[PATCH] gnu: Add podman

DoneSubmitted by Timmy Douglas.
Details
3 participants
  • Ludovic Courtès
  • Timmy Douglas
  • Nguyễn Gia Phong
Owner
unassigned
Severity
normal
T
T
Timmy Douglas wrote on 29 Nov 2021 07:46
(address . guix-patches@gnu.org)(name . Timmy Douglas)(address . mail@timmydouglas.com)
4d5abde1033a5178c7b088fbd13f93f4f96866b6.1638168394.git.mail@timmydouglas.com
* gnu/packages/containers.scm (crun, conmon, libslirp, slirp4netns,
cni-plugins, podman): Add podman and dependencies.
---

I was going to try running some docker containers on my Guix system
today, but I noticed docker was an old version. I decided to try
packaging podman as the daemonless aspect seems appealing and was able
to run a basic alpine image (rootless) after a couple of hours of
putting this together. This is one of my first packages for Guix, so
please give me some feedback--I'm also interested if anyone else would
like to work together on this, because I'm fairly new to Guix and I
haven't used podman before either. This probably needs some more
testing since I only tried a basic scenario.

For podman to work, I needed to run this:
`sudo mount -t cgroup2 none /sys/fs/cgroup`


gnu/packages/containers.scm | 304 ++++++++++++++++++++++++++++++++++++
1 file changed, 304 insertions(+)
create mode 100644 gnu/packages/containers.scm

Toggle diff (312 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
new file mode 100644
index 0000000000..1c83698c2e
--- /dev/null
+++ b/gnu/packages/containers.scm
@@ -0,0 +1,304 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2021 Timmy Douglas <mail@timmydouglas.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages containers)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (gnu packages)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
+  #:use-module (guix build-system meson)
+  #:use-module (guix utils)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages check)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages golang)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages networking)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages selinux)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages virtualization)
+  #:use-module (gnu packages web))
+
+;; For podman to work, the user needs to run
+;; `sudo mount -t cgroup2 none /sys/fs/cgroup`
+
+(define-public crun
+  (package
+    (name "crun")
+    (version "1.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/crun")
+             (commit "8e5757a4e68590326dafe8a8b1b4a584b10a1370") ; 1.3
+             (recursive? #t)))
+       (sha256
+        (base32 "01yiss2d57kwlxb7zlqzjwlg9fyaf19yjngd1mw9n4hxls3dfj3k"))
+       (file-name (git-file-name name version))))
+    
+    (build-system gnu-build-system)
+    (arguments
+     '(#:tests? #f
+                #:configure-flags '("--disable-systemd")
+                #:phases
+                (modify-phases %standard-phases
+                  (add-after 'unpack 'do-not-depend-on-git
+                    (lambda _
+                      (substitute* "autogen.sh"
+                        (("^git submodule update.*")
+                         ""))
+                      (with-output-to-file "git-version.h"
+                        (lambda ()
+                          (display (string-append
+                                    "/* autogenerated.  */\n#ifndef GIT_VERSION\n# define GIT_VERSION \""
+                                    "8e5757a4e68590326dafe8a8b1b4a584b10a1370" ; refactor this
+                                    "\"\n#endif\n"))))
+                      #t
+                      )))))
+    (inputs
+     `(("libcap" ,libcap)
+       ("libseccomp" ,libseccomp)
+       ("libyajl" ,libyajl)))
+    (native-inputs
+     `(("automake" ,automake)
+       ("autoreconf" ,autoconf)
+       ("git" ,git)
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)
+       ("python-3" ,python-3)))
+    (home-page "https://github.com/containers/crun")
+    (synopsis "OCI Container runtime")
+    (description
+     "crun is a fast and low-memory footprint OCI Container Runtime fully written in C.")
+    (license license:gpl2+)))
+
+(define-public conmon
+  (package
+    (name "conmon")
+    (version "v2.0.30")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/conmon")
+             (commit version)))
+       (sha256
+        (base32 "1sxpbm01g4xak4kqwvk45gmzr6n9bjzlfp1j85wyz8rj2hg2x4rm"))
+       (file-name (git-file-name name version))))
+    
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+                    #:tests? #f ; currently broken as go tries to use network
+                    #:phases (modify-phases %standard-phases
+                               (delete 'configure)
+                               (add-after 'unpack 'set-env
+                                 (lambda* (#:key inputs #:allow-other-keys)
+                                   ;; when running go, things fail because
+                                   ;; HOME=/homeless-shelter.
+                                   (setenv "HOME" "/tmp")))
+                               (replace 'check
+                                 (lambda* (#:key tests? #:allow-other-keys)
+                                   (when tests?
+                                     (invoke "make" "test")))))))
+    (inputs
+     `(("glib" ,glib)
+       ("glibc" ,glibc)
+       ("libseccomp" ,libseccomp)
+       ("crun" ,crun)))
+    (native-inputs
+     `(("git" ,git)
+       ("go" ,go)
+       ("pkg-config" ,pkg-config)))
+    (home-page "https://github.com/containers/conmon")
+    (synopsis "Monitoring and communication tool between container manager and OCI runtime")
+    (description
+     "Conmon is a monitoring program and communication tool between a container
+manager (like Podman or CRI-O) and an OCI runtime (like runc or crun) for a
+single container.")
+    (license license:asl2.0)))
+
+(define-public libslirp
+  (package
+    (name "libslirp")
+    (version "v4.6.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.freedesktop.org/slirp/libslirp")
+             (commit version)))
+       (sha256
+        (base32 "1b4cn51xvzbrxd63g6w1033prvbxfxsnsn1l0fa5i311xv28vkh0"))
+       (file-name (git-file-name name version))))
+    
+    (build-system meson-build-system)
+    (arguments '(#:tests? #f))
+    (inputs
+     `(("glib" ,glib)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "https://gitlab.freedesktop.org/slirp/libslirp")
+    (synopsis "User-mode networking library")
+    (description
+     "libslirp is a user-mode networking library used by virtual machines,
+containers or various tools.")
+    (license license:non-copyleft))) ;fixme what is this?
+
+(define-public slirp4netns
+  (package
+    (name "slirp4netns")
+    (version "v1.1.12")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/rootless-containers/slirp4netns")
+             (commit version)))
+       (sha256
+        (base32 "03llv4dlf7qqxwz4zdyk926g4bigfj2gb50glm70ciflpvzs8081"))
+       (file-name (git-file-name name version))))
+    
+    (build-system gnu-build-system)
+    (arguments '(#:tests? #f))
+    (inputs
+     `(("glib" ,glib)
+       ("libcap" ,libcap)
+       ("libseccomp" ,libseccomp)
+       ("libslirp" ,libslirp)))
+    (native-inputs
+     `(("automake" ,automake)
+       ("autoreconf" ,autoconf)
+       ("pkg-config" ,pkg-config)))
+    (home-page "https://github.com/rootless-containers/slirp4netns")
+    (synopsis "User-mode networking for unprivileged network namespaces")
+    (description
+     "slirp4netns provides user-mode networking (\"slirp\") for unprivileged network namespaces.")
+    (license license:gpl2+)))
+
+(define-public cni-plugins
+  (package
+    (name "cni-plugins")
+    (version "v1.0.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containernetworking/plugins")
+             (commit version)))
+       (sha256
+        (base32 "1j91in0mg4nblpdccyq63ncbnn2pc2zzjp1fh3jy0bsndllgv0nc"))
+       (file-name (git-file-name name version))))
+    
+    (build-system go-build-system)
+    (arguments
+     `(#:unpack-path "github.com/containernetworking/plugins"
+                     #:tests? #f
+                     #:phases (modify-phases %standard-phases
+                                (replace 'build
+                                  (lambda _
+                                    (with-directory-excursion "src/github.com/containernetworking/plugins"
+                                      (invoke "./build_linux.sh"))))
+                                (replace 'install
+                                  (lambda* (#:key outputs #:allow-other-keys)
+                                    (copy-recursively "src/github.com/containernetworking/plugins/bin"
+                                                      (string-append (assoc-ref outputs "out") "/bin"))
+                                    #t)))))
+    (home-page "https://github.com/containernetworking/plugins")
+    (synopsis "CNI network plugins")
+    (description
+     "Some CNI network plugins, maintained by the containernetworking team.")
+    (license license:asl2.0)))
+
+(define-public podman
+  (package
+    (name "podman")
+    (version "v3.4.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/podman")
+             (commit version)))
+       (sha256
+        (base32 "0v1xpd1q6ym9ibaj6242v4mp0wwdmj4dd9l7zfyydbxrx6a8ahjn"))
+       (file-name (git-file-name name version))))
+    
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+                    #:tests? #f ; need to setup ginkgo
+                    #:phases (modify-phases %standard-phases
+                               (delete 'configure)
+                               (add-after 'unpack 'set-env
+                                 (lambda* (#:key inputs #:allow-other-keys)
+                                   ;; when running go, things fail because
+                                   ;; HOME=/homeless-shelter.
+                                   (setenv "HOME" "/tmp")))
+                               (add-after 'unpack 'fix-hardcoded-paths
+                                 (lambda _
+                                   (substitute* (find-files "libpod" "\\.go")
+                                     (("exec.LookPath[(][\"]slirp4netns[\"][)]")
+                                      (string-append "exec.LookPath(\"" (which "slirp4netns") "\")")))
+                                   (substitute* "vendor/github.com/containers/common/pkg/config/config_linux.go"
+                                     (("/usr/local/libexec/podman")
+                                      (string-append (assoc-ref %outputs "out") "/bin")))
+                                   (substitute* "vendor/github.com/containers/common/pkg/config/default.go"
+                                     (("/usr/libexec/podman/conmon") (which "conmon"))
+                                     (("/usr/local/libexec/cni")
+                                      (string-append (assoc-ref %build-inputs "cni-plugins") "/bin"))
+                                     (("/usr/bin/crun") (which "crun")))
+                                   #true))
+                               (replace 'check
+                                 (lambda* (#:key tests? #:allow-other-keys)
+                                   (when tests?
+                                     (invoke "make" "test")))))))
+    (inputs
+     `(("btrfs-progs" ,btrfs-progs)
+       ("cni-plugins" ,cni-plugins)
+       ("conmon" ,conmon)
+       ("gpgme" ,gpgme)
+       ("go-md2man" ,go-github-com-go-md2man)
+       ("iptables" ,iptables) ; fixme not sure if podman will call this using $PATH
+       ("libassuan" ,libassuan)
+       ("libseccomp" ,libseccomp)
+       ("libselinux" ,libselinux)
+       ("slirp4netns" ,slirp4netns)
+       ("crun" ,crun)))
+    (native-inputs
+     `(("git" ,git)
+       ("go" ,go)
+       ("pkg-config" ,pkg-config)))
+    (home-page "https://podman.io")
+    (synopsis "Manage containers, images, pods, and their volumes")
+    (description
+     "Podman (the POD MANager) is a tool for managing containers and images,
+volumes mounted into those containers, and pods made from groups of
+containers.")
+    (license license:asl2.0)))
-- 
2.33.1
L
L
Ludovic Courtès wrote on 18 Dec 2021 18:57
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174@debbugs.gnu.org)
874k75pzi7.fsf@gnu.org
Hi Timmy,

Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (17 lines)
> * gnu/packages/containers.scm (crun, conmon, libslirp, slirp4netns,
> cni-plugins, podman): Add podman and dependencies.
> ---
>
> I was going to try running some docker containers on my Guix system
> today, but I noticed docker was an old version. I decided to try
> packaging podman as the daemonless aspect seems appealing and was able
> to run a basic alpine image (rootless) after a couple of hours of
> putting this together. This is one of my first packages for Guix, so
> please give me some feedback--I'm also interested if anyone else would
> like to work together on this, because I'm fairly new to Guix and I
> haven't used podman before either. This probably needs some more
> testing since I only tried a basic scenario.
>
> For podman to work, I needed to run this:
> `sudo mount -t cgroup2 none /sys/fs/cgroup`

Woow, that’s a great start, and it’ll certainly be useful to many.

Overall it LGTM. Here are some minor issues that would be nice
addressing:

Toggle quote (4 lines)
> gnu/packages/containers.scm | 304 ++++++++++++++++++++++++++++++++++++
> 1 file changed, 304 insertions(+)
> create mode 100644 gnu/packages/containers.scm

We usually have one patch per new package; IWBN if you could split this
patch accordingly.

Make sure to add ‘containers.scm’ to ‘gnu/local.mk’ too.

Toggle quote (5 lines)
> + (arguments
> + '(#:tests? #f
> + #:configure-flags '("--disable-systemd")
> + #:phases

Please align keywords, as in:

'(#:tests? #f
#:configure-flags …
#:phases …)

Toggle quote (4 lines)
> + (display (string-append
> + "/* autogenerated. */\n#ifndef GIT_VERSION\n# define GIT_VERSION \""
> + "8e5757a4e68590326dafe8a8b1b4a584b10a1370" ; refactor this

You can write “,commit” (read: “unquote commit”), assuming there’s a
‘commit’ local variable above.

Toggle quote (12 lines)
> + (inputs
> + `(("libcap" ,libcap)
> + ("libseccomp" ,libseccomp)
> + ("libyajl" ,libyajl)))
> + (native-inputs
> + `(("automake" ,automake)
> + ("autoreconf" ,autoconf)
> + ("git" ,git)
> + ("libtool" ,libtool)
> + ("pkg-config" ,pkg-config)
> + ("python-3" ,python-3)))

IWBN if you could run packages through ‘guix style’:


Toggle quote (3 lines)
> + (name "conmon")
> + (version "v2.0.30")

Please remove “v” from the version number (here and elsewhere), and…

Toggle quote (3 lines)
> + (uri (git-reference
> + (url "https://github.com/containers/conmon")
> + (commit version)))
^
… add it here, with (string-append "v" version).

