alexion
969737b6b5
Add a `nesting` placement field to the Host-side guest interface, a bool off by default. On, it grants the guest's container the prerequisites its interior needs to run Podman and other OCI containers: the `CAP_NET_ADMIN` capability an OCI runtime uses to build its bridges and firewall rules, and the `/dev/net/tun` and `/dev/fuse` device nodes it reaches for to network those containers and back their overlay storage. Off, both the capability and device lists are empty, so a non-nesting guest is untouched. cgroup delegation, the other nested prerequisite, the NixOS container backend already grants every container unconditionally, so the Skeleton records it with an absence pointer rather than re-emitting it. Add a nesting-sample guest whose interior defines an `oci-containers` workload on Podman, and enable it on neogaia with `nesting` on, so the path builds end to end through the Host's `nix flake check` — which pulls in podman and the generated container unit for the nested system.
12 lines
337 B
Nix
12 lines
337 B
Nix
args@{ my, ... }:
|
|
# A sample guest whose interior runs an OCI container on Podman.
|
|
# The image is pulled at runtime, so the guest builds with no build-time fetch.
|
|
my.guest {
|
|
name = "nesting-sample";
|
|
interior = {
|
|
virtualisation.oci-containers.containers.hello = {
|
|
image = "docker.io/library/hello-world";
|
|
};
|
|
};
|
|
} args
|