JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #67325 from NixOS/revert-67130-containers/unprivileged

Browse Source 
Revert "nixos/containers: add unprivileged option"
This commit is contained in:
Marek Mahut 2019-08-23 08:39:09 +02:00 committed by GitHub
commit bde3197f9b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 2 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
nixos/modules/virtualisation/containers.nix
View File

@ -139,7 +139,6 @@ let
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
${optionalString (cfg.unprivileged) "-U"} \
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
@ -239,8 +238,8 @@ let
ExecReload = pkgs.writeScript "reload-container"
''
#! ${pkgs.runtimeShell} -e
${pkgs.systemd}/bin/machinectl shell "$INSTANCE" \
''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test
${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
'';
SyslogIdentifier = "container %i";
@ -424,7 +423,6 @@ let
extraVeths = {};
additionalCapabilities = [];
ephemeral = false;
unprivileged = false;
allowedDevices = [];
hostAddress = null;
hostAddress6 = null;
@ -518,16 +516,6 @@ in
'';
};
unprivileged = mkOption {
type = types.bool;
default = false;
description = ''
Run container in unprivileged mode using private users feature of <command>systemd-nspawn</command>.
This option is eqvivalent of adding -U parameter to <command>systemd-nspawn</command> command.
See <literal>systemd-nspawn(1)</literal> man page for more information.
'';
};
ephemeral = mkOption {
type = types.bool;
default = false;

1
nixos/tests/all-tests.nix
View File

@ -48,7 +48,6 @@ in
colord = handleTest ./colord.nix {};
containers-bridge = handleTest ./containers-bridge.nix {};
containers-ephemeral = handleTest ./containers-ephemeral.nix {};
containers-unprivileged = handleTest ./containers-unprivileged.nix {};
containers-extra_veth = handleTest ./containers-extra_veth.nix {};
containers-hosts = handleTest ./containers-hosts.nix {};
containers-imperative = handleTest ./containers-imperative.nix {};

56
nixos/tests/containers-unprivileged.nix
View File

@ -1,56 +0,0 @@
# Test for NixOS' container support.
import ./make-test.nix ({ pkgs, ...} : {
name = "containers-unprivileged";
machine = { pkgs, ... }: {
virtualisation.memorySize = 768;
virtualisation.writableStore = true;
containers.webserver = {
unprivileged = true;
privateNetwork = true;
hostAddress = "10.231.136.1";
localAddress = "10.231.136.2";
config = {
services.nginx = {
enable = true;
virtualHosts.localhost = {
root = (pkgs.runCommand "localhost" {} ''
mkdir "$out"
echo hello world > "$out/index.html"
'');
};
};
networking.firewall.allowedTCPPorts = [ 80 ];
};
};
};
testScript = ''
$machine->succeed("nixos-container list") =~ /webserver/ or die;
# Start the webserver container.
$machine->succeed("nixos-container start webserver");
my $ip = $machine->succeed("nixos-container show-ip webserver");
chomp $ip;
$machine->succeed("ping -n -c1 $ip");
# Check that container root folder is owned by a new private user
$machine->succeed('test $(stat -c "%U" /var/lib/containers/webserver) == "vu-webserver-0"');
# Check that webserver is working before reload
$machine->succeed("curl --fail http://$ip/ > /dev/null");
# Reload container
$machine->succeed('systemctl reload container@webserver');
# Check that webserver is working after reload
$machine->succeed("curl --fail http://$ip/ > /dev/null");
# Stop the container.
$machine->succeed("nixos-container stop webserver");
$machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
'';
})