Repository: lima-vm/lima
Pull request #870 (2022-05-25 03:20:07)

Add LIMA_CIDATA_HOSTHOME_MOUNTPOINT
This can be used by provisioning scripts to locate the mount point of the user's home directory. We can't just use `/Users/$LIMA_CIDATA_USER` because we don't know if the host is Linux or macOS, so it could be `/home/$LIMA_CIDATA_USER` or something completely custom. Also `$LIMA_CIDATA_USER` is the username inside the guest and might be set to `lima` if the username on the macOS host is not a valid Linux username.

Example usage to configure client certs for the docker daemon:

```shell
ln -s $LIMA_CIDATA_HOME_MOUNTPOINT/.docker/certs.d /etc/docker/certs.d
```


jandubois: This PR is in draft mode because it will have merge conflicts with #867.

Please provide feedback if there is a less clunky way to do this!
chancez: This seems useful, especially with custom mounts.
AkihiroSuda: Still draft?

Patch:
diff --git a/cmd/limactl/copy.go b/cmd/limactl/copy.go
index e118e1cd..383253d1 100644
--- a/cmd/limactl/copy.go
+++ b/cmd/limactl/copy.go
@@ -108,7 +108,7 @@ func copyAction(cmd *cobra.Command, args []string) error {
 		// arguments such as ControlPath.  This is preferred as we can multiplex
 		// sessions without re-authenticating (MaxSessions permitting).
 		for _, instDir := range instDirs {
-			sshOpts, err = sshutil.SSHOpts(instDir, false, false, false, false)
+			sshOpts, err = sshutil.SSHOpts(instDir, false, false)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/limactl/shell.go b/cmd/limactl/shell.go
index 80fcd75a..ce136481 100644
--- a/cmd/limactl/shell.go
+++ b/cmd/limactl/shell.go
@@ -131,7 +131,7 @@ func shellAction(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	sshOpts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent, *y.SSH.ForwardX11, *y.SSH.ForwardX11Trusted)
+	sshOpts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/limactl/show_ssh.go b/cmd/limactl/show_ssh.go
index 1558b9be..a27c6e1d 100644
--- a/cmd/limactl/show_ssh.go
+++ b/cmd/limactl/show_ssh.go
@@ -87,7 +87,7 @@ func showSSHAction(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
-	opts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent, *y.SSH.ForwardX11, *y.SSH.ForwardX11Trusted)
+	opts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent)
 	if err != nil {
 		return err
 	}
diff --git a/docs/internal.md b/docs/internal.md
index d8de4e2c..05ef9161 100644
--- a/docs/internal.md
+++ b/docs/internal.md
@@ -118,6 +118,7 @@ The volume label is "cidata", as defined by [cloud-init NoCloud](https://cloudin
 - `LIMA_CIDATA_MNT`: the mount point of the disk. `/mnt/lima-cidata`.
 - `LIMA_CIDATA_USER`: the user name string
 - `LIMA_CIDATA_UID`: the numeric UID
+- `LIMA_CIDATA_HOSTHOME_MOUNTPOINT`: the mount point of the host home directory, or empty if not mounted
 - `LIMA_CIDATA_MOUNTS`: the number of the Lima mounts
 - `LIMA_CIDATA_MOUNTS_%d_MOUNTPOINT`: the N-th mount point of Lima mounts (N=0, 1, ...)
 - `LIMA_CIDATA_MOUNTTYPE`: the type of the Lima mounts ("reverse-sshfs", "9p", ...)
diff --git a/examples/README.md b/examples/README.md
index 13b8a448..4de9a0b6 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -36,7 +36,6 @@ Others:
 - [`deprecated/centos-7.yaml`](./deprecated/centos-7.yaml): [deprecated] CentOS 7
 - [`experimental/9p.yaml`](experimental/9p.yaml): [experimental] use 9p mount type
 - [`experimental/riscv64.yaml`](experimental/riscv64.yaml): [experimental] RISC-V
-- [`experimental/apptainer.yaml`](./experimental/apptainer.yaml): [experimental] [Apptainer](https://apptainer.org/)
 
