Commit graph

151 commits

Author SHA1 Message Date
Frederik Rietdijk ae23084237
Merge pull request #30107 from danbst/patch-13
declarative containers: improve example config
2017-11-04 09:59:09 +01:00
Danylo Hlynskyi 398705ba86
containers: autoStart doc typo 2017-11-01 10:25:26 +02:00
Danylo Hlynskyi dc8500165c declarative containers: improve example config
Container config example code mentions `postgresql` service, but the correct use of that service involves setting `system.stateVersion` option (as discovered in https://github.com/NixOS/nixpkgs/issues/30056).

The actual system state version is set randomly to 17.03 because I have no preferences here
2017-10-05 00:42:50 +00:00
Franz Pletz 1bed4773f5
postgresql92: remove last references 2017-09-05 18:20:56 +02:00
evujumenuk 36dd8edde1 containers: remove EXIT_ON_REBOOT
EXIT_ON_REBOOT has been obsolete since sometime in 2014.
2017-08-24 20:48:24 +02:00
Franz Pletz 9536169074
nixos/treewide: remove boolean examples for options
They contain no useful information and increase the length of the
autogenerated options documentation.

See discussion in #18816.
2017-03-17 23:36:19 +01:00
Ian-Woo Kim 5ca0f72472 nixos-container: break lines in description of forwardPorts. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 4f0b663c2e nixos-container: hostPort -> forwardPort and forwardPort is now a list of (protocol,hostPort,containerPort). 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 0bfc631de2 nixos-container: support multiple port forwarding. change type of hostPort from 'string' to 'listOf str' 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 8684285251 nixos-container: introduce hostPort in declarative container options. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim a238c8a575 nixos-container: add --port option for nixos-container (forward network ports to systemd-nspawn container) 2017-02-15 05:12:46 +01:00
montag451 ea5551b551 containers: fix broken /etc/hosts entries when localAddress contains a netmask 2016-12-12 09:20:28 +01:00
montag451 4889c271ca Add macvlan support for declarative containers 2016-12-12 07:34:28 +01:00
Franz Pletz 2401f06801
containers: disable dhcpcd on veth bridge interfaces 2016-12-04 01:41:10 +01:00
Christian Kampka 35ecef2c6d containers module: Add tmpfs options (#20557)
Allows one or more directories to be mounted as a read-only file system.

This makes it convenient to run volatile containers that do not retain
application state.
2016-11-22 02:11:33 +01:00
Arnold Krille b6023f37ad container: fix extraVeth submodule usage
the submodule needs options, not a plain set.
2016-10-09 16:02:14 +02:00
Eric Sagnes a67b597b22 container module: allowedDevices type to submodule
The optionSet type is deprecated in favor of submodule
2016-10-02 14:07:00 +09:00
Joachim F 7e80c42b0e Merge pull request #18511 from ericsagnes/feat/remove-optionSet
modules: optionSet -> submodule
2016-10-01 17:57:45 +02:00
Jörg Thalheim a8c172ca4b Merge pull request #18822 from wlhlm/containers-dev-tun
Allow access to /dev/net/tun inside containers
2016-10-01 00:19:02 +02:00
Wilhelm Schuster 0d1e1b1810 containers module: Add option to enable tunnel access
This adds the containers.<name>.enableTun option allowing containers to
access /dev/net/tun. This is required by openvpn, tinc, etc. in order to
work properly inside containers.

The new option builds on top of two generic options
containers.<name>.additionalCapabilities and
containers.<name>.allowedDevices which also can be used for example when
adding support for FUSE later down the road.
2016-09-25 19:25:17 +02:00
Jörg Thalheim d6ce2e4bcb
containers: fix dynamic hash lookup
we want the content of attribute as a key:
b9df84cd4f broke this
2016-09-24 09:26:52 +02:00
Eelco Dolstra b9df84cd4f nixos-container: Syntax fixes
Get rid of the "or null" stuff. Also change 'cfg . "foo"' to 'cfg.foo'.

