From patchwork Fri Sep 22 20:34:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Giacomo Leidi X-Patchwork-Id: 54165 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id E74E327BBE9; Fri, 22 Sep 2023 21:35:00 +0100 (BST) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 12EAF27BBE2 for ; Fri, 22 Sep 2023 21:34:59 +0100 (BST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qjmrU-0000NW-Ud; Fri, 22 Sep 2023 16:34:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qjmrT-0000NK-8G for guix-patches@gnu.org; Fri, 22 Sep 2023 16:34:51 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qjmrT-0000sY-09 for guix-patches@gnu.org; Fri, 22 Sep 2023 16:34:51 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qjmrd-0003lN-O7 for guix-patches@gnu.org; Fri, 22 Sep 2023 16:35:01 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#66160] [PATCH] gnu: Add oci-container-service-type. References: <650a02e2-9425-a7fd-2014-7cf6e17ee65b@autistici.org> In-Reply-To: <650a02e2-9425-a7fd-2014-7cf6e17ee65b@autistici.org> Resent-From: Giacomo Leidi Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 22 Sep 2023 20:35:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 66160 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 66160@debbugs.gnu.org Cc: Giacomo Leidi Received: via spool by 66160-submit@debbugs.gnu.org id=B66160.169541489814451 (code B ref 66160); Fri, 22 Sep 2023 20:35:01 +0000 Received: (at 66160) by debbugs.gnu.org; 22 Sep 2023 20:34:58 +0000 Received: from localhost ([127.0.0.1]:37337 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qjmra-0003l0-4N for submit@debbugs.gnu.org; Fri, 22 Sep 2023 16:34:58 -0400 Received: from confino.investici.org ([2a11:7980:1::2:0]:49101) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qjmrY-0003km-80 for 66160@debbugs.gnu.org; Fri, 22 Sep 2023 16:34:57 -0400 Received: from mx1.investici.org (unknown [127.0.0.1]) by confino.investici.org (Postfix) with ESMTP id 4RskXL4fZFz1156; Fri, 22 Sep 2023 20:34:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autistici.org; s=stigmate; t=1695414882; bh=iNxdaarAFZ1CX0zSLFf6y9lgrZmbI9qrkto+84vyJ2Q=; h=From:To:Cc:Subject:Date:From; b=YulRJSMEhI4x7ZxjW3e5XTpybIBZAztmS2FxFDqOPnzKuEoK1bcjHpM49cg2hwI0m dUU0Ygye10qVPo3DK3XsyBFuFBW8Jg6I09sCxu/y+QieSLnqqKnmRE9TwUEbNQ8pfl bMbu4Qp5FI+Sq9hfy94f7myE40D8sCBe25IehlS8= Received: from [93.190.126.19] (mx1.investici.org [93.190.126.19]) (Authenticated sender: goodoldpaul@autistici.org) by localhost (Postfix) with ESMTPSA id 4RskXL2vtKz114y; Fri, 22 Sep 2023 20:34:42 +0000 (UTC) Date: Fri, 22 Sep 2023 22:34:21 +0200 Message-ID: <3b982aed1fa51f7b9e4bd87294b006f1977d26aa.1695414861.git.goodoldpaul@autistici.org> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: Giacomo Leidi X-ACL-Warn: , Giacomo Leidi via Guix-patches X-Patchwork-Original-From: Giacomo Leidi via Guix-patches via From: Giacomo Leidi Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches * gnu/services/docker.scm (oci-container-configuration): New variable; (oci-container-shepherd-service): new variable; (oci-container-service-type): new variable. * doc/guix.texi: Document it. --- doc/guix.texi | 78 +++++++++++++++++++ gnu/services/docker.scm | 163 +++++++++++++++++++++++++++++++++++++++- 2 files changed, 240 insertions(+), 1 deletion(-) base-commit: f45c0c82289d409b4fac00464ea8b323839ba53f diff --git a/doc/guix.texi b/doc/guix.texi index 617b8463e3..988ab64773 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -39349,6 +39349,84 @@ Miscellaneous Services @command{singularity run} and similar commands. @end defvar +@cindex OCI-backed, Shepherd services +@subsubheading OCI backed services + +Should you wish to manage your Docker containers with the same consistent +interface you use for your other Shepherd