 ## Tier 1
 
diff --git a/examples/default.yaml b/examples/default.yaml
index 7853c9f1..48891285 100644
--- a/examples/default.yaml
+++ b/examples/default.yaml
@@ -106,12 +106,6 @@ ssh:
   # Forward ssh agent into the instance.
   # 🟢 Builtin default: false
   forwardAgent: null
-  # Forward X11 into the instance
-  # 🟢 Builtin default: false
-  forwardX11: null
-  # Trust forwarded X11 clients
-  # 🟢 Builtin default: false
-  forwardX11Trusted: null
 
 # ===================================================================== #
 # ADVANCED CONFIGURATION
diff --git a/examples/experimental/apptainer.yaml b/examples/experimental/apptainer.yaml
deleted file mode 100644
index 5393b82d..00000000
--- a/examples/experimental/apptainer.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Example to use Apptainer instead of containerd & nerdctl
-# $ limactl start ./apptainer.yaml
-# $ limactl shell apptainer apptainer run -u -B $HOME:$HOME docker://alpine
-
-# This example requires Lima v0.8.3 or later.
-
-# NOTE: skip 8.6-20220515, as it seems broken (lacks sudo): https://bugs.rockylinux.org/view.php?id=102
-images:
-- location: "https://dl.rockylinux.org/pub/rocky/8.5/images/Rocky-8-GenericCloud-8.5-20211114.2.x86_64.qcow2"
-  arch: "x86_64"
-  digest: "sha256:c23f58f26f73fb9ae92bfb4cf881993c23fdce1bbcfd2881a5831f90373ce0c8"
-mounts:
-- location: "~"
-- location: "/tmp/lima"
-  writable: true
-firmware:
-  legacyBIOS: true
-cpuType:
-  # Workaround for "vmx_write_mem: mmu_gva_to_gpa XXXXXXXXXXXXXXXX failed" on Intel Mac
-  # https://bugs.launchpad.net/qemu/+bug/1838390
-  x86_64: "Haswell-v4"
-containerd:
-  system: false
-  user: false
-provision:
-- mode: system
-  script: |
-    #!/bin/bash
-    set -eux -o pipefail
-    command -v apptainer >/dev/null 2>&1 && exit 0
-    dnf install -y https://github.com/apptainer/apptainer/releases/download/v1.0.2/apptainer-1.0.2-1.x86_64.rpm
-probes:
-- script: |
-    #!/bin/bash
-    set -eux -o pipefail
-    if ! timeout 30s bash -c "until command -v apptainer >/dev/null 2>&1; do sleep 3; done"; then
-      echo >&2 "apptainer is not installed yet"
-      exit 1
-    fi
-  hint: See "/var/log/cloud-init-output.log". in the guest
diff --git a/examples/faasd.yaml b/examples/faasd.yaml
index 95549681..0006c421 100644
--- a/examples/faasd.yaml
+++ b/examples/faasd.yaml
@@ -1,29 +1,22 @@
 # Deploy faasd (which installs a bundled containerd).
 #
 # It can be accessed from the host by authenticating with faas-cli;
-# the ports are already forwarded automatically by lima.
+# the ports are already forwarded automatically by lima:
+#
+# Get the faas-cli:
+# $ curl -sLS https://cli.openfaas.com | sh
+#
+# You can now log into your gateway:
+# $ export OPENFAAS_URL=http://localhost:8080
+# $ limactl shell faasd sudo cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -u admin --password-stdin
+# $
+# $ faas-cli store deploy NodeInfo
+#
+# Deployed. 200 OK.
+# URL: http://localhost:8080/function/nodeinfo
 #
 # This example requires Lima v0.7.0 or later.
 
