Talk:Podman

Missing `virtualisation.podman.dockerSocket.enable`

Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)

The “rootless” example gives root access

The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed.

The Setup section does the same thing by default. It adds the user to podman unconditionally, then says “consider using rootless podman.” The warning itself is accurate; it matches the module’s own option description. But the example should leave the group out and add it only for people who need the rootful socket, such as Docker-API tools.

Miike (talk) 07:17, 14 October 2026 (UTC)

nix.settings.allowed-users = ["nginx-rootless"]; is harmful and not needed

The default is [ "*" ]. Setting a list replaces that default, so every other non-trusted user, including your normal admin account, loses access to the Nix daemon. Because the default already allows everyone, the line should just be deleted. If someone has restricted it before, they should add the user with "@wheel"-style entries, not replace the list. Miike (talk) 07:19, 14 October 2026 (UTC)