New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos/containers: allow containers with long names to create private networks #100433
Conversation
TBH, I'm not sure why the pipeline failed :/ |
As this only checks for the booted kernel (which can differ from the one currently running) how does this behave when switching to a new system with 5.8+ configured, but having booted an older kernel? Is there an error message printed by nspawn? Or are the links just named differently? |
Nice catch - in that case switching fails with:
The ethernet device itself does get created - it's just that its alternative name remains unspecified, so it's only reachable via Maybe our container-startup-script (the one that crashes with |
Hmm - I wasn't entirely sure, just thinking out loudly. If this is shown inside the activation script, it already gives quite a lot of information. Maybe if we combine it with a 21.03 release note entry explaining the change, and a "make sure you're running a kernel with support for alternative interface names (5.8+)" at the end, that should be enough to connect the dots? |
Release note seems alright for me :-) Changing kernel versions requires users to make conscious effort (i.e. to modify some part of their configuration), so I consider Maybe we could add a warning (like |
Ran into this issue and would be nice to have this. What remains to be done/reviewed? |
tl;dr as far as I'm concerned, this feature is ready 🙂 (though I'm not sure who I could ping to get it merged) As @flokli noticed, we've got a small shortcoming that when you upgrade from an older kernel to 5.8+, the kernel version assertion passes and thus Nix compiles a configuration which then fails at runtime during |
The problem here is that even on latest |
a0957ac
to
d778cb8
Compare
The new test already contains: {
boot.kernelPackages = pkgs.linuxPackages_latest;
} ... plus it passes on my machine, so I wouldn't bet my money on an older kernel being loaded. I've just rebased my branch and we'll see now - maybe it was just some spurious failure. |
Aaargh, sorry, I'm dumb. It's already too long ago - I forgot long names are only enabled on new kernels. I locally cherry-picked the commit into master and successfully ran the test. Can you:
|
…networks Launching a container with a private network requires creating a dedicated networking interface for it; name of that interface is derived from the container name itself - e.g. a container named `foo` gets attached to an interface named `ve-foo`. An interface name can span up to IFNAMSIZ characters, which means that a container name must contain at most IFNAMSIZ - 3 - 1 = 11 characters; it's a limit that we validate using a build-time assertion. This limit has been upgraded with Linux 5.8, as it allows for an interface to contain a so-called altname, which can be much longer, while remaining treated as a first-class citizen. Since altnames have been supported natively by systemd for a while now, due diligence on our side ends with dropping the name-assertion on newer kernels. This commit closes NixOS#38509. systemd/systemd#14467 systemd/systemd#17220 https://lwn.net/Articles/794289/
d778cb8
to
336ef2d
Compare
Thanks! |
Motivation for this change
Launching a container with a private network requires creating a
dedicated networking interface for it; name of that interface is derived
from the container name itself - e.g. a container named
foo
getsattached to an interface named
ve-foo
.An interface name can span up to IFNAMSIZ characters, which means that a
container name must contain at most IFNAMSIZ - 3 - 1 = 11 characters;
it's a limit that we validate using a build-time assertion.
This limit has been upgraded with Linux 5.8, as it allows for an
interface to contain a so-called altname, which can be much longer,
while remaining treated as a first-class citizen.
Since altnames have been supported natively by systemd for a while now,
due diligence on our side ends with dropping the name-assertion on newer
kernels.
This merge request closes #38509.
systemd/systemd#14467
systemd/systemd#17220
https://lwn.net/Articles/794289/
Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
./result/bin/
)nix path-info -S
before and after)