Docker - Revision history

DHCP: /* Using Privileged Ports for Rootless Docker */ remove unneeded blank line

2026-07-19T19:48:54Z

Using Privileged Ports for Rootless Docker: remove unneeded blank line

← Older revision		Revision as of 19:48, 19 July 2026
Line 323:		Line 323:
	- "8000:80"		- "8000:80"
	</syntaxhighlight>		</syntaxhighlight>

	<translate>		<translate>

DHCP: style fixes

2026-07-19T19:48:23Z

style fixes

← Older revision		Revision as of 19:48, 19 July 2026
Line 17:		Line 17:
	To temporarily use Docker in a shell environment, you can run:		To temporarily use Docker in a shell environment, you can run:
	</translate>		</translate>
	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=console>
	nix-shell -p docker		$ nix-shell -p docker
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>
Line 183:		Line 183:
	To use <code>compose2nix</code> with <code>nix-shell</code> you can use		To use <code>compose2nix</code> with <code>nix-shell</code> you can use
	</translate>		</translate>
	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=console>
	nix shell github:aksiksi/compose2nix		$ nix shell github:aksiksi/compose2nix
	compose2nix -h		$ compose2nix -h
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>
Line 219:		Line 219:
	Alternatively, you can specify the input and output files with the following flags		Alternatively, you can specify the input and output files with the following flags
	</translate>		</translate>
	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=console>
	compose2nix -inputs input.yml -output output.nix -runtime docker		$ compose2nix -inputs input.yml -output output.nix -runtime docker
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>
Line 252:		Line 252:
	</translate>		</translate>

	<syntaxhighlight lang="nix~~" line="1~~">		<syntaxhighlight lang="nix">
	virtualisation.docker = {		virtualisation.docker = {
	# Consider disabling the system wide Docker daemon		# Consider disabling the system wide Docker daemon
Line 393:		Line 393:

	<translate>		<translate>

	==== Calculating the sha256 for a pulled Docker image ==== <!--T:49-->		==== Calculating the sha256 for a pulled Docker image ==== <!--T:49-->
	</translate>		</translate>
Line 420:		Line 419:
	</translate>		</translate>

	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=console>
	skopeo copy docker://lnl7/nix@sha256:632268d5fd9ca87169c65353db99be8b4e2eb41833b626e09688f484222e860f docker-archive:///tmp/image.tgz:lnl7/nix:2.0		$ skopeo copy docker://lnl7/nix@sha256:632268d5fd9ca87169c65353db99be8b4e2eb41833b626e09688f484222e860f docker-archive:///tmp/image.tgz:lnl7/nix:2.0
	~~</syntaxhighlight>~~		$ nix-hash --base32 --flat --type sha256 /tmp/image.tgz

	~~<syntaxhighlight lang="bash">~~
	nix-hash --base32 --flat --type sha256 /tmp/image.tgz
	~~</syntaxhighlight>~~
	~~<syntaxhighlight lang="shell">~~
	1x00ks05cz89k3wc460i03iyyjr7wlr28krk7znavfy2qx5a0hfd		1x00ks05cz89k3wc460i03iyyjr7wlr28krk7znavfy2qx5a0hfd
	</syntaxhighlight>		</syntaxhighlight>
Line 603:		Line 597:
	If you have a service running on the host that exposes a socket, such as mariadb, you can also expose that socket to the container instead. You'll want to expose the folder the socket is in as a volume - so:		If you have a service running on the host that exposes a socket, such as mariadb, you can also expose that socket to the container instead. You'll want to expose the folder the socket is in as a volume - so:
	</translate>		</translate>
	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=nix>
	volumes = [		volumes = [
	"/var/run/mysqld:/mysqld"		"/var/run/mysqld:/mysqld"
	];		];
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>
	<!--T:77-->		<!--T:77-->
	to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.		to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.

	</translate>		</translate>

Line 661:		Line 654:
	When Docker uses too much disk space:		When Docker uses too much disk space:
	</translate>		</translate>
	<syntaxhighlight lang=~~"bash"~~>		<syntaxhighlight lang=nix>
	# Remove unused containers, networks, images, and volumes		# Remove unused containers, networks, images, and volumes
	docker system prune -a --volumes		docker system prune -a --volumes
Line 680:		Line 673:
	<translate>		<translate>
	<!--T:91-->		<!--T:91-->
	Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your `configuration.nix`:		Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your <code>configuration.nix</code>:
	</translate>		</translate>
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 759:		Line 752:
	volumes:		volumes:
	ollama: {}\|name=compose.yml\|lang=yaml}}		ollama: {}\|name=compose.yml\|lang=yaml}}

	<translate>		<translate>

YesYouKen: /* Rootless Docker */

2026-07-06T07:28:04Z

Rootless Docker

← Older revision		Revision as of 07:28, 6 July 2026
Line 252:		Line 252:
	</translate>		</translate>

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix" line="1">
	virtualisation.docker = {		virtualisation.docker = {
	# Consider disabling the system wide Docker daemon		# Consider disabling the system wide Docker daemon
Line 262:		Line 262:
	# Optionally customize rootless Docker daemon settings		# Optionally customize rootless Docker daemon settings
	daemon.settings = {		daemon.settings = {
			data-root = "~/.local/docker";
	dns = [ "1.1.1.1" "8.8.8.8" ];		dns = [ "1.1.1.1" "8.8.8.8" ];
	registry-mirrors = [ "https://mirror.gcr.io" ];		registry-mirrors = [ "https://mirror.gcr.io" ];