Also fixed what appears to be an actual bug: in postStartScript,
cfg.attribute (where attribute is a function argument) should be
cfg.${attribute}.
2016-09-22 14:06:22 +02:00
Eric Sagnes 69713a882c containers module: optionSet -> submodule 2016-09-13 12:54:59 +09:00
Guillaume Maudoux 3aef93e8f0 nixos/containers: Process config like toplevel options (#17365) 2016-08-29 18:25:50 +02:00
Arnold Krille 9045a8e24c declarative containers: additional veths
With these changes, a container can have more then one veth-pair. This allows for example to have LAN and DMZ as bridges on the host and add dedicated containers for proxies, ipv4-firewall and ipv6-firewall. Or to have a bridge for normal WAN, one bridge for administration and one bridge for customer-internal communication. So that web-server containers can be reached from outside per http, from the management via ssh and can talk to their database via the customer network.

The scripts to set up the containers are now rendered several times instead of just one template. The scripts now contain per-container code to configure the extra veth interfaces. The default template without support for extra-veths is still rendered for the imperative containers.

Also a test is there to see if extra veths can be placed into host-bridges or can be reached via routing.
2016-07-28 23:06:41 +02:00
Eelco Dolstra fd5bbdb436 nixos-containers: Set DevicePolicy=closed
This makes the container a bit more secure, by preventing root
creating device nodes to access the host file system, for
instance. (Reference: systemd-nspawn@.service in systemd.)
2016-07-28 17:58:55 +02:00
Eelco Dolstra bf3edfbb3c nixos-containers: Use systemd 231's --notify-ready flag 2016-07-28 17:58:52 +02:00
Eric Merritt eb92804f91 nixos-containers: init package (#16959)
This moves nixos-containers into its own package so that it can be
relied upon by other packages/systems. This should make development
using dynamic containers much easier.
2016-07-19 08:13:06 +02:00
aszlig dc38003af9
nixos/containers: Create an empty machine-id file
Since systemd version 230, it is required to have a machine-id file
prior to the startup of the container. If the file is empty, a transient
machine ID is generated by systemd-nspawn.

See systemd/systemd#3014 for more details on the matter.

This unbreaks all of the containers-* NixOS tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra
Closes: #15808
2016-05-29 18:38:37 +02:00
Eelco Dolstra b37d6d8996 Fix failure to start old containers
The existence of $root/var/lib/private/host-notify as a socket
prevented a bind mount:

  container foo[8083]: Failed to create mount point /var/lib/containers/foo/var/lib/private/host-notify: No such device or address
2016-05-26 16:19:40 +02:00
Arnold Krille 3c819f28f5 containers: Make declarative containers real systemd services
Without the templating (which is still present for imperative containers), it
will be possible to set individual dependencies. Like depending on the network
only if the hostbridge or hardware interfaces are used.

Ported from #3021
2016-04-02 17:07:41 +02:00
Arnold Krille aa46904490 containers: Add a hostbridge and ipv6 addresses
This allows the containers to have their interface in a bridge on the host.
Also this adds IPv6 addresses to the containers both with bridged and unbridged
network.
2016-04-02 17:07:41 +02:00
Ian-Woo Kim b3eebcd93c Merge branch 'master' into extra-binds 2015-09-28 06:02:52 +00:00
Ian-Woo Kim c6b031d32b minor changes 2015-09-28 05:48:16 +00:00
Jan Malakhovski 6eadb16022 nixos: fix some types 2015-09-18 18:48:50 +00:00
Matthias Beyer a38d9d1ca8 nixos-container: Add bash completion for "nixos-container" command 2015-09-16 22:18:48 +02:00
Luca Bruno 682777ed24 nixos containers: fix system path when reloading 2015-09-11 16:59:40 +02:00
Boris Sukholitko ae80c3e7bc containers: fix interfaces option bugs
The default should be [], no need to check it for INTERFACES
variable.
2015-08-26 22:11:12 +03:00
Boris Sukholitko 77c49d9333 containers: add interfaces config option.
It uses systemd-nspawn's --network-interface to move
existing interfaces into the container.
2015-08-22 13:03:07 +03:00
Ian-Woo Kim ae2279bcdb nixos-containers: bindMounts: change default to readOnly. use EXTRA_NSPAWN_FLAGS 2015-05-26 13:41:31 +00:00
Ian-Woo Kim 4d551227c9 nixos-container: rename extraBinds to bindMounts and use attribute set format. 2015-05-26 11:56:42 +00:00
Ian-Woo Kim c4f66eb85d unify extraBindsRW/RO into extraBinds. Now arbitrary mount point is supported. 2015-05-25 19:09:53 +00:00
Ian-Woo Kim cac38c8664 extraBindsRO/extraBindsRW 2015-05-24 16:31:59 +00:00
Eelco Dolstra 307064ceb5 Don't use machinectl to shut down containers
If the host is shutting down, machinectl may fail because it's
bus-activated and D-Bus will be shutting down. So just send a signal
to the leader process directly.

