Re: guix pack isolation

[Simon Tournier]

Hi,

On ven., 10 févr. 2023 at 00:25, Kyle Andrews <kyle@posteo.net> wrote:

> I am wondering how I can/should go about isolating containers created
> using `guix pack`. Right now they are inheriting configurations from my
> personal user folder.
>
> My system administrators are still quite skeptical about installing
> Guix, but they have made it convenient to submit singularity container
> jobs via SLURM. Otherwise, I would prefer to use `guix shell` because it
> seems to make it easy to create a fully isolated container.

>From my point of view, you have 2 options: relocatable or squashfs.

About relocatable pack, you might be interested by:

    https://hpc.guix.info/blog/2020/05/faster-relocatable-packs-with-fakechroot/


About squashfs (Singularity container), you can try:

    guix pack -f squashfs python python-numpy bash-minimal -S /bin=bin

which will produce a compressed squashfs that you then import with
Singularity.  I do not have Singularity at hand, let demo with Docker
which is very similar.

1. Produce the pack on the machine running Guix

--8<---------------cut here---------------start------------->8---
$ guix pack -f docker python python-numpy bash -S /bin=bin
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'... 100.0%
The following derivations will be built:
  
/gnu/store/nid89k59pcxkl6lg7mlppqk8qmizbn6p-python-python-numpy-bash-docker-pack.tar.gz.drv
  /gnu/store/jlib2ngiianwv6854c1kbl6zlgixxg48-module-import.drv
  /gnu/store/irsn92v5ykaxb4yrynrr45hp6jkd4cxc-profile.drv

1,2 MB will be downloaded
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'... 100.0%
 guile-json-3.5.0  44KiB              1.1MiB/s 00:00 [##################] 100.0%
 module-import  1KiB                  508KiB/s 00:00 [##################] 100.0%
building profile with 3 packages...
 module-import-compiled  1.1MiB       5.4MiB/s 00:00 [##################] 100.0%
building 
/gnu/store/nid89k59pcxkl6lg7mlppqk8qmizbn6p-python-python-numpy-bash-docker-pack.tar.gz.drv...
/gnu/store/i3hkgkjq672hic4nkn4g718b9sggg4rh-python-python-numpy-bash-docker-pack.tar.gz
--8<---------------cut here---------------end--------------->8---

2. Transfer the produce pack (…-docker-pack.tar.gz) to the machine without Guix.
3. Load the pack and use it!

--8<---------------cut here---------------start------------->8---
$ docker load < my-docker-pack.tar.gz
Loaded image: python-python-numpy-bash:latest

$ docker run -ti python-python-numpy-bash:latest python3
Python 3.9.9 (main, Jan  1 1970, 00:00:01) 
[GCC 10.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import numpy as np
import numpy as np
>>> A = np.array([[1,0,1],[0,1,0],[0,0,1]]);
A = np.array([[1,0,1],[0,1,0],[0,0,1]]);
>>> _, s, _ = np.linalg.svd(A); s; abs(s[0] - 1./s[2])
_, s, _ = np.linalg.svd(A); s; abs(s[0] - 1./s[2])
array([1.61803399, 1.        , 0.61803399])
0.0
>>> 
--8<---------------cut here---------------end--------------->8---

Cheers,
simon