-message: |
-  # Get the faas-cli from one of following sources:
-  # package manager:
-  brew install faas-cli
-  #
-  # script:
-  curl -sLS https://cli.openfaas.com | sh
-  #
-  # You can now log into your gateway:
-  ------
-  export OPENFAAS_URL=http://localhost:8080
-  limactl shell faasd sudo cat /var/lib/faasd/secrets/basic-auth-password | faas-cli login -u admin --password-stdin
-  ------
-  #
-  # Once logged in, you can deploy your first function
-  ------
-  faas-cli store deploy NodeInfo
-  ------
-
 # Image is set to jammy (22.04 LTS) for long-term stability
 images:
 # Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
@@ -49,7 +42,7 @@ containerd:
   user: false
 
 provision:
-- mode: user
+- mode: system
   script: |
     #!/bin/sh
     curl -sfL https://raw.githubusercontent.com/openfaas/faasd/master/hack/install.sh | bash -s -
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot.sh b/pkg/cidata/cidata.TEMPLATE.d/boot.sh
index 1ec1ee09..666649f5 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot.sh
@@ -54,7 +54,7 @@ fi
 
 USER_SCRIPT="/home/${LIMA_CIDATA_USER}.linux/.lima-user-script"
 if [ -d "${LIMA_CIDATA_MNT}"/provision.user ]; then
-	if [ ! -f /sbin/openrc-run ]; then
+	if [ ! -f /sbin/openrc-init ]; then
 		until [ -e "/run/user/${LIMA_CIDATA_UID}/systemd/private" ]; do sleep 3; done
 	fi
 	for f in "${LIMA_CIDATA_MNT}"/provision.user/*; do
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/11-colorterm-environment.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/11-colorterm-environment.sh
index b39dda78..6991b256 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/11-colorterm-environment.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/11-colorterm-environment.sh
@@ -7,7 +7,7 @@ fi
 
 # accept any incoming COLORTERM environment variable
 sed -i 's/^AcceptEnv LANG LC_\*$/AcceptEnv COLORTERM LANG LC_*/' /etc/ssh/sshd_config
-if [ -f /sbin/openrc-run ]; then
+if [ -f /sbin/openrc-init ]; then
 	rc-service --ifstarted sshd reload
 elif command -v systemctl >/dev/null 2>&1; then
 	if systemctl -q is-active ssh; then
diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/25-guestagent-base.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/25-guestagent-base.sh
index a1d447ca..bada60bd 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/25-guestagent-base.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/25-guestagent-base.sh
@@ -18,7 +18,7 @@ fi
 install -m 755 "${LIMA_CIDATA_MNT}"/lima-guestagent /usr/local/bin/lima-guestagent
 
 # Launch the guestagent service
-if [ -f /sbin/openrc-run ]; then
+if [ -f /sbin/openrc-init ]; then
 	# Install the openrc lima-guestagent service script
 	cat >/etc/init.d/lima-guestagent <<'EOF'
 #!/sbin/openrc-run
diff --git a/pkg/cidata/cidata.TEMPLATE.d/lima.env b/pkg/cidata/cidata.TEMPLATE.d/lima.env
index e6aa7f5d..59d88127 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/lima.env
+++ b/pkg/cidata/cidata.TEMPLATE.d/lima.env
@@ -1,6 +1,7 @@
 LIMA_CIDATA_NAME={{ .Name }}
 LIMA_CIDATA_USER={{ .User }}
 LIMA_CIDATA_UID={{ .UID }}
+LIMA_CIDATA_HOSTHOME_MOUNTPOINT={{ .HostHomeMountPoint }}
 LIMA_CIDATA_MOUNTS={{ len .Mounts }}
 {{- range $i, $val := .Mounts}}
 LIMA_CIDATA_MOUNTS_{{$i}}_MOUNTPOINT={{$val.MountPoint}}
diff --git a/pkg/cidata/cidata.go b/pkg/cidata/cidata.go
index 286a3cdc..f695cfbd 100644
--- a/pkg/cidata/cidata.go
+++ b/pkg/cidata/cidata.go
@@ -128,6 +128,10 @@ func GenerateISO9660(instDir, name string, y *limayaml.LimaYAML, udpDNSLocalPort
 	case limayaml.NINEP:
 		fstype = "9p"
 	}
+	hostHome, err := localpathutil.Expand("~")
+	if err != nil {
+		return err
+	}
 	for i, f := range y.Mounts {
 		tag := fmt.Sprintf("mount%d", i)
 		location, err := localpathutil.Expand(f.Location)
@@ -156,6 +160,9 @@ func GenerateISO9660(instDir, name string, y *limayaml.LimaYAML, udpDNSLocalPort
 			options += ",nofail"
 		}
 		args.Mounts = append(args.Mounts, Mount{Tag: tag, MountPoint: mountPoint, Type: fstype, Options: options})
+		if location == hostHome {
+			args.HostHomeMountPoint = mountPoint
+		}
 	}
 
