Revert "nixos/containers: add unprivileged option"
This commit is contained in:
parent
611fbf7206
commit
4aef2212ee
@ -139,7 +139,6 @@ let
|
|||||||
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
|
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
|
||||||
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
|
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
|
||||||
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
|
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
|
||||||
${optionalString (cfg.unprivileged) "-U"} \
|
|
||||||
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
|
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
|
||||||
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
|
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
|
||||||
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
|
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
|
||||||
@ -239,8 +238,8 @@ let
|
|||||||
ExecReload = pkgs.writeScript "reload-container"
|
ExecReload = pkgs.writeScript "reload-container"
|
||||||
''
|
''
|
||||||
#! ${pkgs.runtimeShell} -e
|
#! ${pkgs.runtimeShell} -e
|
||||||
${pkgs.systemd}/bin/machinectl shell "$INSTANCE" \
|
${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
|
||||||
''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test
|
bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
SyslogIdentifier = "container %i";
|
SyslogIdentifier = "container %i";
|
||||||
@ -424,7 +423,6 @@ let
|
|||||||
extraVeths = {};
|
extraVeths = {};
|
||||||
additionalCapabilities = [];
|
additionalCapabilities = [];
|
||||||
ephemeral = false;
|
ephemeral = false;
|
||||||
unprivileged = false;
|
|
||||||
allowedDevices = [];
|
allowedDevices = [];
|
||||||
hostAddress = null;
|
hostAddress = null;
|
||||||
hostAddress6 = null;
|
hostAddress6 = null;
|
||||||
@ -518,16 +516,6 @@ in
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
unprivileged = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
default = false;
|
|
||||||
description = ''
|
|
||||||
Run container in unprivileged mode using private users feature of <command>systemd-nspawn</command>.
|
|
||||||
This option is eqvivalent of adding -U parameter to <command>systemd-nspawn</command> command.
|
|
||||||
See <literal>systemd-nspawn(1)</literal> man page for more information.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
ephemeral = mkOption {
|
ephemeral = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
|
@ -48,7 +48,6 @@ in
|
|||||||
colord = handleTest ./colord.nix {};
|
colord = handleTest ./colord.nix {};
|
||||||
containers-bridge = handleTest ./containers-bridge.nix {};
|
containers-bridge = handleTest ./containers-bridge.nix {};
|
||||||
containers-ephemeral = handleTest ./containers-ephemeral.nix {};
|
containers-ephemeral = handleTest ./containers-ephemeral.nix {};
|
||||||
containers-unprivileged = handleTest ./containers-unprivileged.nix {};
|
|
||||||
containers-extra_veth = handleTest ./containers-extra_veth.nix {};
|
containers-extra_veth = handleTest ./containers-extra_veth.nix {};
|
||||||
containers-hosts = handleTest ./containers-hosts.nix {};
|
containers-hosts = handleTest ./containers-hosts.nix {};
|
||||||
containers-imperative = handleTest ./containers-imperative.nix {};
|
containers-imperative = handleTest ./containers-imperative.nix {};
|
||||||
|
@ -1,56 +0,0 @@
|
|||||||
# Test for NixOS' container support.
|
|
||||||
|
|
||||||
import ./make-test.nix ({ pkgs, ...} : {
|
|
||||||
name = "containers-unprivileged";
|
|
||||||
|
|
||||||
machine = { pkgs, ... }: {
|
|
||||||
virtualisation.memorySize = 768;
|
|
||||||
virtualisation.writableStore = true;
|
|
||||||
|
|
||||||
containers.webserver = {
|
|
||||||
unprivileged = true;
|
|
||||||
privateNetwork = true;
|
|
||||||
hostAddress = "10.231.136.1";
|
|
||||||
localAddress = "10.231.136.2";
|
|
||||||
config = {
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts.localhost = {
|
|
||||||
root = (pkgs.runCommand "localhost" {} ''
|
|
||||||
mkdir "$out"
|
|
||||||
echo hello world > "$out/index.html"
|
|
||||||
'');
|
|
||||||
};
|
|
||||||
};
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
testScript = ''
|
|
||||||
$machine->succeed("nixos-container list") =~ /webserver/ or die;
|
|
||||||
|
|
||||||
# Start the webserver container.
|
|
||||||
$machine->succeed("nixos-container start webserver");
|
|
||||||
|
|
||||||
my $ip = $machine->succeed("nixos-container show-ip webserver");
|
|
||||||
chomp $ip;
|
|
||||||
$machine->succeed("ping -n -c1 $ip");
|
|
||||||
|
|
||||||
# Check that container root folder is owned by a new private user
|
|
||||||
$machine->succeed('test $(stat -c "%U" /var/lib/containers/webserver) == "vu-webserver-0"');
|
|
||||||
|
|
||||||
# Check that webserver is working before reload
|
|
||||||
$machine->succeed("curl --fail http://$ip/ > /dev/null");
|
|
||||||
|
|
||||||
# Reload container
|
|
||||||
$machine->succeed('systemctl reload container@webserver');
|
|
||||||
|
|
||||||
# Check that webserver is working after reload
|
|
||||||
$machine->succeed("curl --fail http://$ip/ > /dev/null");
|
|
||||||
|
|
||||||
# Stop the container.
|
|
||||||
$machine->succeed("nixos-container stop webserver");
|
|
||||||
$machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
|
|
||||||
'';
|
|
||||||
})
|
|
Loading…
Reference in New Issue
Block a user