NixOS Containers - Revision history

DHCP: update system.stateVersion to 26.05

2026-05-30T14:46:36Z

update system.stateVersion to 26.05

← Older revision		Revision as of 14:46, 30 May 2026
Line 39:		Line 39:
	services.resolved.enable = true;		services.resolved.enable = true;

	system.stateVersion = "24.11";		system.stateVersion = "26.05";
	};		};
	};\|name=/etc/nixos/configuration.nix\|lang=nix}}		};\|name=/etc/nixos/configuration.nix\|lang=nix}}
Line 287:		Line 287:
	{ config, pkgs, lib, ... }:		{ config, pkgs, lib, ... }:
	{		{
	system.stateVersion = "25.11";		system.stateVersion = "26.05";

	networking = {		networking = {
Line 322:		Line 322:
	};		};

	system.stateVersion = "25.11";		system.stateVersion = "26.05";

	networking = {		networking = {

Blastboom Strice: Remove /Host Configuration/ after short discussion in the wiki

2026-05-19T08:41:21Z

Remove Host Configuration: after short discussion in the wiki

← Older revision		Revision as of 08:41, 19 May 2026
Line 2:		Line 2:

	See [[Docker]] page for OCI container (Docker, Podman) configuration.		See [[Docker]] page for OCI container (Docker, Podman) configuration.

	~~=== Host Configuration ===~~
	~~For all of the examples below to work, you'll have to enable virtualization and the use of containers in your host systems nix configuration.~~
	~~{{file\|3=boot.enableContainers = true;~~
	~~virtualisation.containers.enable = true;\|name=/etc/nixos/configuration.nix\|lang=nix}}~~

	=== Configuration ===		=== Configuration ===

Blastboom Strice: Resolving https://wiki.nixos.org/wiki/Talk:NixOS_Containers#when_using_nftables

2026-05-18T23:04:57Z

Resolving https://wiki.nixos.org/wiki/Talk:NixOS_Containers#when_using_nftables

← Older revision		Revision as of 23:04, 18 May 2026
Line 13:		Line 13:
	{{file\|3=networking.nat = {		{{file\|3=networking.nat = {
	enable = true;		enable = true;
			# Use "ve-*" when using nftables instead of iptables
	internalInterfaces = ["ve-+"];		internalInterfaces = ["ve-+"];
	externalInterface = "ens3";		externalInterface = "ens3";
Line 60:		Line 61:
	{{File\|3=networking.nat = {		{{File\|3=networking.nat = {
	enable = true;		enable = true;
			# Use "ve-*" when using nftables instead of iptables
	internalInterfaces = ["ve-+"];		internalInterfaces = ["ve-+"];
	externalInterface = "ens3";		externalInterface = "ens3";

Blastboom Strice: Change sub-headings-4 to bold paragraph

2026-05-18T22:43:38Z

Change sub-headings-4 to bold paragraph

← Older revision		Revision as of 22:43, 18 May 2026
Line 55:		Line 55:
	By default, if <code>privateNetwork</code> is not set, the container shares the network with the host, enabling it to bind any port on any interface. However, when <code>privateNetwork</code> is set to <code>true</code>, the container gains its private virtual <code>eth0</code> and <code>ve-<container_name></code> on the host. This isolation is beneficial when you want the container to have its dedicated networking stack.		By default, if <code>privateNetwork</code> is not set, the container shares the network with the host, enabling it to bind any port on any interface. However, when <code>privateNetwork</code> is set to <code>true</code>, the container gains its private virtual <code>eth0</code> and <code>ve-<container_name></code> on the host. This isolation is beneficial when you want the container to have its dedicated networking stack.

