summary refs log tree commit diff
path: root/pkgs/applications/virtualization
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/applications/virtualization')
-rw-r--r--pkgs/applications/virtualization/catatonit/default.nix24
-rw-r--r--pkgs/applications/virtualization/colima/default.nix6
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix4
-rw-r--r--pkgs/applications/virtualization/crosvm/default.nix15
-rw-r--r--pkgs/applications/virtualization/crun/default.nix4
-rw-r--r--pkgs/applications/virtualization/ddev/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker-slim/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/compose.nix6
-rw-r--r--pkgs/applications/virtualization/docker/default.nix30
-rw-r--r--pkgs/applications/virtualization/docker/distribution.nix6
-rw-r--r--pkgs/applications/virtualization/driver/win-spice/default.nix8
-rw-r--r--pkgs/applications/virtualization/driver/win-virtio/default.nix38
-rwxr-xr-xpkgs/applications/virtualization/driver/win-virtio/update.sh12
-rw-r--r--pkgs/applications/virtualization/ecs-agent/default.nix4
-rw-r--r--pkgs/applications/virtualization/firecracker/default.nix8
-rw-r--r--pkgs/applications/virtualization/imgcrypt/default.nix4
-rw-r--r--pkgs/applications/virtualization/kvmtool/default.nix2
-rw-r--r--pkgs/applications/virtualization/kvmtool/strlcpy-glibc-2.38-fix.patch25
-rw-r--r--pkgs/applications/virtualization/lima/default.nix6
-rw-r--r--pkgs/applications/virtualization/nixpacks/default.nix6
-rw-r--r--pkgs/applications/virtualization/nvidia-container-toolkit/default.nix28
-rw-r--r--pkgs/applications/virtualization/open-vm-tools/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman-tui/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch33
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix57
-rw-r--r--pkgs/applications/virtualization/qemu/utils.nix24
-rw-r--r--pkgs/applications/virtualization/runc/default.nix6
-rw-r--r--pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix13
-rw-r--r--pkgs/applications/virtualization/singularity/packages.nix17
-rw-r--r--pkgs/applications/virtualization/stratovirt/default.nix6
-rw-r--r--pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch8
-rw-r--r--pkgs/applications/virtualization/tart/default.nix4
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix8
-rw-r--r--pkgs/applications/virtualization/virt-viewer/default.nix2
-rw-r--r--pkgs/applications/virtualization/virtualbox/default.nix4
-rw-r--r--pkgs/applications/virtualization/virtualbox/extpack.nix2
-rw-r--r--pkgs/applications/virtualization/virtualbox/guest-additions/default.nix2
-rw-r--r--[-rwxr-xr-x]pkgs/applications/virtualization/vmware-workstation/default.nix0
-rw-r--r--pkgs/applications/virtualization/youki/default.nix6
41 files changed, 214 insertions, 238 deletions
diff --git a/pkgs/applications/virtualization/catatonit/default.nix b/pkgs/applications/virtualization/catatonit/default.nix
index 074015bb345..5b66a59e585 100644
--- a/pkgs/applications/virtualization/catatonit/default.nix
+++ b/pkgs/applications/virtualization/catatonit/default.nix
@@ -1,26 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, glibc, nixosTests }:
+{ stdenv
+, lib
+, autoreconfHook
+, fetchFromGitHub
+, glibc
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "catatonit";
-  version = "0.1.7";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jX4fYC/rpfd3ro2UZ6OEu4kU5wpusOwmEVPWEjxwlW4=";
+    sha256 = "sha256-AqJURf4OrPHfTm5joA3oPXH4McE1k0ouvDXAF3jiwgk=";
   };
 
-  patches = [
-    # Pull the fix pending upstream inclusion to support automake-1.16.5:
-    #  https://github.com/openSUSE/catatonit/pull/18
-    (fetchpatch {
-      name = "automake-1.16.5.patch";
-      url = "https://github.com/openSUSE/catatonit/commit/99bb9048f532257f3a2c3856cfa19fe957ab6cec.patch";
-      sha256 = "sha256-ooxVjtWXJddQiBvO9I5aRyLeL8y3ecxW/Kvtfg/bpRA=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
 
