Skip to main content
Revision df716c98d203ab64cdf05f9c17fdae565b7daa1c authored by Eelco Dolstra on 23 June 2012, 04:28:35 UTC, committed by Eelco Dolstra on 23 June 2012, 04:28:35 UTC
In chroot builds, use a private network namespace
On Linux it's possible to run a process in its own network namespace,
meaning that it gets its own set of network interfaces, disjunct from
the rest of the system.  We use this to completely remove network
access to chroot builds, except that they get a private loopback
interface.  This means that:

- Builders cannot connect to the outside network or to other processes
  on the same machine, except processes within the same build.

- Vice versa, other processes cannot connect to processes in a chroot
  build, and open ports/connections do not show up in "netstat".

- If two concurrent builders try to listen on the same port (e.g. as
  part of a test), they no longer conflict with each other.

This was inspired by the "PrivateNetwork" flag in systemd.
1 parent 2f3f413
Raw File Download
nix-copy-closure.in 
#! @perl@ -w @perlFlags@

use Nix::SSH;
use Nix::Config;
use Nix::Store;
use Nix::CopyClosure;


if (scalar @ARGV < 1) {
    print STDERR <<EOF
Usage: nix-copy-closure [--from | --to] HOSTNAME [--sign] [--gzip] [--bzip2] [--xz] PATHS...
EOF
    ;
    exit 1;
}


# Get the target host.
my $sshHost;

my $sign = 0;

my $compressor = "";
my $decompressor = "";

my $progressViewer = "";

my $toMode = 1;

my $includeOutputs = 0;

my $dryRun = 0;


# !!! Copied from nix-pack-closure, should put this in a module.
my @storePaths = ();

while (@ARGV) {
    my $arg = shift @ARGV;
    
    if ($arg eq "--sign") {
        $sign = 1;
    }
    elsif ($arg eq "--gzip") {
        $compressor = "gzip";
        $decompressor = "gunzip";
    }
    elsif ($arg eq "--bzip2") {
        $compressor = "bzip2";
        $decompressor = "bunzip2";
    }
    elsif ($arg eq "--xz") {
        $compressor = "xz";
        $decompressor = "xz -d";
    }
    elsif ($arg eq "--from") {
        $toMode = 0;
    }
    elsif ($arg eq "--to") {
        $toMode = 1;
    }
    elsif ($arg eq "--include-outputs") {
        $includeOutputs = 1;
    }
    elsif ($arg eq "--show-progress") {
        $progressViewer = "@pv@";
    }
    elsif ($arg eq "--dry-run") {
        $dryRun = 1;
    }
    elsif (!defined $sshHost) {
        $sshHost = $arg;
    }
    else {
        push @storePaths, $arg;
    }
}


openSSHConnection $sshHost or die "$0: unable to start SSH\n";


if ($toMode) { # Copy TO the remote machine.
    Nix::CopyClosure::copyTo($sshHost, [ @sshOpts ], [ @storePaths ], $compressor, $decompressor, $includeOutputs, $dryRun, $sign, $progressViewer);
}

else { # Copy FROM the remote machine.

    # Query the closure of the given store paths on the remote
    # machine.  Paths are assumed to be store paths; there is no
    # resolution (following of symlinks).
    my $extraOpts = $includeOutputs ? "--include-outputs" : "";
    my $pid = open(READ,
        "set -f; ssh @sshOpts $sshHost nix-store --query --requisites $extraOpts @storePaths|") or die;
    
    while (<READ>) {
        chomp;
        die "bad: $_" unless /^\//;
        push @missing, $_ unless isValidPath($_);
    }

    close READ or die "nix-store on remote machine `$sshHost' failed: $?";

    # Export the store paths on the remote machine and import them locally.
    if (scalar @missing > 0) {
        print STDERR "copying ", scalar @missing, " missing paths from ‘$sshHost’...\n";
        $compressor = "| $compressor" if $compressor ne "";
        $decompressor = "$decompressor |" if $decompressor ne "";
	$progressViewer = "$progressViewer |" if $progressViewer ne "";
        unless ($dryRun) {
            my $extraOpts = $sign ? "--sign" : "";
            system("set -f; ssh $sshHost @sshOpts 'nix-store --export $extraOpts @missing $compressor' | $progressViewer $decompressor $Nix::Config::binDir/nix-store --import > /dev/null") == 0
                or die "copying store paths from remote machine `$sshHost' failed: $?";
        }
    }

}