sysbox: init at 0.6.2 #273241

juliosueiras · 2023-12-10T01:07:31Z

Description of changes

Add sysbox package and module

Fixes #271901

Things done

Add a 👍 reaction to pull requests you find important.

FedX-sudo · 2023-12-11T01:43:53Z

Tested with nixpkgs-review. Basic functionality works. Appears to be functioning.

juliosueiras · 2023-12-11T01:48:09Z

Tested with nixpkgs-review. Basic functionality works. Appears to be functioning.

nice, just want to make sure, the test was done with --runtime=sysbox?

FedX-sudo · 2023-12-11T13:41:16Z

No, nixpkgs-review does not like that flag, nor do any of the binaries provided by sysbox.

juliosueiras · 2023-12-11T13:43:33Z

No, nixpkgs-review does not like that flag, nor do any of the binaries provided by sysbox.

ah, forgot to mention, sysbox meant to be use to with docker, so the --runtime=sysbox is meant to be use with docker run etc

FedX-sudo · 2023-12-11T13:47:09Z

Hmmm, not sure about Docker, but Podman is returning Error: default OCI runtime "sysbox" not found: invalid argument

EDIT: presumably the NixOS module needs to be enabled.

juliosueiras · 2023-12-11T13:52:15Z

Hmmm, not sure about Docker, but Podman is returning Error: default OCI runtime "sysbox" not found: invalid argument

DId the message Sysbox require docker to be functional not show up?

juliosueiras · 2023-12-11T13:53:01Z

ah, to make sure, when you say you tested, you mean the binaries only? and not the module

juliosueiras · 2023-12-11T13:54:08Z

yes, sysbox is a runtime that is meant to be added to docker, thats why the module is here as well

FedX-sudo · 2023-12-11T14:01:36Z

Ok, I assumed testing of the module was not required. I apologize. Let me figure out how to test that....

fsnkty · 2024-02-07T07:50:32Z

nixos/modules/virtualisation/sysbox.nix

@@ -0,0 +1,73 @@
+{ config, lib, pkgs, ... }:
+
+with lib;


to address #208242 for this module, uses of with such as this should be avoided.
consider inherits where you find yourself using lib.foo excessively.

fsnkty · 2024-02-07T07:50:48Z

nixos/modules/virtualisation/sysbox.nix

+        type = types.bool;
+        default = false;
+        description =
+          lib.mdDoc ''


lib.mdDoc is now just an alias and can be safely removed everywhere.
see d36f950 and #237557

lib.mkEnableOption would be nice.

fsnkty · 2024-02-07T07:52:38Z

nixos/modules/virtualisation/sysbox.nix

+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.rsync pkgs.kmod pkgs.iptables ];
+      script = "${cfg.package}/bin/sysbox-mgr";


would lib.getExe not be more appropriate here? ( and all following uses like this )

fsnkty · 2024-02-07T07:55:05Z

pkgs/top-level/all-packages.nix

@@ -908,6 +908,8 @@ with pkgs;

  docker-slim = callPackage ../applications/virtualization/docker-slim { };

+  sysbox = callPackage ../applications/virtualization/sysbox { };


is this needed? pkgs/by-name should likely be used instead.

gabyx · 2024-02-19T14:49:05Z

Looking forwards to this.

gabyx · 2024-02-19T15:22:50Z

nixos/modules/virtualisation/sysbox.nix

+        default = false;
+        description =
+          lib.mdDoc ''
+            This option enables sysbox


Would be nice to be a little bit more precise what this does =).
e.g.

Suggested change

This option enables sysbox

Enables the container runtime `sysbox-runc` from `nestybox`.

Starts a `sysbox-mgr` manager service and makes the runtime available

for `docker` to be used in `docker run --runtime=sysbox-runc ...`.

traverseda · 2024-03-13T13:38:40Z

I hate to ask, but I'm a bit new to nixos in general, I'm trying to test some software that depends on sysbox. Do we have any idea when this will bu added in?