Toggle quote (7 lines)
> + (synopsis "User-mode networking library")
> + (description
> + "libslirp is a user-mode networking library used by virtual machines,
> +containers or various tools.")
> + (license license:non-copyleft))) ;fixme what is this?

It’s ‘license:bsd-3’, per

That’s it.

Could you send updated patches?

Thank you, and apologies for the delay!

Ludo’.
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 1/6] gnu: add crun
(address . 52174@debbugs.gnu.org)
52542aec3c127a893453ac1ecbbd504022d4c8dd.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: new file
* gnu/local.mk: add containers.scm
---
gnu/local.mk | 1 +
gnu/packages/containers.scm | 87 +++++++++++++++++++++++++++++++++++++
2 files changed, 88 insertions(+)
create mode 100644 gnu/packages/containers.scm

Toggle diff (107 lines)
diff --git a/gnu/local.mk b/gnu/local.mk
index 33e108c752..8ffcf662ce 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -157,6 +157,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/configuration-management.scm	\
   %D%/packages/conky.scm			\
   %D%/packages/connman.scm			\
+  %D%/packages/containers.scm			\
   %D%/packages/convmv.scm			\
   %D%/packages/cook.scm				\
   %D%/packages/coq.scm				\
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
new file mode 100644
index 0000000000..7ffe6e95d0
--- /dev/null
+++ b/gnu/packages/containers.scm
@@ -0,0 +1,87 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2021 Timmy Douglas <mail@timmydouglas.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages containers)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (gnu packages)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
+  #:use-module (guix build-system meson)
+  #:use-module (guix utils)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages check)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages golang)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages networking)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages selinux)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages virtualization)
+  #:use-module (gnu packages web))
+
+(define-public crun
+  (let ((commit "8e5757a4e68590326dafe8a8b1b4a584b10a1370"))
+    (package
+      (name "crun")
+      (version "1.3")
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/containers/crun")
+               (commit commit)
+               (recursive? #t)))
+         (sha256
+          (base32 "01yiss2d57kwlxb7zlqzjwlg9fyaf19yjngd1mw9n4hxls3dfj3k"))
+         (file-name (git-file-name name version))))
+
+      (build-system gnu-build-system)
+      (arguments
+       `(#:tests? #f
+         #:configure-flags '("--disable-systemd")
+         #:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'do-not-depend-on-git
+             (lambda _
+               (substitute* "autogen.sh"
+                 (("^git submodule update.*")
+                  ""))
+               (with-output-to-file "git-version.h"
+                 (lambda ()
+                   (display (string-append
+                             "/* autogenerated.  */\n#ifndef GIT_VERSION\n# define GIT_VERSION \""
+                             ,commit
+                             "\"\n#endif\n"))))
+               #t)))))
+      (inputs
+       (list libcap libseccomp libyajl))
+      (native-inputs
+       (list automake autoconf git libtool pkg-config python-3))
+      (home-page "https://github.com/containers/crun")
+      (synopsis "OCI Container runtime")
+      (description
+       "crun is a fast and low-memory footprint OCI Container Runtime fully written in C.")
+      (license license:gpl2+))))
-- 
2.34.0
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 2/6] gnu: add conmon
(address . 52174@debbugs.gnu.org)
058f226cf4e0b5fdb6642ff4b9d20e28b5312781.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: add conmon
---
gnu/packages/containers.scm | 42 +++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)

Toggle diff (52 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 7ffe6e95d0..d4f9d742db 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -85,3 +85,45 @@ (define-public crun
       (description
        "crun is a fast and low-memory footprint OCI Container Runtime fully written in C.")
       (license license:gpl2+))))
+
+(define-public conmon
+  (package
+    (name "conmon")
+    (version "2.0.30")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/conmon")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1sxpbm01g4xak4kqwvk45gmzr6n9bjzlfp1j85wyz8rj2hg2x4rm"))
+       (file-name (git-file-name name version))))
+
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+                    #:tests? #f ; currently broken as go tries to use network
+                    #:phases (modify-phases %standard-phases
+                               (delete 'configure)
+                               (add-after 'unpack 'set-env
+                                 (lambda* (#:key inputs #:allow-other-keys)
+                                   ;; when running go, things fail because
+                                   ;; HOME=/homeless-shelter.
+                                   (setenv "HOME" "/tmp")))
+                               (replace 'check
+                                 (lambda* (#:key tests? #:allow-other-keys)
+                                   (when tests?
+                                     (invoke "make" "test")))))))
+    (inputs
+     (list glib glibc libseccomp crun))
+    (native-inputs
+     (list git go pkg-config))
+    (home-page "https://github.com/containers/conmon")
+    (synopsis "Monitoring and communication tool between container manager and OCI runtime")
+    (description
+     "Conmon is a monitoring program and communication tool between a container
+manager (like Podman or CRI-O) and an OCI runtime (like runc or crun) for a
+single container.")
+    (license license:asl2.0)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 3/6] gnu: add libslirp
(address . 52174@debbugs.gnu.org)
494f640fc1a93f5b04d4f39692af3b831998d085.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: add libslirp
---
gnu/packages/containers.scm | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)

Toggle diff (37 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index d4f9d742db..777eaa2eb9 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -127,3 +127,30 @@ (define-public conmon
 manager (like Podman or CRI-O) and an OCI runtime (like runc or crun) for a
 single container.")
     (license license:asl2.0)))
+
+(define-public libslirp
+  (package
+    (name "libslirp")
+    (version "4.6.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.freedesktop.org/slirp/libslirp")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1b4cn51xvzbrxd63g6w1033prvbxfxsnsn1l0fa5i311xv28vkh0"))
+       (file-name (git-file-name name version))))
+
+    (build-system meson-build-system)
+    (arguments '(#:tests? #f))
+    (inputs
+     (list glib))
+    (native-inputs
+     (list pkg-config))
+    (home-page "https://gitlab.freedesktop.org/slirp/libslirp")
+    (synopsis "User-mode networking library")
+    (description
+     "libslirp is a user-mode networking library used by virtual machines,
+containers or various tools.")
+    (license license:bsd-3)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 4/6] gnu: add slirp4netns
(address . 52174@debbugs.gnu.org)
5c1a99e39b736f68c55669842cf68c08180a8086.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: add slirp4netns
---
gnu/packages/containers.scm | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)

Toggle diff (36 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 777eaa2eb9..f13da74ac1 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -154,3 +154,29 @@ (define-public libslirp
      "libslirp is a user-mode networking library used by virtual machines,
 containers or various tools.")
     (license license:bsd-3)))
+
+(define-public slirp4netns
+  (package
+    (name "slirp4netns")
+    (version "1.1.12")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/rootless-containers/slirp4netns")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "03llv4dlf7qqxwz4zdyk926g4bigfj2gb50glm70ciflpvzs8081"))
+       (file-name (git-file-name name version))))
+
+    (build-system gnu-build-system)
+    (arguments '(#:tests? #f))
+    (inputs
+     (list glib libcap libseccomp libslirp))
+    (native-inputs
+     (list automake autoconf pkg-config))
+    (home-page "https://github.com/rootless-containers/slirp4netns")
+    (synopsis "User-mode networking for unprivileged network namespaces")
+    (description
+     "slirp4netns provides user-mode networking (\"slirp\") for unprivileged network namespaces.")
+    (license license:gpl2+)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 5/6] gnu: add cni-plugins
(address . 52174@debbugs.gnu.org)
e9e94f9a04f7b10834db3f59b774c231952a61d7.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: add cni-plugins
---
gnu/packages/containers.scm | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)

