From ac215779dd1fdfe58d75bcc22cb6a5b0a58744a4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Mon, 17 Mar 2014 15:23:20 +0100
Subject: [PATCH] Give containers a writable /nix/var/nix/{profiles,gcroots}

These are stored on the host in
/nix/var/nix/{profiles,gcroots}/per-container/<container-name> to
ensure that container profiles/roots are not garbage-collected.
---
 nixos/modules/virtualisation/containers.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index 034ebe84b42..6a4833e1e21 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -110,10 +110,19 @@ with pkgs.lib;
             if ! [ -e ${container.root}/etc/os-release ]; then
               touch ${container.root}/etc/os-release
             fi
+
+            mkdir -p -m 0755 \
+              /nix/var/nix/profiles/per-container/${name} \
+              /nix/var/nix/gcroots/per-container/${name}
           '';
 
         serviceConfig.ExecStart =
-          "${config.systemd.package}/bin/systemd-nspawn -M ${name} -D ${container.root} --bind-ro=/nix ${container.path}/init";
+          "${config.systemd.package}/bin/systemd-nspawn"
+          + " -M ${name} -D ${container.root}"
+          + " --bind-ro=/nix/store --bind-ro=/nix/var/nix/db --bind-ro=/nix/var/nix/daemon-socket"
+          + " --bind=/nix/var/nix/profiles/per-container/${name}:/nix/var/nix/profiles"
+          + " --bind=/nix/var/nix/gcroots/per-container/${name}:/nix/var/nix/gcroots"
+          + " ${container.path}/init";
 
         preStop =
           ''