 	switch *y.MountType {
diff --git a/pkg/cidata/template.go b/pkg/cidata/template.go
index 63fb0547..c9012ca0 100644
--- a/pkg/cidata/template.go
+++ b/pkg/cidata/template.go
@@ -43,24 +43,25 @@ type Mount struct {
 	Options    string
 }
 type TemplateArgs struct {
-	Name            string // instance name
-	IID             string // instance id
-	User            string // user name
-	UID             int
-	SSHPubKeys      []string
-	Mounts          []Mount
-	MountType       string
-	Containerd      Containerd
-	Networks        []Network
-	SlirpNICName    string
-	SlirpGateway    string
-	SlirpDNS        string
-	SlirpIPAddress  string
-	UDPDNSLocalPort int
-	TCPDNSLocalPort int
-	Env             map[string]string
-	DNSAddresses    []string
-	CACerts         CACerts
+	Name               string // instance name
+	IID                string // instance id
+	User               string // user name
+	UID                int
+	SSHPubKeys         []string
+	Mounts             []Mount
+	MountType          string
+	Containerd         Containerd
+	Networks           []Network
+	SlirpNICName       string
+	SlirpGateway       string
+	SlirpDNS           string
+	SlirpIPAddress     string
+	UDPDNSLocalPort    int
+	TCPDNSLocalPort    int
+	Env                map[string]string
+	DNSAddresses       []string
+	CACerts            CACerts
+	HostHomeMountPoint string
 }
 
 func ValidateTemplateArgs(args TemplateArgs) error {
diff --git a/pkg/hostagent/hostagent.go b/pkg/hostagent/hostagent.go
index da877338..3755edc8 100644
--- a/pkg/hostagent/hostagent.go
+++ b/pkg/hostagent/hostagent.go
@@ -120,7 +120,7 @@ func New(instName string, stdout io.Writer, sigintCh chan os.Signal, opts ...Opt
 		return nil, err
 	}
 
-	sshOpts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent, *y.SSH.ForwardX11, *y.SSH.ForwardX11Trusted)
+	sshOpts, err := sshutil.SSHOpts(inst.Dir, *y.SSH.LoadDotSSHPubKeys, *y.SSH.ForwardAgent)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/limayaml/defaults.go b/pkg/limayaml/defaults.go
index 128360ba..040da5f6 100644
--- a/pkg/limayaml/defaults.go
+++ b/pkg/limayaml/defaults.go
@@ -206,26 +206,6 @@ func FillDefault(y, d, o *LimaYAML, filePath string) {
 		y.SSH.ForwardAgent = pointer.Bool(false)
 	}
 
-	if y.SSH.ForwardX11 == nil {
-		y.SSH.ForwardX11 = d.SSH.ForwardX11
-	}
-	if o.SSH.ForwardX11 != nil {
-		y.SSH.ForwardX11 = o.SSH.ForwardX11
-	}
-	if y.SSH.ForwardX11 == nil {
-		y.SSH.ForwardX11 = pointer.Bool(false)
-	}
-
-	if y.SSH.ForwardX11Trusted == nil {
-		y.SSH.ForwardX11Trusted = d.SSH.ForwardX11Trusted
-	}
-	if o.SSH.ForwardX11Trusted != nil {
-		y.SSH.ForwardX11Trusted = o.SSH.ForwardX11Trusted
-	}
-	if y.SSH.ForwardX11Trusted == nil {
-		y.SSH.ForwardX11Trusted = pointer.Bool(false)
-	}
-
 	hosts := make(map[string]string)
 	// Values can be either names or IP addresses. Name values are canonicalized in the hostResolver.
 	for k, v := range d.HostResolver.Hosts {
diff --git a/pkg/limayaml/limayaml.go b/pkg/limayaml/limayaml.go
index 20ea3a4f..17030804 100644
--- a/pkg/limayaml/limayaml.go
+++ b/pkg/limayaml/limayaml.go
@@ -96,8 +96,6 @@ type SSH struct {
 	// LoadDotSSHPubKeys loads ~/.ssh/*.pub in addition to $LIMA_HOME/_config/user.pub .
 	LoadDotSSHPubKeys *bool `yaml:"loadDotSSHPubKeys,omitempty" json:"loadDotSSHPubKeys,omitempty"` // default: true
 	ForwardAgent      *bool `yaml:"forwardAgent,omitempty" json:"forwardAgent,omitempty"`           // default: false
-	ForwardX11        *bool `yaml:"forwardX11,omitempty" json:"forwardX11,omitempty"`               // default: false
-	ForwardX11Trusted *bool `yaml:"forwardX11Trusted,omitempty" json:"forwardX11Trusted,omitempty"` // default: false
 }
 
