bug#47106: Bubblewrap hates Guix containers 😞

[Leo Prikler]

Am Sonntag, den 14.03.2021, 21:32 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > Nah, it's a rather ad-hoc definition grown from what should be an
> > Eolie
> > container from the cookbook (also refer to #47097).
> > 
> >     guix environment --preserve='^DISPLAY$' --preserve=XAUTHORITY \
> >      --preserve=TERM \
> >      --expose=$XAUTHORITY \
> >      --expose=/etc/machine-id \
> >      --expose=/etc/ssl/certs/ \
> >      --expose=/sys/block --expose=/sys/class --expose=/sys/bus \
> >      --expose=/sys/dev --expose=/sys/devices \
> >      --ad-hoc epiphany nss-certs dbus procps coreutils psmisc
> > screen
> 
> I’m not sure I follow; does it work when you do this?
It does work insofar as I don't get any warnings about resources
missing from /sys, but the bubblewrapped WebKit processes don't have
access to $DISPLAY even though epiphany itself has.  While they don't
crash the browser itself and just infinitely respawn, that's still far
from usable.

> /sys is already mounted inside ‘guix environment -C’ containers so I
> don’t see what difference it would make.
I think I've been told this several times, but I don't believe it.  Not
adding all these expose=/sys lines triggers the "warnings" in the
original post.  (Okay, perhaps one of /sys/dev and /sys/devices is
superfluous, I would need to check.)

> But wait, the example above lacks ‘-C’; a mistake?
Indeed, -CN should also be given, but I hastily edited the command line
inside the email to make it appear more beautiful than it actually is,
thereby deleting it.  I'm sorry.  The preserves and exposes should be
the same list as I'm actually using however.

Regards,
Leo