diff mbox series

[bug#41041] doc: Add container example to run a web browser.

Message ID 20200503081258.21873-1-mail@ambrevar.xyz
State Accepted
Headers show
Series [bug#41041] doc: Add container example to run a web browser. | expand

Checks

Context Check Description
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job

Commit Message

Pierre Neidhardt May 3, 2020, 8:12 a.m. UTC 
* doc/guix.texi (Invoking `guix environment'): Add paragraph and example to
  run Eolie in a guix environment container.  Add `container' cindex for the
  first container example, and the `certificates' cindex for the web browser
  example.
---
 doc/guix.texi | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

Comments

Ludovic Courtès May 7, 2020, 7:42 a.m. UTC | #1 
Hi,

Pierre Neidhardt <mail@ambrevar.xyz> skribis:

> * doc/guix.texi (Invoking `guix environment'): Add paragraph and example to
>   run Eolie in a guix environment container.  Add `container' cindex for the
>   first container example, and the `certificates' cindex for the web browser
>   example.

Good idea!

> +@example
> +guix environment --container --network --expose=/etc/machine-id \
> +  --expose=/etc/ssl/certs/ \
> +  --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
> +  --ad-hoc eolie coreutils nss-certs dbus -- \
> +  env DISPLAY=$DISPLAY eolie

Instead of ‘env’, you can preserve the ‘DISPLAY’ variable with:

  guix environment -E ^DISPLAY$ …

which in turn allows you to remove ‘coreutils’, maybe.

Otherwise LGTM!

Thanks,
Ludo’.
Pierre Neidhardt May 7, 2020, 7:47 a.m. UTC | #2 
Ludovic Courtès <ludo@gnu.org> writes:

> Instead of ‘env’, you can preserve the ‘DISPLAY’ variable with:
>
>   guix environment -E ^DISPLAY$ …
>
> which in turn allows you to remove ‘coreutils’, maybe.

Good tip, thanks!  It's strange that I've seen this "coreutils + env"
trick so many times around.  I guess we really lacked examples like this
one :)
Caleb Ristvedt May 7, 2020, 8:02 a.m. UTC | #3 
Pierre Neidhardt <mail@ambrevar.xyz> writes:

> +share some files and directories; we include @code{nss-certs} and expose
> +@file{/etc/sll/certs/} for HTTPS authentication; finally we use

Typo: sll --> ssl

- reepca
Pierre Neidhardt May 7, 2020, 8:05 a.m. UTC | #4 
Merged with 60131df02b521235a311031f9410f530ded60f33.
Pierre Neidhardt May 7, 2020, 8:38 a.m. UTC | #5 
Good catch!  I've just fixed it.
diff mbox series

Patch

diff --git a/doc/guix.texi b/doc/guix.texi
index d5d8662937..3c31386036 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -4786,6 +4786,7 @@  additionally includes Git and strace:
 guix environment --pure guix --ad-hoc git strace
 @end example
 
+@cindex container
 Sometimes it is desirable to isolate the environment as much as
 possible, for maximal purity and reproducibility.  In particular, when
 using Guix on a host distro that is not Guix System, it is desirable to
@@ -4802,6 +4803,23 @@  guix environment --ad-hoc --container guile -- guile
 The @code{--container} option requires Linux-libre 3.19 or newer.
 @end quotation
 
+@cindex certificates
+Another typical use case for containers is to run security-sensitive
+applications such as a web browser.  To run Eolie, we must expose and
+share some files and directories; we include @code{nss-certs} and expose
+@file{/etc/sll/certs/} for HTTPS authentication; finally we use
+@code{env} from the @code{coreutils} package to set the @code{DISPLAY}
+environment variable since containerized graphical applications won't
+display without it.
+
+@example
+guix environment --container --network --expose=/etc/machine-id \
+  --expose=/etc/ssl/certs/ \
+  --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
+  --ad-hoc eolie coreutils nss-certs dbus -- \
+  env DISPLAY=$DISPLAY eolie
+@end example
+
 The available options are summarized below.
 
 @table @code