Toggle diff (44 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index f13da74ac1..8810ecb8c8 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -180,3 +180,37 @@ (define-public slirp4netns
     (description
      "slirp4netns provides user-mode networking (\"slirp\") for unprivileged network namespaces.")
     (license license:gpl2+)))
+
+(define-public cni-plugins
+  (package
+    (name "cni-plugins")
+    (version "1.0.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containernetworking/plugins")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1j91in0mg4nblpdccyq63ncbnn2pc2zzjp1fh3jy0bsndllgv0nc"))
+       (file-name (git-file-name name version))))
+
+    (build-system go-build-system)
+    (arguments
+     `(#:unpack-path "github.com/containernetworking/plugins"
+                     #:tests? #f
+                     #:phases (modify-phases %standard-phases
+                                (replace 'build
+                                  (lambda _
+                                    (with-directory-excursion "src/github.com/containernetworking/plugins"
+                                      (invoke "./build_linux.sh"))))
+                                (replace 'install
+                                  (lambda* (#:key outputs #:allow-other-keys)
+                                    (copy-recursively "src/github.com/containernetworking/plugins/bin"
+                                                      (string-append (assoc-ref outputs "out") "/bin"))
+                                    #t)))))
+    (home-page "https://github.com/containernetworking/plugins")
+    (synopsis "CNI network plugins")
+    (description
+     "Some CNI network plugins, maintained by the containernetworking team.")
+    (license license:asl2.0)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 19 Dec 2021 05:58
[PATCH v2 6/6] gnu: add podman
(address . 52174@debbugs.gnu.org)
5d39e8142d916df8da9d317bf7a3781c0513ad77.1639889841.git.mail@timmydouglas.com
* gnu/packages/containers.scm: add podman
---

Thanks for the review Ludo! Hopefully this v2 fixes the issues you
pointed out.

gnu/packages/containers.scm | 60 +++++++++++++++++++++++++++++++++++++
1 file changed, 60 insertions(+)

Toggle diff (70 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 8810ecb8c8..389ef42092 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -214,3 +214,63 @@ (define-public cni-plugins
     (description
      "Some CNI network plugins, maintained by the containernetworking team.")
     (license license:asl2.0)))
+
+;; For podman to work, the user needs to run
+;; `sudo mount -t cgroup2 none /sys/fs/cgroup`
+
+(define-public podman
+  (package
+    (name "podman")
+    (version "3.4.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/podman")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1q09qsl1wwiiy5njvb97n1j5f5jin4ckmzj5xbdfs28czb2kx3g5"))
+       (file-name (git-file-name name version))))
+
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+       #:tests? #f ; need to setup ginkgo
+       #:phases (modify-phases %standard-phases
+                  (delete 'configure)
+                  (add-after 'unpack 'set-env
+                    (lambda* (#:key inputs #:allow-other-keys)
+                      ;; when running go, things fail because
+                      ;; HOME=/homeless-shelter.
+                      (setenv "HOME" "/tmp")))
+                  (add-after 'unpack 'fix-hardcoded-paths
+                    (lambda _
+                      (substitute* (find-files "libpod" "\\.go")
+                        (("exec.LookPath[(][\"]slirp4netns[\"][)]")
+                         (string-append "exec.LookPath(\"" (which "slirp4netns") "\")")))
+                      (substitute* "vendor/github.com/containers/common/pkg/config/config_linux.go"
+                        (("/usr/local/libexec/podman")
+                         (string-append (assoc-ref %outputs "out") "/bin")))
+                      (substitute* "vendor/github.com/containers/common/pkg/config/default.go"
+                        (("/usr/libexec/podman/conmon") (which "conmon"))
+                        (("/usr/local/libexec/cni")
+                         (string-append (assoc-ref %build-inputs "cni-plugins") "/bin"))
+                        (("/usr/bin/crun") (which "crun")))
+                      #true))
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      (when tests?
+                        (invoke "make" "test")))))))
+    (inputs
+     (list btrfs-progs cni-plugins conmon crun gpgme go-github-com-go-md2man
+           iptables libassuan libseccomp libselinux slirp4netns))
+    (native-inputs
+     (list git go pkg-config))
+    (home-page "https://podman.io")
+    (synopsis "Manage containers, images, pods, and their volumes")
+    (description
+     "Podman (the POD MANager) is a tool for managing containers and images,
+volumes mounted into those containers, and pods made from groups of
+containers.")
+    (license license:asl2.0)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 21 Dec 2021 21:17
Re: [PATCH v2 1/6] gnu: add crun
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52174@debbugs.gnu.org)
87tuf1zpa1.fsf@timmydouglas.com
Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (24 lines)
> Hi,
>
> Timmy Douglas <mail@timmydouglas.com> skribis:
>
>> * gnu/packages/containers.scm: new file
>> * gnu/local.mk: add containers.scm
>
> [...]
>
>> + (arguments
>> + `(#:tests? #f
>
> Sorry for not noticing earlier: we try hard to run test suites, and only
> disable it as a last resort, with a comment explaining why. Often, we
> disable specific tests that cannot run in the build environment (for
> instance because they assume network access) and run everything else.
>
> I had a quick go at running crun’s test suite, and there’s a number of
> failures, which is not reassuring.
>
> Could you investigate a bit with the goal of fixing any actual issues
> the test suite reveals and/or skipping individual tests that cannot be
> run?

are there some docs I could refer to on how Guix sandboxes the build?
I tried
but I think I need to go further than sourcing env vars.


I tried modifying `make check` phase to invoking `mount` to see if I
could poke around (which didn't exactly work in my quick attempt...)
because I'm not sure how to debug some of the issues. I suspect some are
due to the fs layout/mounts. Probably could figure it out with some more
time but thought it might be best to ask first.

With these changes I could get them to pass by manually `make check`ing
in the --keep-failed directory:

(add-after 'unpack 'fix-tests
(lambda _
(substitute* (find-files "tests" "\\.(c|py)")
(("/bin/true") (which "true"))
(("/bin/false") (which "false"))
; relies on sd_notify which requires systemd?
(("\"sd-notify\" : test_sd_notify,") "")
(("\"sd-notify-file\" : test_sd_notify_file,") "")))))))


from guix build:

============================================================================
Testsuite summary for crun UNKNOWN
============================================================================
# TOTAL: 73
# PASS: 9
# SKIP: 28
# XFAIL: 0
# FAIL: 36
# XPASS: 0
# ERROR: 0


from cd /tmp/guix-build-crun-1.3.drv-5/source && make check

============================================================================
Testsuite summary for crun UNKNOWN
============================================================================
# TOTAL: 73
# PASS: 40
# SKIP: 33
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0


Toggle quote (2 lines)
> Nitpick: You can omit the trailing #t now (yay!).

great!
T
T
Timmy Douglas wrote on 21 Dec 2021 23:37
Re: [PATCH v2 3/6] gnu: add libslirp
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52174@debbugs.gnu.org)
87r1a5zis3.fsf@timmydouglas.com
Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (9 lines)
> Timmy Douglas <mail@timmydouglas.com> skribis:
>
>> * gnu/packages/containers.scm: add libslirp
>
> Rather:
>
> * gnu/packages/containers.scm (libslirp): New variable.