I've tried enabling just it locally with

let 
  sysbox = builtins.getFlake "github:juliosueiras-nix/nixpkgs";
in
{
  sysbox.virtualisation.sysbox.enable = true;
#The rest of my config
}

in my configuration.nix, like I do for some home manager modules, but it doesn't seem to work for forks of nixpkgs like this.

thetredev · 2024-07-17T00:27:31Z

I'm also very intersted in this.

juliosueiras · 2024-07-17T01:54:08Z

will revisit this in this week

thetredev · 2024-07-17T10:08:30Z

@juliosueiras wow that was a quick reply. Thanks for the heads up!

commiterate · 2024-10-19T22:09:21Z

Hmm how feasible would it be to swap to a source build?

Looking at the sysbox repo, it's really just using Git submodules to reference the individual component repos (sysbox-ipc, sysbox-runc, sysbox-mgr, sysbox-fs) and running their make builds which are really just Go module builds (which we can use the buildGoModule derivation wrapper for).

https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/Makefile#L221-L271

That would mean we have 1 Nix package for each Sysbox module and the Sysbox NixOS module would bundle all of them into its own systemd unit.

I'm not sure if the pre-compiled binaries for Debian from the GitHub release need a bunch of ELF patching (though the default fixup phase should already do this).

commiterate · 2024-10-19T22:16:53Z

Looks like that might be a bit more difficult than expected. Of the components, only the sysbox-runc repository has version tag branches. However, even that repo is only meant to be built from the sysbox repository because it uses relative path overrides for sysbox-ipc and sysbox-libs in its go.mod.

https://github.com/nestybox/sysbox-runc/blob/1b440ff266841f3d2d296e664122a9e29ceb9fd8/go.mod#L81

commiterate · 2024-10-19T22:23:36Z

The sysbox Makefile reads the DESTDIR env var to figure out where make install should dump the binaries built by other Make targets.

https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/Makefile#L77-L82

So likely our builds steps are just:

mkdir -p $outdir/bin

# https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/Makefile#L214-L215
make sysbox-local

# https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/Makefile#L77-L82
export DESTDIR=$outdir/bin

# https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/Makefile#L267-L271
make install

Need to figure out other native build inputs besides Go and Make.

commiterate · 2024-10-19T22:30:10Z

We might actually want to not use make install because it copies over scr/sysbox (Bash script with a Sysbox CLI) which hardcodes the expected systemd unit files directory.

https://github.com/nestybox/sysbox/blob/ad23dca8b4c4a485eb74f63eb9dc704767f79003/scr/sysbox#L38-L39

That or we use it but just do an rm -f $outdir/sysbox.

I think GitLab Runner has a similar problem where the CLI has install and uninstall options that generate systemd unit files to the conventional location, so this might not be too big of a deal. While NixOS users won't use it, people using Nix on other Linux distros might.

Some of the stuff in there looks like sysbox config options which we can make into NixOS module options.

commiterate · 2024-10-20T01:33:45Z

Tried doing a source build and got stuck. The sysbox build setup is...a bit tricky (to say the least) to work with. Here's the pkgs/by-name/sy/sysbox/package.nix I stopped at if someone else wants to try.

{
  lib,
  cacert,
  fetchFromGitHub,
  git,
  go,
  nix-update-script,
  protobuf,
  protoc-gen-go,
  protoc-gen-go-grpc,
  stdenv,
  versionCheckHook,
}:

stdenv.mkDerivation rec {
  pname = "sysbox";
  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "nestybox";
    repo = "sysbox";
    rev = "refs/tags/v${version}";
    fetchSubmodules = true;
    hash = "sha256-X2pBPfj3mPlp9ewbiQXoeT5ICv6bIrzMhGbhmUBgLd8=";
  };

  nativeBuildInputs = [
    # From buildGoModule.
    #
    # We don't use buildGoModule since the sysbox repository uses Git submodules with relative paths and nested builds (i.e. not a simple build).
    #
    # https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/go/module.nix
    cacert
    git
    go
    # Protocol Buffers for sysbox-ipc.
    protobuf
    protoc-gen-go
    protoc-gen-go-grpc
  ];

