--privileged required to run guix docker container

[fanquake]

Running any docker image with --privileged is far from ideal.

When the operator executes docker run --privileged, Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host.

I started looking at running the guix image without --privileged:

guix environment: error: build failed: cloning builder process: Operation not permitted

Adding --cap-add=SYS_ADMIN, which is also far from ideal, see "CAP_SYS_ADMIN: the new root", solved that, but lead to:

guix environment: error: build failed: while setting up the build environment: cannot set loopback interface flags: Operation not permitted

So I added --cap-add=NET_ADMIN. I'm now at:

guix environment: error: build failed: while setting up the build environment: cannot pivot old root directory onto '/gnu/store/380c843hbacsr4dvj9dpqb5dw11x60dd-ca-certificate-bundle.drv.chroot/real-root': Operation not permitted

[dongcarl]

Perhaps this might give us a better starting point: https://stackoverflow.com/a/47991611

[maflcko]

Same issue with podman