Hi Lesik,
On 12/20/24 00:14, Aleksej via wrote:
I’m currently trying to migrate my server to the Guix System, but I’m
encountering some issues with OCI containers. Is there a way to run them as a
Shepherd service while using Podman and nftables? I know about the
oci-container-service-type, but it depends on Docker and iptables, both of
which I dislike due to their design. Perhaps the oci-container-service-type
could be abstracted from its backend so that it supports both rootless Podman
and Docker?
It definitely can :) I'm working on an oci-service-type over at gocix
[0], which will deprecate the oci-container-service-type. It is
introducing a configurable OCI runtime supporting rootless Podman and
Docker, and the ability to provision networks and volumes. It still
isn't well tested as I was waiting for rootless Podman to get into Guix
mainline before focusing on it. Hopefully during the end of the year
break I'll be able to test it better and send it upstream. You are
welcome to try it [1] and open issues if you find problems. It is not
yet very well documented but you can find API documentation here [2].
Also, why does the rootless-podman-service-type depend on iptables? Our
netavark version has complete nftables support, so maybe we could add an option
to choose between iptables and nftables?
There is no specific reason besides being the easiest way I was able to
find to get Podman up and running. If you could make the firewall
backend configurable it would be awesome imho.
hope this helps,
giacomo
[0]:
https://github.com/fishinthecalculator/gocix/blob/main/modules/oci/services/containers.scm#L768
[1]:
https://github.com/fishinthecalculator/gocix?tab=readme-ov-file#configure
[2]: https://github.com/fishinthecalculator/gocix/tree/main/doc#OCI-Service
