projects/guix·blob sysadmin-team · refs

330 lines · 13.6 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2018 Danny Milosavljevic <[email protected]>
3;;; Copyright © 2020 Jakub Kądziołka <[email protected]>
4;;; Copyright © 2020, 2021 Maxim Cournoyer <[email protected]>
5;;; Copyright © 2020 Efraim Flashner <[email protected]>
6;;; Copyright © 2020 Jesse Dowell <[email protected]>
7;;; Copyright © 2021 Brice Waegeneire <[email protected]>
8;;; Copyright © 2023, 2024, 2025 Giacomo Leidi <[email protected]>
9;;;
10;;; This file is part of GNU Guix.
11;;;
12;;; GNU Guix is free software; you can redistribute it and/or modify it
13;;; under the terms of the GNU General Public License as published by
14;;; the Free Software Foundation; either version 3 of the License, or (at
15;;; your option) any later version.
16;;;
17;;; GNU Guix is distributed in the hope that it will be useful, but
18;;; WITHOUT ANY WARRANTY; without even the implied warranty of
19;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20;;; GNU General Public License for more details.
21;;;
22;;; You should have received a copy of the GNU General Public License
23;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
24
25(define-module (gnu services docker)
26 #:use-module (gnu services)
27 #:use-module (gnu services configuration)
28 #:use-module (gnu services containers)
29 #:use-module (gnu services shepherd)
30 #:use-module (gnu system privilege)
31 #:use-module (gnu system shadow)
32 #:use-module (gnu packages docker)
33 #:use-module (gnu packages linux) ;singularity
34 #:use-module (guix deprecation)
35 #:use-module (guix diagnostics)
36 #:use-module (guix gexp)
37 #:use-module (guix i18n)
38 #:use-module (guix records)
39 #:use-module (srfi srfi-1)
40 #:use-module (ice-9 format)
41 #:use-module (ice-9 match)
42 #:re-export (oci-image ;for backwards compatibility, until the
43 oci-image? ;oci-container-service-type is fully deprecated
44 oci-image-fields
45 oci-image-repository
46 oci-image-tag
47 oci-image-value
48 oci-image-pack-options
49 oci-image-target
50 oci-image-system
51 oci-image-grafts?
52 oci-container-configuration
53 oci-container-configuration?
54 oci-container-configuration-fields
55 oci-container-configuration-user
56 oci-container-configuration-group
57 oci-container-configuration-command
58 oci-container-configuration-entrypoint
59 oci-container-configuration-host-environment
60 oci-container-configuration-environment
61 oci-container-configuration-image
62 oci-container-configuration-provision
63 oci-container-configuration-requirement
64 oci-container-configuration-log-file
65 oci-container-configuration-auto-start?
66 oci-container-configuration-respawn?
67 oci-container-configuration-shepherd-actions
68 oci-container-configuration-network
69 oci-container-configuration-ports
70 oci-container-configuration-volumes
71 oci-container-configuration-container-user
72 oci-container-configuration-workdir
73 oci-container-configuration-extra-arguments)
74
75 #:export (containerd-configuration
76 containerd-service-type
77 docker-configuration
78 docker-service-type
79 singularity-service-type
80 ;; For backwards compatibility, until the
81 ;; oci-container-service-type is fully deprecated.
82 oci-container-shepherd-service
83 oci-container-service-type
84 %oci-container-accounts))
85
86(define-maybe file-like)
87
88(define-configuration docker-configuration
89 (docker
90 (file-like docker)
91 "Docker daemon package.")
92 (docker-cli
93 (file-like docker-cli)
94 "Docker client package.")
95 (containerd
96 (file-like containerd)
97 "Deprecated. Do not use.")
98 (proxy
99 (file-like docker-libnetwork-cmd-proxy)
100 "The proxy package to support inter-container and outside-container
101loop-back communications.")
102 (enable-proxy?
103 (boolean #t)
104 "Enable or disable the user-land proxy (enabled by default).")
105 (debug?
106 (boolean #f)
107 "Enable or disable debug output.")
108 (enable-iptables?
109 (boolean #t)
110 "Enable addition of iptables rules (enabled by default).")
111 (environment-variables
112 (list '())
113 "Environment variables to set for dockerd")
114 (config-file
115 (maybe-file-like)
116 "JSON configuration file to pass to dockerd")
117 (no-serialization))
118
119(define-configuration containerd-configuration
120 (containerd
121 (file-like containerd)
122 "containerd package.")
123 (debug?
124 (boolean #f)
125 "Enable or disable debug output.")
126 (environment-variables
127 (list '())
128 "Environment variables to set for containerd.")
129 (no-serialization))
130
131(define %docker-accounts
132 (list (user-group (name "docker") (system? #t))))
133
134(define (%containerd-activation config)
135 (let ((state-dir "/var/lib/containerd"))
136 #~(begin
137 (use-modules (guix build utils))
138 (mkdir-p #$state-dir))))
139
140(define (%docker-activation config)
141 (%containerd-activation config)
142 (let ((state-dir "/var/lib/docker"))
143 #~(begin
144 (use-modules (guix build utils))
145 (mkdir-p #$state-dir))))
146
147(define (containerd-shepherd-service config)
148 (match-record config <containerd-configuration>
149 (containerd debug? environment-variables)
150 (shepherd-service
151 (documentation "containerd daemon.")
152 (provision '(containerd))
153 (requirement '(user-processes))
154 (start #~(make-forkexec-constructor
155 (list (string-append #$containerd "/bin/containerd")
156 #$@(if debug?
157 '("--log-level=debug")
158 '()))
159 ;; For finding containerd-shim binary.
