[WIP] nixos/containers: add unprivileged option #67336
Conversation
|
Here are some errors we should address before merging this. Any input is welcomed :) nscd.service inside unprivileged container fails with: Starting/reloading container results in the the following log output: Those errors do not seem critical since I've been successfully running and reloading unprivileged containers for more than half a year now. My understanding is that we should just skip the mount step when running inside a container. |
|
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/nixos-container-limitations/1835/7 |
|
Would it help to disable |
|
@arianvp Yes, I guess reverting |
|
Just as a reminder: If we can't make this work for 20.03 we have to fix the documentation from #67232. |
c2b042c to
381373f
Compare
|
I disabled special-fs mounts inside nixos containers which fixes mount errors. Let me know if you are aware of cases when it might break things. |
381373f to
aba55d1
Compare
|
Also, creating This is because |
|
Seems like the blocking issue has been fixed: (systemd/systemd#13622), so as long as we will get the new systemd version we can continue to work on this :) |
|
Hello, I'm a bot and I thank you in the name of the community for your contributions. Nixpkgs is a busy repository, and unfortunately sometimes PRs get left behind for too long. Nevertheless, we'd like to help committers reach the PRs that are still important. This PR has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. If this is still important to you and you'd like to remove the stale label, we ask that you leave a comment. Your comment can be as simple as "still important to me". But there's a bit more you can do: If you received an approval by an unprivileged maintainer and you are just waiting for a merge, you can @ mention someone with merge permissions and ask them to help. You might be able to find someone relevant by using Git blame on the relevant files, or via GitHub's web interface. You can see if someone's a member of the nixpkgs-committers team, by hovering with the mouse over their username on the web interface, or by searching them directly on the list. If your PR wasn't reviewed at all, it might help to find someone who's perhaps a user of the package or module you are changing, or alternatively, ask once more for a review by the maintainer of the package/module this is about. If you don't know any, you can use Git blame on the relevant files, or GitHub's web interface to find someone who touched the relevant files in the past. If your PR has had reviews and nevertheless got stale, make sure you've responded to all of the reviewer's requests / questions. Usually when PR authors show responsibility and dedication, reviewers (privileged or not) show dedication as well. If you've pushed a change, it's possible the reviewer wasn't notified about your push via email, so you can always officially request them for a review, or just @ mention them and say you've addressed their comments. Lastly, you can always ask for help at our Discourse Forum, or more specifically, at this thread or at #nixos' IRC channel. |
|
The coresponding PR was merged in january, so we probably have the right systemd version now? |
|
@uvNikita any news on this? |
|
@aanderse I think the best path would be to implement containers module v2.0 (see #69414) where we would use systemd-netowrkd and nspawn files which would reduce amount of scripts and workarounds necessary. Adding unprivileged and ephemeral options support there should be a trivial task I think. In fact, this exactly the way I'm currently using unprivileged, ephemeral containers -- a custom stripped-down nixos containers module similar to the one developed in #69414. |
|
@uvNikita great. I'm looking forward to it. Thanks for the reply! |
|
I marked this as stale due to inactivity. → More info |
Now we're doing it correct user-namespacing here as well, for that a few filesystem-fixes had to be applied. For more context, please refer to NixOS#67336 Also credits go to the author of the aforementioned PR, I basically pulled these changes into this branch.
Now we're doing it correct user-namespacing here as well, for that a few filesystem-fixes had to be applied. For more context, please refer to NixOS#67336 Also credits go to the author of the aforementioned PR, I basically pulled these changes into this branch.
This is a subset of aba55d1 (NixOS#67336)[1] that I (Ma27) am using for quite a while in my systemd-nspawn setup (without `nixos-container`) to have unprivileged containers. Recently, Linus reminded me that this isn't part of upstream NixOS and their setup fails like this when activating config in an nspawn instance (no shared store): stderr) activating the configuration... stdout) setting up /etc... stderr) mount: /dev: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/pts: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/shm: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /run: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stdout) Activation script snippet 'specialfs' failed (32) So I decided to submit this portion again. [1] Hence I retained the original authorship. Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
This is a subset of aba55d1 (NixOS#67336)[1] that I (Ma27) am using for quite a while in my systemd-nspawn setup (without `nixos-container`) to have unprivileged containers. Recently, Linus reminded me that this isn't part of upstream NixOS and their setup fails like this when activating config in an nspawn instance (no shared store): stderr) activating the configuration... stdout) setting up /etc... stderr) mount: /dev: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/pts: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/shm: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /run: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stdout) Activation script snippet 'specialfs' failed (32) So I decided to submit this portion again. [1] Hence I retained the original authorship. Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
This is a subset of aba55d1 (NixOS#67336)[1] that I (Ma27) am using for quite a while in my systemd-nspawn setup (without `nixos-container`) to have unprivileged containers. Recently, Linus reminded me that this isn't part of upstream NixOS and their setup fails like this when activating config in an nspawn instance (no shared store): stderr) activating the configuration... stdout) setting up /etc... stderr) mount: /dev: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/pts: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /dev/shm: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stderr) mount: /run: permission denied. stderr) dmesg(1) may have more information after failed mount system call. stdout) Activation script snippet 'specialfs' failed (32) So I decided to submit this portion again. [1] Hence I retained the original authorship. Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
Motivation for this change
Depends on #67332. Fixes #57087.
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nix-review --run "nix-review wip"./result/bin/)nix path-info -Sbefore and after)Notify maintainers
cc @mmahut @danbst @Mic92 @fpletz @arianvp