[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#70933] [PATCH] system: Do not add "--disable-chroot" to containers.
From: |
Ludovic Courtès |
Subject: |
[bug#70933] [PATCH] system: Do not add "--disable-chroot" to containers. |
Date: |
Fri, 31 May 2024 14:01:36 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) |
Hi,
Andreas Enge <andreas@enge.fr> skribis:
> The rationale for these lines is that they enable non-privileged docker
> containers. But I would like to create a privileged container with
> chroot (in an openshift environment, where I suppose this environment
> does additional encapsulation to enforce security), which these lines
> prevent.
>
> Users can still add the option. Alternatively, we could add an additional
> field "chroot? (default: #t)" to guix-configuration.
[...]
> - ((eq? guix-service-type (service-kind s))
> - ;; Pass '--disable-chroot' so that
> - ;; guix-daemon can build thing even in
> - ;; Docker without '--privileged'.
This is tricky, I’m not sure how to provide defaults that works in most
common setups while still allowing the use of privileged Docker
containers as in your case.
I think the current default is good because it’s the common case, but I
agree that we need to find a way to override it.
Thoughts?
Ludo’.