nix-community/home-manager
1
0
Fork 0
mirror of https://github.com/nix-community/home-manager.git synced 2025-12-12 03:51:07 +01:00
Code Activity

podman: add module

Browse source 
This module is a continuation of #2630 by MaeIsBad.

It also adds a module `virtualisation.oci-containers` that is
equivalent to the one in NixOS. Basically it allows a simple toggle to
activate oci-container services and commands.

We also support Podman on mac. Note, Podman requires a VM on mac,
which has to be started before any Podman commands can be executed.
Users might sometimes require VMs that use different architectures
than the default VM started by Podman. Thus, they get the option to
define the VM(s) that will be initialized and started by podman.

Since Podman has to start a machine, it's best to do it using launchd.
The configuration of the machines requires a JSON, generated from an
attrset in Home Manager, which is where Python script comes into play
to take care of diff-ing the `podman machine list` to CRUD them.

PR #4331

Co-authored-by: MaeIsBad <26093674+MaeIsBad@users.noreply.github.com>
This commit is contained in:
Michael Vogel 2023-08-11 10:42:57 +02:00 • committed by Robert Helgesson
parent 07c322a7cf
commit faa4b16358
No known key found for this signature in database
GPG key ID: 36BDAA14C2797E89
16 changed files with 1128 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

76
modules/virtualisation/containers.nix Normal file
View file

@ -0,0 +1,76 @@
{ config, lib, pkgs, ... }:
let
cfg = config.virtualisation.containers;
inherit (lib) mkOption types;
toml = pkgs.formats.toml { };
in {
meta.maintainers = [ lib.maintainers.michaelCTS ];
options.virtualisation.containers = {
enable = lib.mkEnableOption "the common containers configuration module";
ociSeccompBpfHook.enable = lib.mkEnableOption "the OCI seccomp BPF hook";
registries = {
search = mkOption {
type = types.listOf types.str;
default = [ "docker.io" "quay.io" ];
description = ''
List of repositories to search.
'';
};
insecure = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
List of insecure repositories.
'';
};
block = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
List of blocked repositories.
'';
};
};
policy = mkOption {
type = types.attrs;
default = { };
example = lib.literalExpression ''
{
default = [ { type = "insecureAcceptAnything"; } ];
transports = {
docker-daemon = {
"" = [ { type = "insecureAcceptAnything"; } ];
};
};
}
'';
description = ''
Signature verification policy file.
If this option is empty the default policy file from
`skopeo` will be used.
'';
};
};
config = lib.mkIf cfg.enable {
xdg.configFile."containers/registries.conf".source =
toml.generate "registries.conf" {
registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
};
xdg.configFile."containers/policy.json".source = if cfg.policy != { } then
pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
else
"${pkgs.skopeo.src}/default-policy.json";
};
}