From e086dcfcf9b18cb7b4619d9ee5aaa2f1ab1aef1e Mon Sep 17 00:00:00 2001
From: David Thompson <davet@gnu.org>
Date: Mon, 8 Jun 2015 09:04:38 -0400
Subject: scripts: system: Add 'container' action.

* guix/scripts/system.scm (show-help): Display 'container' action.
  (system-derivation-for-action, guix-system): Add 'container' case.
  (perform-action): Skip GRUB config generation when building a container.
* doc/guix.texi (Invoking guix system): Document it.
---
 doc/guix.texi                  | 21 +++++++++++++++++++++
 gnu/system/linux-container.scm |  7 ++++++-
 guix/scripts/system.scm        | 19 +++++++++++++------
 3 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 7715b72818..9e15cbd601 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -7168,6 +7168,27 @@ using the following command:
 # dd if=$(guix system disk-image my-os.scm) of=/dev/sdc
 @end example
 
+@item container
+Return a script to run the operating system declared in @var{file}
+within a container.  Currently, the script must be run as root in order
+to support more than a single user and group.
+
+The container shares its store with the host system.
+
+Additional file systems can be shared between the host and the container
+using the @code{--share} and @code{--expose} command-line options: the
+former specifies a directory to be shared with write access, while the
+latter provides read-only access to the shared directory.
+
+The example below creates a container in which the user's home directory
+is accessible read-only, and where the @file{/exchange} directory is a
+read-write mapping of the host's @file{$HOME/tmp}:
+
+@example
+guix system container my-config.scm \
+   --expose=$HOME --share=$HOME/tmp=/exchange
+@end example
+
 @end table
 
 @var{options} can contain any of the common build options provided by
diff --git a/gnu/system/linux-container.scm b/gnu/system/linux-container.scm
index fdf7460872..08513e8870 100644
--- a/gnu/system/linux-container.scm
+++ b/gnu/system/linux-container.scm
@@ -106,7 +106,12 @@ that will be shared with the host system."
                 (setenv "TMPDIR" "/tmp")
                 (setenv "GUIX_NEW_SYSTEM" #$os-drv)
                 (for-each mkdir-p '("/run" "/bin" "/etc" "/home" "/var"))
-                (primitive-load (string-append #$os-drv "/boot"))))))
+                (primitive-load (string-append #$os-drv "/boot")))
+              ;; A range of 65536 uid/gids is used to cover 16 bits worth of
+              ;; users and groups, which is sufficient for most cases.
+              ;;
+              ;; See: http://www.freedesktop.org/software/systemd/man/systemd-nspawn.html#--private-users=
+              #:host-uids 65536)))
 
       (gexp->script "run-container" script
                     #:modules '((ice-9 match)
diff --git a/guix/scripts/system.scm b/guix/scripts/system.scm
index 8775267f80..c2739022ea 100644
--- a/guix/scripts/system.scm
+++ b/guix/scripts/system.scm
@@ -33,6 +33,7 @@
   #:use-module (gnu build install)
   #:use-module (gnu system)
   #:use-module (gnu system file-systems)
+  #:use-module (gnu system linux-container)
   #:use-module (gnu system vm)
   #:use-module (gnu system grub)
   #:use-module (gnu services)
@@ -336,6 +337,8 @@ list of services."
   (case action
     ((build init reconfigure)
      (operating-system-derivation os))
+    ((container)
+     (container-script os #:mappings mappings))
     ((vm-image)
      (system-qemu-image os #:disk-image-size image-size))
     ((vm)
@@ -368,10 +371,12 @@ building anything."
                                                 #:full-boot? full-boot?
                                                 #:mappings mappings))
        (grub      (package->derivation grub))
-       (grub.cfg  (operating-system-grub.cfg os
-                                             (if (eq? 'init action)
-                                                 '()
-                                                 (previous-grub-entries))))
+       (grub.cfg  (if (eq? 'container action)
+                      (return #f)
+                      (operating-system-grub.cfg os
+                                                 (if (eq? 'init action)
+                                                     '()
+                                                     (previous-grub-entries)))))
        (drvs   -> (if (and grub? (memq action '(init reconfigure)))
                       (list sys grub grub.cfg)
                       (list sys)))
@@ -451,6 +456,8 @@ Build the operating system declared in FILE according to ACTION.\n"))
    reconfigure      switch to a new operating system configuration\n"))
   (display (_ "\
    build            build the operating system without installing anything\n"))
+  (display (_ "\
+  container         build a Linux container that shares the host's store\n"))
   (display (_ "\
    vm               build a virtual machine image that shares the host's store\n"))
   (display (_ "\
@@ -557,7 +564,7 @@ Build the operating system declared in FILE according to ACTION.\n"))
         (alist-cons 'argument arg result)
         (let ((action (string->symbol arg)))
           (case action
-            ((build vm vm-image disk-image reconfigure init
+            ((build container vm vm-image disk-image reconfigure init
               extension-graph dmd-graph)
              (alist-cons 'action action result))
             (else (leave (_ "~a: unknown action~%") action))))))
@@ -586,7 +593,7 @@ Build the operating system declared in FILE according to ACTION.\n"))
         (exit 1))
 
       (case action
-        ((build vm vm-image disk-image reconfigure)
+        ((build container vm vm-image disk-image reconfigure)
          (unless (= count 1)
            (fail)))
         ((init)
-- 
cgit 1.4.1