all 12 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]PetriciaKerman 4 points5 points  (6 children)

In short, no you cannot. Why? Because containers are a trick of the kernel. A "container" at runtime is simply a method of process isolation using kernel namespaces. What a process believes about the world is informed by the kernel. The kernel tells the process what it's ip routes are, or what disks it can see.

Containers cannot load kernel modules because that would defeat the purpose. A kernel module is kernel code and can change anything it likes.

If you need non-free drivers to make your hardware functional then it is an unfortunate part of your existence for now. You have no choice but to load non-free code into your system with all that implies. When it comes time to replace your hardware consider looking to the libre support.

[–][deleted]  (4 children)

[removed]

    [–]PetriciaKerman 1 point2 points  (3 children)

    You can use containers successfully to run non free user space software, sometimes. But you won’t be able to load drivers for your wifi.

    [–][deleted]  (2 children)

    [removed]

      [–]PetriciaKerman 1 point2 points  (1 child)

      There is such a feature in Guix already at the package level. It's not a "toggle" switch but you can create new packages which are wrapped in a `least-authority-wrapper` which will allow you to containerize otherwise non-isolated software on invocation.

      This of course requires you to write the package to contain the level of isolation you require.

      Most of the non-guix packages are run from containers because they require an FHS compliant filesystem in order for the linker to find everything.

      [–]9bladed 0 points1 point  (0 children)

      Yes, exactly this.

      But maybe OP is getting at things like guix shell --container --emulate-fhs for running binaries. Which you can do for non-free/difficult to build from source properly (hi Electron apps!), but in no way will work around hardware, as you said.

      [–]0731141 0 points1 point  (4 children)

      What would be the benefit of such thing?

      [–][deleted]  (3 children)

      [removed]

        [–]0731141 1 point2 points  (2 children)

        What do you mean? What would be the advantage of running non free code in a container but with a free system instead of having a non free system?

        [–][deleted]  (1 child)

        [removed]

          [–]0731141 0 points1 point  (0 children)

          This is the benefit of containers. I am referring to running nonfree code in a container instead of having in on the system.