Is this generated with a guix command?
T
T
Timmy Douglas wrote on 21 Dec 2021 23:42
Re: [PATCH v2 2/6] gnu: add conmon
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52174@debbugs.gnu.org)
87o859zik7.fsf@timmydouglas.com
Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (20 lines)
> Timmy Douglas <mail@timmydouglas.com> skribis:
>
>> * gnu/packages/containers.scm: add conmon
>
> [...]
>
>> + (source
>> + (origin
>> + (method git-fetch)
>> + (uri (git-reference
>> + (url "https://github.com/containers/conmon")
>> + (commit (string-append "v" version))))
>> + (sha256
>> + (base32 "1sxpbm01g4xak4kqwvk45gmzr6n9bjzlfp1j85wyz8rj2hg2x4rm"))
>> + (file-name (git-file-name name version))))
>> +
>> + (build-system gnu-build-system)
>
> Nitpick: you can remove the empty line.

ok. I think guix lint outputted that way or maybe I already had it like that?

Toggle quote (7 lines)
>> + (arguments
>> + `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
>> + (string-append "PREFIX=" %output))
>> + #:tests? #f ; currently broken as go tries to use network
>
> Indentation is off.

emacs really likes to indent it like that. I wonder if I'm missing
something in my setup.


I'll take a look at just skipping network tests rather than avoiding
them altogether.
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 1/6] gnu: add crun
(address . 52174@debbugs.gnu.org)
6e4392911497417cb77932dcd6812eac4587e0a9.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (crun): New variable.
* gnu/local.mk: add containers.scm
---
gnu/local.mk | 1 +
gnu/packages/containers.scm | 103 ++++++++++++++++++++++++++++++++++++
2 files changed, 104 insertions(+)
create mode 100644 gnu/packages/containers.scm

Toggle diff (123 lines)
diff --git a/gnu/local.mk b/gnu/local.mk
index 33e108c752..8ffcf662ce 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -157,6 +157,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/configuration-management.scm	\
   %D%/packages/conky.scm			\
   %D%/packages/connman.scm			\
+  %D%/packages/containers.scm			\
   %D%/packages/convmv.scm			\
   %D%/packages/cook.scm				\
   %D%/packages/coq.scm				\
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
new file mode 100644
index 0000000000..4228a27a91
--- /dev/null
+++ b/gnu/packages/containers.scm
@@ -0,0 +1,103 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2021 Timmy Douglas <mail@timmydouglas.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages containers)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (gnu packages)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
+  #:use-module (guix build-system meson)
+  #:use-module (guix utils)
+  #:use-module (gnu packages admin)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages bash)
+  #:use-module (gnu packages check)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages golang)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages networking)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages selinux)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages virtualization)
+  #:use-module (gnu packages web))
+
+(define-public crun
+  (let ((commit "8e5757a4e68590326dafe8a8b1b4a584b10a1370"))
+    (package
+      (name "crun")
+      (version "1.3")
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/containers/crun")
+               (commit commit)
+               (recursive? #t)))
+         (sha256
+          (base32 "01yiss2d57kwlxb7zlqzjwlg9fyaf19yjngd1mw9n4hxls3dfj3k"))
+         (file-name (git-file-name name version))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:configure-flags '("--disable-systemd")
+         #:tests? #f ; XXX: needs /sys/fs/cgroup mounted
+         #:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'do-not-depend-on-git
+             (lambda _
+               (substitute* "autogen.sh"
+                 (("^git submodule update.*")
+                  ""))
+               (with-output-to-file "git-version.h"
+                 (lambda ()
+                   (display (string-append
+                             "/* autogenerated.  */\n#ifndef GIT_VERSION\n# define GIT_VERSION \""
+                             ,commit
+                             "\"\n#endif\n"))))))
+           (add-after 'unpack 'fix-tests
+             (lambda _
+               (substitute* (find-files "tests" "\\.(c|py)")
+                 (("/bin/true") (which "true"))
+                 (("/bin/false") (which "false"))
+                 ; relies on sd_notify which requires systemd?
+                 (("\"sd-notify\" : test_sd_notify,") "")
+                 (("\"sd-notify-file\" : test_sd_notify_file,") "")))))))
+      (inputs
+       (list libcap
+             libseccomp
+             libyajl))
+      (native-inputs
+       (list automake
+             autoconf
+             git
+             libtool
+             pkg-config
+             python-3))
+      (home-page "https://github.com/containers/crun")
+      (synopsis "Open Container Initiative (OCI) Container runtime")
+      (description
+       "crun is a fast and low-memory footprint Open Container Initiative (OCI)
+Container Runtime fully written in C.")
+      (license license:gpl2+))))
-- 
2.34.0
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 2/6] gnu: add conmon
(address . 52174@debbugs.gnu.org)
93293005601cb92f39825d11263b443d06a3b824.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (conmon): New variable.
---
gnu/packages/containers.scm | 47 +++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)

Toggle diff (57 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 4228a27a91..ff61219c41 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -101,3 +101,50 @@ (define-public crun
        "crun is a fast and low-memory footprint Open Container Initiative (OCI)
 Container Runtime fully written in C.")
       (license license:gpl2+))))
+
+(define-public conmon
+  (package
+    (name "conmon")
+    (version "2.0.30")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/conmon")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1sxpbm01g4xak4kqwvk45gmzr6n9bjzlfp1j85wyz8rj2hg2x4rm"))
+       (file-name (git-file-name name version))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+       ;; XXX: uses `go get` to download 50 packages, runs a ginkgo test suite
+       ;; then tries to download busybox and use a systemd logging library
+       ;; see also https://github.com/containers/conmon/blob/main/nix/derivation.nix
+       #:tests? #f
+       #:test-target "test"
+       #:phases (modify-phases %standard-phases
+                  (delete 'configure)
+                  (add-after 'unpack 'set-env
+                    (lambda* (#:key inputs #:allow-other-keys)
+                      ;; when running go, things fail because
+                      ;; HOME=/homeless-shelter.
+                      (setenv "HOME" "/tmp"))))))
+    (inputs
+     (list crun
+           glib
+           glibc
+           libseccomp))
+    (native-inputs
+     (list git
+           go
+           pkg-config))
+    (home-page "https://github.com/containers/conmon")
+    (synopsis "Monitoring and communication tool between container manager and Open
+Container Initiative (OCI) runtime")
+    (description
+     "Conmon is a monitoring program and communication tool between a container
+manager (like Podman or CRI-O) and an Open Container Initiative (OCI)
+runtime (like runc or crun) for a single container.")
+    (license license:asl2.0)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 3/6] gnu: add libslirp
(address . 52174@debbugs.gnu.org)
470eb4eeaf43a6e7596a35205ba6db5c52e7fdc7.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (libslirp): New variable.
---
gnu/packages/containers.scm | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)

