GNU bug report logs - #56076
guix shell -P behavior is surprising with persistent home

Previous Next

Full log

Message #8 received at 56076 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Ethan Blanton <elb <at> kb8ojh.net>
Cc: 56076 <at> debbugs.gnu.org
Subject: Re: bug#56076: guix shell -P behavior is surprising with persistent
 home
Date: Fri, 24 Jun 2022 23:10:21 +0200

Hi Ethan,

Ethan Blanton <elb <at> kb8ojh.net> skribis:

> I am using guix shell to create an isolated container, but using a
> persistent home directory to preserve configuration and state for the
> program in the container.  Specifically, I am using (lightly
> simplified; note that the user is elb and the manifest contains ONLY
> syncthing):
>
> CONTAINER_HOME=/path/to/persistent/home
> MANIFEST=/path/to/manifest.scm
>
> guix shell --container --network --no-cwd -P      \
>            --share=$CONTAINER_HOME=/home/elb --   \
>            /bin/sh -c 'SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs" syncthing'
>
> Because syncthing requires a certificate store, the easiest way to
> configure that seemed to be through the profile /etc dir, which meant
> using -P.  The above command works, and works correctly, but only the
> first time the profile is started.

I guess it’s confusing because ‘-P’ and ‘--share’ kind of step on each
other’s toes: they both want to control /home/elb.

> On subsequent starts, guix complains that:
>
> guix shell: error: cannot link profile: '/home/elb/.guix-profile' already exists within container
>
> This is easily worked around by removing .guix-profile from the
> --share-bound home directory before invoking guix shell.
>
> It is not clear to me that this is a bug, but it was surprising.  It
> was also surprising that there was not an obvious way to simply
> declare a persistent home directory for a container, although now that
> I understand the `guix shell` command better, I find this less
> surprising than I did when I was first exploring.

Yeah, I’m not sure how to better handle that; the two options are
conflicting.

That said, for this particular use case, you could do:

  guix shell syncthing nss-certs openssl -- syncthing

Adding ‘openssl’ to the mix is a trick to ensure that SSL_CERT_DIR is
defined, thanks to the search path mechanism:

  https://guix.gnu.org/manual/devel/en/html_node/Search-Paths.html

Thoughts?

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.