122 lines
4.4 KiB
Nix
122 lines
4.4 KiB
Nix
# ```admonish note title="To do"
|
|
# Run podman containers run as a non-root user.
|
|
# ```
|
|
#
|
|
# An abstraction over running containers as systemd units, enforcing some good
|
|
# practices:
|
|
#
|
|
# - Container DNS behaves the same under docker and podman.
|
|
# - Ports are exposed on `127.0.0.1`, rather than `0.0.0.0`.
|
|
# - Volumes are backed up by bind-mounts to the host filesystem.
|
|
#
|
|
# Switching between using docker or podman for the container runtime should be
|
|
# totally transparent.
|
|
#
|
|
# **Erase your darlings:** overrides the `volumeBaseDir`.
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
mkPortDef = { host, inner }: "127.0.0.1:${toString host}:${toString inner}";
|
|
|
|
mkVolumeDef = container: { name, host, inner }:
|
|
if host != null
|
|
then "${host}:${inner}"
|
|
else "${cfg.volumeBaseDir}/${container.volumeSubDir}/${name}:${inner}";
|
|
|
|
shouldPreStart = _name: container: container.pullOnStart;
|
|
mkPreStart = name: container: nameValuePair "${cfg.backend}-${name}" {
|
|
preStart = if container.pullOnStart then "${cfg.backend} pull ${container.image}" else "";
|
|
};
|
|
|
|
shouldNetworkService = _name: container: container.network != null;
|
|
mkNetworkService = _name: container:
|
|
let package = if cfg.backend == "docker" then pkgs.docker else pkgs.podman;
|
|
in nameValuePair "${cfg.backend}-net-${container.network}" {
|
|
description = "Manage the ${container.network} network for ${cfg.backend}";
|
|
preStart = "${package}/bin/${cfg.backend} network rm ${container.network} || true";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${package}/bin/${cfg.backend} network create -d bridge ${container.network}";
|
|
ExecStop = "${package}/bin/${cfg.backend} network rm ${container.network}";
|
|
RemainAfterExit = "yes";
|
|
};
|
|
};
|
|
|
|
mkPodService = name: pod:
|
|
let
|
|
package = if cfg.backend == "podman" then pkgs.podman else throw "mkPodService only supports podman";
|
|
aliases = map (cn: "${name}-${cn}") (attrNames pod.containers);
|
|
ports = concatLists (catAttrs "ports" (attrValues pod.containers));
|
|
in
|
|
nameValuePair "${cfg.backend}-pod-${name}" {
|
|
description = "Manage the ${name} pod for ${cfg.backend}";
|
|
preStart = "${package}/bin/${cfg.backend} pod rm --force --ignore ${name} || true";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart =
|
|
let args = map (n: "--network-alias=${n}") aliases ++ map (pd: "-p ${mkPortDef pd}") ports;
|
|
in "${package}/bin/${cfg.backend} pod create ${concatStringsSep " " args} ${name}";
|
|
ExecStop = "${package}/bin/${cfg.backend} pod rm ${name}";
|
|
RemainAfterExit = "yes";
|
|
};
|
|
};
|
|
|
|
mkContainer = _name: container: with container;
|
|
let
|
|
hasNetwork = container.network != null;
|
|
hasPod = container.pod != null;
|
|
in
|
|
{
|
|
inherit autoStart cmd environment environmentFiles image login;
|
|
dependsOn =
|
|
container.dependsOn ++
|
|
(if hasNetwork then [ "net-${container.network}" ] else [ ]) ++
|
|
(if hasPod then [ "pod-${container.pod}" ] else [ ]);
|
|
extraOptions =
|
|
container.extraOptions ++
|
|
(if hasNetwork then [ "--network=${container.network}" ] else [ ]) ++
|
|
(if hasPod then [ "--pod=${container.pod}" ] else [ ]);
|
|
/* ports are defined at the pod level */
|
|
ports = if hasPod then [ ] else map mkPortDef ports;
|
|
volumes = map (mkVolumeDef container) volumes;
|
|
};
|
|
|
|
cfg = config.nixfiles.oci-containers;
|
|
|
|
allContainers =
|
|
let
|
|
mkPodContainer = podName: pod: containerName: container: nameValuePair "${podName}-${containerName}" (
|
|
container //
|
|
{
|
|
network = if cfg.backend == "docker" then podName else null;
|
|
pod = if cfg.backend == "docker" then null else podName;
|
|
volumeSubDir = pod.volumeSubDir;
|
|
}
|
|
);
|
|
in
|
|
concatMapAttrs (podName: pod: mapAttrs' (mkPodContainer podName pod) pod.containers) cfg.pods;
|
|
in
|
|
{
|
|
imports = [
|
|
./options.nix
|
|
];
|
|
|
|
config = {
|
|
virtualisation.${cfg.backend} = {
|
|
enable = true;
|
|
autoPrune.enable = true;
|
|
};
|
|
|
|
virtualisation.oci-containers = {
|
|
backend = cfg.backend;
|
|
containers = mapAttrs mkContainer allContainers;
|
|
};
|
|
|
|
systemd.services = mkMerge [
|
|
(mapAttrs' mkPreStart (filterAttrs shouldPreStart allContainers))
|
|
(mapAttrs' mkNetworkService (filterAttrs shouldNetworkService allContainers))
|
|
(if cfg.backend == "podman" then mapAttrs' mkPodService cfg.pods else { })
|
|
];
|
|
};
|
|
}
|