nixos/oci-containers: wait for network before starting container

Without `ìmageFile` set, the service needs to download the image from
the registry. If the network is not up in time, the service tries to
restart rapidly until it fails.

1 files changed, 4 insertions, 1 deletions

diff --git a/nixos/modules/virtualisation/oci-containers.nix b/nixos/modules/virtualisation/oci-containers.nix
index 81cdf1dd72b..ed04e6a56a2 100644
--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@@ -229,7 +229,10 @@ let
     dependsOn = map (x: "${cfg.backend}-${x}.service") container.dependsOn;
   in {
     wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
-    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ] ++ dependsOn;
+    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ]
+            # if imageFile is not set, the service needs the network to download the image from the registry
+            ++ lib.optionals (container.imageFile == null) [ "network-online.target" ]
+            ++ dependsOn;
     requires = dependsOn;
     environment = proxy_env;