From bfdeba11f86b18172194b416c6eb59b7cc7ef355 Mon Sep 17 00:00:00 2001 From: Ryan Sundberg Date: Wed, 29 Dec 2021 19:52:16 -0800 Subject: linux-container: Handle CLONE_NEWCGROUP and use it by default. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds low-level support for launching Linux containers with cgroup namespaces. * gnu/build/linux-container.scm (%namespaces): Add 'cgroup. (namespaces->bit-mask): Handle it. * guix/build/syscalls.scm (CLONE_NEWCGROUP): New variable. Signed-off-by: Ludovic Courtès --- gnu/build/linux-container.scm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'gnu/build') diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 4a8bed5a9a..bdeca2cdb9 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -52,7 +52,7 @@ exists." (file-exists? "/proc/self/setgroups")) (define %namespaces - '(mnt pid ipc uts user net)) + '(cgroup mnt pid ipc uts user net)) (define (call-with-clean-exit thunk) "Apply THUNK, but exit with a status code of 1 if it fails." @@ -210,6 +210,7 @@ corresponds to the symbols in NAMESPACES." ;; Use the same flags as fork(3) in addition to the namespace flags. (apply logior SIGCHLD (map (match-lambda + ('cgroup CLONE_NEWCGROUP) ('mnt CLONE_NEWNS) ('uts CLONE_NEWUTS) ('ipc CLONE_NEWIPC) -- cgit v1.2.3