Toggle diff (35 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index ff61219c41..7ba39b5c69 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -148,3 +148,28 @@ (define-public conmon
 manager (like Podman or CRI-O) and an Open Container Initiative (OCI)
 runtime (like runc or crun) for a single container.")
     (license license:asl2.0)))
+
+(define-public libslirp
+  (package
+    (name "libslirp")
+    (version "4.6.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.freedesktop.org/slirp/libslirp")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1b4cn51xvzbrxd63g6w1033prvbxfxsnsn1l0fa5i311xv28vkh0"))
+       (file-name (git-file-name name version))))
+    (build-system meson-build-system)
+    (inputs
+     (list glib))
+    (native-inputs
+     (list pkg-config))
+    (home-page "https://gitlab.freedesktop.org/slirp/libslirp")
+    (synopsis "User-mode networking library")
+    (description
+     "libslirp is a user-mode networking library used by virtual machines,
+containers or various tools.")
+    (license license:bsd-3)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 4/6] gnu: add slirp4netns
(address . 52174@debbugs.gnu.org)
1061553b8c9ab0ece4fa3f53d534dd052c9d1a71.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (slirp4netns): New variable.
---
gnu/packages/containers.scm | 40 +++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)

Toggle diff (50 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 7ba39b5c69..5e540bcfe4 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -173,3 +173,43 @@ (define-public libslirp
      "libslirp is a user-mode networking library used by virtual machines,
 containers or various tools.")
     (license license:bsd-3)))
+
+(define-public slirp4netns
+  (package
+    (name "slirp4netns")
+    (version "1.1.12")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/rootless-containers/slirp4netns")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "03llv4dlf7qqxwz4zdyk926g4bigfj2gb50glm70ciflpvzs8081"))
+       (file-name (git-file-name name version))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:tests? #f ; XXX: open("/dev/net/tun"): No such file or directory
+       #:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'fix-hardcoded-paths
+                    (lambda _
+                      (substitute* (find-files "tests" "\\.sh")
+                        (("ping") "/run/setuid-programs/ping")))))))
+    (inputs
+     (list glib
+           libcap
+           libseccomp
+           libslirp))
+    (native-inputs
+     (list automake
+           autoconf
+           iproute ; iproute, jq, nmap (ncat) and util-linux are for tests
+           jq
+           nmap
+           pkg-config
+           util-linux))
+    (home-page "https://github.com/rootless-containers/slirp4netns")
+    (synopsis "User-mode networking for unprivileged network namespaces")
+    (description
+     "slirp4netns provides user-mode networking (\"slirp\") for unprivileged network namespaces.")
+    (license license:gpl2+)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 5/6] gnu: add cni-plugins
(address . 52174@debbugs.gnu.org)
4916a92131ef49b3264de4a049d78d18a2b2c91b.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (cni-plugins): New variable.
---
gnu/packages/containers.scm | 45 +++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)

Toggle diff (55 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 5e540bcfe4..2789dcfc7c 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -213,3 +213,48 @@ (define-public slirp4netns
     (description
      "slirp4netns provides user-mode networking (\"slirp\") for unprivileged network namespaces.")
     (license license:gpl2+)))
+
+(define-public cni-plugins
+  (package
+    (name "cni-plugins")
+    (version "1.0.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containernetworking/plugins")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1j91in0mg4nblpdccyq63ncbnn2pc2zzjp1fh3jy0bsndllgv0nc"))
+       (file-name (git-file-name name version))))
+    (build-system go-build-system)
+    (arguments
+     `(#:unpack-path "github.com/containernetworking/plugins"
+       #:tests? #f ; XXX: see stat /var/run below
+       #:phases (modify-phases %standard-phases
+                  (replace 'build
+                    (lambda _
+                      (with-directory-excursion "src/github.com/containernetworking/plugins"
+                        (invoke "./build_linux.sh"))))
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      ; only pkg/ns tests run without root
+                      (when tests?
+                        (with-directory-excursion "src/github.com/containernetworking/plugins/pkg/ns"
+                          (invoke "stat" "/var/run") ; XXX: test tries to stat this directory
+                          (invoke "unshare" "-rmn" "go" "test")))))
+                  (add-before 'check 'set-test-environment
+                    (lambda _
+                      (setenv "XDG_RUNTIME_DIR" "/tmp/cni-rootless")))
+                  (replace 'install
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (copy-recursively "src/github.com/containernetworking/plugins/bin"
+                                        (string-append (assoc-ref outputs "out") "/bin")))))))
+    (native-inputs
+     (list util-linux))
+    (home-page "https://github.com/containernetworking/plugins")
+    (synopsis "Container Network Interface (CNI) network plugins")
+    (description
+     "Some Container Network Interface (CNI) network plugins, maintained by the
+containernetworking team.")
+    (license license:asl2.0)))
-- 
2.34.0
T
T
Timmy Douglas wrote on 22 Dec 2021 08:33
[PATCH v3 6/6] gnu: add podman
(address . 52174@debbugs.gnu.org)
d64ea7fee076e03ac4a3e1188b69fa4f9a6149b1.1640158278.git.mail@timmydouglas.com
* gnu/packages/containers.scm (podman): New variable.
---

sending a v3 with some cleanup. I left some comments next to the tests
to try to explain the issues I was running into. Let me know if you
have suggestions. thanks

gnu/packages/containers.scm | 78 +++++++++++++++++++++++++++++++++++++
1 file changed, 78 insertions(+)