	~~=====~~ NAT (Network Address Translation) ~~=====~~		'''NAT (Network Address Translation)'''

	In order to allow the container to connect to the internet, you have to configure NAT through <code>networking.nat</code>.		In order to allow the container to connect to the internet, you have to configure NAT through <code>networking.nat</code>.
	{{File\|3=networking.nat = {		{{File\|3=networking.nat = {
Line 63:		Line 64:
	# Lazy IPv6 connectivity for the container		# Lazy IPv6 connectivity for the container
	enableIPv6 = true;		enableIPv6 = true;
	};\|name=/etc/nixos/configuration.nix\|lang=nix}}		};\|name=/etc/nixos/configuration.nix\|lang=nix}}'''Bridge'''

	~~===== Bridge =====~~
	Connect a container to a bridge using Network Manager interfaces:		Connect a container to a bridge using Network Manager interfaces:
	{{File\|3=networking = {		{{File\|3=networking = {
Line 88:		Line 88:
	localAddress = "192.168.100.5/24";		localAddress = "192.168.100.5/24";
	config = { };		config = { };
	};\|name=/etc/nixos/configuration.nix\|lang=nix}}		};\|name=/etc/nixos/configuration.nix\|lang=nix}}'''Without privateNetwork (simpler)'''

	~~===== Without privateNetwork (simpler) =====~~
	If the service can be accessed by changing its port, the private network is not needed necessarily. Be careful to not use occupied ports. This example runs an [[Actual]] server on port 3003. It can be accessed through the host at <code>http://localhost:3003</code>. Since <code>privateNetwork</code> is not defined, it defaults to <code>false</code>.		If the service can be accessed by changing its port, the private network is not needed necessarily. Be careful to not use occupied ports. This example runs an [[Actual]] server on port 3003. It can be accessed through the host at <code>http://localhost:3003</code>. Since <code>privateNetwork</code> is not defined, it defaults to <code>false</code>.

Blastboom Strice: Improve /Bridge together two nixos-containers/

2026-05-18T21:21:24Z

Improve Bridge together two nixos-containers

← Older revision		Revision as of 21:21, 18 May 2026
Line 140:		Line 140:

	=== Define and create nixos-container from a Flake file ===		=== Define and create nixos-container from a Flake file ===


	We can define and create a custom container called <code>container</code> from a file stored as <code>flake.nix</code>. In this case we use the unstable branch of the nixpkgs repository as a source.		We can define and create a custom container called <code>container</code> from a file stored as <code>flake.nix</code>. In this case we use the unstable branch of the nixpkgs repository as a source.
Line 176:		Line 175:

	=== Use agenix secrets in container ===		=== Use agenix secrets in container ===


	To add <code>agenix</code> secrets to a container bind mount the <code>ssh-host.key</code> and import the <code>agenix.nixosModule</code> and set <code>age.identityPaths</code> [https://discourse.nixos.org/t/secrets-inside-nixos-containers/34403/6 Source]		To add <code>agenix</code> secrets to a container bind mount the <code>ssh-host.key</code> and import the <code>agenix.nixosModule</code> and set <code>age.identityPaths</code> [https://discourse.nixos.org/t/secrets-inside-nixos-containers/34403/6 Source]
Line 218:		Line 216:
	They should be connected with a bridge <code>br0</code> and both should have internet address.		They should be connected with a bridge <code>br0</code> and both should have internet address.

	Assuming Network Manager is used, so the introduction of systemd.network should not interfere with the rest of the setup.		Assuming Network Manager is used, so the introduction of <code>systemd.network</code> should not interfere with the rest of the setup.

	'''Configuration:'''		'''Configuration:'''
Line 349:		Line 347:
	};\|name=/etc/nixos/configuration.nix\|lang=nix}}		};\|name=/etc/nixos/configuration.nix\|lang=nix}}

	You can test the connection by loggining into containerA and pinging containerB, curling to ~~its~~ httpd server or pinging an internet website:		You can test the connection between <code>containerA</code> and <code>containerB</code> by loggining into <code>containerA</code> and pinging <code>containerB</code>, curling to <code>containerB</code>'s httpd server or pinging an internet website:
	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	# nixos-container root-login containerA		# nixos-container root-login containerA
	[root@containerA:~]# ping 192.168.100.3 -c3 # ~~ping~~ containerB		[root@containerA:~]# ping 192.168.100.3 -c3 # Ping containerB
	[root@containerA:~]# curl http://192.168.100.3:80 # ~~curl~~ to containerB's httpd server		[root@containerA:~]# curl http://192.168.100.3:80 # Curl to containerB's httpd server
	[root@containerA:~]# ping nixos.org -c3 # ~~ping~~ an internet website		[root@containerA:~]# ping nixos.org -c3 # Ping an internet website
	</syntaxhighlight>		</syntaxhighlight>