@@ -37,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A container init that is so simple it's effectively brain-dead";
     homepage = "https://github.com/openSUSE/catatonit";
-    license = licenses.gpl3Plus;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ erosennin ] ++ teams.podman.members;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/virtualization/colima/default.nix b/pkgs/applications/virtualization/colima/default.nix
index 14f18551224..153a2271266 100644
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i+JveX9cXF+2Po5NFM8HTmwcSJJ/iSPrlwbA/7aNhc0=";
+    sha256 = "sha256-1Tvh1K/jdJoCHeDO1ckbd793UqB6pn4Qvts3vk8PFTM=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-lsTvzGFoC3Brnr1Q0Hl0ZqEDfcTeQ8vWGe+xylTyvts=";
+  vendorHash = "sha256-IQKfv+bwDQMuDytfYvirBfrmGexj3LGnIQjoJv1NEoU=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 7d7a2730cd2..82e814610dc 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.7.5";
+  version = "1.7.9";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    hash = "sha256-g+1JfXO1k0ijPpVTo+WxmXro4p4MbRCIZdgtgy58M60=";
+    hash = "sha256-/kCnzOL8CJuJJglHzmev3alt8cMwTUbIiZhNft9zwps=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index c6ee442d02f..05de3c1626d 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.28.1";
+  version = "1.28.2";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    sha256 = "sha256-4RwR4aM+h0cqogJ9sxoODlPGaXH2PALFoBU3jv/6Agg=";
+    sha256 = "sha256-g9J66CZOAoco7UmK+xPEE6T5Aes3LWEG3J40LuDcvYo=";
   };
   vendorHash = null;
 
diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 59cc830844c..1d90b428023 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -1,4 +1,5 @@
-{ lib, rustPlatform, fetchgit, pkg-config, protobuf, python3, wayland-scanner
+{ lib, rustPlatform, fetchgit, fetchpatch
+, pkg-config, protobuf, python3, wayland-scanner
 , libcap, libdrm, libepoxy, minijail, virglrenderer, wayland, wayland-protocols
 }:
 
@@ -13,6 +14,16 @@ rustPlatform.buildRustPackage rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "test-page-size-fix.patch";
+      url = "https://chromium.googlesource.com/crosvm/crosvm/+/d9bc6e99ff5ac31d7d88b684c938af01a0872fc1%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      includes = [ "src/crosvm/config.rs" ];
+      hash = "sha256-3gfNzp0WhtNr+8CWSISCJau208EMIo3RJhM+4SyeV3o=";
+    })
+  ];
+
   separateDebugInfo = true;
 
   cargoHash = "sha256-yRujLgPaoKx/wkG3yMwQ5ndy9X5xDWSKtCr8DypXvEA=";
@@ -37,7 +48,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "A secure virtual machine monitor for KVM";
-    homepage = "https://chromium.googlesource.com/crosvm/crosvm/";
+    homepage = "https://crosvm.dev/";
     mainProgram = "crosvm";
     maintainers = with maintainers; [ qyliss ];
     license = licenses.bsd3;
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 5ea6bdc8dd3..77c36d3f81c 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.9";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-1Ygr4tnMCRsskeJMUFv2XJxnNak8E30jZDZiLkXAQyg=";
+    hash = "sha256-D4Y+n/6R2v3U/BhYQitsHd6ckda1vfAzciFbTM/1J80=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/virtualization/ddev/default.nix b/pkgs/applications/virtualization/ddev/default.nix
index 0b4412432ab..3196c846a2c 100644
--- a/pkgs/applications/virtualization/ddev/default.nix
+++ b/pkgs/applications/virtualization/ddev/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddev";
-  version = "1.22.3";
+  version = "1.22.4";
 
   src = fetchFromGitHub {
     owner = "ddev";
     repo = "ddev";
     rev = "v${version}";
-    hash = "sha256-KxBnnNs7dmNGZR048FSDoCZ7+P1IXnhH6iy7e0y+2f8=";
+    hash = "sha256-ml7SrUmpZubKeDChmNOCHzboR/OBQsr6R8H9peqABek=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index 72216d09548..62e424422fb 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-slim";
-  version = "1.40.4";
+  version = "1.40.6";
 
   src = fetchFromGitHub {
     owner = "slimtoolkit";
     repo = "slim";
     rev = version;
-    hash = "sha256-A5qMg+mgcvK0YyJLbnFdZRS3s+OFWFaLKmnyvKj4r4g=";
+    hash = "sha256-0rn+tqdPVjkIPxOwL9rDnolrpcsDOwOah0Y7924mjD4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index db6d5a3dadb..bd8dbab4cfc 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.21.0";
+  version = "2.23.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-JekWw5YI6O+CLXc7oNIxPJsRzYimGFDGL6ACyM4D04k=";
+    hash = "sha256-g8XaMvKt3tR7a7kq+n4ueDXx9iWuAu02ONb73W23ZGY=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-vVnaZLvPbhJNFn/ACuYDbXCKPKNlYoGCm+liTlPMcjs=";
+  vendorHash = "sha256-BeW39XN1CvPCCq4otX+Il2dGGcjGrTMzc4iSXmQZFmw=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 392bb4dacc5..a8c7d77da67 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -106,12 +106,6 @@ rec {
           url = "https://github.com/moby/moby/pull/43136.patch";
           hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
         })
-      ] ++ lib.optionals (lib.versionOlder version "23.0.5") [
-        (fetchpatch {
-          name = "fix-issue-with-go-1.20.6.patch";
-          url = "https://github.com/moby/moby/pull/45972.patch";
-          hash = "sha256-zxFh/bI6+INOYSg6QFs0S9rdl9Z21KUIZFmzpNVjpSA=";
-        })
       ];
 
       postPatch = ''
@@ -185,19 +179,11 @@ rec {
       makeWrapper pkg-config go-md2man go libtool installShellFiles
     ];
 
