diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2025-04-04 16:36:17 +0200 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2025-05-05 14:33:59 +0200 |
| commit | a391394a22f76e29459132888f9950ad74993c5f (patch) | |
| tree | 1bffa4e09ffb41f97b7cf3311940ac52c02b7f0f /gnu/system | |
| parent | acc4215644a8730e69ab1127e897d7eed56db952 (diff) | |
linux-container: Support having a read-only root file system.
Until now, the read-only file system set up by ‘call-with-container’
would always be writable. With this change, it can be made read-only.
With this patch, only ‘least-authority-wrapper’ switches to a read-only
root file system.
* gnu/build/linux-container.scm (remount-read-only): New procedure.
(mount-file-systems): Add #:writable-root? and #:populate-file-system
and honor them.
(run-container): Likewise.
(call-with-container): Likewise.
* gnu/system/linux-container.scm (container-script): Pass #:writable-root?
to ‘call-with-container’.
(eval/container): Add #:populate-file-system and #:writable-root? and
honor them.
* guix/scripts/environment.scm (launch-environment/container):
Pass #:writable-root? to ‘call-with-container’.
* guix/scripts/home.scm (spawn-home-container): Likewise.
* tests/containers.scm ("call-with-container, mnt namespace, read-only root")
("call-with-container, mnt namespace, writable root"): New tests.
Change-Id: I603e2fd08851338b737bb16c8af3f765e2538906
Diffstat (limited to 'gnu/system')
| -rw-r--r-- | gnu/system/linux-container.scm | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/gnu/system/linux-container.scm b/gnu/system/linux-container.scm index 3622328500..e7cb90d091 100644 --- a/gnu/system/linux-container.scm +++ b/gnu/system/linux-container.scm @@ -312,12 +312,15 @@ Run the container with the given options.")) #:namespaces (if #$shared-network? (delq 'net %namespaces) %namespaces) + #:writable-root? #t #:process-spawned-hook explain))))) (gexp->script "run-container" script))) (define* (eval/container exp #:key + (populate-file-system (const #t)) + writable-root? (mappings '()) (mounts '()) (namespaces %namespaces) @@ -367,6 +370,8 @@ effects." (list "-c" (object->string (lowered-gexp-sexp lowered)))))) + #:writable-root? writable-root? + #:populate-file-system populate-file-system #:namespaces namespaces #:guest-uid guest-uid #:guest-gid guest-gid)))))) |