 type Firmware struct {
diff --git a/pkg/sshutil/sshutil.go b/pkg/sshutil/sshutil.go
index 1675bbe5..629e99d2 100644
--- a/pkg/sshutil/sshutil.go
+++ b/pkg/sshutil/sshutil.go
@@ -201,7 +201,7 @@ func CommonOpts(useDotSSH bool) ([]string, error) {
 }
 
 // SSHOpts adds the following options to CommonOptions: User, ControlMaster, ControlPath, ControlPersist
-func SSHOpts(instDir string, useDotSSH, forwardAgent bool, forwardX11 bool, forwardX11Trusted bool) ([]string, error) {
+func SSHOpts(instDir string, useDotSSH, forwardAgent bool) ([]string, error) {
 	controlSock := filepath.Join(instDir, filenames.SSHSock)
 	if len(controlSock) >= osutil.UnixPathMax {
 		return nil, fmt.Errorf("socket path %q is too long: >= UNIX_PATH_MAX=%d", controlSock, osutil.UnixPathMax)
@@ -223,12 +223,6 @@ func SSHOpts(instDir string, useDotSSH, forwardAgent bool, forwardX11 bool, forw
 	if forwardAgent {
 		opts = append(opts, "ForwardAgent=yes")
 	}
-	if forwardX11 {
-		opts = append(opts, "ForwardX11=yes")
-	}
-	if forwardX11Trusted {
-		opts = append(opts, "ForwardX11Trusted=yes")
-	}
 	return opts, nil
 }
 


Test patch:
diff --git a/pkg/limayaml/defaults_test.go b/pkg/limayaml/defaults_test.go
index 16794cdd..f352838c 100644
--- a/pkg/limayaml/defaults_test.go
+++ b/pkg/limayaml/defaults_test.go
@@ -65,8 +65,6 @@ func TestFillDefault(t *testing.T) {
 			LocalPort:         pointer.Int(0),
 			LoadDotSSHPubKeys: pointer.Bool(true),
 			ForwardAgent:      pointer.Bool(false),
-			ForwardX11:        pointer.Bool(false),
-			ForwardX11Trusted: pointer.Bool(false),
 		},
 		Firmware: Firmware{
 			LegacyBIOS: pointer.Bool(false),
@@ -232,8 +230,6 @@ func TestFillDefault(t *testing.T) {
 			LocalPort:         pointer.Int(888),
 			LoadDotSSHPubKeys: pointer.Bool(false),
 			ForwardAgent:      pointer.Bool(true),
-			ForwardX11:        pointer.Bool(false),
-			ForwardX11Trusted: pointer.Bool(false),
 		},
 		Firmware: Firmware{
 			LegacyBIOS: pointer.Bool(true),
@@ -380,8 +376,6 @@ func TestFillDefault(t *testing.T) {
 			LocalPort:         pointer.Int(4433),
 			LoadDotSSHPubKeys: pointer.Bool(true),
 			ForwardAgent:      pointer.Bool(true),
-			ForwardX11:        pointer.Bool(false),
-			ForwardX11Trusted: pointer.Bool(false),
 		},
 		Firmware: Firmware{
 			LegacyBIOS: pointer.Bool(true),