Toggle diff (88 lines)
diff --git a/gnu/packages/containers.scm b/gnu/packages/containers.scm
index 2789dcfc7c..5656de616a 100644
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@@ -258,3 +258,81 @@ (define-public cni-plugins
      "Some Container Network Interface (CNI) network plugins, maintained by the
 containernetworking team.")
     (license license:asl2.0)))
+
+;; For podman to work, the user needs to run
+;; `sudo mount -t cgroup2 none /sys/fs/cgroup`
+
+(define-public podman
+  (package
+    (name "podman")
+    (version "3.4.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/containers/podman")
+             (commit (string-append "v" version))))
+       (sha256
+        (base32 "1q09qsl1wwiiy5njvb97n1j5f5jin4ckmzj5xbdfs28czb2kx3g5"))
+       (file-name (git-file-name name version))))
+
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          (string-append "PREFIX=" %output))
+       #:tests? #f ; /sys/fs/cgroup not set up in guix sandbox
+       #:test-target "test"
+       #:phases (modify-phases %standard-phases
+                  (delete 'configure)
+                  (add-after 'unpack 'set-env
+                    (lambda* (#:key inputs #:allow-other-keys)
+                      ;; when running go, things fail because
+                      ;; HOME=/homeless-shelter.
+                      (setenv "HOME" "/tmp")))
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      (when tests?
+                        (invoke "strace" "-f" "bin/podman" "version")
+                        (invoke "make" "localsystem")
+                        (invoke "make" "remotesystem"))))
+                  (add-after 'unpack 'fix-hardcoded-paths
+                    (lambda _
+                      (substitute* (find-files "libpod" "\\.go")
+                        (("exec.LookPath[(][\"]slirp4netns[\"][)]")
+                         (string-append "exec.LookPath(\"" (which "slirp4netns") "\")")))
+                      (substitute* "hack/install_catatonit.sh"
+                        (("CATATONIT_PATH=\"[^\"]+\"")
+                         (string-append "CATATONIT_PATH=" (which "true"))))
+                      (substitute* "vendor/github.com/containers/common/pkg/config/config_linux.go"
+                        (("/usr/local/libexec/podman")
+                         (string-append (assoc-ref %outputs "out") "/bin")))
+                      (substitute* "vendor/github.com/containers/common/pkg/config/default.go"
+                        (("/usr/libexec/podman/conmon") (which "conmon"))
+                        (("/usr/local/libexec/cni")
+                         (string-append (assoc-ref %build-inputs "cni-plugins") "/bin"))
+                        (("/usr/bin/crun") (which "crun"))))))))
+    (inputs
+     (list btrfs-progs
+           cni-plugins
+           conmon
+           crun
+           gpgme
+           go-github-com-go-md2man
+           iptables
+           libassuan
+           libseccomp
+           libselinux
+           slirp4netns))
+    (native-inputs
+     (list bats
+           git
+           go
+           ; strace ; XXX debug
+           pkg-config))
+    (home-page "https://podman.io")
+    (synopsis "Manage containers, images, pods, and their volumes")
+    (description
+     "Podman (the POD MANager) is a tool for managing containers and images,
+volumes mounted into those containers, and pods made from groups of
+containers.")
+    (license license:asl2.0)))
-- 
2.34.0
L
L
Ludovic Courtès wrote on 24 Dec 2021 16:23
Re: [PATCH v2 1/6] gnu: add crun
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174@debbugs.gnu.org)
87v8zet4b4.fsf@gnu.org
Hello,

Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (2 lines)
> Ludovic Courtès <ludo@gnu.org> writes:

[...]

Toggle quote (17 lines)
>> Sorry for not noticing earlier: we try hard to run test suites, and only
>> disable it as a last resort, with a comment explaining why. Often, we
>> disable specific tests that cannot run in the build environment (for
>> instance because they assume network access) and run everything else.
>>
>> I had a quick go at running crun’s test suite, and there’s a number of
>> failures, which is not reassuring.
>>
>> Could you investigate a bit with the goal of fixing any actual issues
>> the test suite reveals and/or skipping individual tests that cannot be
>> run?
>
> are there some docs I could refer to on how Guix sandboxes the build?
> I tried
> https://guix.gnu.org/manual/en/html_node/Debugging-Build-Failures.html#Debugging-Build-Failures
> but I think I need to go further than sourcing env vars.

Pretty much all the tricks are there.

There’s also info on what’s visible in the build environment here:


Toggle quote (32 lines)
> I tried modifying `make check` phase to invoking `mount` to see if I
> could poke around (which didn't exactly work in my quick attempt...)
> because I'm not sure how to debug some of the issues. I suspect some are
> due to the fs layout/mounts. Probably could figure it out with some more
> time but thought it might be best to ask first.
>
> With these changes I could get them to pass by manually `make check`ing
> in the --keep-failed directory:
>
> (add-after 'unpack 'fix-tests
> (lambda _
> (substitute* (find-files "tests" "\\.(c|py)")
> (("/bin/true") (which "true"))
> (("/bin/false") (which "false"))
> ; relies on sd_notify which requires systemd?
> (("\"sd-notify\" : test_sd_notify,") "")
> (("\"sd-notify-file\" : test_sd_notify_file,") "")))))))
>
>
> from guix build:
>
> ============================================================================
> Testsuite summary for crun UNKNOWN
> ============================================================================
> # TOTAL: 73
> # PASS: 9
> # SKIP: 28
> # XFAIL: 0
> # FAIL: 36
> # XPASS: 0
> # ERROR: 0

There are 36 failures though; does ‘test-suite.log’ show more details?

Thanks,
Ludo’.
L
L
Ludovic Courtès wrote on 24 Dec 2021 16:24
Re: [PATCH v2 3/6] gnu: add libslirp
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174@debbugs.gnu.org)
87r1a2t49x.fsf@gnu.org
Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (13 lines)
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Timmy Douglas <mail@timmydouglas.com> skribis:
>>
>>> * gnu/packages/containers.scm: add libslirp
>>
>> Rather:
>>
>> * gnu/packages/containers.scm (libslirp): New variable.
>
>
> Is this generated with a guix command?

Yes, etc/committer.scm can do that for you.

Ludo’.
L
L
Ludovic Courtès wrote on 24 Dec 2021 16:25
Re: [PATCH v2 2/6] gnu: add conmon
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174@debbugs.gnu.org)
87mtkqt47p.fsf@gnu.org
Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (4 lines)
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Timmy Douglas <mail@timmydouglas.com> skribis:

[...]

Toggle quote (10 lines)
>>> + (arguments
>>> + `(#:make-flags (list ,(string-append "CC=" (cc-for-target))
>>> + (string-append "PREFIX=" %output))
>>> + #:tests? #f ; currently broken as go tries to use network
>>
>> Indentation is off.
>
> emacs really likes to indent it like that. I wonder if I'm missing
> something in my setup.

I does it right for me, but I forgot if it’s the default or if it’s
thanks to Emacs-Guix or something else.

Ludo’.
T
T
Timmy Douglas wrote on 25 Dec 2021 01:22
Re: [PATCH v2 1/6] gnu: add crun
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52174@debbugs.gnu.org)
87pmplmt24.fsf@timmydouglas.com
Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (15 lines)
>> from guix build:
>>
>> ============================================================================
>> Testsuite summary for crun UNKNOWN
>> ============================================================================
>> # TOTAL: 73
>> # PASS: 9
>> # SKIP: 28
>> # XFAIL: 0
>> # FAIL: 36
>> # XPASS: 0
>> # ERROR: 0
>
> There are 36 failures though; does ‘test-suite.log’ show more details?