Fixes #6212.
2015-02-28 19:23:00 +01:00
Lane Seppala 4106a3b74e Fix rebooting containers where resolv.conf is a symlink 2015-02-27 10:27:18 -07:00
Eelco Dolstra 22d2fc3657 Fix "systemctl reload container@"
Fixes #5179.
2015-02-27 14:32:54 +01:00
Jaka Hudoklin 2af3ff52c2 nixos/containers: make containers in containers possible 2015-01-28 16:06:44 +01:00
Eelco Dolstra 3ca275d7ba NixOS containers: Create /root with 700 permission
Systemd-nspawn creates /root with 755 permission if it doesn't exist,
which is bad. So we have to create it ourselves before calling
systemd-nspawn.
2015-01-15 17:51:43 +01:00
mokasin dd6dfde575 Add auto-start option to containers. 2015-01-12 18:26:22 +01:00
Aristid Breitkreuz 5ff169f4d7 containers: remove obsolete comment 2014-11-23 12:30:03 +01:00
Vladimír Čunát d957b4bd78 Merge recent master into staging
Hydra nixpkgs: ?compare=1151601
2014-09-13 21:48:29 +02:00
Eelco Dolstra 152ae27aac Merge remote-tracking branch 'origin/systemd-216' into staging 2014-09-08 13:53:33 +02:00
Eelco Dolstra 3d821c068a Merge remote-tracking branch 'origin/master' into systemd-216 2014-09-02 14:43:27 +02:00
Vladimír Čunát e51f73652d Merge recent master into staging
Hydra: ?compare=1149952

Conflicts:
	nixos/doc/manual/configuration.xml (changed split file)
	nixos/modules/config/users-groups.nix (choosing filterNull instead of inline definition)
	pkgs/development/libraries/readline/readline6.3.nix (auto-solved)
2014-08-30 10:04:02 +02:00
Eelco Dolstra 6773babd5b Containers: Use nsenter to execute commands in containers
Also remove ‘nixos-container set-root-password’, which is kind of
pointless now.
2014-08-28 02:20:23 +02:00
Eelco Dolstra 0263a8f860 NixOS containers: Use exit status 133 for reboots 2014-08-24 12:28:41 +02:00
Vladimír Čunát d4e9fd2a90 Merge recent master into staging
Hydra: ?compare=1148749

Conflicts (easy):
	nixos/modules/virtualisation/containers.nix
2014-08-21 15:09:31 +02:00
Eelco Dolstra 23db49cf98 Containers: Fix all-containers.service start
Fixes #3662.
2014-08-19 10:06:48 +02:00
Eelco Dolstra 2c899859bf Containers: Use systemd startup notification
Systemd in a container will call sd_notify when it has finished
booting, so we can use that to signal that the container is
ready. This does require some fiddling with $NOTIFY_SOCKET.
2014-08-18 17:16:13 +02:00
Eelco Dolstra 11d99048c1 Containers: Use systemd-nspawn startup notification 2014-08-18 17:14:55 +02:00
Eelco Dolstra ceb67cc9ef Containers: Clean up veth interfaces 2014-08-18 17:14:49 +02:00
Eelco Dolstra 32b977d4a7 Containers: Fix reboot and poweroff
Previously "machinectl reboot/poweroff" brutally killed the container,
as did "systemctl stop/restart". And reboot didn't actually work. Now
everything is fine.
2014-08-18 17:14:38 +02:00
Eelco Dolstra 2337a85fc3 Autostart containers at boot time 2014-08-18 17:09:42 +02:00
Eelco Dolstra e620be97fe Containers: Set up /etc/resolv.conf
Systemd-nspawn is supposed to do this, but doesn't if any of the
--network-* flags are used.
2014-08-15 04:06:01 +02:00
Eelco Dolstra 330fadb706 Containers: Use systemd-nspawn startup notification
This prevents the container unit startup from hanging until timeout if
systemd-nspawn fails.
2014-08-13 00:49:25 +02:00
Eelco Dolstra 878b738333 Containers: Clean up veth interfaces 2014-08-12 03:13:32 +02:00
Eelco Dolstra 04ec038e89 Containers: Fix reboot and poweroff
Previously "machinectl reboot/poweroff" brutally killed the container,
as did "systemctl stop/restart". And reboot didn't actually work. Now
everything is fine.
2014-08-12 03:13:31 +02:00
Eelco Dolstra 4fc151b5a3 nixos-install: Ask the user to set a root password
This removes the need to have an initially empty root password.
2014-05-09 00:52:02 +02:00
Eelco Dolstra 333bfe16c4 Containers: Support setting up macvlan interfaces
By setting a line like

