Is it necessary to add all system executables? This might mean that the service could work on some system configurations and not others.

In which case would it not work? CRI-O needs some executables like conmon and runc in $PATH, so I thought this would be an usual way to solve this.

You can use

       systemd.services.<name>.path
           Packages added to the service's PATH environment variable. Both the bin and sbin subdirectories of each package are added.

           Type: unspecified

           Default: [ ]

for that.

e.g.

systemd.services.crio = {
  path = [ pkgs.conmon pkgs.runc ];
};

Thanks, that's nice. I also had to add utillinux for nsenter.

I know nothing about cri-o but it just sounds a bit scary to me on first sight? Is this the correct default?
Please ignore me if this is a stupid question

Thanks for pointing that out, since I think it is important. For now I would leave it as it is, see the documentation here: https://github.com/containers/image/blob/master/docs/containers-policy.json.5.md#insecureacceptanything

What do you think?

Seems like good default. It will behave just like docker where images can be pulled left and right. Let's start like this and then add a new nixos option later, if there is demand to configure it.

At some point, we want to move this line to a virtualization.runc module, as for example podman will try to look for this file too, as both podman, cri-o and many other CRI implementations use /etc/containers and conmon for tasks. But we can do that once we try to package those. We should just not forget to do that at some point

Other distributions provide a dedicated package for these configuration files, do we want to do this as well? Because the policy file is not directly related to runc and other runtimes could be used with CRI-O as well (like kata containers).

Yes we can create a etc.containers nixos module and then have all the other modules depend on it.