QuBe: /* System setup */Add note about restart being possibly required

2026-04-06T14:45:30Z

System setup: Add note about restart being possibly required

← Older revision		Revision as of 14:45, 6 April 2026
Line 32:		Line 32:
	<!--T:7-->		<!--T:7-->
	To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref>		To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref>
			(Note that it may take a restart for the group changes to take effect.)
	</translate>		</translate>
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 52:		Line 53:

	<translate>		<translate>

	== Configuration == <!--T:9-->		== Configuration == <!--T:9-->
	</translate>		</translate>

MysticStaples: Combine networking declarations

2026-03-17T18:20:02Z

Combine networking declarations

← Older revision		Revision as of 18:20, 17 March 2026
Line 301:		Line 301:
	allowedTCPPorts = [ 80 8000 53 5300 ];		allowedTCPPorts = [ 80 8000 53 5300 ];
	allowedUDPPorts = [ 53 5300 ];		allowedUDPPorts = [ 53 5300 ];
			extraCommands = ''
			iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000
			iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300
			iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300
			'';
	};		};

	boot.kernel.sysctl = {		boot.kernel.sysctl = {
	"net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding		"net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding
	};

	~~networking = {~~
	~~firewall.extraCommands = ''~~
	~~iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000~~
	~~iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300~~
	~~iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300~~
	~~'';~~
	};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">		};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">
	services:		services:

Turbotimon: Got a evaluation warning on 25.11: You have set virtualisation.docker.enableNvidia. This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.

2026-02-11T11:55:02Z

Got a evaluation warning on 25.11: You have set virtualisation.docker.enableNvidia. This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.

← Older revision		Revision as of 11:55, 11 February 2026
Line 725:		Line 725:

	{{File\|3={		{{File\|3={
	virtualisation.docker.enable = true;		# virtualisation.docker.enable = true; # This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.

	hardware.nvidia-container-toolkit.enable = true;		hardware.nvidia-container-toolkit.enable = true;
			# Prevents: - Option enableNvidia on x86_64 requires 32-bit support libraries
	# Regular Docker		# Regular Docker
	virtualisation.docker.daemon.settings.features.cdi = true;		virtualisation.docker.daemon.settings.features.cdi = true;

BrenekH: Modify the flake reproducible image dates section to use a snippet which doesn't exclude the the time of the commit. The original snippet intentionally cut the time so the `date` command would accept the input of `self.lastModifiedDate`. By using `self.lastModified` (seconds since epoch of commit) and prepending "@", the date command can interpret the full datetime and embed it into the resulting image.

2025-12-27T01:11:58Z

Modify the flake reproducible image dates section to use a snippet which doesn't exclude the the time of the commit. The original snippet intentionally cut the time so the `date` command would accept the input of `self.lastModifiedDate`. By using `self.lastModified` (seconds since epoch of commit) and prepending "@", the date command can interpret the full datetime and embed it into the resulting image.

← Older revision		Revision as of 01:11, 27 December 2025
Line 389:		Line 389:
	<translate>		<translate>
	<!--T:48-->		<!--T:48-->
	An alternative, if using [[flakes]], is to do <code>created = builtins.~~substring 0 8~~ self.~~lastModifiedDate~~</code>, which uses the commit date, and is therefore reproducible.		An alternative, if using [[flakes]], is to do <code>created = "@" + builtins.toString self.lastModified</code>, which uses the commit date, and is therefore reproducible.
	</translate>		</translate>

	<translate>		<translate>

	==== Calculating the sha256 for a pulled Docker image ==== <!--T:49-->		==== Calculating the sha256 for a pulled Docker image ==== <!--T:49-->
	</translate>		</translate>

Dysbulic: Missing word.

2025-12-24T07:48:55Z

Missing word.

← Older revision		Revision as of 07:48, 24 December 2025
Line 294:		Line 294:

	=== Using Privileged Ports for Rootless Docker ===		=== Using Privileged Ports for Rootless Docker ===
	Rootless containers are not able to ports from 0 to 1023 as such port can only be used by privileged users. This problem can be solved by using port forwarding.		Rootless containers are not able to bind ports from 0 to 1023 as such port can only be used by privileged users. This problem can be solved by using port forwarding.

	Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP). We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000. Same logic applies for port 53. Refer to the following example:<syntaxhighlight lang="nixos"># Firewall		Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP). We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000. Same logic applies for port 53. Refer to the following example:<syntaxhighlight lang="nixos"># Firewall

Mightyiam: See also Nixcademy blog post on running and auto-updating docker containers

2025-12-20T13:16:13Z

See also Nixcademy blog post on running and auto-updating docker containers

← Older revision		Revision as of 13:16, 20 December 2025
Line 764:		Line 764:

	<references/>		<references/>

			== See also ==

			*[https://nixcademy.com/posts/auto-update-containers/ Run and Auto-Update Docker Containers on NixOS, Nixcademy]

	[[Category:Applications]]		[[Category:Applications]]

Joshbuker: Fix missing volume from example compose.yml

2025-12-11T04:03:53Z

Fix missing volume from example compose.yml

← Older revision		Revision as of 04:03, 11 December 2025
Line 754:		Line 754:
	capabilities: [gpu]		capabilities: [gpu]
	device_ids:		device_ids:
	- nvidia.com/gpu=all\|name=compose.yml\|lang=yaml}}		- nvidia.com/gpu=all
			volumes:
			ollama: {}\|name=compose.yml\|lang=yaml}}

	<translate>		<translate>