Raito Bezariusandeldritch horrors
9a59106c17
In the past, it tried direct access if it *could* [1] perform direct access. This solves a bunch of errors people had when they tried the cgroup feature and their scripts did not pass NIX_REMOTE=daemon manually (nixos-rebuild-ng, home-manager activation from a root systemd unit, etc.) To avoid looping infinitely while receiving daemon connections, we forcibly change the store URI when forking for a subdaemon to do direct access automatically, this doesn't break forward usecases where you point a daemon to another socket because we only change NIX_REMOTE="", NIX_REMOTE=daemon, NIX_REMOTE=auto to a local and direct access. All these usecases would end up infinitely looping no matter what settings are set, because we are also responsible for creating the daemon socket. [1]: this happened all the time if you were `root`. Related: https://github.com/NixOS/nixpkgs/pull/415701 Change-Id: I783fc795a9c2ee25b3d9f44f453f8f94b063371f Signed-off-by: Raito Bezarius <raito@lix.systems>
49 lines
1.6 KiB
Nix
49 lines
1.6 KiB
Nix
{ nixpkgs, ... }:
|
|
|
|
{
|
|
name = "cgroups";
|
|
|
|
nodes =
|
|
{
|
|
host =
|
|
{ config, pkgs, ... }:
|
|
{ virtualisation.additionalPaths = [ pkgs.stdenvNoCC ];
|
|
nix.extraOptions =
|
|
''
|
|
extra-experimental-features = nix-command auto-allocate-uids cgroups
|
|
extra-system-features = uid-range
|
|
'';
|
|
nix.settings.use-cgroups = true;
|
|
nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
|
|
};
|
|
};
|
|
|
|
testScript = { nodes }: ''
|
|
start_all()
|
|
|
|
host.wait_for_unit("multi-user.target")
|
|
|
|
# Start build in background
|
|
host.execute("nix build --use-cgroups --auto-allocate-uids --file ${./hang.nix} >&2 &")
|
|
pid = int(host.succeed("pgrep nix"))
|
|
service = "/sys/fs/cgroup/system.slice/nix-daemon.service"
|
|
|
|
# Wait for cgroups to be created
|
|
host.succeed(f"until [ -e {service}/supervisor ]; do sleep 1; done", timeout=30)
|
|
host.succeed(f"until [ -e {service}/nix-build-uid-* ]; do sleep 1; done", timeout=30)
|
|
|
|
# Check that there aren't processes where there shouldn't be, and that there are where there should be
|
|
host.succeed(f'[ -z "$(cat {service}/cgroup.procs)" ]')
|
|
host.succeed(f'[ -n "$(cat {service}/supervisor/cgroup.procs)" ]')
|
|
host.succeed(f'[ -n "$(cat {service}/nix-build-uid-*/cgroup.procs)" ]')
|
|
|
|
# Perform an interrupt
|
|
host.execute(f"kill -SIGINT {pid}")
|
|
|
|
# Check that there aren't any cgroups anymore, neither any state records
|
|
host.succeed(f"until [ ! -e {service}/nix-build-uid-* ]; do sleep 1; done", timeout=30)
|
|
host.succeed("until [ ! -e /nix/var/nix/cgroups/nix-build-uid-* ]; do sleep 1; done", timeout=30)
|
|
'';
|
|
|
|
}
|