Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
9.2 kB · 318 lines
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319{ config, lib, utils, pkgs, ...}:let cfg = config.virtualisation.podman; json = pkgs.formats.json { };
inherit (lib) mkOption types;
# Provides a fake "docker" binary mapping to podman dockerCompat = pkgs.runCommand "${cfg.package.pname}-docker-compat-${cfg.package.version}" { outputs = [ "out" "man" ]; inherit (cfg.package) meta; preferLocalBuild = true; } '' mkdir -p $out/bin ln -s ${cfg.package}/bin/podman $out/bin/docker
mkdir -p $man/share/man/man1 for f in ${cfg.package.man}/share/man/man1/*; do basename=$(basename $f | sed s/podman/docker/g) ln -s $f $man/share/man/man1/$basename done '';
in{ imports = [ (lib.mkRemovedOptionModule [ "virtualisation" "podman" "defaultNetwork" "dnsname" ] "Use virtualisation.podman.defaultNetwork.settings.dns_enabled instead.") (lib.mkRemovedOptionModule [ "virtualisation" "podman" "defaultNetwork" "extraPlugins" ] "Netavark isn't compatible with CNI plugins.") ./network-socket.nix ];
meta = { maintainers = lib.teams.podman.members; };
options.virtualisation.podman = {
enable = mkOption { type = types.bool; default = false; description = '' This option enables Podman, a daemonless container engine for developing, managing, and running OCI Containers on your Linux System.
It is a drop-in replacement for the {command}`docker` command. ''; };
dockerSocket.enable = mkOption { type = types.bool; default = false; description = '' Make the Podman socket available in place of the Docker socket, so Docker tools can find the Podman socket.
Podman implements the Docker API.
Users must be in the `podman` group in order to connect. As with Docker, members of this group can gain root access. ''; };
dockerCompat = mkOption { type = types.bool; default = false; description = '' Create an alias mapping {command}`docker` to {command}`podman`. ''; };
enableNvidia = mkOption { type = types.bool; default = false; description = '' **Deprecated**, please use hardware.nvidia-container-toolkit.enable instead.
Enable use of Nvidia GPUs from within podman containers. ''; };
extraPackages = mkOption { type = with types; listOf package; default = [ ]; example = lib.literalExpression '' [ pkgs.gvisor ] ''; description = '' Extra packages to be installed in the Podman wrapper. ''; };
autoPrune = { enable = mkOption { type = types.bool; default = false; description = '' Whether to periodically prune Podman resources. If enabled, a systemd timer will run `podman system prune -f` as specified by the `dates` option. ''; };
flags = mkOption { type = types.listOf types.str; default = [ ]; example = [ "--all" ]; description = '' Any additional flags passed to {command}`podman system prune`. ''; };
dates = mkOption { default = "weekly"; type = types.str; description = '' Specification (in the format described by {manpage}`systemd.time(7)`) of the time at which the prune will occur. ''; }; };
package = (lib.mkPackageOption pkgs "podman" { extraDescription = '' This package will automatically include extra packages and runtimes. ''; }) // { apply = pkg: pkg.override { extraPackages = cfg.extraPackages ++ [ "/run/wrappers" # setuid shadow config.systemd.package # To allow systemd-based container healthchecks ] ++ lib.optional (config.boot.supportedFilesystems.zfs or false) config.boot.zfs.package; extraRuntimes = [ pkgs.runc ] ++ lib.optionals ( config.virtualisation.containers.containersConf.settings.network.default_rootless_network_cmd or "" == "slirp4netns" ) ( with pkgs; [ slirp4netns ] ); }; };
defaultNetwork.settings = lib.mkOption { type = json.type; default = { }; example = lib.literalExpression "{ dns_enabled = true; }"; description = '' Settings for podman's default network. ''; };
};
config = let networkConfig = ( { dns_enabled = false; driver = "bridge"; id = "0000000000000000000000000000000000000000000000000000000000000000"; internal = false; ipam_options = { driver = "host-local"; }; ipv6_enabled = false; name = "podman"; network_interface = "podman0"; subnets = [ { gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; } ]; } // cfg.defaultNetwork.settings ); inherit (networkConfig) dns_enabled network_interface; in lib.mkIf cfg.enable { warnings = lib.optionals cfg.enableNvidia [ '' You have set virtualisation.podman.enableNvidia. This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead. '' ];
environment.systemPackages = [ cfg.package ] ++ lib.optional cfg.dockerCompat dockerCompat;
# https://github.com/containers/podman/blob/097cc6eb6dd8e598c0e8676d21267b4edb11e144/docs/tutorials/basic_networking.md#default-network environment.etc."containers/networks/podman.json" = lib.mkIf (cfg.defaultNetwork.settings != { }) { source = json.generate "podman.json" networkConfig; };
# containers cannot reach aardvark-dns otherwise networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
virtualisation.containers = { enable = true; # Enable common /etc/containers configuration containersConf.settings = { network.network_backend = "netavark"; }; };
systemd.packages = [ cfg.package ];
systemd.services.podman-prune = { description = "Prune podman resources";
restartIfChanged = false; unitConfig.X-StopOnRemoval = false;
serviceConfig = { Type = "oneshot"; ExecStart = utils.escapeSystemdExecArgs ( [ (lib.getExe cfg.package) "system" "prune" "-f" ] ++ cfg.autoPrune.flags ); };
startAt = lib.optional cfg.autoPrune.enable cfg.autoPrune.dates; after = [ "podman.service" ]; requires = [ "podman.service" ]; };
systemd.services.podman.environment = config.networking.proxy.envVars; systemd.sockets.podman.wantedBy = [ "sockets.target" ]; systemd.sockets.podman.socketConfig.SocketGroup = "podman"; # Podman does not support multiple sockets, as of podman 5.0.2, so we use # a symlink. Unfortunately this does not let us use an alternate group, # such as `docker`. systemd.sockets.podman.socketConfig.Symlinks = lib.mkIf cfg.dockerSocket.enable [ "/run/docker.sock" ];
systemd.user.services.podman.environment = config.networking.proxy.envVars; systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
systemd.timers.podman-prune.timerConfig = lib.mkIf cfg.autoPrune.enable { Persistent = true; RandomizedDelaySec = 1800; };
systemd.tmpfiles.packages = [ # The /run/podman rule interferes with our podman group, so we remove # it and let the systemd socket logic take care of it. (pkgs.runCommand "podman-tmpfiles-nixos" { package = cfg.package; preferLocalBuild = true; } '' mkdir -p $out/lib/tmpfiles.d/ grep -v 'D! /run/podman 0700 root root' \ <$package/lib/tmpfiles.d/podman.conf \ >$out/lib/tmpfiles.d/podman.conf '' ) ];
users.groups.podman = { };
assertions = [ { assertion = cfg.dockerCompat -> !config.virtualisation.docker.enable; message = "Option dockerCompat conflicts with docker"; } { assertion = cfg.dockerSocket.enable -> !config.virtualisation.docker.enable; message = '' The options virtualisation.podman.dockerSocket.enable and virtualisation.docker.enable conflict, because only one can serve the socket. ''; } ]; };}