			You can test the connection between the host machine and <code>containerA</code> or <code>containerB</code> by pinging <code>containerA</code>, pinging <code>containerB</code> and curling to <code>containerB</code>'s httpd server:
			<syntaxhighlight lang="console">
			$ ping 192.168.100.2 -c3 # Ping containerA
			$ ping 192.168.100.3 -c3 # Ping containerB
			$ curl http://192.168.100.3:80 # Curl to containerB's httpd server
			</syntaxhighlight>

			Note that with the command <code>ip address</code>, even if the interfaces of the containers are displayed (<code>vb-containerA</code> and <code>vb-containerB</code>), they only have a MAC address assigned, they do not have a separate ip address displayed. For extra configuring, maybe use the option <code>containers.<name>.extraVeths</code>.

			Made with help of the <code>systemd.network</code> wiki page<ref>[[Systemd/networkd]]</ref> and this discourse post<ref>https://discourse.nixos.org/t/how-to-connect-two-or-more-nixos-containers-together-their-internet-ports/77674/9?u=blastboomstrice</ref>.

	== Troubleshooting ==		== Troubleshooting ==

Blastboom Strice: Shorten /Connect two nixos-containers with privateNetwork together with a network bridge/ to /Bridge together two nixos-containers/

2026-05-18T20:53:07Z

Shorten Connect two nixos-containers with privateNetwork together with a network bridge: to Bridge together two nixos-containers

← Older revision		Revision as of 20:53, 18 May 2026
Line 206:		Line 206:
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

	=== Bridge together two nixos-containers ~~with privateNetwork enabled~~ ===		=== Bridge together two nixos-containers ===
	'''Target:'''		'''Target:'''

Blastboom Strice: Consistent formatting

2026-05-18T20:46:01Z

Consistent formatting

Show changes

Blastboom Strice: Fix headings and formatting, fix /Bridge together two nixos-containers with privateNetwork enabled/

2026-05-18T20:09:54Z

Fix headings and formatting, fix Bridge together two nixos-containers with privateNetwork enabled

Show changes

Blastboom Strice: /Connect two nixos-containers with privateNetwork together with a network bridge/

2026-05-18T19:39:30Z

Connect two nixos-containers with privateNetwork together with a network bridge

Show changes

Arcstur: example without privateNetwork

2026-05-14T22:26:54Z

example without privateNetwork

@@ Line 88: / Line 88: @@
    localAddress = "192.168.100.5/24";
    config = { };
 };
 </syntaxhighlight>

NixOS Containers - Revision history

DHCP: update system.stateVersion to 26.05

Blastboom Strice: Remove /*Host Configuration*/ after short discussion in the wiki

Blastboom Strice: Resolving https://wiki.nixos.org/wiki/Talk:NixOS_Containers#when_using_nftables

Blastboom Strice: Change sub-headings-4 to bold paragraph

Blastboom Strice: Improve /*Bridge together two nixos-containers*/

Blastboom Strice: Shorten /*Connect two nixos-containers with privateNetwork together with a network bridge*/ to /*Bridge together two nixos-containers*/

Blastboom Strice: Consistent formatting

Blastboom Strice: Fix headings and formatting, fix /*Bridge together two nixos-containers with privateNetwork enabled*/

Blastboom Strice: /*Connect two nixos-containers with privateNetwork together with a network bridge*/

Arcstur: example without privateNetwork

Blastboom Strice: Remove /Host Configuration/ after short discussion in the wiki

Blastboom Strice: Improve /Bridge together two nixos-containers/

Blastboom Strice: Shorten /Connect two nixos-containers with privateNetwork together with a network bridge/ to /Bridge together two nixos-containers/

Blastboom Strice: Fix headings and formatting, fix /Bridge together two nixos-containers with privateNetwork enabled/

Blastboom Strice: /Connect two nixos-containers with privateNetwork together with a network bridge/