New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos-containers: allow writable api fs #73467
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The commit message doesn't say why we need writeable api fs. Also, I thought this enabled that feature by default. Saying "nixos-containers: add ... option" in commit subject might make that clearer.
Also, I would add a link to the relevant systemd documentation to the commit - the option's documentation is very hard to find! |
ca58961
to
9f2bca4
Compare
rebased on master and addressed review comments. Thanks @bjornfor and @asymmetric :) |
@xwvvvvwx, @asymmetric can you add a simple nixos vm test that exercises this functionality? |
Also note #74761 |
9f2bca4
to
f9a8787
Compare
rebased on master and added tests 🙂 |
34ef00b
to
5ca26a8
Compare
@xwvvvvwx The link to the docs din your PR description doesn't work (anymore). It is (now) https://systemd.io/ENVIRONMENT/ BTW, do you have your config for the wireshark VPN online? |
Allows network-manager and dhcpcd to be run in a nixos-container when the container is sharing the host network or has been launched using the `--network-namespace-path` option. env var documented here: https://systemd.io/ENVIRONMENT/
5ca26a8
to
a0c869b
Compare
@Moredread thanks 🙂. Updated PR description and commit message accordingly.
This PR in combination with #71328 lets me do something like this: https://ipfs.io/ipfs/QmVzMqS5abxDku6VSVKDg2bFqqdrwb8V69WKSYJ8kq4rHH to configure a whole internet wireguard vpn using network namespaces. |
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly:
|
I would still be interested in seeing this merged, once the conflicts are resolved. |
I marked this as stale due to inactivity. → More info |
Motivation for this change
I run
network-manager
anddhcpcd
in containers as part of a namespace based whole internet wireguard vpn solution. Both of these packages will not work unless they can write to/proc/sys/net
, so require theSYSTEMD_NSPAWN_API_VFS_WRITABLE
environment variable (see here for docs) to be set.Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nix-review --run "nix-review wip"
./result/bin/
)nix path-info -S
before and after)Notify maintainers
cc @