From af0238c70efc80925c31d293da3bf8affca6437f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Mon, 9 Feb 2026 16:42:44 +0100
Subject: [PATCH] nixos/virtualisation: assert nspawn container name length

If the names for systemd-nspawn containers are too long,
the generated bridge interface names will surpass the
kernel limit IFNAMSIZ (15 characters + '\0').
---
 .../nspawn-container/default.nix              | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix
index 6f303eec16df..56bcb13e68bf 100644
--- a/nixos/modules/virtualisation/nspawn-container/default.nix
+++ b/nixos/modules/virtualisation/nspawn-container/default.nix
@@ -70,6 +70,37 @@ in
   config = {
     boot.isNspawnContainer = true;
 
+    assertions = [
+      {
+        # Check every interface defined in allInterfaces.
+        # Containers try to create a bridge "${config.system.name}-${interfaceName}"
+        assertion = lib.all (
+          iface:
+          let
+            hostName = "${config.system.name}-${iface.name}";
+          in
+          lib.stringLength hostName <= 15
+        ) (lib.attrValues cfg.allInterfaces);
+
+        message =
+          let
+            offendingInterfaces = lib.filter (
+              iface: lib.stringLength "${config.system.name}-${iface.name}" > 15
+            ) (lib.attrValues cfg.allInterfaces);
+            offenderList = map (
+              i:
+              "${config.system.name}-${i.name} (${toString (lib.stringLength "${config.system.name}-${i.name}")} chars)"
+            ) offendingInterfaces;
+          in
+          ''
+            The following generated host interface names exceed the Linux 15-character limit:
+              ${lib.concatStringsSep "\n            " offenderList}
+
+            Please shorten 'config.system.name' or the interface names in 'virtualisation.interfaces'.
+          '';
+      }
+    ];
+
     # TODO(arianvp): Remove after https://github.com/NixOS/nixpkgs/pull/480686 is merged
     console.enable = true;