Commit graph

151 commits

Author SHA1 Message Date
Vladimír Čunát d957b4bd78 Merge recent master into staging
Hydra nixpkgs: ?compare=1151601
2014-09-13 21:48:29 +02:00
Eelco Dolstra 152ae27aac Merge remote-tracking branch 'origin/systemd-216' into staging 2014-09-08 13:53:33 +02:00
Eelco Dolstra 3d821c068a Merge remote-tracking branch 'origin/master' into systemd-216 2014-09-02 14:43:27 +02:00
Vladimír Čunát e51f73652d Merge recent master into staging
Hydra: ?compare=1149952

Conflicts:
	nixos/doc/manual/configuration.xml (changed split file)
	nixos/modules/config/users-groups.nix (choosing filterNull instead of inline definition)
	pkgs/development/libraries/readline/readline6.3.nix (auto-solved)
2014-08-30 10:04:02 +02:00
Eelco Dolstra 6773babd5b Containers: Use nsenter to execute commands in containers
Also remove ‘nixos-container set-root-password’, which is kind of
pointless now.
2014-08-28 02:20:23 +02:00
Eelco Dolstra 0263a8f860 NixOS containers: Use exit status 133 for reboots 2014-08-24 12:28:41 +02:00
Vladimír Čunát d4e9fd2a90 Merge recent master into staging
Hydra: ?compare=1148749

Conflicts (easy):
	nixos/modules/virtualisation/containers.nix
2014-08-21 15:09:31 +02:00
Eelco Dolstra 23db49cf98 Containers: Fix all-containers.service start
Fixes #3662.
2014-08-19 10:06:48 +02:00
Eelco Dolstra 2c899859bf Containers: Use systemd startup notification
Systemd in a container will call sd_notify when it has finished
booting, so we can use that to signal that the container is
ready. This does require some fiddling with $NOTIFY_SOCKET.
2014-08-18 17:16:13 +02:00
Eelco Dolstra 11d99048c1 Containers: Use systemd-nspawn startup notification 2014-08-18 17:14:55 +02:00
Eelco Dolstra ceb67cc9ef Containers: Clean up veth interfaces 2014-08-18 17:14:49 +02:00
Eelco Dolstra 32b977d4a7 Containers: Fix reboot and poweroff
Previously "machinectl reboot/poweroff" brutally killed the container,
as did "systemctl stop/restart". And reboot didn't actually work. Now
everything is fine.
2014-08-18 17:14:38 +02:00
Eelco Dolstra 2337a85fc3 Autostart containers at boot time 2014-08-18 17:09:42 +02:00
Eelco Dolstra e620be97fe Containers: Set up /etc/resolv.conf
Systemd-nspawn is supposed to do this, but doesn't if any of the
--network-* flags are used.
2014-08-15 04:06:01 +02:00
Eelco Dolstra 330fadb706 Containers: Use systemd-nspawn startup notification
This prevents the container unit startup from hanging until timeout if
systemd-nspawn fails.
2014-08-13 00:49:25 +02:00
Eelco Dolstra 878b738333 Containers: Clean up veth interfaces 2014-08-12 03:13:32 +02:00
Eelco Dolstra 04ec038e89 Containers: Fix reboot and poweroff
Previously "machinectl reboot/poweroff" brutally killed the container,
as did "systemctl stop/restart". And reboot didn't actually work. Now
everything is fine.
2014-08-12 03:13:31 +02:00
Eelco Dolstra 4fc151b5a3 nixos-install: Ask the user to set a root password
This removes the need to have an initially empty root password.
2014-05-09 00:52:02 +02:00
Eelco Dolstra 333bfe16c4 Containers: Support setting up macvlan interfaces
By setting a line like

  MACVLANS="eno1"

in /etc/containers/<name>.conf, the container will get an Ethernet
interface named mv-eno1, which represents an additional MAC address on
the physical eno1 interface. Thus the container has direct access to
the physical network. You can specify multiple interfaces in MACVLANS.

Unfortunately, you can't do this with wireless interfaces.

Note that dhcpcd is disabled in containers by default, so you'll
probably want to set

  networking.useDHCP = true;

in the container, or configure a static IP address.