services, +@var{oci-container-service-type} is the tool to use. + +@defvar oci-container-service-type + +This is a thin wrapper around Docker's CLI that wraps OCI images backed +processes as Shepherd Services. + +@lisp +(simple-service 'oci-grafana-service + (list + (oci-container-configuration + (image "prom/prometheus") + (network "host") + (ports + '(("9000" . "9000") + ("9090" . "9090")))))) + (oci-container-configuration + (image "grafana/grafana:10.0.1") + (network "host") + (volumes + '("/var/lib/grafana:/var/lib/grafana")))))) +@end lisp + +@end defvar + +@deftp {Data Type} oci-container-configuration +Available @code{oci-container-configuration} fields are: + +@table @asis +@item @code{command} (default: @code{()}) (type: list-of-strings) +Overwrite the default CMD of the image. + +@item @code{entrypoint} (default: @code{""}) (type: string) +Overwrite the default ENTRYPOINT of the image. + +@item @code{environment} (default: @code{()}) (type: list) +Set environment variables. This can be a list of pairs or strings, even mixed: + +@lisp +(list '("LANGUAGE" . "eo:ca:eu") + "JAVA_HOME=/opt/java") +@end lisp + +@item @code{image} (type: string) +The image used to build the container. + +@item @code{name} (default: @code{""}) (type: string) +Set a name for the spawned container. + +@item @code{network} (default: @code{""}) (type: string) +Set a Docker network for the spawned container. + +@item @code{ports} (default: @code{()}) (type: list) +Set the port or port ranges to expose from the spawned container. This can be a +list of pairs or strings, even mixed: + +@lisp +(list '("8080" . "80") + "10443:443") +@end lisp + +@item @code{volumes} (default: @code{()}) (type: list) +Set volume mappings for the spawned container. This can be a +list of pairs or strings, even mixed: + +@lisp +(list '("/root/data/grafana" . "/var/lib/grafana") + "/gnu/store:/gnu/store") +@end lisp + +@end table +@end deftp + @cindex Audit @subsubheading Auditd Service diff --git a/gnu/services/docker.scm b/gnu/services/docker.scm index c2023d618c..8a4fa2107e 100644 --- a/gnu/services/docker.scm +++ b/gnu/services/docker.scm @@ -5,6 +5,7 @@ ;;; Copyright © 2020 Efraim Flashner ;;; Copyright © 2020 Jesse Dowell ;;; Copyright © 2021 Brice Waegeneire +;;; Copyright © 2023 Giacomo Leidi ;;; ;;; This file is part of GNU Guix. ;;; @@ -34,10 +35,25 @@ (define-module (gnu services docker) #:use-module (guix records) #:use-module (guix gexp) #:use-module (guix packages) + #:use-module (srfi srfi-1) + #:use-module (ice-9 format) #:export (docker-configuration docker-service-type - singularity-service-type)) + singularity-service-type + oci-container-configuration + oci-container-configuration? + oci-container-configuration-fields + oci-container-configuration-command + oci-container-configuration-entrypoint + oci-container-configuration-environment + oci-container-configuration-image + oci-container-configuration-name + oci-container-configuration-network + oci-container-configuration-ports + oci-container-configuration-volumes + oci-container-service-type + oci-container-shepherd-service)) (define-configuration docker-configuration (docker @@ -216,3 +232,148 @@ (define singularity-service-type (service-extension activation-service-type (const %singularity-activation)))) (default-value singularity))) + + +;;; +;;; OCI container. +;;; + +(define (oci-sanitize-pair pair delimiter) + (cond ((file-like? (car pair)) + (file-append (car pair) delimiter (cdr pair))) + ((gexp? (car pair)) + (file-append (car pair) delimiter (cdr pair))) + ((string? (car pair)) + (string-append (car pair) delimiter (cdr pair))) + (else + (error + (format #f "pair members must only contain gexps, file-like objects and strings but ~a was found" (car pair)))))) + +(define (oci-sanitize-mixed-list name value delimiter) + (map + (lambda (el) + (cond ((string? el) el) + ((pair? el) (oci-sanitize-pair el delimiter)) + (else + (error + (format #f "~a members must be either a string or a pair but ~a was found!" name el))))) + value)) + +(define (oci-sanitize-environment value) + ;; Expected spec format: + ;; '(("HOME" . "/home/nobody") "JAVA_HOME=/java") + (oci-sanitize-mixed-list "environment" value "=")) + +(define (oci-sanitize-ports value) + ;; Expected spec format: + ;; '(("8088" . "80") "2022:22") + (oci-sanitize-mixed-list "ports" value ":")) + +(define (oci-sanitize-volumes value) + ;; Expected spec format: + ;; '(("/mnt/dir" . "/dir") "/run/current-system/profile:/java") + (oci-sanitize-mixed-list "volumes" value ":")) + +(define-configuration/no-serialization oci-container-configuration + (command + (list-of-strings '()) + "Overwrite the default CMD of the image.") + (entrypoint + (string "") + "Overwrite the default ENTRYPOINT of the image.") + (environment + (list '()) + "Set environment variables." + (sanitizer oci-sanitize-environment)) + (image + (string) + "The image used to build the container.") + (name + (string "") + "Set a name for the spawned container.") + (network + (string "") + "Set a Docker network for the spawned container.") + (ports + (list '()) + "Set the port or port ranges to expose from the spawned container." + (sanitizer oci-sanitize-ports)) + (volumes + (list '()) + "Set volume mappings for the spawned container." + (sanitizer oci-sanitize-volumes))) + +(define oci-container-configuration->options + (lambda (config) + (let ((entrypoint + (oci-container-configuration-entrypoint config)) + (network + (oci-container-configuration-network config))) + (apply append + (filter (compose not unspecified?) + `(,(when (not (string-null? entrypoint)) + (list "--entrypoint" entrypoint)) + ,(append-map + (lambda (spec) + (list "--env" spec)) + (oci-container-configuration-environment config)) + ,(when (not (string-null? network)) + (list "--network" network)) + ,(append-map + (lambda (spec) + (list "-p" spec)) + (oci-container-configuration-ports config)) + ,(append-map + (lambda (spec) + (list "-v" spec)) + (oci-container-configuration-volumes config)))))))) + +(define (oci-container-shepherd-service config) + (define (guess-name name image) + (if (not (string-null? name)) + name + (string-append "docker-" + (basename (car (string-split image #\:)))))) + + (let* ((docker-command (file-append docker-cli "/bin/docker")) + (config-name (oci-container-configuration-name config)) + (image (oci-container-configuration-image config)) + (name (guess-name config-name image))) + + (shepherd-service (provision `(,(string->symbol name))) + (requirement '(dockerd)) + (respawn? #f) + (documentation + (string-append + "Docker backed Shepherd service for image: " image)) + (start + #~(make-forkexec-constructor + ;; docker run [OPTIONS] IMAGE [COMMAND] [ARG...] + (list #$docker-command + "run" + "--rm" + "--name" #$name + #$@(oci-container-configuration->options config) + #$(oci-container-configuration-image config) + #$@(oci-container-configuration-command config)) + #:user "root" + #:group "root")) + (stop + #~(lambda _ + (invoke #$docker-command "stop" #$name)))))) + +(define (configs->shepherd-services configs) + (map oci-container-shepherd-service configs)) + +(define oci-container-service-type + (service-type (name 'oci-container) + (extensions (list (service-extension profile-service-type + (lambda _ (list docker-cli))) + (service-extension shepherd-root-service-type + configs->shepherd-services))) + (default-value '()) + (extend append) + (compose concatenate) + (description + "This service provides allows the management of Docker +containers as Shepherd services.")))