-    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23") [
+    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23" && stdenv.isLinux) [
       glibc
       glibc.static
     ];
 
-    patches = lib.optionals (lib.versionOlder version "23.0.5") [
-      (fetchpatch {
-        name = "fix-issue-with-go-1.20.6.patch";
-        url = "https://github.com/docker/cli/pull/4441.patch";
-        hash = "sha256-F4ueSbdBk1w8OqC4Dgh8+4Ql4zTjehaM368ET7k6Yx8=";
-      })
-    ];
-
     postPatch = ''
       patchShebangs man scripts/build/
       substituteInPlace ./scripts/build/.variables --replace "set -eu" ""
@@ -283,15 +269,15 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.25";
+    version = "20.10.26";
     cliRev = "v${version}";
-    cliHash = "sha256-Wi/NHn8erqvKEVEJqkc99cO/sfPHptwMT44Savcuw2M=";
+    cliHash = "sha256-EPhsng0kLnweVbC8ZnH0NK1/yHlYSA5Sred4rWJX/Gs=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-trJjQMYF/Uog7nvUlELyUYbsTPGz8Rn21v1/V5xhu+A=";
-    runcRev = "v1.1.5";
-    runcHash = "sha256-r5as3hb0zt+XPfxAPeH+YIc/n6IRlscPOZMGfhVE5C4=";
-    containerdRev = "v1.6.20";
-    containerdHash = "sha256-Nd3S6hmvA8LBFUN4XaQJMApbmwGIp6GTnFQimnYagZg=";
+    mobyHash = "sha256-IJ7m2mQnsLiom0EuZLpuLY6fYEko7rEy35igJv1AY04=";
+    runcRev = "v1.1.8";
+    runcHash = "sha256-rDJYEc64KW4Qa3Eg2oUjJqIKrg6THb5hxQFFbvb9Zp4=";
+    containerdRev = "v1.6.22";
+    containerdHash = "sha256-In7OkK3xm7Cz3H1jzG9b4tsZbmo44QCq8pNU+PPy8dY=";
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
diff --git a/pkgs/applications/virtualization/docker/distribution.nix b/pkgs/applications/virtualization/docker/distribution.nix
index 89c029e5e94..8c2fec16186 100644
--- a/pkgs/applications/virtualization/docker/distribution.nix
+++ b/pkgs/applications/virtualization/docker/distribution.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "distribution";
-  version = "2.8.2";
+  version = "2.8.3";
   rev = "v${version}";
 
   goPackagePath = "github.com/docker/distribution";
@@ -11,13 +11,13 @@ buildGoPackage rec {
     owner = "docker";
     repo = "distribution";
     inherit rev;
-    sha256 = "sha256-aBAUyM+MtRZAA6Jxu4cFyRIo5OU+7IdLKdQqgm0AFPI=";
+    sha256 = "sha256-6/clOTkI1JnDjb+crcHmjbQlaqffP/sntGqUB2ftajU=";
   };
 
   meta = with lib; {
     description = "The Docker toolset to pack, ship, store, and deliver content";
     license = licenses.asl20;
-    maintainers = [ maintainers.globin ];
+    maintainers = [];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/virtualization/driver/win-spice/default.nix b/pkgs/applications/virtualization/driver/win-spice/default.nix
index 9bbbe640148..ff3364b1ae9 100644
--- a/pkgs/applications/virtualization/driver/win-spice/default.nix
+++ b/pkgs/applications/virtualization/driver/win-spice/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, p7zip, win-virtio }:
+{ lib, stdenv, fetchurl, p7zip, virtio-win }:
 