  MACVLANS="eno1"

in /etc/containers/<name>.conf, the container will get an Ethernet
interface named mv-eno1, which represents an additional MAC address on
the physical eno1 interface. Thus the container has direct access to
the physical network. You can specify multiple interfaces in MACVLANS.

Unfortunately, you can't do this with wireless interfaces.

Note that dhcpcd is disabled in containers by default, so you'll
probably want to set

  networking.useDHCP = true;

in the container, or configure a static IP address.

To do: add a containers.* option for this, and a flag for
"nixos-container create".
2014-05-07 17:53:57 +02:00
Eelco Dolstra 6f7aaf10a5 Containers: Use systemd-nspawn's --network-veth flag
Note that this causes the name of the host-side interface to change
from c-<name> to ve-<name>.
2014-05-07 17:53:57 +02:00
Eelco Dolstra 810680bcae Containers: Use systemd-nspawn's --keep-unit flag
This gets rid of some redundant scopes/slices.
2014-05-07 17:53:57 +02:00
Eelco Dolstra b03a2f9e90 Set personality when running a 32-bit container on a 64-bit host 2014-04-19 13:14:51 +02:00
Eelco Dolstra 16bba2db2e Use "machinectl poweroff" to shut down containers 2014-04-18 17:11:59 +02:00
Eelco Dolstra 5fa812ba5e Containers: Inherit the platform type of the host
http://hydra.nixos.org/build/10350055
2014-04-15 12:58:42 +02:00
Eelco Dolstra 35bf0f4810 Don't restart container-startup-done 2014-04-15 12:07:24 +02:00
Eelco Dolstra 29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra 6a7a8a144f Document NixOS containers 2014-04-10 15:07:29 +02:00
Eelco Dolstra ac8c924c09 nixos-container: Add ‘run’ and ‘root-login’ commands
And remove ‘root-shell’.
2014-04-10 15:07:29 +02:00
Eelco Dolstra 3dca6b98cb Fix permissions on /var/lib/startup-done 2014-04-10 15:07:28 +02:00
Eelco Dolstra b0b3fa928a Disable container support in containers
Systemd-nspawn doesn't support nesting, so providing nixos-container
inside a container doesn't make sense.
2014-04-03 16:36:23 +02:00
Eelco Dolstra 1ad9a654be Make starting a container synchronous
So now "systemctl start container@foo" will only return after the
container has reached multi-user.target.
2014-04-03 16:36:23 +02:00
Eelco Dolstra fee81c3739 Always enable container logins 2014-04-03 16:35:36 +02:00
Eelco Dolstra 6da72a4456 nixos-container: Rewrite in Perl
Also fix race condition when multiple containers are created
simultaneously (as NixOps tends to do).
2014-03-31 19:49:15 +02:00
Eelco Dolstra 7ebd856a38 Provide nixos-container unconditionally 2014-03-31 19:49:01 +02:00
Eelco Dolstra 29c469b88d Allow dashes in container names 2014-03-24 12:19:28 +01:00
Eelco Dolstra ba88db3cd3 Add support for imperative container management
The command nixos-container can now create containers.  For instance,
the following creates and starts a container named ‘database’:

