Talk:Podman

Missing `virtualisation.podman.dockerSocket.enable`

Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)

The “rootless” example gives root access

The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed.

The Setup section does the same thing by default. It adds the user to podman unconditionally, then says “consider using rootless podman.” The warning itself is accurate; it matches the module’s own option description. But the example should leave the group out and add it only for people who need the rootful socket, such as Docker-API tools.

Miike (talk) 07:17, 14 October 2026 (UTC)

nix.settings.allowed-users = ["nginx-rootless"]; is harmful and not needed

The default is [ "*" ]. Setting a list replaces that default, so every other non-trusted user, including your normal admin account, loses access to the Nix daemon. Because the default already allows everyone, the line should just be deleted. If someone has restricted it before, they should add the user with "@wheel"-style entries, not replace the list. Miike (talk) 07:19, 14 October 2026 (UTC)

Rootful published ports bypass the NixOS firewall, and the page never says so

The oci-containers example correctly binds to 127.0.0.1:1234:1234, but it doesn’t explain why. The module’s own ports documentation says publishing bypasses the firewall. That sentence belongs on the wiki page. Miike (talk) 07:19, 14 October 2026 (UTC)

Missing caveats on two tips in “Limitations and quirks”

• net.ipv4.ip_unprivileged_port_start = 80 lets every local user bind ports 80–1023, including 443. That is a system-wide security trade-off, and the page doesn’t mention it.
• :U recursively chowns the host directory. Used on a shared or home directory, it can break permissions. It should come with a warning.

Miike (talk) 07:20, 14 October 2026 (UTC)

The compose config snippets are wrong in three ways

• services.podman.settings.containers is a Home Manager option, but it’s shown as plain NixOS config. The NixOS equivalent is virtualisation.containers.containersConf.settings.
• compose_providers and compose_warning_logs belong in the [engine] table of containers.conf, not at the top level. So it should be …settings.engine.compose_providers.
• The first snippet is missing a ; after the list, so it’s a syntax error.

Miike (talk) 07:21, 14 October 2026 (UTC)

PODMAN_COMPOSE_WARNING_LOGS = false; fails evaluation

environment.sessionVariables only accepts strings, ints, paths, or lists of those. It needs to be "false". Miike (talk) 07:22, 14 October 2026 (UTC)

The dns_enabled comment is misleading

That setting only changes Podman’s default podman network; on NixOS it also opens UDP 53 on podman0. Compose stacks normally run on their own project network, and user-created netavark networks already have DNS. So it isn’t “required” for compose containers to reach each other. Its real use is for name resolution on the default network. Miike (talk) 07:22, 14 October 2026 (UTC)

The ZFS section contradicts itself

It talks about rootless, then recommends a dataset at /var/lib/containers/storage. That is the rootful path; rootless storage lives in ~/.local/share/containers/storage, as the page itself says later. Miike (talk) 07:23, 14 October 2026 (UTC)

Small typos

• The file is flake.nix, not flakes.nix, and the snippet doesn’t show the home-manager input it depends on.
• The Home Manager comment says containers/registries; it should be registries.conf.
• “the container runs ,” has a stray comma.

Miike (talk) 07:23, 14 October 2026 (UTC)

The nix-shell gist is old

• The default rootless network is now pasta, not slirp4netns.
• Podman prefers crun over runc.
• users.extraUsers is only an alias for users.users.
• runCommandNoCC is a long-deprecated alias for runCommand; I didn’t confirm whether current nixpkgs still accepts it.
• The subuid/subgid comment isn’t needed on NixOS: normal users get ranges allocated automatically when none are set.
• install -Dm555 makes the config files executable and read-only, so 0644 would be more sensible.

Miike (talk) 07:24, 14 October 2026 (UTC)

registries.search is deprecated on nixos-unstable

There it’s replaced by virtualisation.containers.registries.settings, with removal planned for 26.11. On 26.05 the current form still works, but the page will go stale soon. Miike (talk) 07:24, 14 October 2026 (UTC)

The rootless section skips the simpler NixOS-native option

virtualisation.oci-containers.containers.<name>.podman.user runs a container rootless without Home Manager. The module warns if lingering isn’t enabled for that user. Miike (talk) 07:25, 14 October 2026 (UTC)