 let
   version_usbdk = "1.0.22";
@@ -58,9 +58,9 @@ stdenv.mkDerivation  {
       copy_usbdk = arch: "mkdir -p $out/${arch}/usbdk; cp usbdk/${arch}/* $out/${arch}/usbdk/. \n";
       copy_vdagent = arch: "mkdir -p $out/${arch}/vdagent; cp vdagent/${arch}/* $out/${arch}/vdagent/. \n";
       # SPICE needs vioserial
-      # TODO: Link windows version in win-spice (here) to version used in win-virtio.
-      #       That way it would never matter whether vioserial is installed from win-virtio or win-spice.
-      copy_vioserial = arch: version: "mkdir -p $out/${arch}/vioserial; cp ${win-virtio}/vioserial/${version}/${arch}/* $out/${arch}/vioserial/. \n";
+      # TODO: Link windows version in win-spice (here) to version used in virtio-win.
+      #       That way it would never matter whether vioserial is installed from virtio-win or win-spice.
+      copy_vioserial = arch: version: "mkdir -p $out/${arch}/vioserial; cp ${virtio-win}/vioserial/${version}/${arch}/* $out/${arch}/vioserial/. \n";
       copy = arch: version: (copy_qxl arch version) + (copy_usbdk arch) + (copy_vdagent arch) + (copy_vioserial arch version);
     in ''
       runHook preInstall
diff --git a/pkgs/applications/virtualization/driver/win-virtio/default.nix b/pkgs/applications/virtualization/driver/win-virtio/default.nix
deleted file mode 100644
index 97fecfaeda3..00000000000
--- a/pkgs/applications/virtualization/driver/win-virtio/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchurl, libarchive }:
-
-stdenv.mkDerivation rec {
-  pname = "win-virtio";
-  version = "0.1.240-1";
-
-  src = fetchurl {
-    url = "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-${version}/virtio-win.iso";
-    hash = "sha256-69SCWGaPf3jgJu0nbCip0Z2D4CD/oICtaZENyGu8vMY=";
-  };
-
-  nativeBuildInputs = [
-    libarchive
-  ];
-
-  unpackCmd = "mkdir source; bsdtar -xf $curSrc -C source";
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -R ./. $out/
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Windows VirtIO Drivers";
-    homepage = "https://docs.fedoraproject.org/en-US/quick-docs/creating-windows-virtual-machines-using-virtio-drivers/index.html";
-    changelog = "https://fedorapeople.org/groups/virt/virtio-win/CHANGELOG";
-    license = [ licenses.bsd3 ];
-    maintainers = with maintainers; [ anthonyroussel ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/virtualization/driver/win-virtio/update.sh b/pkgs/applications/virtualization/driver/win-virtio/update.sh
deleted file mode 100755
index b35dd1d9fcf..00000000000
--- a/pkgs/applications/virtualization/driver/win-virtio/update.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl pup common-updater-scripts
-
-set -eu -o pipefail
-
-version="$(curl -Ls https://fedorapeople.org/groups/virt/virtio-win/repo/latest/ | \
-        pup 'a[href*="virtio-win-"] text{}' | \
-        sed -E 's/virtio-win-(.*)\.noarch\.rpm/\1/' | \
-        sort -Vu | \
-        tail -n1)"
-
-update-source-version win-virtio "$version"
diff --git a/pkgs/applications/virtualization/ecs-agent/default.nix b/pkgs/applications/virtualization/ecs-agent/default.nix
index 218c50fb1ee..8a016147686 100644
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.75.3";
+  version = "1.78.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-30KDmbT46K5/jE2aSFkX2TZZvWDtzudazTyqFiyLTds=";
+    hash = "sha256-8/hHv5veTQXNg8c5oew+5FWLAQkytTD2+Gdb30sY9lo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/firecracker/default.nix b/pkgs/applications/virtualization/firecracker/default.nix
index b366a28e59a..ee95b55a0b9 100644
--- a/pkgs/applications/virtualization/firecracker/default.nix
+++ b/pkgs/applications/virtualization/firecracker/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv }:
 
 let
-  version = "1.4.0";
+  version = "1.5.0";
   # nixpkgs-update: no auto update
 
   suffix = {
@@ -23,8 +23,8 @@ stdenv.mkDerivation {
 
   sourceRoot = ".";
   src = dlbin {
-    x86_64-linux = "sha256-WSa8fd0OSPo1HFkH6i8cGMNH1df88xI6PCx39ONb73c=";
-    aarch64-linux = "sha256-eOsO/nbwKT50tC5g6INPELh2yVb5C3EGqNLQLT7IGBs=";
+    x86_64-linux = "sha256-TzNPWcLDKOv12eJ9PHckdJ7tfdlozPoXj2fbdOzHfAk=";
+    aarch64-linux = "sha256-cHNMfcoHCBw+BnWx9USny8jyvH97gXCCJW1aKvPXgCs=";
   };
 
