movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/containers: add unprivileged option

Browse source 
Fixes #57083.
This commit is contained in:
Nikita Uvarov 2019-08-20 23:43:15 +02:00
parent bacf5619e2
commit 7e7fc6471e
No known key found for this signature in database
GPG key ID: F7A5FB3A7C10EF96
3 changed files with 71 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nixos/modules/virtualisation/containers.nix
View file

@ -139,6 +139,7 @@ let
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
${optionalString (cfg.unprivileged) "-U"} \
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
@ -238,8 +239,8 @@ let
ExecReload = pkgs.writeScript "reload-container"
''
#! ${pkgs.runtimeShell} -e
${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
${pkgs.systemd}/bin/machinectl shell "$INSTANCE" \
''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test
'';
SyslogIdentifier = "container %i";
@ -423,6 +424,7 @@ let
extraVeths = {};
additionalCapabilities = [];
ephemeral = false;
unprivileged = false;
allowedDevices = [];
hostAddress = null;
hostAddress6 = null;
@ -516,6 +518,16 @@ in
'';
};
unprivileged = mkOption {
type = types.bool;
default = false;
description = ''
Run container in unprivileged mode using private users feature of <command>systemd-nspawn</command>.
This option is eqvivalent of adding -U parameter to <command>systemd-nspawn</command> command.
See <literal>systemd-nspawn(1)</literal> man page for more information.
'';
};
ephemeral = mkOption {
type = types.bool;
default = false;