felschr/nixos-config
1
1
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

feat(virtualisation): enable gvisor for containers

Browse source
This commit is contained in:
Felix Schröter 2024-03-07 20:47:24 +01:00
parent 4eab62fe3b
commit 5da5d66d6a
Signed by: felschr
GPG key ID: 671E39E6744C807D
4 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
services/collabora-office.nix
View file

@ -18,6 +18,8 @@ in {
extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
};
extraOptions = [
"--runtime-flag=directfs=false"
"--runtime-flag=network=host"
"--uidmap=0:65534:1"
"--gidmap=0:65534:1"
"--uidmap=100:${toString uid}:1"

2
services/focalboard.nix
View file

@ -59,6 +59,8 @@ in {
# only secrets need to be included, e.g. FOCALBOARD_DBCONFIG
environmentFiles = [ config.age.secrets.focalboard-env.path ];
extraOptions = [
"--runtime-flag=directfs=false"
"--runtime-flag=network=host"
"--uidmap=0:65534:1"
"--gidmap=0:65534:1"
"--uidmap=65534:${toString uid}:1"

2
services/immich.nix
View file

@ -37,6 +37,8 @@ let
config.age.secrets.immich-typesense-env.path
];
extraOptions = [
"--runtime-flag=directfs=false"
"--runtime-flag=network=host"
"--uidmap=0:65534:1"
"--gidmap=0:65534:1"
"--uidmap=${toString uid}:${toString uid}:1"

7
virtualisation/containers.nix
View file

@ -1,4 +1,4 @@
_:
{ pkgs, lib, ... }:
{
# Enable /etc/containers configuration (used by podman, cri-o, etc.)
@ -6,6 +6,11 @@ _:
virtualisation.containers.containersConf.settings = {
# Create unique User Namespace for the container
containers.userns = "auto";
engine = {
conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.gvisor ]}" ];
runtimes.runsc = [ "${pkgs.gvisor}/bin/runsc" ];
runtime = "runsc";
};
};
virtualisation.containers.storage.settings = {
# defaults