To do: add a containers.* option for this, and a flag for
"nixos-container create".
2014-05-07 17:53:57 +02:00
Eelco Dolstra 6f7aaf10a5 Containers: Use systemd-nspawn's --network-veth flag
Note that this causes the name of the host-side interface to change
from c-<name> to ve-<name>.
2014-05-07 17:53:57 +02:00
Eelco Dolstra 810680bcae Containers: Use systemd-nspawn's --keep-unit flag
This gets rid of some redundant scopes/slices.
2014-05-07 17:53:57 +02:00
Eelco Dolstra b03a2f9e90 Set personality when running a 32-bit container on a 64-bit host 2014-04-19 13:14:51 +02:00
Eelco Dolstra 16bba2db2e Use "machinectl poweroff" to shut down containers 2014-04-18 17:11:59 +02:00
Eelco Dolstra 5fa812ba5e Containers: Inherit the platform type of the host
http://hydra.nixos.org/build/10350055
2014-04-15 12:58:42 +02:00
Eelco Dolstra 35bf0f4810 Don't restart container-startup-done 2014-04-15 12:07:24 +02:00
Eelco Dolstra 29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra 6a7a8a144f Document NixOS containers 2014-04-10 15:07:29 +02:00
Eelco Dolstra ac8c924c09 nixos-container: Add ‘run’ and ‘root-login’ commands
And remove ‘root-shell’.
2014-04-10 15:07:29 +02:00
Eelco Dolstra 3dca6b98cb Fix permissions on /var/lib/startup-done 2014-04-10 15:07:28 +02:00
Eelco Dolstra b0b3fa928a Disable container support in containers
Systemd-nspawn doesn't support nesting, so providing nixos-container
inside a container doesn't make sense.
2014-04-03 16:36:23 +02:00
Eelco Dolstra 1ad9a654be Make starting a container synchronous
So now "systemctl start container@foo" will only return after the
container has reached multi-user.target.
2014-04-03 16:36:23 +02:00
Eelco Dolstra fee81c3739 Always enable container logins 2014-04-03 16:35:36 +02:00
Eelco Dolstra 6da72a4456 nixos-container: Rewrite in Perl
Also fix race condition when multiple containers are created
simultaneously (as NixOps tends to do).
2014-03-31 19:49:15 +02:00
Eelco Dolstra 7ebd856a38 Provide nixos-container unconditionally 2014-03-31 19:49:01 +02:00
Eelco Dolstra 29c469b88d Allow dashes in container names 2014-03-24 12:19:28 +01:00
Eelco Dolstra ba88db3cd3 Add support for imperative container management
The command nixos-container can now create containers.  For instance,
the following creates and starts a container named ‘database’:

  $ nixos-container create database

The configuration of the container is stored in
/var/lib/containers/<name>/etc/nixos/configuration.nix.  After editing
the configuration, you can make the changes take effect by doing

  $ nixos-container update database

The container can also be destroyed:

  $ nixos-container destroy database

Containers are now executed using a template unit,
‘container@.service’, so the unit in this example would be
‘container@database.service’.
2014-03-24 12:19:27 +01:00
Eelco Dolstra 0cca0f477f nixos-container-shell -> nixos-container { login | root-shell } 2014-03-24 12:19:27 +01:00
Eelco Dolstra 2ace7edb81 Rename systemd.containers -> containers
That NixOS containers use systemd-nspawn is just an implementation
detail (which we could change in the future).
2014-03-24 12:19:27 +01:00
Eelco Dolstra 5b10ea1f99 Don't run dhcpcd in containers 2014-03-18 11:39:51 +01:00
Eelco Dolstra 11c4c4ae54 Add command ‘nixos-container-shell’ for logging into a container 2014-03-18 11:36:03 +01:00
Eelco Dolstra 7b82d1ee27 Ensure that the container root can always be accessed via /var/lib/containers 2014-03-18 11:04:54 +01:00
Eelco Dolstra 895bcdd1cb Add support for running a container with a private network interface
For example, the following sets up a container named ‘foo’.  The
container will have a single network interface eth0, with IP address
10.231.136.2.  The host will have an interface c-foo with IP address
10.231.136.1.

  systemd.containers.foo =
    { privateNetwork = true;
      hostAddress = "10.231.136.1";
      localAddress = "10.231.136.2";
      config =
        { services.openssh.enable = true; };
    };

With ‘privateNetwork = true’, the container has the CAP_NET_ADMIN
capability, allowing it to do arbitrary network configuration, such as
setting up firewall rules.  This is secure because it cannot touch the
interfaces of the host.