   dontConfigure = true;
@@ -50,6 +50,8 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Secure, fast, minimal micro-container virtualization";
     homepage = "http://firecracker-microvm.io";
+    changelog = "https://github.com/firecracker-microvm/firecracker/releases/tag/v${version}";
+    mainProgram = "firecracker";
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ thoughtpolice endocrimes ];
diff --git a/pkgs/applications/virtualization/imgcrypt/default.nix b/pkgs/applications/virtualization/imgcrypt/default.nix
index 86c1da42a22..25adabdba0a 100644
--- a/pkgs/applications/virtualization/imgcrypt/default.nix
+++ b/pkgs/applications/virtualization/imgcrypt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "imgcrypt";
-  version = "1.1.8";
+  version = "1.1.9";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FLqFzEEfgsKcjAevhF6+8mR3zOUjfXyfWwWsxVOcdJU=";
+    hash = "sha256-EStyi6RDK1G6kuaDGumZaHB4OrSrhhx/F5GsLe0amyA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/kvmtool/default.nix b/pkgs/applications/virtualization/kvmtool/default.nix
index e7429f3312d..9aeb21e3f06 100644
--- a/pkgs/applications/virtualization/kvmtool/default.nix
+++ b/pkgs/applications/virtualization/kvmtool/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation {
     sha256 = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
   };
 
+  patches = [ ./strlcpy-glibc-2.38-fix.patch ];
+
   buildInputs = lib.optionals stdenv.hostPlatform.isAarch64 [ dtc ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/virtualization/kvmtool/strlcpy-glibc-2.38-fix.patch b/pkgs/applications/virtualization/kvmtool/strlcpy-glibc-2.38-fix.patch
new file mode 100644
index 00000000000..457f8e3cff5
--- /dev/null
+++ b/pkgs/applications/virtualization/kvmtool/strlcpy-glibc-2.38-fix.patch
@@ -0,0 +1,25 @@
+Manually tell the compiler that strlcpy exists. The `try-build` function seems
+somewhat broken, i.e. any code that I try to pass to it doesn't link because of an
+"undefined reference to main" error (and some more quoting issues with newlines being
+swalloed).
+
+Because both musl and glibc seemt o support strlcpy nowadays, I decided to just skip the
+possibly broken feature-check and hardcode that it exists.
+
+diff --git a/Makefile b/Makefile
+index ed2414b..37be9cd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -239,10 +239,8 @@ endif
+ # On a given system, some libs may link statically, some may not; so, check
+ # both and only build those that link!
+ 
+-ifeq ($(call try-build,$(SOURCE_STRLCPY),$(CFLAGS),$(LDFLAGS)),y)
+-	CFLAGS_DYNOPT	+= -DHAVE_STRLCPY
+-	CFLAGS_STATOPT	+= -DHAVE_STRLCPY
+-endif
++CFLAGS_DYNOPT	+= -DHAVE_STRLCPY
++CFLAGS_STATOPT	+= -DHAVE_STRLCPY
+ 
+ ifeq ($(call try-build,$(SOURCE_BFD),$(CFLAGS),$(LDFLAGS) -lbfd -static),y)
+ 	CFLAGS_STATOPT	+= -DCONFIG_HAS_BFD
diff --git a/pkgs/applications/virtualization/lima/default.nix b/pkgs/applications/virtualization/lima/default.nix
index 9dc433c1716..b20bf2497fa 100644
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "lima";
-  version = "0.17.2";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0yWQhyDSDGZT6K/SeVntTdqnDzyGD244+r5kG1MFh1c=";
+    sha256 = "sha256-sOOpqgEvDBVvD/o1wFL3ebqWw0XpSdEqY8cZmtdXyxE=";
   };
 
-  vendorHash = "sha256-yA6qwnbRFR/V2Aaf53jLTejPKuNzbod2dVnLEQLoQkM=";
+  vendorHash = "sha256-vJlnptEja3nBfj/c1hSZjY9DZPQ970ZIMnHBPndd2vQ=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ]
     ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun sigtool ];
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 68e37fdbd7f..e35a5d16a49 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.15.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iZOcpVvhHbf8u2NrnwAIg7jlTN/afeBi2+jbsNYKlz4=";
+    sha256 = "sha256-yeZGhE+ImWXW3HPpAo+E1GOSEwPr7yK78XVmCocGqH4=";
   };
 
-  cargoHash = "sha256-cysxQ4qc70zpEOpL5bccMHdEDGbdjzbGftTMb58RrYc=";
+  cargoHash = "sha256-xqKYd80PCM7Rnj+9dV2XjigE4sweOnL4HfOQiOYzCEQ=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix b/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
index 9d32d9864ac..a174c303122 100644
--- a/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
+++ b/pkgs/applications/virtualization/nvidia-container-toolkit/default.nix
@@ -2,7 +2,7 @@
 , glibc
 , fetchFromGitLab
 , makeWrapper
-, buildGoPackage
+, buildGoModule
 , linkFarm
 , writeShellScript
 , containerRuntimePath
@@ -24,7 +24,7 @@ let
     fi
   '';
 in
-buildGoPackage rec {
+buildGoModule rec {
   pname = "container-toolkit/container-toolkit";
   version = "1.9.0";
 