Maybe my original reply wasn't clear--they all pass when I cd into the
tmp (--keep-failed) directory and run them manually. They fail when the builder runs
them. I think I put the reasons in the v3 patch. For crun, it's because
it needs the /sys/fs/cgroup mount which doesn't seem to be there for the
builder. For the others, it's a similar situation--off the top of my
head, they were either missing that mount or a /dev device.
L
L
Ludovic Courtès wrote on 1 Jan 19:11 +0100
Re: bug#52174: [PATCH] gnu: Add podman
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174-done@debbugs.gnu.org)
87wnjjnx5u.fsf_-_@gnu.org
Hi,

Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (24 lines)
> Ludovic Courtès <ludo@gnu.org> writes:
>
>>> from guix build:
>>>
>>> ============================================================================
>>> Testsuite summary for crun UNKNOWN
>>> ============================================================================
>>> # TOTAL: 73
>>> # PASS: 9
>>> # SKIP: 28
>>> # XFAIL: 0
>>> # FAIL: 36
>>> # XPASS: 0
>>> # ERROR: 0
>>
>> There are 36 failures though; does ‘test-suite.log’ show more details?
>
> Maybe my original reply wasn't clear--they all pass when I cd into the
> tmp (--keep-failed) directory and run them manually. They fail when the builder runs
> them. I think I put the reasons in the v3 patch. For crun, it's because
> it needs the /sys/fs/cgroup mount which doesn't seem to be there for the
> builder. For the others, it's a similar situation--off the top of my
> head, they were either missing that mount or a /dev device.

Oh I see. I pushed v3 as 637dec9d45db4df2a3e6aa565fa2c5cf6bb77768 with
minor tweaks (long lines and one or two synopses/descriptions tweaked.)

IWBN to see if we can still run those tests somehow, or at least the
subset of them that doesn’t rely on /sys/fs/cgroup. I’d argue that the
test harness should automatically skip tests that cannot be run; perhaps
worth raising upstream?

Thanks!

Ludo’.
Closed
T
T
Timmy Douglas wrote on 1 Jan 20:59 +0100
(name . Ludovic Courtès)(address . ludo@gnu.org)(address . 52174-done@debbugs.gnu.org)
87czlbmdlu.fsf@timmydouglas.com
Ludovic Courtès <ludo@gnu.org> writes:

Toggle quote (14 lines)
> Hi,
>
>> Timmy Douglas <mail@timmydouglas.com> skribis:
>>
>> Maybe my original reply wasn't clear--they all pass when I cd into the
>> tmp (--keep-failed) directory and run them manually. They fail when the builder runs
>> them. I think I put the reasons in the v3 patch. For crun, it's because
>> it needs the /sys/fs/cgroup mount which doesn't seem to be there for the
>> builder. For the others, it's a similar situation--off the top of my
>> head, they were either missing that mount or a /dev device.
>
> Oh I see. I pushed v3 as 637dec9d45db4df2a3e6aa565fa2c5cf6bb77768 with
> minor tweaks (long lines and one or two synopses/descriptions tweaked.)

thanks for the help Ludo!

Toggle quote (5 lines)
> IWBN to see if we can still run those tests somehow, or at least the
> subset of them that doesn’t rely on /sys/fs/cgroup. I’d argue that the
> test harness should automatically skip tests that cannot be run; perhaps
> worth raising upstream?

I'd like to get the tests to run also, but the builder sandbox appears
to be blocking some pretty major functionality that the tests would rely
on.

I think pretty much all of the container/crun ones would rely on the
cgroup mount because that's the kernel interface into the container
APIs... Is there some way that guix and the builder could eventually
expose those by default? I don't know how receptive upstream would be
towards an ask to run container tests with the container interface
disabled?

For the networking ones that fail, they try to use /dev/net/tun. Like
the cgroup one, I assume this is a kernel interface needed to perform
network operations. I guess the builders disable this as a part of the
network disabling stuff because the tests pass outside of the builder
sandbox.

The cni-plugins (cni=container network interface) use /var/run to mount
network namespaces. /var/run is present on my machine but I don't think
it exists inside the builder sandbox. The actual directory used can be
set with XDG_RUNTIME_DIR, but it appears the code still checks the
ownership of /var/run to see if it's running in a user namespace:
Closed
L
L
Ludovic Courtès wrote on 3 Jan 12:14 +0100
(name . Timmy Douglas)(address . mail@timmydouglas.com)(address . 52174-done@debbugs.gnu.org)
87czl9m5po.fsf@gnu.org
Hello,

Timmy Douglas <mail@timmydouglas.com> skribis:

Toggle quote (2 lines)
> Ludovic Courtès <ludo@gnu.org> writes:

[...]

Toggle quote (16 lines)
>> IWBN to see if we can still run those tests somehow, or at least the
>> subset of them that doesn’t rely on /sys/fs/cgroup. I’d argue that the
>> test harness should automatically skip tests that cannot be run; perhaps
>> worth raising upstream?
>
> I'd like to get the tests to run also, but the builder sandbox appears
> to be blocking some pretty major functionality that the tests would rely
> on.
>
> I think pretty much all of the container/crun ones would rely on the
> cgroup mount because that's the kernel interface into the container
> APIs... Is there some way that guix and the builder could eventually
> expose those by default? I don't know how receptive upstream would be
> towards an ask to run container tests with the container interface
> disabled?

The daemon probably won’t expose those; we’re rather conservative into
what to expose and how to change it because changes could break
bit-reproducible builds in unexpected ways.

I understand many/most tests require cgroups, I’m just wondering if we
can run at least those that don’t require it. Perhaps we’re talking
about a very limited number of tests, in which case it’s moot, I don’t
know.

Toggle quote (6 lines)
> For the networking ones that fail, they try to use /dev/net/tun. Like
> the cgroup one, I assume this is a kernel interface needed to perform
> network operations. I guess the builders disable this as a part of the
> network disabling stuff because the tests pass outside of the builder
> sandbox.

Yeah.

Toggle quote (7 lines)
> The cni-plugins (cni=container network interface) use /var/run to mount
> network namespaces. /var/run is present on my machine but I don't think
> it exists inside the builder sandbox. The actual directory used can be
> set with XDG_RUNTIME_DIR, but it appears the code still checks the
> ownership of /var/run to see if it's running in a user namespace:
> https://github.com/containernetworking/plugins/blob/2c46a726805bcf13e2f78580c57b21e9de107285/pkg/testutils/netns_linux.go

Hmm OK. So yeah, maybe there’s nothing we can do here.

Thanks for your feedback,
Ludo’.
Closed
N
N
Nguyễn Gia Phong wrote on 23 Aug 09:11 +0200
unarchive 52174
(address . control@debbugs.gnu.org)
CMD7YQ15DXEX.MVHRBE66IJXI@nix
unarchive 52174
N
N
Nguyễn Gia Phong wrote on 23 Aug 09:14 +0200
Re: [PATCH] gnu: Add podman
(address . 52174@debbugs.gnu.org)
CMD81D1XG2NF.361IMWJCOJP0X@nix
Toggle quote (3 lines)
> For podman to work, the user needs to run
> `sudo mount -t cgroup2 none /sys/fs/cgroup`

I mounted /sys/fs/cgroup as v2 but podman info still shows

host:
...
cgroupControllers: []
cgroupManager: cgroupfs
cgroupVersion: v1

and (expectedly) podman run fails:

Error: OCI runtime error: cgroups in hybrid mode not supported,
drop all controllers from cgroupv2

How do I look for a fix?
?
Your comment

This issue is archived.

To comment on this conversation send email to 52174@debbugs.gnu.org