movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-30 13:05:15 +03:00
Code Activity

systemd: switch to unified cgroup hierarchy by default

Browse source 
See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.

Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.

Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.

Fixes #73800
This commit is contained in:
Florian Klink 2020-11-17 21:54:26 +01:00
parent e949d75899
commit d22b3ed4bc
5 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nixos/modules/security/hidepid.nix
View file

@ -23,5 +23,9 @@ with lib;
boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];
# Disable cgroupsv2, which doesn't work with hidepid.
# https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203
systemd.enableUnifiedCgroupHierarchy = false;
};
}

9
nixos/modules/system/boot/systemd.nix
View file

@ -550,6 +550,14 @@ in
'';
};
systemd.enableUnifiedCgroupHierarchy = mkOption {
default = true;
type = types.bool;
description = ''
Whether to enable the unified cgroup hierarchy (cgroupsv2).
'';
};
systemd.coredump.enable = mkOption {
default = true;
type = types.bool;
@ -1178,6 +1186,7 @@ in
boot.kernel.sysctl = mkIf (!cfg.coredump.enable) {
"kernel.core_pattern" = "core";
};
boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
};
# FIXME: Remove these eventually.

3
nixos/modules/virtualisation/docker.nix
View file

@ -155,6 +155,9 @@ in
users.groups.docker.gid = config.ids.gids.docker;
systemd.packages = [ cfg.package ];
# TODO: remove once docker 20.10 is released
systemd.enableUnifiedCgroupHierarchy = false;
systemd.services.docker = {
wantedBy = optional cfg.enableOnBoot "multi-user.target";
environment = proxy_env;