Merge pull request #250949 from ShamrockLee/apptainer-localstatedir

apptainer, singularity: use self-contained LOCALSTATEDIR by default
This commit is contained in:
Silvan Mosberger 2023-11-23 01:37:54 +01:00 committed by GitHub
commit bf01ec00a0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 25 additions and 8 deletions

View File

@ -443,6 +443,10 @@
- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
- Apptainer/Singularity now defaults to using `"$out/var/lib"` for the `LOCALSTATEDIR` configuration option instead of the top-level `"/var/lib"`. This change impacts the `SESSIONDIR` (container-run-time mount point) configuration, which is set to `$LOCALSTATEDIR/<apptainer or singularity>/mnt/session`. This detaches the packages from the top-level directory, rendering the NixOS module optional.
The default behavior of the NixOS module `programs.singularity` stays unchanged. We add a new option `programs.singularity.enableExternalSysConfDir` (default to `true`) to specify whether to set the top-level `"/var/lib"` as `LOCALSTATEDIR` or not.
- DocBook option documentation is no longer supported, all module documentation now uses markdown.
- `services.outline` can now be configured to use local filesystem storage instead of S3 storage using [services.outline.storage.storageType](#opt-services.outline.storage.storageType).

View File

@ -45,6 +45,18 @@ in
Use `lib.mkForce` to forcefully specify the overridden package.
'';
};
enableExternalLocalStateDir = mkOption {
type = types.bool;
default = true;
example = false;
description = mdDoc ''
Whether to use top-level directories as LOCALSTATEDIR
instead of the store path ones.
This affects the SESSIONDIR of Apptainer/Singularity.
If set to true, the SESSIONDIR will become
`/var/lib/''${projectName}/mnt/session`.
'';
};
enableFakeroot = mkOption {
type = types.bool;
default = true;
@ -65,7 +77,9 @@ in
config = mkIf cfg.enable {
programs.singularity.packageOverriden = (cfg.package.override (
optionalAttrs cfg.enableFakeroot {
optionalAttrs cfg.enableExternalLocalStateDir {
externalLocalStateDir = "/var/lib";
} // optionalAttrs cfg.enableFakeroot {
newuidmapPath = "/run/wrappers/bin/newuidmap";
newgidmapPath = "/run/wrappers/bin/newgidmap";
} // optionalAttrs cfg.enableSuid {
@ -80,12 +94,8 @@ in
group = "root";
source = "${cfg.packageOverriden}/libexec/${cfg.packageOverriden.projectName}/bin/starter-suid.orig";
};
systemd.tmpfiles.rules = [
systemd.tmpfiles.rules = mkIf cfg.enableExternalLocalStateDir [
"d /var/lib/${cfg.packageOverriden.projectName}/mnt/session 0770 root root -"
"d /var/lib/${cfg.packageOverriden.projectName}/mnt/final 0770 root root -"
"d /var/lib/${cfg.packageOverriden.projectName}/mnt/overlay 0770 root root -"
"d /var/lib/${cfg.packageOverriden.projectName}/mnt/container 0770 root root -"
"d /var/lib/${cfg.packageOverriden.projectName}/mnt/source 0770 root root -"
];
};

View File

@ -71,6 +71,8 @@ in
, newuidmapPath ? null
# Path to SUID-ed newgidmap executable
, newgidmapPath ? null
# External LOCALSTATEDIR
, externalLocalStateDir ? null
# Remove the symlinks to `singularity*` when projectName != "singularity"
, removeCompat ? false
# Workaround #86349
@ -106,6 +108,7 @@ in
inherit
enableSeccomp
enableSuid
externalLocalStateDir
projectName
removeCompat
starterSuidPath
@ -141,7 +144,7 @@ in
configureScript = "./mconfig";
configureFlags = [
"--localstatedir=/var/lib"
"--localstatedir=${if externalLocalStateDir != null then externalLocalStateDir else "${placeholder "out"}/var/lib"}"
"--runstatedir=/var/run"
]
++ lib.optional (!enableSeccomp) "--without-seccomp"

View File

@ -111,7 +111,7 @@ rec {
touch .${projectName}.d/env/94-appsbase.sh
cd ..
mkdir -p /var/lib/${projectName}/mnt/{container,final,overlay,session,source}
mkdir -p /var/lib/${projectName}/mnt/session
echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd
echo > /etc/resolv.conf
TMPDIR=$(pwd -P) ${projectName} build $out ./img