uids 1) + (extra-environment-variables '())) + (define (with-root-directory f) + (if (eq? root 'temporary) + (call-with-temporary-directory f) + (f root))) + + (define (make-rw-port read-port write-port) + (make-soft-port + (vector + (lambda (c) (write-char c write-port)) + (lambda (s) (display s write-port)) + (lambda () (force-output write-port)) + (lambda () (read-char read-port)) + (lambda () (close-port read-port) (close-port write-port))) + "r+")) + + ;; car is the inport port, cdr is the output port. You write to the output + ;; port, and read from the input port. + (define child-to-parent-pipe + (if read? + (pipe) + #f)) + + (define parent-to-child-pipe + (if write? + (pipe) + #f)) + + (define (run-program) + (when read? + (match child-to-parent-pipe + ((input-port . output-port) + ;; close the output part of the child-to-parent-pipe, as this is used + ;; by the parent process + (close-port input-port) + + ;; Make the input part of the child-to-parent-pipe the standard + ;; output of this process + (dup2 (fileno output-port) 1)))) + + (when write? + (match parent-to-child-pipe + ((input-port . output-port) + ;; close the input part of the parent-to-child-pipe, as this is used + ;; by the parent processs + (close-port output-port) + + ;; Make the output part of the parent-to-child-pipe the standard + ;; input of this process + (dup2 (fileno input-port) 0)))) + + ;; TODO Maybe close all file descriptors, as start_child in Guile does? + + (for-each putenv extra-environment-variables) + + (apply execlp command)) + + (with-root-directory + (lambda (root) + (let ((pid (run-container root mounts namespaces host-uids run-program))) + ;; Catch SIGINT and kill the container process. + (sigaction SIGINT + (lambda (signum) + (false-if-exception + (kill pid SIGKILL)))) + + (let* ((read-port (and=> child-to-parent-pipe car)) + (write-port (and=> parent-to-child-pipe cdr)) + + (port (or (and read-port write-port + (make-rw-port read-port write-port)) + read-port + write-port))) + + (values port pid)))))) + (define* (run-container root mounts namespaces host-uids thunk #:key (guest-uid 0) (guest-gid 0)) "Run THUNK in a new container process and return its PID. ROOT specifies