25 lines
932 B
Bash
25 lines
932 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
socket=/var/guix/daemon-socket/socket
|
|
|
|
# /var/guix is a persistent volume, so a stale socket from a previous
|
|
# (now-dead) container can still be sitting there; always start a fresh
|
|
# daemon, which unlinks and rebinds the socket itself, rather than
|
|
# skipping startup just because the path exists.
|
|
# --disable-chroot: sandboxed builds normally isolate via Linux namespaces
|
|
# (unshare/clone), which Docker blocks by default even for root ("clone:
|
|
# Operation not permitted") and which also seems to cut off DNS for the
|
|
# substituter subprocess. We're already isolated by the outer container,
|
|
# so skip guix-daemon's own sandboxing rather than granting --privileged.
|
|
rm -f "$socket"
|
|
guix-daemon --build-users-group=guixbuild --disable-chroot &
|
|
|
|
for _ in $(seq 1 30); do
|
|
[ -S "$socket" ] && break
|
|
sleep 1
|
|
done
|
|
[ -S "$socket" ] || { echo "guix-daemon did not come up" >&2; exit 1; }
|
|
|
|
exec "$@"
|