gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #67130 from uvNikita/containers/unprivileged

Browse Source 
nixos/containers: add unprivileged option
This commit is contained in:
Marek Mahut
2019-08-23 08:00:35 +02:00
committed by GitHub
parent dfc6d580bc 7e7fc6471e
commit 27acea73b8
3 changed files with 71 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
nixos/modules/virtualisation/containers.nix
View File

@@ -139,6 +139,7 @@ let
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
${optionalString (cfg.unprivileged) "-U"} \
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
@@ -238,8 +239,8 @@ let
ExecReload = pkgs.writeScript "reload-container"
''
#! ${pkgs.runtimeShell} -e
${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
${pkgs.systemd}/bin/machinectl shell "$INSTANCE" \
''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test
'';
SyslogIdentifier = "container %i";
@@ -423,6 +424,7 @@ let
extraVeths = {};
additionalCapabilities = [];
ephemeral = false;
unprivileged = false;
allowedDevices = [];
hostAddress = null;
hostAddress6 = null;
@@ -516,6 +518,16 @@ in
'';
};
unprivileged = mkOption {
type = types.bool;
default = false;
description = ''
Run container in unprivileged mode using private users feature of <command>systemd-nspawn</command>.
This option is eqvivalent of adding -U parameter to <command>systemd-nspawn</command> command.
See <literal>systemd-nspawn(1)</literal> man page for more information.
'';
};
ephemeral = mkOption {
type = types.bool;
default = false;