expand nspawn unit file validation logic to allow all currently supported fields #49712
+7
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GrahamcOfBorg
added
6.topic: nixos
c0bw3b
added a commit
that referenced
this pull request
Dec 8, 2018
c0bw3b
added a commit
that referenced
this pull request
Dec 8, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
I tried to set
systemd.nspawn.ubuntu.execConfig.LimitNOFILE, but as it turns out the nspawn module does a whole lot of validation (which is imho unnecessary beyond a simple sanity check) and rejects that property, even though it's supported:https://www.freedesktop.org/software/systemd/man/systemd.nspawn.html
Things done
I've added all (?) missing fields to the list of allowed ones.
But nspawn seems to be part of a bigger closure which a lot of packages depend on, so I can't really test this.It's just a few additions to a list though .. what could go wrong?Could this change be applied to the stable branch, too? As it is now nspawn is somewhat limited. Or is there some easy hack possible to circumvent the validation?
cc @Mic92 because you've been active around here