From 930f45eb5a22ddfdf0566a05e53a40f532572326 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Thu, 8 Jan 2026 12:25:00 +0100
Subject: [PATCH] nixos/tests: add nspawn container integration test

Co-authored-by: Jeremy Fleischman <jeremyfleischman@gmail.com>
---
 nixos/tests/all-tests.nix       |  1 +
 nixos/tests/test-containers.nix | 76 +++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 nixos/tests/test-containers.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 99ddaeea55d0..15bb03eaf6b5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1592,6 +1592,7 @@ in
   teleports = runTest ./teleports.nix;
   temporal = runTest ./temporal.nix;
   terminal-emulators = handleTest ./terminal-emulators.nix { };
+  test-containers = runTest ./test-containers.nix;
   test-containers-bittorrent = runTest ./test-containers-bittorrent.nix;
   thanos = runTest ./thanos.nix;
   thelounge = handleTest ./thelounge.nix { };
diff --git a/nixos/tests/test-containers.nix b/nixos/tests/test-containers.nix
new file mode 100644
index 000000000000..b5db58658891
--- /dev/null
+++ b/nixos/tests/test-containers.nix
@@ -0,0 +1,76 @@
+{ pkgs, ... }:
+{
+  name = "test-containers";
+  meta.maintainers = with pkgs.lib.maintainers; [ jfly ];
+
+  nodes = {
+    n1 = {
+      networking.firewall.enable = false;
+      virtualisation.vlans = [ 1 ];
+    };
+    n2 = {
+      networking.firewall.enable = false;
+      virtualisation.vlans = [
+        2
+      ];
+    };
+  };
+
+  containers = {
+    c1 = {
+      networking.firewall.enable = false;
+      virtualisation.vlans = [ 1 ];
+    };
+    c2 = {
+      networking.firewall.enable = false;
+      virtualisation.vlans = [ 2 ];
+    };
+    c12 = {
+      networking.firewall.enable = false;
+      virtualisation.vlans = [
+        1
+        2
+      ];
+    };
+  };
+
+  testScript = /* python */ ''
+    c1.start()
+    c2.start()
+    c12.start()
+
+    c1.succeed("echo hello > /hello.txt")
+    c1.copy_from_vm("/hello.txt")
+
+    c1.systemctl("start network-online.target")
+    c2.systemctl("start network-online.target")
+    c12.systemctl("start network-online.target")
+    c1.wait_for_unit("network-online.target")
+    c2.wait_for_unit("network-online.target")
+    c12.wait_for_unit("network-online.target")
+
+    # Confirm containers in vlan 1 can talk to each other.
+    c1.succeed("ping -c 1 c12")
+    c12.succeed("ping -c 1 c1")
+
+    # Confirm containers in vlan 2 can talk to each other.
+    # <<< c2.succeed("ping -c 1 c12")  # <<< TODO: this doesn't work because c12's "primary ip" is for vlan 1
+    c12.succeed("ping -c 1 c2")
+
+    # Confirm containers in separate vlans cannot talk to each other.
+    c1.fail("ping -c 1 -W 1 c2")
+
+    n1.start()
+    n2.start()
+    n1.systemctl("start network-online.target")
+    n2.systemctl("start network-online.target")
+    n1.wait_for_unit("network-online.target")
+    n2.wait_for_unit("network-online.target")
+
+    # <<< # Confirm containers and nodes in the same vlan can talk to each other.
+    # <<< c1.succeed("ping -c 1 n1")
+    # <<< n1.succeed("ping -c 1 c1")
+    # <<< c2.succeed("ping -c 1 n2")
+    # <<< n2.succeed("ping -c 1 c2")
+  '';
+}