NixOS Containers: Difference between revisions
m update system.stateVersion to 26.05 |
|||
| (3 intermediate revisions by one other user not shown) | |||
| Line 2: | Line 2: | ||
See [[Docker]] page for OCI container (Docker, Podman) configuration. | See [[Docker]] page for OCI container (Docker, Podman) configuration. | ||
=== Configuration === | === Configuration === | ||
| Line 13: | Line 8: | ||
{{file|3=networking.nat = { | {{file|3=networking.nat = { | ||
enable = true; | enable = true; | ||
# Use "ve-*" when using nftables instead of iptables | |||
internalInterfaces = ["ve-+"]; | internalInterfaces = ["ve-+"]; | ||
externalInterface = "ens3"; | externalInterface = "ens3"; | ||
| Line 43: | Line 39: | ||
services.resolved.enable = true; | services.resolved.enable = true; | ||
system.stateVersion = " | system.stateVersion = "26.05"; | ||
}; | }; | ||
};|name=/etc/nixos/configuration.nix|lang=nix}} | };|name=/etc/nixos/configuration.nix|lang=nix}} | ||
| Line 55: | Line 51: | ||
By default, if <code>privateNetwork</code> is not set, the container shares the network with the host, enabling it to bind any port on any interface. However, when <code>privateNetwork</code> is set to <code>true</code>, the container gains its private virtual <code>eth0</code> and <code>ve-<container_name></code> on the host. This isolation is beneficial when you want the container to have its dedicated networking stack. | By default, if <code>privateNetwork</code> is not set, the container shares the network with the host, enabling it to bind any port on any interface. However, when <code>privateNetwork</code> is set to <code>true</code>, the container gains its private virtual <code>eth0</code> and <code>ve-<container_name></code> on the host. This isolation is beneficial when you want the container to have its dedicated networking stack. | ||
'''NAT (Network Address Translation)''' | |||
In order to allow the container to connect to the internet, you have to configure NAT through <code>networking.nat</code>. | In order to allow the container to connect to the internet, you have to configure NAT through <code>networking.nat</code>. | ||
{{File|3=networking.nat = { | {{File|3=networking.nat = { | ||
enable = true; | enable = true; | ||
# Use "ve-*" when using nftables instead of iptables | |||
internalInterfaces = ["ve-+"]; | internalInterfaces = ["ve-+"]; | ||
externalInterface = "ens3"; | externalInterface = "ens3"; | ||
# Lazy IPv6 connectivity for the container | # Lazy IPv6 connectivity for the container | ||
enableIPv6 = true; | enableIPv6 = true; | ||
};|name=/etc/nixos/configuration.nix|lang=nix}} | };|name=/etc/nixos/configuration.nix|lang=nix}}'''Bridge''' | ||
Connect a container to a bridge using Network Manager interfaces: | Connect a container to a bridge using Network Manager interfaces: | ||
{{File|3=networking = { | {{File|3=networking = { | ||
| Line 88: | Line 85: | ||
localAddress = "192.168.100.5/24"; | localAddress = "192.168.100.5/24"; | ||
config = { }; | config = { }; | ||
};|name=/etc/nixos/configuration.nix|lang=nix}} | };|name=/etc/nixos/configuration.nix|lang=nix}}'''Without privateNetwork (simpler)''' | ||
If the service can be accessed by changing its port, the private network is not needed necessarily. Be careful to not use occupied ports. This example runs an [[Actual]] server on port 3003. It can be accessed through the host at <code>http://localhost:3003</code>. Since <code>privateNetwork</code> is not defined, it defaults to <code>false</code>. | If the service can be accessed by changing its port, the private network is not needed necessarily. Be careful to not use occupied ports. This example runs an [[Actual]] server on port 3003. It can be accessed through the host at <code>http://localhost:3003</code>. Since <code>privateNetwork</code> is not defined, it defaults to <code>false</code>. | ||
| Line 291: | Line 287: | ||
{ config, pkgs, lib, ... }: | { config, pkgs, lib, ... }: | ||
{ | { | ||
system.stateVersion = " | system.stateVersion = "26.05"; | ||
networking = { | networking = { | ||
| Line 326: | Line 322: | ||
}; | }; | ||
system.stateVersion = " | system.stateVersion = "26.05"; | ||
networking = { | networking = { | ||