nixos/singularity: disable setuid for apptainer

(cherry picked from commit 5f4b6ea5dde8b0153f416c78519d877ab1224f91)
2024-01-10 20:47:57 +00:00
parent 562dd63932
commit 35de6f1c4e
1 changed files with 6 additions and 1 deletions
@@ -61,7 +61,12 @@ in
    };
    enableSuid = mkOption {
      type = types.bool;
-      default = true;
+      # SingularityCE requires SETUID for most things. Apptainer prefers user
+      # namespaces, e.g. `apptainer exec --nv` would fail if built
+      # `--with-suid`:
+      # > `FATAL: nvidia-container-cli not allowed in setuid mode`
+      default = cfg.package.projectName != "apptainer";
+      defaultText = literalExpression ''config.services.singularity.package.projectName != "apptainer"'';
      example = false;
      description = mdDoc ''
        Whether to enable the SUID support of Singularity/Apptainer.