diff mbox series

[bug#77638,2/8] guix home: ‘container’ explicitly mounts $HOME and /run/user/1000.

Message ID 70337e70f5d365c717bc43b08ad99b0f28d48b7e.1744114408.git.ludo@gnu.org
State New
Headers
Series Harden 'call-with-container' |

Commit Message

Ludovic Courtès April 8, 2025, 12:24 p.m. UTC 
  * guix/scripts/home.scm (spawn-home-container): Pass #:mounts to
‘eval/container’.

Change-Id: I1986c1411711cebaf623f97897d91436d8167037
---
 guix/scripts/home.scm | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/guix/scripts/home.scm b/guix/scripts/home.scm
index b4c82d275f..56a4b7c7d4 100644
--- a/guix/scripts/home.scm
+++ b/guix/scripts/home.scm
@@ -3,7 +3,7 @@ 
 ;;; Copyright © 2021 Xinglu Chen <public@yoctocell.xyz>
 ;;; Copyright © 2021 Pierre Langlois <pierre.langlois@gmx.com>
 ;;; Copyright © 2021 Oleg Pykhalov <go.wigust@gmail.com>
-;;; Copyright © 2022-2023 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2022-2023, 2025 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2022 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2022 Antero Mejr <antero@mailbox.org>
 ;;;
@@ -36,7 +36,8 @@  (define-module (guix scripts home)
   #:autoload   (guix modules) (source-module-closure)
   #:autoload   (gnu build linux-container) (call-with-container %namespaces)
   #:autoload   (gnu system linux-container) (eval/container)
-  #:autoload   (gnu system file-systems) (file-system-mapping
+  #:autoload   (gnu system file-systems) (file-system
+                                          file-system-mapping
                                           file-system-mapping-source
                                           file-system-mapping->bind-mount
                                           specification->file-system-mapping
@@ -361,6 +362,18 @@  (define* (spawn-home-container home
    #:namespaces (if network?
                     (delq 'net %namespaces)       ; share host network
                     %namespaces)
+   #:mounts (list (file-system
+                    (device "none")
+                    (mount-point
+                     (in-vicinity "/run/user"     ;for shepherd & co.
+                                  (number->string uid)))
+                    (type "tmpfs")
+                    (check? #f))
+                  (file-system                    ;writable home
+                    (device "none")
+                    (mount-point home-directory)
+                    (type "tmpfs")
+                    (check? #f)))
    #:mappings (append network-mappings mappings)
    #:guest-uid uid
    #:guest-gid gid))