Talk:Podman - Revision history

Miike: /* The rootless section skips the simpler NixOS-native option */ new section

2026-10-14T07:25:04Z

The rootless section skips the simpler NixOS-native option: new section

← Older revision		Revision as of 07:25, 14 October 2026
Line 68:		Line 68:

	There it’s replaced by <code>virtualisation.containers.registries.settings</code>, with removal planned for 26.11. On 26.05 the current form still works, but the page will go stale soon. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)		There it’s replaced by <code>virtualisation.containers.registries.settings</code>, with removal planned for 26.11. On 26.05 the current form still works, but the page will go stale soon. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)

			== The rootless section skips the simpler NixOS-native option ==

			<code>virtualisation.oci-containers.containers.<name>.podman.user</code> runs a container rootless without Home Manager. The module warns if lingering isn’t enabled for that user. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:25, 14 October 2026 (UTC)

Miike: /* registries.search is deprecated on nixos-unstable */ new section

2026-10-14T07:24:45Z

registries.search is deprecated on nixos-unstable: new section

← Older revision		Revision as of 07:24, 14 October 2026
Line 64:		Line 64:

	[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)		[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)

			== registries.search is deprecated on nixos-unstable ==

			There it’s replaced by <code>virtualisation.containers.registries.settings</code>, with removal planned for 26.11. On 26.05 the current form still works, but the page will go stale soon. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)

Miike: /* The nix-shell gist is old */ new section

2026-10-14T07:24:14Z

The nix-shell gist is old: new section

← Older revision		Revision as of 07:24, 14 October 2026
Line 53:		Line 53:

	[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)		[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)

			== The nix-shell gist is old ==

			* The default rootless network is now <code>pasta</code>, not <code>slirp4netns</code>.
			* Podman prefers <code>crun</code> over <code>runc</code>.
			* <code>users.extraUsers</code> is only an alias for <code>users.users</code>.
			* <code>runCommandNoCC</code> is a long-deprecated alias for <code>runCommand</code>; I didn’t confirm whether current nixpkgs still accepts it.
			* The subuid/subgid comment isn’t needed on NixOS: normal users get ranges allocated automatically when none are set.
			* <code>install -Dm555</code> makes the config files executable and read-only, so <code>0644</code> would be more sensible.

			[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:24, 14 October 2026 (UTC)

Miike: /* Small typos */ new section

2026-10-14T07:23:33Z

Small typos: new section

← Older revision		Revision as of 07:23, 14 October 2026
Line 45:		Line 45:

	It talks about rootless, then recommends a dataset at <code>/var/lib/containers/storage</code>. That is the rootful path; rootless storage lives in <code>~/.local/share/containers/storage</code>, as the page itself says later. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)		It talks about rootless, then recommends a dataset at <code>/var/lib/containers/storage</code>. That is the rootful path; rootless storage lives in <code>~/.local/share/containers/storage</code>, as the page itself says later. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)

			== Small typos ==

			* The file is <code>flake.nix</code>, not <code>flakes.nix</code>, and the snippet doesn’t show the <code>home-manager</code> input it depends on.
			* The Home Manager comment says <code>containers/registries</code>; it should be <code>registries.conf</code>.
			* “the container runs ,” has a stray comma.

			[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)

Miike: /* The ZFS section contradicts itself */ new section

2026-10-14T07:23:03Z

The ZFS section contradicts itself: new section

← Older revision		Revision as of 07:23, 14 October 2026
Line 41:		Line 41:

	That setting only changes Podman’s default <code>podman</code> network; on NixOS it also opens UDP 53 on <code>podman0</code>. Compose stacks normally run on their own project network, and user-created netavark networks already have DNS. So it isn’t “required” for compose containers to reach each other. Its real use is for name resolution on the default network. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)		That setting only changes Podman’s default <code>podman</code> network; on NixOS it also opens UDP 53 on <code>podman0</code>. Compose stacks normally run on their own project network, and user-created netavark networks already have DNS. So it isn’t “required” for compose containers to reach each other. Its real use is for name resolution on the default network. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)

			== The ZFS section contradicts itself ==

			It talks about rootless, then recommends a dataset at <code>/var/lib/containers/storage</code>. That is the rootful path; rootless storage lives in <code>~/.local/share/containers/storage</code>, as the page itself says later. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:23, 14 October 2026 (UTC)

Miike: /* The dns enabled comment is misleading */ new section

2026-10-14T07:22:40Z

The dns enabled comment is misleading: new section

← Older revision		Revision as of 07:22, 14 October 2026
Line 37:		Line 37:

