diff options
| author | Ryan Sundberg <ryan@arctype.co> | 2021-12-29 19:52:16 -0800 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2022-01-05 23:44:18 +0100 |
| commit | bfdeba11f86b18172194b416c6eb59b7cc7ef355 (patch) | |
| tree | 8dc74b57f6ff1d821235542eed18e066a999773d | |
| parent | 2c1807c516185a3d3d7cdca23297ca480dab16d4 (diff) | |
| download | guix-patches-bfdeba11f86b18172194b416c6eb59b7cc7ef355.tar guix-patches-bfdeba11f86b18172194b416c6eb59b7cc7ef355.tar.gz | |
linux-container: Handle CLONE_NEWCGROUP and use it by default.
Adds low-level support for launching Linux containers with cgroup namespaces.
* gnu/build/linux-container.scm (%namespaces): Add 'cgroup.
(namespaces->bit-mask): Handle it.
* guix/build/syscalls.scm (CLONE_NEWCGROUP): New variable.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| -rw-r--r-- | gnu/build/linux-container.scm | 3 | ||||
| -rw-r--r-- | guix/build/syscalls.scm | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 4a8bed5a9a..bdeca2cdb9 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -52,7 +52,7 @@ exists." (file-exists? "/proc/self/setgroups")) (define %namespaces - '(mnt pid ipc uts user net)) + '(cgroup mnt pid ipc uts user net)) (define (call-with-clean-exit thunk) "Apply THUNK, but exit with a status code of 1 if it fails." @@ -210,6 +210,7 @@ corresponds to the symbols in NAMESPACES." ;; Use the same flags as fork(3) in addition to the namespace flags. (apply logior SIGCHLD (map (match-lambda + ('cgroup CLONE_NEWCGROUP) ('mnt CLONE_NEWNS) ('uts CLONE_NEWUTS) ('ipc CLONE_NEWIPC) diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm index 45f95c509d..a7401fd73f 100644 --- a/guix/build/syscalls.scm +++ b/guix/build/syscalls.scm @@ -132,6 +132,7 @@ CLONE_CHILD_CLEARTID CLONE_CHILD_SETTID + CLONE_NEWCGROUP CLONE_NEWNS CLONE_NEWUTS CLONE_NEWIPC @@ -1025,6 +1026,7 @@ caller lacks root privileges." ;; Linux clone flags, from linux/sched.h (define CLONE_CHILD_CLEARTID #x00200000) (define CLONE_CHILD_SETTID #x01000000) +(define CLONE_NEWCGROUP #x02000000) (define CLONE_NEWNS #x00020000) (define CLONE_NEWUTS #x04000000) (define CLONE_NEWIPC #x08000000) |