public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
nixpkgs/nixos/modules/virtualisation/container-config.nix

28 lines
661 B
Nix
Raw Normal View History

Always enable container logins
2014-04-01 06:42:18 -07:00
{ config, pkgs, lib, ... }:
with lib;
Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 06:04:39 -07:00
{
Always enable container logins
2014-04-01 06:42:18 -07:00
config = mkIf config.boot.isContainer {
Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 06:04:39 -07:00
Enable udisks2 by default The ability for unprivileged users to mount external media is useful regardless of the desktop environment. Also, since udisks2 is activated on-demand, it doesn't add any overhead if you're not using it.
2014-04-19 05:41:21 -07:00
# Disable some features that are not useful in a container.
Drop ALSA dependency in containers
2014-04-15 16:44:43 -07:00
sound.enable = mkDefault false;
Enable udisks2 by default The ability for unprivileged users to mount external media is useful regardless of the desktop environment. Also, since udisks2 is activated on-demand, it doesn't add any overhead if you're not using it.
2014-04-19 05:41:21 -07:00
services.udisks2.enable = mkDefault false;
Disable some more unnecessary stuff in containers
2015-04-19 13:40:07 -07:00
powerManagement.enable = mkDefault false;
Drop ALSA dependency in containers
2014-04-15 16:44:43 -07:00
Containers: Use /etc/resolv.conf supplied by the host This used to work with systemd-nspawn 203, because it bind-mounted /etc/resolv.conf (so openresolv couldn't overwrite it). Now it's just copied, so we need some special handling.
2014-04-18 07:40:27 -07:00
networking.useHostResolvConf = true;
sshd: Add support for socket activation By enabling ‘services.openssh.startWhenNeeded’, sshd is started on-demand by systemd using socket activation. This is particularly useful if you have a zillion containers and don't want to have sshd running permanently. Note that socket activation is not noticeable slower, contrary to what the manpage for ‘sshd -i’ says, so we might want to make this the default one day.
2014-04-22 07:07:53 -07:00
# Containers should be light-weight, so start sshd on demand.
services.openssh.startWhenNeeded = mkDefault true;
Containers: Don't warn about not having a boot loader
2014-04-18 08:00:11 -07:00
# Shut up warnings about not having a boot loader.
system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
audit: Disable in containers This barfs: Jan 18 12:46:32 machine 522i0x9l80z7gw56iahxjjsdjp0xi10q-audit-start[506]: The audit system is disabled
2016-01-18 04:57:27 -08:00
# Not supported in systemd-nspawn containers.
security.audit.enable = false;
Provide a simple way to log into containers On the host, you can run $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw to get a login prompt. So this allows logging in even if the container has no SSH access enabled. You can also do $ socat unix:<path-to-container>/var/lib/root-shell.socket - to get a plain root shell. (This socket is only accessible by root, obviously.) This makes it easy to execute commands in the container, e.g. $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 06:04:39 -07:00
};
}