@@ -32,20 +32,30 @@ buildGoPackage rec {
     owner = "nvidia";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b4mybNB5FqizFTraByHk5SCsNO66JaISj18nLgLN7IA=";
+    hash = "sha256-b4mybNB5FqizFTraByHk5SCsNO66JaISj18nLgLN7IA=";
   };
 
-  goPackagePath = "github.com/NVIDIA/nvidia-container-toolkit";
+  vendorHash = null;
+
+  postPatch = ''
+    # replace the default hookDefaultFilePath to the $out path
+    substituteInPlace cmd/nvidia-container-runtime/main.go \
+      --replace '/usr/bin/nvidia-container-runtime-hook' '${placeholder "out"}/bin/nvidia-container-runtime-hook'
+  '';
 
   ldflags = [ "-s" "-w" ];
 
   nativeBuildInputs = [ makeWrapper ];
 
-  preBuild = ''
-    # replace the default hookDefaultFilePath to the $out path
-    substituteInPlace go/src/github.com/NVIDIA/nvidia-container-toolkit/cmd/nvidia-container-runtime/main.go \
-      --replace '/usr/bin/nvidia-container-runtime-hook' '${placeholder "out"}/bin/nvidia-container-runtime-hook'
-  '';
+  checkFlags =
+    let
+      skippedTests = [
+        # Disable tests executing nvidia-container-runtime command.
+        "TestGoodInput"
+        "TestDuplicateHook"
+      ];
+    in
+    [ "-skip" "${builtins.concatStringsSep "|" skippedTests}" ];
 
