diff --git a/nixos/doc/manual/containers.xml b/nixos/doc/manual/containers.xml
index b8f170fc614f..2530d5195212 100644
--- a/nixos/doc/manual/containers.xml
+++ b/nixos/doc/manual/containers.xml
@@ -213,8 +213,8 @@ $ ping -c1 10.233.4.2
Networking is implemented using a pair of virtual Ethernet
devices. The network interface in the container is called
eth0, while the matching interface in the host is
-called c-container-name
-(e.g., c-foo). The container has its own network
+called ve-container-name
+(e.g., ve-foo). The container has its own network
namespace and the CAP_NET_ADMIN capability, so it
can perform arbitrary network configuration such as setting up
firewall rules, without affecting or having access to the host’s
@@ -228,11 +228,11 @@ on the host:
networking.nat.enable = true;
-networking.nat.internalInterfaces = ["c-+"];
+networking.nat.internalInterfaces = ["ve-+"];
networking.nat.externalInterface = "eth0";
where eth0 should be replaced with the desired
-external interface. Note that c-+ is a wildcard
+external interface. Note that ve-+ is a wildcard
that matches all container interfaces.
diff --git a/nixos/doc/manual/release-notes.xml b/nixos/doc/manual/release-notes.xml
index 836cb5c19f4c..52e88bb4c861 100644
--- a/nixos/doc/manual/release-notes.xml
+++ b/nixos/doc/manual/release-notes.xml
@@ -4,6 +4,28 @@
Release notes
+
+
+
+
+Release 14.10 (“Caterpillar”, 2014/10/??)
+
+When upgrading from a previous release, please be aware of the
+following incompatible changes:
+
+
+
+ The host side of a container virtual Ethernet pair
+ is now called ve-container-name
+ rather than c-container-name.
+
+
+
+
+
+
+
+
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 757340b3c2cd..8799d7d8a201 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -34,9 +34,8 @@ let
# Ignore peth* devices; on Xen, they're renamed physical
# Ethernet cards used for bridging. Likewise for vif* and tap*
- # (Xen) and virbr* and vnet* (libvirt) and c-* and ctmp-* (NixOS
- # containers).
- denyinterfaces ${toString ignoredInterfaces} lo peth* vif* tap* tun* virbr* vnet* vboxnet* c-* ctmp-*
+ # (Xen) and virbr* and vnet* (libvirt).
+ denyinterfaces ${toString ignoredInterfaces} lo peth* vif* tap* tun* virbr* vnet* vboxnet*
${config.networking.dhcpcd.extraConfig}
'';
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index 7a8c8a4594b5..08c234b94133 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -4,16 +4,6 @@ with lib;
let
- runInNetns = pkgs.stdenv.mkDerivation {
- name = "run-in-netns";
- unpackPhase = "true";
- buildPhase = ''
- mkdir -p $out/bin
- gcc ${./run-in-netns.c} -o $out/bin/run-in-netns
- '';
- installPhase = "true";
- };
-
nixos-container = pkgs.substituteAll {
name = "nixos-container";
dir = "bin";
@@ -23,6 +13,28 @@ let
inherit (pkgs) socat;
};
+ # The container's init script, a small wrapper around the regular
+ # NixOS stage-2 init script.
+ containerInit = pkgs.writeScript "container-init"
+ ''
+ #! ${pkgs.stdenv.shell} -e
+
+ # Initialise the container side of the veth pair.
+ if [ "$PRIVATE_NETWORK" = 1 ]; then
+ ip link set host0 name eth0
+ ip link set dev eth0 up
+ if [ -n "$HOST_ADDRESS" ]; then
+ ip route add $HOST_ADDRESS dev eth0
+ ip route add default via $HOST_ADDRESS
+ fi
+ if [ -n "$LOCAL_ADDRESS" ]; then
+ ip addr add $LOCAL_ADDRESS dev eth0
+ fi
+ fi
+
+ exec "$1"
+ '';
+
system = config.nixpkgs.system;
in
@@ -70,7 +82,7 @@ in
Whether to give the container its own private virtual
Ethernet interface. The interface is called
eth0, and is hooked up to the interface
- c-container-name
+ ve-container-name
on the host. If this option is not set, then the
container shares the network interfaces of the host,
and can bind to any port on any interface.
@@ -176,39 +188,8 @@ in
"/nix/var/nix/profiles/per-container/$INSTANCE" \
"/nix/var/nix/gcroots/per-container/$INSTANCE"
- if [ -f "/etc/containers/$INSTANCE.conf" ]; then
- . "/etc/containers/$INSTANCE.conf"
- fi
-
- # Cleanup from last time.
- ifaceHost=c-$INSTANCE
- ifaceCont=ctmp-$INSTANCE
- ns=net-$INSTANCE
- ip netns del $ns 2> /dev/null || true
- ip link del $ifaceHost 2> /dev/null || true
- ip link del $ifaceCont 2> /dev/null || true
-
if [ "$PRIVATE_NETWORK" = 1 ]; then
- # Create a pair of virtual ethernet devices. On the host,
- # we get ‘c-
-#include
-#include
-
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-
-int main(int argc, char * * argv)
-{
- if (argc < 3) {
- fprintf(stderr, "%s: missing arguments\n", argv[0]);
- return 1;
- }
-
- char nsPath[PATH_MAX];
-
- sprintf(nsPath, "/run/netns/%s", argv[1]);
-
- int fd = open(nsPath, O_RDONLY);
- if (fd == -1) {
- fprintf(stderr, "%s: opening network namespace: %s\n", argv[0], strerror(errno));
- return 1;
- }
-
- if (setns(fd, CLONE_NEWNET) == -1) {
- fprintf(stderr, "%s: setting network namespace: %s\n", argv[0], strerror(errno));
- return 1;
- }
-
- umount2(nsPath, MNT_DETACH);
- if (unlink(nsPath) == -1) {
- fprintf(stderr, "%s: unlinking network namespace: %s\n", argv[0], strerror(errno));
- return 1;
- }
-
- /* FIXME: Remount /sys so that /sys/class/net reflects the
- interfaces visible in the network namespace. This requires
- bind-mounting /sys/fs/cgroups etc. */
-
- execv(argv[2], argv + 2);
- fprintf(stderr, "%s: running command: %s\n", argv[0], strerror(errno));
- return 1;
-}