Commit graph

1048 commits

Author SHA1 Message Date
zowoq 37f1ed7ca4 nixos/podman: install systemd files
- install podman service and socket
- install podman tmpfile
2021-02-14 06:57:39 +10:00
adisbladis 6caa6cb3f5
Merge pull request #111924 from saschagrunert/cri-o-oci-hook
nixos/cri-o: add OCI seccomp bpf hook support
2021-02-06 12:03:44 +01:00
adisbladis 3c6035cd9a
Merge pull request #106767 from erikarvstedt/fix-container-pkgs-2
nixos-container: fix `nixpkgs` container options being ignored
2021-02-06 11:57:14 +01:00
Sascha Grunert e2b7bdd08d
nixos/cri-o: add OCI seccomp bpf hook support
We now set the hooks dir correctly if the OCI hook is enabled. CRI-O
supports this specific hook from v1.20.0.

Signed-off-by: Sascha Grunert <mail@saschagrunert.de>
2021-02-05 11:04:49 +01:00
Jörg Thalheim 57cfa03b03
Merge pull request #111591 from Mic92/zfs-kube 2021-02-02 11:56:58 +00:00
Robert Hensing a4f4d86e92
Merge pull request #111583 from mikroskeem/more-docker-fixes
docker: fix socket activation race
2021-02-01 19:13:38 +01:00
Jörg Thalheim 9c6a9d0458
nixos/lxd: refactor to use zfs.package/enabled property 2021-02-01 17:59:18 +01:00
Mark Vainomaa 9360e789c6
docker: fix socket activation race 2021-02-01 18:14:43 +02:00
Fritz Otlinghaus d7c39c01ae
nixos/xen: add types 2021-01-31 13:47:57 +01:00
Simon Žlender ede24160fc nixos/oci-containers: Remove dep on system.path 2021-01-29 18:29:07 +01:00
Simon Žlender 683f0b8938 nixos/oci-containers: Use docker.package 2021-01-28 21:27:50 +01:00
volth bc0d605cf1 treewide: fix double quoted strings in meta.description
Signed-off-by: Ben Siraphob <bensiraphob@gmail.com>
2021-01-24 19:56:59 +07:00
Pavol Rusnak 66dc9dbb59
nixos/modules: stdenv.lib -> lib 2021-01-17 21:40:51 +01:00
Aaron Andersen 6b0ba74baa
Merge pull request #109099 from jpotier/fix-deprecation-warning-azure-agent
nixos/azure-agent: fix deprecation warning
2021-01-16 07:52:05 -05:00
Milan Pässler 4000091123
nixos/docker: change misleading error message
The socketActivation option was removed, but later on socket activation
was added back without the option to disable it. The description now reflects
that socket activation is used unconditionally in the current setup.
2021-01-15 15:00:11 +01:00
Mark Vainomaa a81c27cd54
docker: fix systemd socket activation 2021-01-15 15:53:31 +02:00
Erik Arvstedt 9a283a038d
nixos-container: fix nixpkgs container options being ignored
Since the introduction of option `containers.<name>.pkgs`, the
`nixpkgs.*` options (including `nixpkgs.pkgs`, `nixpkgs.config`, ...) were always
ignored in container configs, which broke existing containers.

This was due to `containers.<name>.pkgs` having two separate effects:
(1) It sets the source for the modules that are used to evaluate the container.
(2) It sets the `pkgs` arg (`_module.args.pkgs`) that is used inside the container
    modules.
    This happens even when the default value of `containers.<name>.pkgs` is unchanged, in which
    case the container `pkgs` arg is set to the pkgs of the host system.
    Previously, the `pkgs` arg was determined by the `containers.<name>.config.nixpkgs.*` options.