   postInstall = ''
     mkdir -p $out/etc/nvidia-container-runtime
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index 078c786ae23..9c3f3f74e6a 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open-vm-tools";
-  version = "12.3.0";
+  version = "12.3.5";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "open-vm-tools";
     rev = "stable-${finalAttrs.version}";
-    hash = "sha256-YVpWomLED5sBKXKdJtuDjb7/aKB2flVIm2ED3xSsccE=";
+    hash = "sha256-OuESPenXVDKLckIZ3sQCtQXZXCL6xSLZOxZWVEX2XMk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/open-vm-tools";
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index ce1a439b73c..e5d5eb93098 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-XaZgvy8b/3XUjO/GAQV6fxfqlR+eSMeosC7ugoYsEJM=";
+    hash = "sha256-l6jbc/+Fi5xx7yhK0e5/iqcm7i8JnU37Qr4niVG4OvU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 128ab444073..8841abcd367 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.6.2";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-Zxzb7ORyugvN9mhxa0s8r0ch16Ndbm3Z1JCsQcwbF6g=";
+    hash = "sha256-o5FTCuFUbTlENqvh+u6fPEfD816tKWPxHu2yhBi/Mf0=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
index db6455cab4c..5663f5e8a01 100644
--- a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
+++ b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
@@ -1,16 +1,19 @@
-diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
-index a118285f7..d775f0099 100644
---- a/pkg/machine/qemu/machine.go
-+++ b/pkg/machine/qemu/machine.go
-@@ -1560,11 +1560,6 @@ func (v *MachineVM) waitAPIAndPrintInfo(forwardState machine.APIForwardingState,
- 			case machine.NotInstalled:
- 				fmt.Printf("\nThe system helper service is not installed; the default Docker API socket\n")
- 				fmt.Printf("address can't be used by podman. ")
--				if helper := findClaimHelper(); len(helper) > 0 {
--					fmt.Printf("If you would like to install it run the\nfollowing commands:\n")
--					fmt.Printf("\n\tsudo %s install\n", helper)
--					fmt.Printf("\tpodman machine stop%s; podman machine start%s\n\n", suffix, suffix)
--				}
- 			case machine.MachineLocal:
+diff --git a/pkg/machine/machine_common.go b/pkg/machine/machine_common.go
+index 649748947..a981d93bf 100644
+--- a/pkg/machine/machine_common.go
++++ b/pkg/machine/machine_common.go
+@@ -127,14 +127,6 @@ address can't be used by podman. `
+ 
+ 				if len(helper) < 1 {
+ 					fmt.Print(fmtString)
+-				} else {
+-					fmtString += `If you would like to install it run the\nfollowing commands:
+-
+-        sudo %s install
+-        podman machine stop%[1]s; podman machine start%[1]s
+-
+-                `
+-					fmt.Printf(fmtString, helper, suffix)
+ 				}
+ 			case MachineLocal:
  				fmt.Printf("\nAnother process was listening on the default Docker API socket address.\n")
- 			case machine.ClaimUnsupported:
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 24d2e8dc217..0dc91af767f 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -4,39 +4,43 @@
 , makeWrapper, removeReferencesTo
 , attr, libcap, libcap_ng, socat, libslirp
 , CoreServices, Cocoa, Hypervisor, rez, setfile, vmnet
-, guestAgentSupport ? with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows
-, numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
-, seccompSupport ? stdenv.isLinux, libseccomp
-, alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner
-, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner, libpulseaudio
-, pipewireSupport ? !stdenv.isDarwin && !nixosTestRunner, pipewire
-, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner, SDL2, SDL2_image
-, jackSupport ? !stdenv.isDarwin && !nixosTestRunner, libjack2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner, gtk3, gettext, vte, wrapGAppsHook
-, vncSupport ? !nixosTestRunner, libjpeg, libpng
-, smartcardSupport ? !nixosTestRunner, libcacard
-, spiceSupport ? true && !nixosTestRunner, spice, spice-protocol
-, ncursesSupport ? !nixosTestRunner, ncurses
+, guestAgentSupport ? (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !toolsOnly
+, numaSupport ? stdenv.isLinux && !stdenv.isAarch32 && !toolsOnly, numactl
+, seccompSupport ? stdenv.isLinux && !toolsOnly, libseccomp
+, alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner && !toolsOnly
+, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, libpulseaudio
+, pipewireSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, pipewire
+, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, SDL2, SDL2_image
+, jackSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, libjack2
+, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner && !toolsOnly, gtk3, gettext, vte, wrapGAppsHook
+, vncSupport ? !nixosTestRunner && !toolsOnly, libjpeg, libpng
+, smartcardSupport ? !nixosTestRunner && !toolsOnly, libcacard
+, spiceSupport ? true && !nixosTestRunner && !toolsOnly, spice, spice-protocol
+, ncursesSupport ? !nixosTestRunner && !toolsOnly, ncurses
 , usbredirSupport ? spiceSupport, usbredir
 , xenSupport ? false, xen
 , cephSupport ? false, ceph
 , glusterfsSupport ? false, glusterfs, libuuid
 , openGLSupport ? sdlSupport, mesa, libepoxy, libdrm
 , virglSupport ? openGLSupport, virglrenderer
-, libiscsiSupport ? true, libiscsi
+, libiscsiSupport ? !toolsOnly, libiscsi
 , smbdSupport ? false, samba
-, tpmSupport ? true
+, tpmSupport ? !toolsOnly
 , uringSupport ? stdenv.isLinux, liburing
 , canokeySupport ? false, canokey-qemu
-, capstoneSupport ? true, capstone
+, capstoneSupport ? !toolsOnly, capstone
 , enableDocs ? true
 , hostCpuOnly ? false
-, hostCpuTargets ? (if hostCpuOnly
+, hostCpuTargets ? (if toolsOnly
+                    then [ ]
+                    else if hostCpuOnly
                     then (lib.optional stdenv.isx86_64 "i386-softmmu"
                           ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
                     else null)
 , nixosTestRunner ? false
+, toolsOnly ? false
 , gitUpdater
+, qemu-utils # for tests attribute
 }:
 
 let
@@ -47,12 +51,13 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "qemu"
     + lib.optionalString xenSupport "-xen"
     + lib.optionalString hostCpuOnly "-host-cpu-only"
-    + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "8.1.1";
+    + lib.optionalString nixosTestRunner "-for-vm-tests"
+    + lib.optionalString toolsOnly "-utils";
+  version = "8.1.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N84u9eUA+3UvaBEXxotFEYMD6kmn4mvVQIDO1U+rfe8=";
+    hash = "sha256-VBUmp2RXbrSU0v9exGrrJT5i6ikDXRwjwKivTmzU8Ic=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]
@@ -239,14 +244,15 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
-  postInstall = ''
+  postInstall = lib.optionalString (!toolsOnly) ''
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
-    tests = {
+    tests = lib.optionalAttrs (!toolsOnly) {
       qemu-tests = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
+      qemu-utils-builds = qemu-utils;
     };
     updateScript = gitUpdater {
       # No nicer place to find latest release.
@@ -260,11 +266,14 @@ stdenv.mkDerivation (finalAttrs: {
   requiredSystemFeatures = [ "big-parallel" ];
 