  # From buildGoModule.
  inherit (go) GOOS GOARCH;

  # The various Makefiles use some programs (e.g. hostname, ip) and FHS files (e.g. /etc/os-release) to set variables used by a few Make targets.
  #
  # Most of these targets are for tests instead of builds. We won't set them and will just eat some ugly warning messages instead.
  postPatch = ''
    # sysbox-ipc expects people to manually download the Protocol Buffer compiler, extract it to /usr/bin, and extract its included header files to /usr/local/include.
    #
    # See:
    # * https://github.com/nestybox/sysbox-ipc/blob/f05151f4b4c1df63d7fd241577ca032905c1bd0e/sysboxFsGrpc/sysboxFsProtobuf/Makefile
    # * https://github.com/nestybox/sysbox-ipc/blob/f05151f4b4c1df63d7fd241577ca032905c1bd0e/sysboxMgrGrpc/sysboxMgrProtobuf/Makefile
    substituteInPlace sysbox-ipc/sysboxFsGrpc/sysboxFsProtobuf/Makefile \
      --replace-warn "/usr/local/include" "${protobuf}/include"
    substituteInPlace sysbox-ipc/sysboxMgrGrpc/sysboxMgrProtobuf/Makefile \
      --replace-warn "/usr/local/include" "${protobuf}/include"

    # sysbox-ipc uses an old protoc-gen-go version that used to support Go gRPC code generation. This was removed after the release of protoc-gen-go-grpc.
    #
    # See: https://github.com/golang/protobuf/issues/1070
    substituteInPlace sysbox-ipc/sysboxFsGrpc/sysboxFsProtobuf/Makefile \
      --replace-warn "--go_out=plugins=grpc:." "--go_out=. --go-grpc_out=."
    substituteInPlace sysbox-ipc/sysboxMgrGrpc/sysboxMgrProtobuf/Makefile \
      --replace-warn "--go_out=plugins=grpc:." "--go_out=. --go-grpc_out=."
  '';

  # From buildGoModule.
  configurePhase = ''
    export GOCACHE=$TMPDIR/go-cache
    export GOPATH=$TMPDIR/go
    # ⛔ Go module lookup breaks in the build sandbox or due to GOPROXY=off. Not sure what to do.
    export GOPROXY=off
    export GOSUMDB=off
  '';

  buildFlags = [
    "sysbox-local"
    "HOSTNAME=nix"
  ];

  installFlags = [
    "install"
    "DESTDIR=${placeholder "out"}/bin"
  ];

  doInstallCheck = true;

  nativeInstallCheckInputs = [ versionCheckHook ];

  versionCheckProgramArg = "--version";

  passthru = {
    updateScript = nix-update-script { };
  };

  meta = {
    description = "Open-source, next-generation \"runc\" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.";
    homepage = "https://github.com/nestybox/sysbox";
    license = lib.licenses.asl20;
    mainProgram = "sysbox-runc";
    platforms = lib.platforms.linux;
    # TODO: Find maintainer(s).
    maintainers = with lib.maintainers; [ ];
  };
}

It would probably be doable with buildGoModule if sysbox switches to sourcing Go modules remotely instead of using submodules with relative file paths. That would likely mean publishing releases for each component repository separately at the expense of DX for them. Alternatively, they unify all modules into a single repository and Go module.

That might be their plan in the future but it's not clear if the justification to do that today is worth their workflow disruption before sysbox reaches 1.0.

As for this PR, we should probably also add the AArch64 Debian binary as well in addition to bumping up to 0.6.4.

Add sysbox 0.6.2 package

633a0e5

juliosueiras marked this pull request as draft December 10, 2023 01:08

juliosueiras added 3 commits December 9, 2023 20:09

Resort maintainers list

9ea3c05

Resort maintainers list

2cddc3a

Add sysbox module

84bf710

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Dec 10, 2023

juliosueiras added 6 commits December 9, 2023 20:20

Updated with security switch

ea0591b

Fix package option for sysbox module

932b968

Update sysbox module

c92dbde

Update formatting

e5bdd4b

Fixed pathing in sysbox module

5af174e

Fixed license type

9878ab3

ofborg bot added 8.has: package (new) This PR adds a new package 11.by: package-maintainer This PR was created by the maintainer of the package it changes 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 1-10 labels Dec 10, 2023

