Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rkt: run api service and make socket activatable #40534

Closed
wants to merge 1 commit into from
Closed

rkt: run api service and make socket activatable #40534

wants to merge 1 commit into from

Conversation

peterhoeg
Copy link
Member

Motivation for this change

The rkt-metadata service is socket activatable so there is no point running it eagerly. Also, it was just called "rkt" in the past which isn't really descriptive as it isn't needed for running regular containers but is a metadata service.

We also now run the API service.

Cc: @Mic92 and @coretemp who have shown interest in the socket activation stuff

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@GrahamcOfBorg
Copy link

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: rkt

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

@GrahamcOfBorg
Copy link

Success on x86_64-linux (full log)

Attempted: rkt

Partial log (click to expand)

these paths will be fetched (53.60 MiB download, 64.60 MiB unpacked):
  /nix/store/grpmiddag0npm1r0dhyi0a7i4rkljpgw-rkt-1.30.0
copying path '/nix/store/grpmiddag0npm1r0dhyi0a7i4rkljpgw-rkt-1.30.0' from 'https://cache.nixos.org'...
/nix/store/grpmiddag0npm1r0dhyi0a7i4rkljpgw-rkt-1.30.0

Mic92
Mic92 reviewed May 15, 2018
View reviewed changes
nixos/modules/virtualisation/rkt.nix
};
};

systemd.tmpfiles.rules = [
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain why all these files are needed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upstream wants it

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which services creates this usually?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I should have been clearer - sorry. In order to be able to actually interact with rkt without being root/using sudo, you need to be a member of the rkt group.

Without this PR:

peter@dolores:~ $ rkt list
list: failed to get pod handles: mkdir /var/lib/rkt/pods: permission denied

With it:

peter@dolores:~ $ rkt list
UUID	APP	IMAGE NAME	STATE	CREATED	STARTED	NETWORKS

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we maybe use the upstream file? environment.etc."tmpfiles.d/rkt.conf".source = "${rkt}/lib/tmpfiles.d/rkt.conf";?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, it is not installed by default. Adding the following to postInstall should do it.

mkdir -p $out/lib/tmpfiles.d
install -Dm644 dist/init/systemd/tmpfiles.d/rkt.conf $out/lib/tmpfiles.d/rkt.conf

Taken from https://github.com/rkt/rkt/blob/601d9887c5f3659c0e5f72ce1f839787c55fd1f3/scripts/install-rkt.sh#L57

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Services should probably be installed the same way. And systemd.packages should probably recognize tmpfiles.d (#40594).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I understand it, files in tmpfiles.d are not automatically loaded on NixOS. We need to add them to systemd.tmpfiles.rules.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From

nixpkgs/nixos/modules/system/boot/systemd.nix

Lines 773 to 781 in 8a93595

"tmpfiles.d/systemd.conf".source = "${systemd}/example/tmpfiles.d/systemd.conf";
"tmpfiles.d/x11.conf".source = "${systemd}/example/tmpfiles.d/x11.conf";
"tmpfiles.d/nixos.conf".text = ''
# This file is created automatically and should not be modified.
# Please change the option ‘systemd.tmpfiles.rules’ instead.
${concatStringsSep "\n" cfg.tmpfiles.rules}
'';
, it seems like they are.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Files that are simply part of the package distribution aren't added - so we need to add it to /etc/tmpfiles.d like it's done here or alternatively builtins.readFile. In any case, there is no need to re-invent the wheel so I will adjust this to use the file distributes with upstream. We could it it similarly for the units.

@mmahut
Copy link
Member

mmahut commented Aug 3, 2019

What is the status of this pull request?

@peterhoeg
Copy link
Member Author

rkt is for all intents and purposes dead, so we might as well close this.

@peterhoeg peterhoeg closed this Aug 5, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mic92 Mic92 Mic92 left review comments

@jtojnar jtojnar jtojnar left review comments

Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@peterhoeg @GrahamcOfBorg @mmahut @Mic92 @jtojnar