  $ nixos-container create database

The configuration of the container is stored in
/var/lib/containers/<name>/etc/nixos/configuration.nix.  After editing
the configuration, you can make the changes take effect by doing

  $ nixos-container update database

The container can also be destroyed:

  $ nixos-container destroy database

Containers are now executed using a template unit,
‘container@.service’, so the unit in this example would be
‘container@database.service’.
2014-03-24 12:19:27 +01:00
Eelco Dolstra 0cca0f477f nixos-container-shell -> nixos-container { login | root-shell } 2014-03-24 12:19:27 +01:00
Eelco Dolstra 2ace7edb81 Rename systemd.containers -> containers
That NixOS containers use systemd-nspawn is just an implementation
detail (which we could change in the future).
2014-03-24 12:19:27 +01:00
Eelco Dolstra 5b10ea1f99 Don't run dhcpcd in containers 2014-03-18 11:39:51 +01:00
Eelco Dolstra 11c4c4ae54 Add command ‘nixos-container-shell’ for logging into a container 2014-03-18 11:36:03 +01:00
Eelco Dolstra 7b82d1ee27 Ensure that the container root can always be accessed via /var/lib/containers 2014-03-18 11:04:54 +01:00
Eelco Dolstra 895bcdd1cb Add support for running a container with a private network interface
For example, the following sets up a container named ‘foo’.  The
container will have a single network interface eth0, with IP address
10.231.136.2.  The host will have an interface c-foo with IP address
10.231.136.1.

  systemd.containers.foo =
    { privateNetwork = true;
      hostAddress = "10.231.136.1";
      localAddress = "10.231.136.2";
      config =
        { services.openssh.enable = true; };
    };

With ‘privateNetwork = true’, the container has the CAP_NET_ADMIN
capability, allowing it to do arbitrary network configuration, such as
setting up firewall rules.  This is secure because it cannot touch the
interfaces of the host.

The helper program ‘run-in-netns’ is needed at the moment because ‘ip
netns exec’ doesn't quite do the right thing (it remounts /sys without
bind-mounting the original /sys/fs/cgroups).
2014-03-18 10:49:25 +01:00
Eelco Dolstra ac215779dd Give containers a writable /nix/var/nix/{profiles,gcroots}
These are stored on the host in
/nix/var/nix/{profiles,gcroots}/per-container/<container-name> to
ensure that container profiles/roots are not garbage-collected.
2014-03-17 15:23:20 +01:00
Eelco Dolstra ef8e0266a2 Don't reboot a container when its configuration changes
Instead, just run "switch-to-configuration" inside the container.
2014-03-17 15:03:29 +01:00
Eelco Dolstra 0d506aa712 Provide a simple way to log into containers
On the host, you can run

  $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw

to get a login prompt.  So this allows logging in even if the
container has no SSH access enabled.

You can also do

  $ socat unix:<path-to-container>/var/lib/root-shell.socket -

to get a plain root shell.  (This socket is only accessible by root,
obviously.)  This makes it easy to execute commands in the container,
e.g.

  $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 14:10:47 +01:00
Rickard Nilsson d5211b0e0e Make initialRootPassword overrideable in all virtualisation modules, not just virtualbox. 2014-02-24 18:05:26 +01:00
Shea Levy c8f1a6ac1e Revert "Add nixosSubmodule option type"
Moving recent types work to a separate branch for now

This reverts commit ca1c5cfa8f.
2014-02-13 12:10:50 -05:00
Shea Levy 220654e205 Revert "Add heterogeneousAttrsOf option type"
Moving recent types work to a separate branch for now

This reverts commit 3f70dabad3.
2014-02-13 12:10:50 -05:00
Shea Levy 3f70dabad3 Add heterogeneousAttrsOf option type
It is parameterized by a function that takes a name and evaluates to the
option type for the attribute of that name. Together with
submoduleWithExtraArgs, this subsumes nixosSubmodule.
2014-02-11 14:59:24 -05:00
Shea Levy ca1c5cfa8f Add nixosSubmodule option type
Since NixOS modules expect special arguments, use a hack to provide them
2014-02-11 14:21:34 -05:00