juliosueiras closed this Dec 11, 2023

juliosueiras reopened this Dec 11, 2023

Make assertion more explicit

1f40464

Remove mkForce for extraOption

8239b41

h7x4 added the 8.has: module (new) This PR adds a module in `nixos/` label Jan 3, 2024

fsnkty reviewed Feb 7, 2024

View reviewed changes

gabyx reviewed Feb 19, 2024

View reviewed changes

wegank added the 2.status: merge conflict This PR has merge conflicts with the target branch label Mar 20, 2024

wegank added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jul 4, 2024

stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jul 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sysbox: init at 0.6.2 #273241

sysbox: init at 0.6.2 #273241

juliosueiras commented Dec 10, 2023 •

edited

Loading

FedX-sudo commented Dec 11, 2023

juliosueiras commented Dec 11, 2023

FedX-sudo commented Dec 11, 2023

juliosueiras commented Dec 11, 2023 •

edited

Loading

FedX-sudo commented Dec 11, 2023 •

edited

Loading

juliosueiras commented Dec 11, 2023 •

edited

Loading

juliosueiras commented Dec 11, 2023

juliosueiras commented Dec 11, 2023

FedX-sudo commented Dec 11, 2023

fsnkty Feb 7, 2024

fsnkty Feb 7, 2024

fsnkty Feb 7, 2024

fsnkty Feb 7, 2024

fsnkty Feb 7, 2024

gabyx commented Feb 19, 2024

gabyx Feb 19, 2024

traverseda commented Mar 13, 2024 •

edited

Loading

thetredev commented Jul 17, 2024

juliosueiras commented Jul 17, 2024

thetredev commented Jul 17, 2024

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 20, 2024 •

edited

Loading

		@@ -908,6 +908,8 @@ with pkgs;

		docker-slim = callPackage ../applications/virtualization/docker-slim { };

		sysbox = callPackage ../applications/virtualization/sysbox { };

-            This option enables sysbox
+            Enables the container runtime `sysbox-runc` from `nestybox`.
+            Starts a `sysbox-mgr` manager service and makes the runtime available
+            for `docker` to be used in `docker run --runtime=sysbox-runc ...`.

sysbox: init at 0.6.2 #273241

Are you sure you want to change the base?

sysbox: init at 0.6.2 #273241

Conversation

juliosueiras commented Dec 10, 2023 • edited Loading

Description of changes

Things done

FedX-sudo commented Dec 11, 2023

juliosueiras commented Dec 11, 2023

FedX-sudo commented Dec 11, 2023

juliosueiras commented Dec 11, 2023 • edited Loading

FedX-sudo commented Dec 11, 2023 • edited Loading

juliosueiras commented Dec 11, 2023 • edited Loading

juliosueiras commented Dec 11, 2023

juliosueiras commented Dec 11, 2023

FedX-sudo commented Dec 11, 2023

fsnkty Feb 7, 2024

Choose a reason for hiding this comment

fsnkty Feb 7, 2024

Choose a reason for hiding this comment

fsnkty Feb 7, 2024

Choose a reason for hiding this comment

fsnkty Feb 7, 2024

Choose a reason for hiding this comment

fsnkty Feb 7, 2024

Choose a reason for hiding this comment

gabyx commented Feb 19, 2024

gabyx Feb 19, 2024

Choose a reason for hiding this comment

traverseda commented Mar 13, 2024 • edited Loading

thetredev commented Jul 17, 2024

juliosueiras commented Jul 17, 2024

thetredev commented Jul 17, 2024

commiterate commented Oct 19, 2024 • edited Loading

commiterate commented Oct 19, 2024 • edited Loading

commiterate commented Oct 19, 2024 • edited Loading

commiterate commented Oct 19, 2024 • edited Loading

commiterate commented Oct 20, 2024 • edited Loading

juliosueiras commented Dec 10, 2023 •

edited

Loading

juliosueiras commented Dec 11, 2023 •

edited

Loading

FedX-sudo commented Dec 11, 2023 •

edited

Loading

juliosueiras commented Dec 11, 2023 •

edited

Loading

traverseda commented Mar 13, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 19, 2024 •

edited

Loading

commiterate commented Oct 20, 2024 •

edited

Loading