This commit reverts the breaking change (2) while adding a backwards-compatible way to achieve (1).
It removes option `pkgs` and adds option `nixpkgs` which implements (1).
Existing users of `pkgs` are informed by an error message to use option
`nixpkgs` or to achieve only (2) by setting option `containers.<name>.config.nixpkgs.pkgs`.
2021-01-15 12:49:42 +01:00
Jörg Thalheim f3042e3078
Merge pull request #108862 from cpcloud/refactor-nvidia-containers 2021-01-15 11:10:09 +00:00
Mark Vainomaa b451286b1f
docker: 19.03.4 -> 20.10.2 (#108960)
This commit refactors the build process to handle Docker engine and
CLI split.
2021-01-13 11:33:14 +01:00
Martin Potier de02ae9350
nixos/azure-agent: fix deprecation warning 2021-01-12 13:00:38 +02:00
Amine Chikhaoui ecf84de70c
ec2-amis: 2020-11-23 update (#104740) 2021-01-11 12:37:14 -05:00
Phillip Cloud a873cbc218 nixos/podman: use shared config drvs to populate podman module 2021-01-10 08:54:37 -05:00
Phillip Cloud 3e57cbdd3c nixos/podman: remove assertion that docker and podman nvidia runtimes cannot both be enabled 2021-01-10 08:54:37 -05:00
Phillip Cloud 50f70cb8ed nixos/podman: remove nvidia-container-runtime/config.toml creation from module 2021-01-10 08:54:37 -05:00
Phillip Cloud 8f1a64953e nixos/docker: remove nvidia-container-runtime/config.toml creation from module 2021-01-10 08:54:37 -05:00
Phillip Cloud 890a298409 nvidia-docker: wrapProgram to pickup needed runc executable 2021-01-08 09:29:56 -05:00
Phillip Cloud c9955d06be nixos/podman: add nvidia runtime support 2021-01-08 09:29:55 -05:00
Sandro 58514b3428
Merge pull request #108380 from Patryk27/fixes/lxd-cgroup-v2
nixos/lxd: disable cgroup v2 when LXD is active
2021-01-08 00:23:35 +01:00
Alyssa Ross 6c3d21aff9
nixos/getty: rename from services.mingetty
It's been 8.5 years since NixOS used mingetty, but the option was
never renamed (despite the file definining the module being renamed in
9f5051b76c ("Rename mingetty module to agetty")).

I've chosen to rename it to services.getty here, rather than
services.agetty, because getty is implemantation-neutral and also the
name of the unit that is generated.
2021-01-05 09:09:42 +00:00
Patryk Wychowaniec 30ccbe8eec
nixos/lxd: disable cgroup v2 when LXD is active 2021-01-04 11:25:30 +01:00
lewo 7a6a0577f6
Merge pull request #107610 from puffnfresh/patch-3
oci-containers: fix containers attribute in docs
2020-12-31 09:39:25 +01:00
Niklas Hambüchen 9424925867
Merge pull request #85244 from tomberek/tomberek/amazon-init
amazon-init: add xz to PATH
2020-12-31 01:50:19 +01:00
Brian McKenna 1c73baa8c8
oci-containers: fix containers attribute in docs 2020-12-26 16:06:30 +11:00
Vladimír Čunát 57a787c9fa
Revert Merge #107275: nixos: fix "nixos-rebuild ...
... build-vm-with-bootloader" for EFI systems

This reverts commit 20257280d9, reversing
changes made to 926a1b2094.
It broke nixosTests.installer.simpleUefiSystemdBoot
and right now channel is lagging behing for two weeks.
2020-12-23 21:24:24 +01:00
Bjørn Forsman 39fad297fd nixos: fix "nixos-rebuild build-vm-with-bootloader" for EFI systems
`nixos-rebuild build-vm-with-bootloader` currently fails with the
default NixOS EFI configuration:

  $ cat >configuration.nix <<EOF
  {
    fileSystems."/".device = "/dev/sda1";
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;
  }
  EOF

  $ nixos-rebuild build-vm-with-bootloader -I nixos-config=$PWD/configuration.nix -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixos-20.09.tar.gz
  [...]
  insmod: ERROR: could not insert module /nix/store/1ibmgfr13r8b6xyn4f0wj115819f359c-linux-5.4.83/lib/modules/5.4.83/kernel/fs/efivarfs/efivarfs.ko.xz: No such device
  mount: /sys/firmware/efi/efivars: mount point does not exist.
  [    1.908328] reboot: Power down
  builder for '/nix/store/dx2ycclyknvibrskwmii42sgyalagjxa-nixos-boot-disk.drv' failed with exit code 32
  [...]

Fix it by setting virtualisation.useEFIBoot = true in qemu-vm.nix, when
efi is needed.

And remove the now unneeded configuration in
./nixos/tests/systemd-boot.nix, since it's handled globally.

Before:
* release-20.03: successful build, unsuccessful run
* release-20.09 (and master): unsuccessful build

After:
* Successful build and run.

Fixes https://github.com/NixOS/nixpkgs/issues/107255
2020-12-21 08:55:13 +01:00
Jens Nolte ad6c2dea6a nixos/nixos-container: Always apply extraVeth ip configuration
Fixes that `containers.<name>.extraVeths.<name>` configuration was not
always applied.

