--privileged required to run guix container

[fanquake]

Running any docker image with --privileged is far from ideal.

When the operator executes docker run --privileged, Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host.

I started looking at running the guix image without --privileged:

guix environment: error: build failed: cloning builder process: Operation not permitted

Adding --cap-add=SYS_ADMIN, which is also far from ideal, see "CAP_SYS_ADMIN: the new root", solved that, but lead to:

guix environment: error: build failed: while setting up the build environment: cannot set loopback interface flags: Operation not permitted

So I added --cap-add=NET_ADMIN. I'm now at:

guix environment: error: build failed: while setting up the build environment: cannot pivot old root directory onto '/gnu/store/380c843hbacsr4dvj9dpqb5dw11x60dd-ca-certificate-bundle.drv.chroot/real-root': Operation not permitted

[dongcarl]

Perhaps this might give us a better starting point: https://stackoverflow.com/a/47991611

[maflcko]

Same issue with podman

[trevarj]

I was able to get past this by providing --isolate-host-loopback to guix-daemon. Another detail is that you must change the guix-daemon.service (systemd) to use /var/guix/profiles/per-user/%u/current-guix/bin/guix-daemon (user instead of root).

Ex. in guix-daemon.service

ExecStart=/usr/bin/toolbox run sudo /var/guix/profiles/per-user/%u/current-guix/bin/guix-daemon \
    --build-users-group=guixbuild \
    --discover=no \
    --isolate-host-loopback \
    --substitute-urls='https://bordeaux.guix.gnu.org'

See: Invoking Guix Daemon

Note: I am using Silverblue here which is why I have /usr/bin/toolbox. Should be interchangeable with podman (and maybe docker?) though

[fanquake]

Interesting; thanks for having a look. We can look at implementing this, when Guix makes a new release, that should include this flag.

[maflcko]

fixed in guix 1.5? https://guix.gnu.org/en/blog/2026/gnu-guix-1.5.0-released/#:~:text=Security%20improvements