nixpkgs/nixos/modules/virtualisation/container-config.nix

{ config, pkgs, lib, ... }:

with lib;

{

  config = mkIf config.boot.isContainer {

    # Disable some features that are not useful in a container.
    sound.enable = mkDefault false;
    services.udisks2.enable = mkDefault false;
    powerManagement.enable = mkDefault false;

    networking.useHostResolvConf = true;

    # Containers should be light-weight, so start sshd on demand.
    services.openssh.startWhenNeeded = mkDefault true;

    # Shut up warnings about not having a boot loader.
    system.build.installBootLoader = "${pkgs.coreutils}/bin/true";

    # Not supported in systemd-nspawn containers.
    security.audit.enable = false;

  };

}
Always enable container logins 2014-04-01 15:42:18 +02:00			`{ config, pkgs, lib, ... }:`

			`with lib;`
Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot \| socat unix:<path-to-container>/var/lib/root-shell.socket - 2014-03-17 14:04:39 +01:00
			`{`

Always enable container logins 2014-04-01 15:42:18 +02:00			`config = mkIf config.boot.isContainer {`
Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot \| socat unix:<path-to-container>/var/lib/root-shell.socket - 2014-03-17 14:04:39 +01:00
Enable udisks2 by default The ability for unprivileged users to mount external media is useful regardless of the desktop environment. Also, since udisks2 is activated on-demand, it doesn't add any overhead if you're not using it. 2014-04-19 14:41:21 +02:00			`# Disable some features that are not useful in a container.`
Drop ALSA dependency in containers 2014-04-16 01:44:43 +02:00			`sound.enable = mkDefault false;`
Enable udisks2 by default The ability for unprivileged users to mount external media is useful regardless of the desktop environment. Also, since udisks2 is activated on-demand, it doesn't add any overhead if you're not using it. 2014-04-19 14:41:21 +02:00			`services.udisks2.enable = mkDefault false;`
Disable some more unnecessary stuff in containers 2015-04-19 22:40:07 +02:00			`powerManagement.enable = mkDefault false;`
Drop ALSA dependency in containers 2014-04-16 01:44:43 +02:00
Containers: Use /etc/resolv.conf supplied by the host This used to work with systemd-nspawn 203, because it bind-mounted /etc/resolv.conf (so openresolv couldn't overwrite it). Now it's just copied, so we need some special handling. 2014-04-18 16:40:27 +02:00			`networking.useHostResolvConf = true;`

sshd: Add support for socket activation By enabling ‘services.openssh.startWhenNeeded’, sshd is started on-demand by systemd using socket activation. This is particularly useful if you have a zillion containers and don't want to have sshd running permanently. Note that socket activation is not noticeable slower, contrary to what the manpage for ‘sshd -i’ says, so we might want to make this the default one day. 2014-04-22 16:07:53 +02:00			`# Containers should be light-weight, so start sshd on demand.`
			`services.openssh.startWhenNeeded = mkDefault true;`

Containers: Don't warn about not having a boot loader 2014-04-18 17:00:11 +02:00			`# Shut up warnings about not having a boot loader.`
			`system.build.installBootLoader = "${pkgs.coreutils}/bin/true";`

audit: Disable in containers This barfs: Jan 18 12:46:32 machine 522i0x9l80z7gw56iahxjjsdjp0xi10q-audit-start[506]: The audit system is disabled 2016-01-18 13:57:27 +01:00			`# Not supported in systemd-nspawn containers.`
			`security.audit.enable = false;`

Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot \| socat unix:<path-to-container>/var/lib/root-shell.socket - 2014-03-17 14:04:39 +01:00			`};`

			`}`