Talk:Podman

Missing `virtualisation.podman.dockerSocket.enable`

Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)

The “rootless” example gives root access

The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed.

The Setup section does the same thing by default. It adds the user to podman unconditionally, then says “consider using rootless podman.” The warning itself is accurate; it matches the module’s own option description. But the example should leave the group out and add it only for people who need the rootful socket, such as Docker-API tools.

Miike (talk) 07:17, 14 October 2026 (UTC)

nix.settings.allowed-users = ["nginx-rootless"]; is harmful and not needed

The default is [ "*" ]. Setting a list replaces that default, so every other non-trusted user, including your normal admin account, loses access to the Nix daemon. Because the default already allows everyone, the line should just be deleted. If someone has restricted it before, they should add the user with "@wheel"-style entries, not replace the list. Miike (talk) 07:19, 14 October 2026 (UTC)

Rootful published ports bypass the NixOS firewall, and the page never says so

The oci-containers example correctly binds to 127.0.0.1:1234:1234, but it doesn’t explain why. The module’s own ports documentation says publishing bypasses the firewall. That sentence belongs on the wiki page. Miike (talk) 07:19, 14 October 2026 (UTC)

Missing caveats on two tips in “Limitations and quirks”

• net.ipv4.ip_unprivileged_port_start = 80 lets every local user bind ports 80–1023, including 443. That is a system-wide security trade-off, and the page doesn’t mention it.
• :U recursively chowns the host directory. Used on a shared or home directory, it can break permissions. It should come with a warning.

Miike (talk) 07:20, 14 October 2026 (UTC)

The compose config snippets are wrong in three ways

• services.podman.settings.containers is a Home Manager option, but it’s shown as plain NixOS config. The NixOS equivalent is virtualisation.containers.containersConf.settings.
• compose_providers and compose_warning_logs belong in the [engine] table of containers.conf, not at the top level. So it should be …settings.engine.compose_providers.
• The first snippet is missing a ; after the list, so it’s a syntax error.

Miike (talk) 07:21, 14 October 2026 (UTC)

PODMAN_COMPOSE_WARNING_LOGS = false; fails evaluation

environment.sessionVariables only accepts strings, ints, paths, or lists of those. It needs to be "false". Miike (talk) 07:22, 14 October 2026 (UTC)