The helper program ‘run-in-netns’ is needed at the moment because ‘ip
netns exec’ doesn't quite do the right thing (it remounts /sys without
bind-mounting the original /sys/fs/cgroups).
2014-03-18 10:49:25 +01:00
Eelco Dolstra ac215779dd Give containers a writable /nix/var/nix/{profiles,gcroots}
These are stored on the host in
/nix/var/nix/{profiles,gcroots}/per-container/<container-name> to
ensure that container profiles/roots are not garbage-collected.
2014-03-17 15:23:20 +01:00
Eelco Dolstra ef8e0266a2 Don't reboot a container when its configuration changes
Instead, just run "switch-to-configuration" inside the container.
2014-03-17 15:03:29 +01:00
Eelco Dolstra 0d506aa712 Provide a simple way to log into containers
On the host, you can run

  $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw

to get a login prompt.  So this allows logging in even if the
container has no SSH access enabled.

You can also do

  $ socat unix:<path-to-container>/var/lib/root-shell.socket -

to get a plain root shell.  (This socket is only accessible by root,
obviously.)  This makes it easy to execute commands in the container,
e.g.

  $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 14:10:47 +01:00
Rickard Nilsson d5211b0e0e Make initialRootPassword overrideable in all virtualisation modules, not just virtualbox. 2014-02-24 18:05:26 +01:00
Shea Levy c8f1a6ac1e Revert "Add nixosSubmodule option type"
Moving recent types work to a separate branch for now

This reverts commit ca1c5cfa8f.
2014-02-13 12:10:50 -05:00
Shea Levy 220654e205 Revert "Add heterogeneousAttrsOf option type"
Moving recent types work to a separate branch for now

This reverts commit 3f70dabad3.
2014-02-13 12:10:50 -05:00
Shea Levy 3f70dabad3 Add heterogeneousAttrsOf option type
It is parameterized by a function that takes a name and evaluates to the
option type for the attribute of that name. Together with
submoduleWithExtraArgs, this subsumes nixosSubmodule.
2014-02-11 14:59:24 -05:00
Shea Levy ca1c5cfa8f Add nixosSubmodule option type
Since NixOS modules expect special arguments, use a hack to provide them
2014-02-11 14:21:34 -05:00
Eelco Dolstra 9ee30cd9b5 Add support for lightweight NixOS containers
You can now say:

  systemd.containers.foo.config =
    { services.openssh.enable = true;
      services.openssh.ports = [ 2022 ];
      users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-dss ..." ];
    };

which defines a NixOS instance with the given configuration running
inside a lightweight container.

You can also manage the configuration of the container independently
from the host:

  systemd.containers.foo.path = "/nix/var/nix/profiles/containers/foo";

where "path" is a NixOS system profile.  It can be created/updated by
doing:

  $ nix-env --set -p /nix/var/nix/profiles/containers/foo \
      -f '<nixos>' -A system -I nixos-config=foo.nix

The container configuration (foo.nix) should define

  boot.isContainer = true;

to optimise away the building of a kernel and initrd.  This is done
automatically when using the "config" route.

On the host, a lightweight container appears as the service
"container-<name>.service".  The container is like a regular NixOS
(virtual) machine, except that it doesn't have its own kernel.  It has
its own root file system (by default /var/lib/containers/<name>), but
shares the Nix store of the host (as a read-only bind mount).  It also
has access to the network devices of the host.

Currently, if the configuration of the container changes, running
"nixos-rebuild switch" on the host will cause the container to be
rebooted.  In the future we may want to send some message to the
container so that it can activate the new container configuration
without rebooting.

Containers are not perfectly isolated yet.  In particular, the host's
/sys/fs/cgroup is mounted (writable!) in the guest.
2013-11-27 17:14:10 +01:00