160 #:environment-variables
161 (list #$@environment-variables
162 (string-append "PATH=" #$containerd "/bin"))
163 #:pid-file "/run/containerd/containerd.pid"
164 #:pid-file-timeout 300
165 #:log-file "/var/log/containerd.log"))
166 (stop #~(make-kill-destructor)))))
167
168(define containerd-service-type
169 (service-type (name 'containerd)
170 (description "Run containerd container runtime.")
171 (extensions
172 (list
173 ;; Make sure the 'ctr' command is available.
174 (service-extension profile-service-type
175 (compose list containerd-configuration-containerd))
176 (service-extension shepherd-root-service-type
177 (lambda (config)
178 (list (containerd-shepherd-service config))))))
179 (default-value (containerd-configuration))))
180
181(define (docker-shepherd-service config)
182 (let* ((docker (docker-configuration-docker config))
183 (enable-proxy? (docker-configuration-enable-proxy? config))
184 (enable-iptables? (docker-configuration-enable-iptables? config))
185 (environment-variables (docker-configuration-environment-variables config))
186 (proxy (docker-configuration-proxy config))
187 (debug? (docker-configuration-debug? config))
188 (config-file (docker-configuration-config-file config)))
189 (shepherd-service
190 (documentation "Docker daemon.")
191 (provision '(dockerd))
192 (requirement '(user-processes
193 containerd
194 dbus-system
195 elogind
196 file-system-/sys/fs/cgroup
197 networking
198 udev))
199 (start #~(make-forkexec-constructor
200 (list (string-append #$docker "/bin/dockerd")
201 "-p" "/var/run/docker.pid"
202 #$@(if (not (eq? config-file %unset-value))
203 (list #~(string-append
204 "--config-file=" #$config-file))
205 '())
206 #$@(if debug?
207 '("--debug" "--log-level=debug")
208 '())
209 #$@(if enable-proxy?
210 (list "--userland-proxy=true"
211 #~(string-append
212 "--userland-proxy-path=" #$proxy "/bin/proxy"))
213 '("--userland-proxy=false"))
214 (if #$enable-iptables?
215 "--iptables"
216 "--iptables=false")
217 "--containerd" "/run/containerd/containerd.sock")
218 #:environment-variables
219 (list #$@environment-variables)
220 #:pid-file "/var/run/docker.pid"
221 #:log-file "/var/log/docker.log"))
222 (stop #~(make-kill-destructor)))))
223
224(define docker-service-type
225 (service-type (name 'docker)
226 (description "Provide capability to run Docker application
227bundles in Docker containers.")
228 (extensions
229 (list
230 ;; Make sure the 'docker' command is available.
231 (service-extension profile-service-type
232 (compose list docker-configuration-docker-cli))
233 (service-extension activation-service-type
234 %docker-activation)
235 (service-extension shepherd-root-service-type
236 (lambda (config)
237 (list (docker-shepherd-service config))))
238 (service-extension account-service-type
239 (const %docker-accounts))))
240 (default-value (docker-configuration))))
241
242
243;;;
244;;; Singularity.
245;;;
246
247(define %singularity-activation
248 (with-imported-modules '((guix build utils))
249 #~(begin
250 (use-modules (guix build utils))
251
252 (define %mount-directory
253 "/var/singularity/mnt/")
254
255 ;; Create the directories that Singularity 2.6 expects to find. Make
256 ;; them #o755 like the 'install-data-hook' rule in 'Makefile.am' of
257 ;; Singularity 2.6.1.
258 (for-each (lambda (directory)
259 (let ((directory (string-append %mount-directory
260 directory)))
261 (mkdir-p directory)
262 (chmod directory #o755)))
263 '("container" "final" "overlay" "session"))
264 (chmod %mount-directory #o755))))
265
266(define (singularity-privileged-programs singularity)
267 "Return the privileged programs that SINGULARITY needs."
268 (define helpers
269 ;; The helpers, under a meaningful name.
270 (computed-file "singularity-privileged-helpers"
271 #~(begin
272 (mkdir #$output)
273 (for-each (lambda (program)
274 (symlink (string-append #$singularity
275 "/libexec/singularity"
276 "/bin/"
277 program "-suid")
278 (string-append #$output
279 "/singularity-"
280 program
281 "-helper")))
282 '("action" "mount" "start")))))
283
284 (map file-like->setuid-program
285 (list (file-append helpers "/singularity-action-helper")
286 (file-append helpers "/singularity-mount-helper")
287 (file-append helpers "/singularity-start-helper"))))
288
289(define singularity-service-type
290 (service-type (name 'singularity)
291 (description
292 "Install the Singularity application bundle tool.")
293 (extensions
294 (list (service-extension privileged-program-service-type
295 singularity-privileged-programs)
296 (service-extension activation-service-type
297 (const %singularity-activation))))
298 (default-value singularity)))
299
300
301;;;
302;;; OCI container.
303;;;
304
305;; For backwards compatibility, until the
306;; oci-container-service-type is fully deprecated.
307(define-deprecated (oci-container-shepherd-service config)
308 oci-service-type
309 ((@ (gnu services containers) oci-container-shepherd-service)
310 'docker config))
311(define %oci-container-accounts
312 (filter user-account? (oci-service-accounts (oci-configuration))))
313
314(define oci-container-service-type
315 (service-type (name 'oci-container)
316 (extensions
317 (list (service-extension oci-service-type
318 (lambda (containers)
319 (warning
320 (G_
321 "'oci-container-service-type' is\
322 deprecated, use 'oci-service-type' instead~%"))
323 (oci-extension
324 (containers containers))))))
325 (default-value '())
326 (extend append)
327 (compose concatenate)
328 (description
329 "This service allows the management of OCI
330containers as Shepherd services.")))