When configuring `containers.<name>.extraVeths.<name>` and not
configuring one of `containers.<name>.localAddress`, `.localAddress6`,
`.hostAddress`, `.hostAddress6` or `.hostBridge` the veth was created,
but otherwise no configuration (i.e. no ip) was applied.

nixos-container always configures the primary veth (when `.localAddress`
or `.hostAddress` is set) to be the containers default gateway, so
this fix is required to create a veth in containers that use a different
default gateway.

To test this patch configure the following container and check if the
addresses are applied:
```
  containers.testveth = {
    extraVeths.testveth = {
      hostAddress = "192.168.13.2";
      localAddress = "192.168.13.1";
    };
    config = {...}:{};
  };
```
2020-12-19 04:32:05 +01:00
Erik Arvstedt 77c4fc2e89
nixos-container: simplify 'pkgs' option type
Set the default value directly instead of using a `null` proxy value.
2020-12-15 20:25:59 +01:00
Erik Arvstedt 29385f0560
nixos-containers: remove redundant eval-config args
The values of these args are identical to the default values defined
in `eval-config.nix`.
Note especially that `lib` is not reevaluated.
2020-12-15 20:25:59 +01:00
Frederik Rietdijk b2a3891e12 Merge master into staging-next 2020-11-27 15:09:19 +01:00
Graham Christensen bc49a0815a
utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Frederik Rietdijk 587538d087 Merge staging-next into staging 2020-11-23 18:10:33 +01:00
zowoq dbbd289982 nixos/*: fix indentation 2020-11-23 08:42:51 +10:00
Florian Klink c76891314d
Merge pull request #104094 from flokli/systemd-unified-cgroup-hierarchy
systemd: switch to unified cgroup hierarchy by default
2020-11-22 22:35:42 +01:00
Jack Kelly 43bfd7e5b1 {ec2,openstack}-metadata-fetcher: unconditionally fetch metadata
The metadata fetcher scripts run each time an instance starts, and it
is not safe to assume that responses from the instance metadata
service (IMDS) will be as they were on first boot.

Example: an EC2 instance can have its user data changed while
the instance is stopped. When the instance is restarted, we want to
see the new user data applied.
2020-11-22 11:04:46 +10:00
Jack Kelly 8c39655de3 {ec2,openstack}-metadata-fetcher: introduce wget_imds function 2020-11-22 11:04:46 +10:00
Jack Kelly f8c3027812 openstack-metadata-fetcher: stop lying in log message 2020-11-22 11:04:46 +10:00
Graham Christensen f2cfecdec3
nixos ami: preflight the imds token
According to Freenode's ##AWS, the metadata server can sometimes
take a few moments to get its shoes on, and the very first boot
of a machine can see failed requests for a few moments.
2020-11-19 13:56:44 -05:00
Graham Christensen 83ea88e03f
nixos: ec2 ami: support IMDSv2
AWS's metadata service has two versions. Version 1 allowed plain HTTP
requests to get metadata. However, this was frequently abused when a
user could trick an AWS-hosted server in to proxying requests to the
metadata service. Since the metadata service is frequently used to
generate AWS access keys, this is pretty gnarly. Version two is
identical except it requires the caller to request a token and provide
it on each request.

Today, starting a NixOS AMI in EC2 where the metadata service is
configured to only allow v2 requests fails: the user's SSH key is not
placed, and configuration provided by the user-data is not applied.
The server is useless. This patch addresses that.

Note the dependency on curl is not a joyful one, and it expand the
initrd by 30M. However, see the added comment for more information
about why this is needed. Note the idea of using `echo` and `nc` are
laughable. Don't do that.
2020-11-19 13:00:56 -05:00
Florian Klink d22b3ed4bc systemd: switch to unified cgroup hierarchy by default
See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for
details on why this is desirable, and how it impacts containers.

Users that need to keep using the old cgroup hierarchy can re-enable it
by setting `systemd.unifiedCgroupHierarchy` to `false`.

Well-known candidates not supporting that hierarchy, like docker and
hidepid=… will disable it automatically.

Fixes #73800
2020-11-19 16:56:46 +01:00
Graham Christensen 21339b41bf
nixos: openstack: have its own metadata fetcher expression
These two APIs have diverged over time and are no longer compatible.
2020-11-18 11:42:32 -05:00