Hi Vagrant, Sorry if I am naive, I am trying to understand and it appears that pieces are missing in my bag. :-)
On Mon, 07 Dec 2020 at 09:55, Vagrant Cascadian <vagr...@debian.org> wrote: > The /proc/sys/kernel_unprivileged_userns_clone file is specific to > Debian and Ubuntu packaged linux kernel; it is a patchset not applied > upstream, as far as I am aware. I'm not sure if other distros support > disabling and enabling this feature using this mechanism. Thanks. I still do not understand the message from Guix System: --8<---------------cut here---------------start------------->8--- ~/co/guix (master)$ guix environment -C guix guix environment: error: cannot create container: unprivileged user cannot create user namespaces guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1" --8<---------------cut here---------------end--------------->8--- (see <https://yhetil.org/guix/e5c86d238ca5174b745b8ea6cb0cb6ad6b20aa5e.ca...@yasuaki.com>) Why does this appear if «set /proc/sys/kernel/unprivileged_userns_clone to "1"» does not make sense on Guix System? Then Tobias answered: (see <https://yhetil.org/guix/87k0tux63a.fsf@nckx>) yasu 写道： > Now, I don't use Debian at all (I use Guix System) and do you > think > this is a Bug in Guix (in that this Debian specific word should > never > even be mentioned in Guix?) It's not Debian-specific. It is a bug in Guix. It should try to create a namespace and properly report an error iff that fails, not prematurely abort after farting about in /proc. A separate unprivileged-user-namespace-supported? is broken by design. Reverting commit 8bc5ca5 works around this but it wasn't to blame. so I miss why does a similar patch as, > > https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch is not applied to Guix System? Is it because a technical or else reason behind? Or is it simply because no one takes the time to fix the problem? All the best, simon
