NixOS Containers: Difference between revisions
imported>Onny Additional example usage: List containers |
imported>Onny Updated nameserver workaround |
||
| Line 34: | Line 34: | ||
system.stateVersion = "23.05"; | system.stateVersion = "23.05"; | ||
networking | networking = { | ||
firewall = { | |||
enable = true; | |||
allowedTCPPorts = [ 80 ]; | |||
}; | |||
# Use systemd-resolved inside the container | |||
useHostResolvConf = mkForce false; | |||
}; | }; | ||
services.resolved.enable = true; | |||
}; | }; | ||
| Line 78: | Line 80: | ||
Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}. | Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}. | ||
== Declarative docker containers == | == Declarative docker containers == | ||
Revision as of 10:07, 5 October 2023
Native NixOS containers
It is possible to configure native systemd-nspawn containers, which are running NixOS and are configured and managed by NixOS using the containers directive.
Installation
The following example creates a container called nextcloud running the web application Nextcloud. It will start automatically at boot and has its private network subnet.
/etc/nixos/configuration.nix
networking.nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "ens3";
# Lazy IPv6 connectivity for the container
enableIPv6 = true;
};
containers.nextcloud = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
hostAddress6 = "fc00::1";
localAddress6 = "fc00::2";
config = { config, pkgs, ... }: {
services.nextcloud = {
enable = true;
package = pkgs.nextcloud27;
hostName = "localhost";
config.adminpassFile = "${pkgs.writeText "adminpass" "test123"}"; # DON'T DO THIS IN PRODUCTION - the password file will be world-readable in the Nix Store!
};
system.stateVersion = "23.05";
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 ];
};
# Use systemd-resolved inside the container
useHostResolvConf = mkForce false;
};
services.resolved.enable = true;
};
};
In order to reach the web application on the host system, we have to open Firewall port 80 and also configure NAT through networking.nat. The web service of the container will be available at http://192.168.100.10
Usage
List containers
# machinectl list
Checking the status of the container
# systemctl status container@nextcloud
Login into the container
# nixos-container root-login nextcloud
Start or stop a container
# nixos-container start nextcloud
# nixos-container stop nextcloud
Destroy a container including its file system
# nixos-container destroy nextcloud
Further informations are available in the NixOS Manual, NixOS manual.
Declarative docker containers
Example config:
{ config, pkgs, ... }:
{
config.virtualisation.oci-containers.containers = {
hackagecompare = {
image = "chrissound/hackagecomparestats-webserver:latest";
ports = ["127.0.0.1:3010:3010"];
volumes = [
"/root/hackagecompare/packageStatistics.json:/root/hackagecompare/packageStatistics.json"
];
cmd = [
"--base-url"
"\"/hackagecompare\""
];
};
};
}
Troubleshooting
I have changed the host's channel and some services are no longer functional
Symptoms:
- Lost data in PostgreSQL database
- MySQL has changed its path, where it creates the database
Solution
If you did not have a system.stateVersion option set inside your declarative container configuration, it will use the default one for the channel. Your data might be safe, if you did nothing meanwhile. Add the missing system.stateVersion to your container, rebuild, and possibly stop/start the container.