@@ -19609,6 +19609,13 @@ Base Services
@item @code{build-accounts} (default: @code{10})
Number of build user accounts to create.
+@item @code{chroot?} (default: @code{'default})
+The value should be one of @code{#t} or @code{#f}, in which
+case chroot is enabled or disabled, respectively;
+or it should be @code{'default}, which amounts to @code{#f} in
+Docker containers (so that they can be run in non-privileged mode)
+or @code{#t} otherwise.
+
@item @code{authorize-key?} (default: @code{#t})
@cindex substitutes, authorization thereof
Whether to authorize the substitute keys listed in
@@ -21,6 +21,7 @@
;;; Copyright © 2022 Justin Veilleux <terramorpha@cock.li>
;;; Copyright © 2022 ( <paren@disroot.org>
;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
+;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -213,6 +214,7 @@ (define-module (gnu services base)
guix-configuration-build-group
guix-configuration-build-accounts
guix-configuration-build-machines
+ guix-configuration-chroot?
guix-configuration-authorize-key?
guix-configuration-authorized-keys
guix-configuration-use-substitutes?
@@ -1848,6 +1850,8 @@ (define-record-type* <guix-configuration>
(default "guixbuild"))
(build-accounts guix-configuration-build-accounts ;integer
(default 10))
+ (chroot? guix-configuration-chroot? ;Boolean | 'default
+ (default 'default))
(authorize-key? guix-configuration-authorize-key? ;Boolean
(default #t))
(authorized-keys guix-configuration-authorized-keys ;list of gexps
@@ -1942,7 +1946,7 @@ (define (guix-shepherd-service config)
glibc-utf8-locales)))
(match-record config <guix-configuration>
- (guix build-group build-accounts authorize-key? authorized-keys
+ (guix build-group build-accounts chroot? authorize-key? authorized-keys
use-substitutes? substitute-urls max-silent-time timeout
log-compression discover? extra-options log-file
http-proxy tmpdir chroot-directories environment)
@@ -1989,6 +1993,9 @@ (define (guix-shepherd-service config)
"--substitute-urls" #$(string-join substitute-urls)
#$@extra-options
+ #$@(if chroot?
+ '()
+ '("--disable-chroot"))
;; Add CHROOT-DIRECTORIES and all their dependencies
;; (if these are store items) to the chroot.
(append-map
@@ -7,6 +7,7 @@
;;; Copyright © 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2023 Pierre Langlois <pierre.langlois@gmx.com>
;;; Copyright © 2024 Leo Nikkilä <hello@lnikki.la>
+;;; Copyright © 2024 Andreas Enge <andreas@enge.fr>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -151,26 +152,28 @@ (define* (containerized-operating-system os mappings
(swap-devices '()) ; disable swap
(services
(append services-to-add
- (filter-map (lambda (s)
- (cond ((memq (service-kind s) services-to-drop)
- #f)
- ((eq? nscd-service-type (service-kind s))
- (service nscd-service-type
- (nscd-configuration
- (inherit (service-value s))
- (caches %nscd-container-caches))))
- ((eq? guix-service-type (service-kind s))
- ;; Pass '--disable-chroot' so that
- ;; guix-daemon can build thing even in
- ;; Docker without '--privileged'.
- (service guix-service-type
- (guix-configuration
- (inherit (service-value s))
- (extra-options
- (cons "--disable-chroot"
- (guix-configuration-extra-options
- (service-value s)))))))
- (else s)))
+ (filter-map
+ (lambda (s)
+ (let ((kind (service-kind s))
+ (value (service-value s)))
+ (cond ((memq kind services-to-drop)
+ #f)
+ ((eq? nscd-service-type kind)
+ (service nscd-service-type
+ (nscd-configuration
+ (inherit value)
+ (caches %nscd-container-caches))))
+ ((and (eq? guix-service-type kind)
+ (eq? (guix-configuration-chroot? value)
+ 'default))
+ ;; If chroot? is 'default, it should become #f
+ ;; so that guix-daemon can build things even in
+ ;; Docker without '--privileged'.
+ (service guix-service-type
+ (guix-configuration
+ (inherit value)
+ (chroot? #f))))
+ (else s))))
(operating-system-user-services os))))
(file-systems (append (map mapping->fs
(if shared-network?
Here is a suggestion for a patch implementing the chroot? parameter. I have tested it by reconfiguring a real machine and still need to test it in containers. Andreas From 8629decf975576447c8662355a35ec0f20e892cf Mon Sep 17 00:00:00 2001 Message-ID: <8629decf975576447c8662355a35ec0f20e892cf.1720189422.git.andreas@enge.fr> From: Andreas Enge <andreas@enge.fr> Date: Fri, 5 Jul 2024 15:47:13 +0200 Subject: [PATCH] gnu: guix-configuration: Add a chroot? parameter. The parameter should take the values #t, #f or 'default. In a container environment, 'default amounts to #f, otherwise it amounts to #t. * gnu/services/base.scm (guix-configuration)<chroot?>: New field. (guix-shepherd-service): If chroot? is #f, add "--disable-chroot". If it is #t or 'default, do nothing. * gnu/system/linux-container.scm (containerized-operating-system): If chroot? is 'default, replace it by #f. * doc/guix.texi: Document the parameter. Change-Id: I8b9c3f46ad8650fa6ed4acee947b4ae5d002d03d --- doc/guix.texi | 7 ++++++ gnu/services/base.scm | 9 ++++++- gnu/system/linux-container.scm | 43 ++++++++++++++++++---------------- 3 files changed, 38 insertions(+), 21 deletions(-) base-commit: b91685abdecdb42c0ac2e30e5cb5032b11b5d269