	<code>environment.sessionVariables</code> only accepts strings, ints, paths, or lists of those. It needs to be <code>"false"</code>. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)		<code>environment.sessionVariables</code> only accepts strings, ints, paths, or lists of those. It needs to be <code>"false"</code>. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)

			== The dns_enabled comment is misleading ==

			That setting only changes Podman’s default <code>podman</code> network; on NixOS it also opens UDP 53 on <code>podman0</code>. Compose stacks normally run on their own project network, and user-created netavark networks already have DNS. So it isn’t “required” for compose containers to reach each other. Its real use is for name resolution on the default network. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)

Miike: /* PODMAN COMPOSE WARNING LOGS = false; fails evaluation */ new section

2026-10-14T07:22:19Z

PODMAN COMPOSE WARNING LOGS = false; fails evaluation: new section

← Older revision		Revision as of 07:22, 14 October 2026
Line 33:		Line 33:

	[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:21, 14 October 2026 (UTC)		[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:21, 14 October 2026 (UTC)

			== PODMAN_COMPOSE_WARNING_LOGS = false; fails evaluation ==

			<code>environment.sessionVariables</code> only accepts strings, ints, paths, or lists of those. It needs to be <code>"false"</code>. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:22, 14 October 2026 (UTC)

Miike: /* The compose config snippets are wrong in three ways */ new section

2026-10-14T07:21:43Z

The compose config snippets are wrong in three ways: new section

← Older revision		Revision as of 07:21, 14 October 2026
Line 25:		Line 25:

	[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:20, 14 October 2026 (UTC)		[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:20, 14 October 2026 (UTC)

			== The compose config snippets are wrong in three ways ==

			* <code>services.podman.settings.containers</code> is a Home Manager option, but it’s shown as plain NixOS config. The NixOS equivalent is <code>virtualisation.containers.containersConf.settings</code>.
			* <code>compose_providers</code> and <code>compose_warning_logs</code> belong in the <code>[engine]</code> table of containers.conf, not at the top level. So it should be <code>…settings.engine.compose_providers</code>.
			* The first snippet is missing a <code>;</code> after the list, so it’s a syntax error.

			[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:21, 14 October 2026 (UTC)

Miike: /* Missing caveats on two tips in “Limitations and quirks” */ new section

2026-10-14T07:20:40Z

Missing caveats on two tips in “Limitations and quirks”: new section

← Older revision		Revision as of 07:20, 14 October 2026
Line 18:		Line 18:

	The oci-containers example correctly binds to <code>127.0.0.1:1234:1234</code>, but it doesn’t explain why. The module’s own <code>ports</code> documentation says publishing bypasses the firewall. That sentence belongs on the wiki page. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:19, 14 October 2026 (UTC)		The oci-containers example correctly binds to <code>127.0.0.1:1234:1234</code>, but it doesn’t explain why. The module’s own <code>ports</code> documentation says publishing bypasses the firewall. That sentence belongs on the wiki page. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:19, 14 October 2026 (UTC)

			== Missing caveats on two tips in “Limitations and quirks” ==

			* <code>net.ipv4.ip_unprivileged_port_start = 80</code> lets every local user bind ports 80–1023, including 443. That is a system-wide security trade-off, and the page doesn’t mention it.
			* <code>:U</code> recursively chowns the host directory. Used on a shared or home directory, it can break permissions. It should come with a warning.

			[[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:20, 14 October 2026 (UTC)

Miike: /* Rootful published ports bypass the NixOS firewall, and the page never says so */ new section

2026-10-14T07:19:49Z

Rootful published ports bypass the NixOS firewall, and the page never says so: new section

← Older revision		Revision as of 07:19, 14 October 2026
Line 14:		Line 14:

	The default is <code>[ "*" ]</code>. Setting a list replaces that default, so every other non-trusted user, including your normal admin account, loses access to the Nix daemon. Because the default already allows everyone, the line should just be deleted. If someone has restricted it before, they should add the user with <code>"@wheel"</code>-style entries, not replace the list. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:19, 14 October 2026 (UTC)		The default is <code>[ "*" ]</code>. Setting a list replaces that default, so every other non-trusted user, including your normal admin account, loses access to the Nix daemon. Because the default already allows everyone, the line should just be deleted. If someone has restricted it before, they should add the user with <code>"@wheel"</code>-style entries, not replace the list. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:19, 14 October 2026 (UTC)

			== Rootful published ports bypass the NixOS firewall, and the page never says so ==

			The oci-containers example correctly binds to <code>127.0.0.1:1234:1234</code>, but it doesn’t explain why. The module’s own <code>ports</code> documentation says publishing bypasses the firewall. That sentence belongs on the wiki page. [[User:Miike\|Miike]] ([[User talk:Miike\|talk]]) 07:19, 14 October 2026 (UTC)