3624bb5362
When logging into a container by using nixos-container root-login all nix-related commands in the container would fail, as they tried to modify the nix db and nix store, which are mounted read-only in the container. We want nixos-container to not try to modify the nix store at all, but instead delegate any build commands to the nix daemon of the host operating system. This already works for non-root users inside a nixos-container, as it doesn't 'own' the nix-store, and thus defaults to talking to the daemon socket at /nix/var/nix/daemon-socket/, which is bind-mounted to the host daemon-socket, causing all nix commands to be delegated to the host. However, when we are the root user inside the container, we have the same uid as the nix store owner, eventhough it's not actually the same root user (due to user namespaces). Nix gets confused, and is convinced it's running in single-user mode, and tries to modify the nix store directly instead. By setting `NIX_REMOTE=daemon` in `/etc/profile`, we force nix to operate in multi-user mode, so that it will talk to the host daemon instead, which will modify the nix store for the container. This fixes #40355
34 lines
824 B
Nix
34 lines
824 B
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
|
|
{
|
|
|
|
config = mkIf config.boot.isContainer {
|
|
|
|
# Disable some features that are not useful in a container.
|
|
sound.enable = mkDefault false;
|
|
services.udisks2.enable = mkDefault false;
|
|
powerManagement.enable = mkDefault false;
|
|
|
|
networking.useHostResolvConf = mkDefault true;
|
|
|
|
# Containers should be light-weight, so start sshd on demand.
|
|
services.openssh.startWhenNeeded = mkDefault true;
|
|
|
|
# Shut up warnings about not having a boot loader.
|
|
system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
|
|
|
|
# Not supported in systemd-nspawn containers.
|
|
security.audit.enable = false;
|
|
|
|
# Make sure that root user in container will talk to host nix-daemon
|
|
environment.etc."profile".text = ''
|
|
export NIX_REMOTE=daemon
|
|
'';
|
|
|
|
|
|
|
|
};
|
|
|
|
}
|