a527bb251a
We offer full cgroup delegation to our sandbox now, required for running containers inside the sandbox. To run systemd-nspawn or containers managers inside the sandbox, there is a need for one extra ingredient now: control over your own cgroup subtree inside the sandbox. If, in addition, you need multiple UIDs, for e.g. rootless usecases, you need to run with the `uid-range` system feature. Therefore, when the daemon or Nix runs under the right condition, e.g. systemd-style delegation of the cgroup subtree while placing the nix-daemon in a supervisor sub-cgroup, we create a new sub-cgroup for each build based on the build UID and delegate that sub-cgroup to the builder's process. Additionally, `uid-range` always request the `cgroups` feature now, as `uid-range` builds would probably always benefit from having cgroups delegated, but the converse is not true. Inspired from https://github.com/NixOS/nix/pull/11412 with a different design that does not use function-local statics to derive the root cgroup. Co-authored-by: Linus Heckemann <git@sphalerite.org> Co-authored-by: Parker Hoyes <contact@parkerhoyes.com> Change-Id: Ic8947c5adaf4b5bbd153386e05fad65a935274fa Signed-off-by: Raito Bezarius <raito@lix.systems>
81 lines
1.8 KiB
Nix
81 lines
1.8 KiB
Nix
{ nixpkgs }:
|
|
|
|
let
|
|
|
|
machine = { config, pkgs, ... }:
|
|
{
|
|
system.stateVersion = "22.05";
|
|
boot.isContainer = true;
|
|
systemd.services.console-getty.enable = false;
|
|
networking.dhcpcd.enable = false;
|
|
|
|
services.httpd = {
|
|
enable = true;
|
|
adminAddr = "nixos@example.org";
|
|
};
|
|
|
|
systemd.services.test = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "httpd.service" ];
|
|
script = ''
|
|
source /.env
|
|
echo "Hello World" > $out/msg
|
|
ls -lR /dev > $out/dev
|
|
${pkgs.curl}/bin/curl -sS --fail http://localhost/ > $out/page.html
|
|
'';
|
|
unitConfig = {
|
|
FailureAction = "exit-force";
|
|
FailureActionExitStatus = 42;
|
|
SuccessAction = "exit-force";
|
|
};
|
|
};
|
|
};
|
|
|
|
cfg = (import (nixpkgs + "/nixos/lib/eval-config.nix") {
|
|
modules = [ machine ];
|
|
system = "x86_64-linux";
|
|
});
|
|
|
|
config = cfg.config;
|
|
|
|
in
|
|
|
|
with cfg._module.args.pkgs;
|
|
|
|
runCommand "test"
|
|
{ buildInputs = [ config.system.path ];
|
|
requiredSystemFeatures = [ "uid-range" ];
|
|
toplevel = config.system.build.toplevel;
|
|
}
|
|
''
|
|
root=$(pwd)/root
|
|
mkdir -p $root $root/etc
|
|
|
|
export > $root/.env
|
|
|
|
# Make /run a tmpfs to shut up a systemd warning.
|
|
mkdir /run
|
|
mount -t tmpfs none /run
|
|
|
|
mount -t cgroup2 none /sys/fs/cgroup
|
|
|
|
mkdir -p $out
|
|
|
|
chmod +w /etc
|
|
touch /etc/os-release
|
|
echo a5ea3f98dedc0278b6f3cc8c37eeaeac > /etc/machine-id
|
|
|
|
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1 \
|
|
${config.systemd.package}/bin/systemd-nspawn \
|
|
--keep-unit \
|
|
-M ${config.networking.hostName} -D "$root" \
|
|
--register=no \
|
|
--resolv-conf=off \
|
|
--bind-ro=/nix/store \
|
|
--bind=$out \
|
|
--bind=/proc:/run/host/proc \
|
|
--bind=/sys:/run/host/sys \
|
|
--private-network \
|
|
$toplevel/init
|
|
''
|