This was superseded by ‘least-authority-wrapper’.
* gnu/build/shepherd.scm (read-pid-file/container)
(make-forkexec-constructor/container): Remove.
Change-Id: I6acccdff2609a35807608f865a4d381146113a88
To support the argument introduced in Shepherd 0.9.0 when defining
container-bound services.
* gnu/build/shepherd.scm (exec-command*)
(make-forkexec-constructor/container): Add '#:supplementary-groups'.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Fixes a regression introduced in
938448bf40 whereby
'fork+exec-command/container' would return #t, then used as the running
value of the 'guix-daemon' service in the installer. Upon installation
completion, stopping the 'guix-daemon' service would fail with
wrong-type-arg because that #t would be passed to the 'stop' method in
lieu of a PID.
* gnu/build/shepherd.scm (fork+exec-command/container): Return a PID
rather than #t.
Fixes a regression introduced in
938448bf40 where 'exec-command*' could
get #:directory #f, in particular when called by
'fork+exec-command/container'.
* gnu/build/shepherd.scm (exec-command*): Add default value for #:directory.
* gnu/build/shepherd.scm (exec-command*): New procedure, with code
formerly...
(make-forkexec-constructor/container): ... here. Use it.
(fork+exec-command/container): Use 'fork+exec-command' only when
CONTAINER-SUPPORT? is false or PID is the current process.
Instead of imperative module-autoload! directives.
* gnu/build/shepherd.scm: Replace module-autoload! directives by autoload
arguments for define-module.
Since commit 8ce6f4dc28, importing this
module in a gexp would pull in (guix config) from the host, thereby
leading to non-reproducible derivations. Users in (gnu services ...) do
not expect that so simply remove the (guix utils) dependency for now.
* gnu/build/shepherd.scm (fork+exec-command/container)[strip-pid]: New
procedure.
Use it instead of 'strip-keyword-arguments'.
Fixes: <https://issues.guix.gnu.org/43533>.
* gnu/build/shepherd.scm (fork+exec-command/container): Check if containers
are supported before joining PID namespaces.
When the store overlay is mounted, other processes such as kmscon, udev
and guix-daemon may open files from the store, preventing the
underlying install support from being umounted. See:
https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00161.html.
To avoid this situation, mount the store overlay inside a container,
and run the installation from within that container.
* gnu/build/shepherd.scm (fork+exec-command/container): New procedure.
* gnu/services/base.scm (guix-shepherd-service): Support an optional PID
argument passed to the "start" method. If that argument is passed, ensure that
guix-daemon enters the given PID MNT namespace by using
fork+exec-command/container procedure.
* gnu/installer/final.scm (umount-cow-store): Remove it,
(install-system): run the installation from within a container.
* gnu/installer/newt/final.scm (run-install-shell): Remove the display hack.
This mirrors a change made in the Shepherd 0.8.0. Previously, upon
startup failure, we could have left processes behind.
* gnu/build/shepherd.scm (read-pid-file/container): Kill (- PID) instead
of PID.
Fixes <https://bugs.gnu.org/41791>.
Reported by Tobias Geerinckx-Rice <me@tobias.gr>.
This change mirrors changes made in the Shepherd 0.8.1, where signals
are blocked in the shepherd process in support of 'signalfd'. The
regression was introduced with the switch to 0.8.1 in
3f9c62d1a8b345909adaeb22f454ad22554c55a1: child processes would not
receive SIGTERM upon 'herd stop SERVICE'.
* gnu/build/shepherd.scm <top level>: Autoload (shepherd system).
(make-forkexec-constructor/container): Call call to 'sigaction' and
'unblock-signals'.
This allows containers created by "guix environment -CN" or by
"guix system container -N" to talk to the host nscd.
* gnu/system/file-systems.scm (%network-file-mappings): Add
"/var/run/nscd".
* gnu/build/shepherd.scm (default-mounts)[nscd-socket]: Remove.
* gnu/system/linux-container.scm (container-script)[nscd-run-directory]
[nscd-mapping, nscd-os, nscd-specs]: Remove.
[script]: Filter out from SPECS bind-mounts where the device does not
exist.
* guix/scripts/environment.scm (launch-environment/container)
[optional-mapping->fs]: New procedure.
[mappings]: Remove %NETWORK-FILE-MAPPINGS.
[file-systems]: Add %NETWORK-FILE-MAPPINGS here, filtered through
'optional-mapping->fs'.
Fixes a bug whereby Tor (for example) would emit syslog messages with a
UTC timestamp instead of local time.
* gnu/build/shepherd.scm (default-mounts): Add /etc/localtime to
MAPPINGS.
Ludovic Courtès
Arun Isaac
Leo Nikkilä
Maxim Cournoyer
Mathieu Othacehe