   meta = with lib; {
-    homepage = "http://www.qemu.org/";
+    homepage = "https://www.qemu.org/";
     description = "A generic and open source machine emulator and virtualizer";
     license = licenses.gpl2Plus;
-    mainProgram = "qemu-kvm";
     maintainers = with maintainers; [ eelco qyliss ];
     platforms = platforms.unix;
+  }
+  # toolsOnly: Does not have qemu-kvm and there's no main support tool
+  // lib.optionalAttrs (!toolsOnly) {
+    mainProgram = "qemu-kvm";
   };
 })
diff --git a/pkgs/applications/virtualization/qemu/utils.nix b/pkgs/applications/virtualization/qemu/utils.nix
deleted file mode 100644
index c284934b3f1..00000000000
--- a/pkgs/applications/virtualization/qemu/utils.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv, installShellFiles, qemu_kvm, removeReferencesTo }:
-
-stdenv.mkDerivation rec {
-  pname = "qemu-utils";
-  inherit (qemu_kvm) version;
-
-  nativeBuildInputs = [ installShellFiles ];
-  buildInputs = [ qemu_kvm ];
-  disallowedRequisites = [ qemu_kvm ];
-  unpackPhase = "true";
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp "${qemu_kvm}/bin/qemu-img" "$out/bin/qemu-img"
-    cp "${qemu_kvm}/bin/qemu-io"  "$out/bin/qemu-io"
-    cp "${qemu_kvm}/bin/qemu-nbd" "$out/bin/qemu-nbd"
-    ${removeReferencesTo}/bin/remove-references-to -t ${qemu_kvm} $out/bin/*
-
-    installManPage ${qemu_kvm}/share/man/man1/qemu-img.1.gz
-    installManPage ${qemu_kvm}/share/man/man8/qemu-nbd.8.gz
-  '';
-
-  inherit (qemu_kvm) meta;
-}
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index 38a28594559..67edd6887c9 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -9,19 +9,18 @@
 , libseccomp
 , libselinux
 , makeWrapper
-, procps
 , nixosTests
 }:
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    hash = "sha256-9vNzKoG+0Ze4+dhluNM6QtsUjV8/bpkuvEF8ASBfBRo=";
+    hash = "sha256-YoRwr5imolblix1st/YeVTrAUdQXTqrx1BdNMdYlt/0=";
   };
 
   vendorHash = null;
@@ -45,7 +44,6 @@ buildGoModule rec {
     install -Dm755 runc $out/bin/runc
     installManPage man/*/*.[1-9]
     wrapProgram $out/bin/runc \
-      --prefix PATH : ${lib.makeBinPath [ procps ]} \
       --prefix PATH : /run/current-system/systemd/bin
     runHook postInstall
   '';
diff --git a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
index 152bb056bc5..67ea1e07b90 100644
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@@ -1,13 +1,13 @@
 { lib
 , fetchFromGitHub
-, makeRustPlatform
 , hostPlatform
-, targetPlatform
+, cargo
+, rustc
 , lld
 }:
 
 let
-  arch = targetPlatform.qemuArch;
+  arch = hostPlatform.qemuArch;
 
   target = ./. + "/${arch}-unknown-none.json";
 
@@ -24,7 +24,12 @@ let
     };
   };
 
-  inherit (cross) rustPlatform;
+  # inherit (cross) rustPlatform;
+  # ^ breaks because we are doing a no_std embedded build with a custom sysroot,
+  # but the fast_cross rustc wrapper already passes a sysroot argument
+  rustPlatform = cross.makeRustPlatform {
+    inherit rustc cargo;
+  };
 
 in
 
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index b52608875f3..8a86f06785b 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -7,14 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      version = "1.2.2";
+      version = "1.2.4";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
-        rev = "v${version}";
-        hash = "sha256-CpNuoG+QykP+HDCyFuIbZKYez5XnYrE75SWFoWu34rg=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-VaVOepfjMBf8F56S1Clpn8HPw65MNQMoZsQguKQ4Sg0=";
       };
 
       # Update by running
@@ -38,25 +38,26 @@ let
   singularity = callPackage
     (import ./generic.nix rec {
       pname = "singularity-ce";
-      version = "3.11.4";
+      version = "4.0.2";
       projectName = "singularity";
 
       src = fetchFromGitHub {
         owner = "sylabs";
         repo = "singularity";
-        rev = "v${version}";
-        hash = "sha256-v8iHbn2OzK/egP2Go76BI74iX8izfy2PM4Uo8LsE8FY=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-R+vAKYR4lJmC7PIITYyg4UeGYjGXoPqqUai3HmPzwG0=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-24Hnpq6LRh3JgaiJWCmHfJKoWLxsbceCdJutjPqZsX8=";
+      vendorHash = "sha256-z3VozeMpaqh4ddZxB3xqo25Gm+8JYeIwASOq+Mmerr4=";
 
-      # Do not build conmon from the Git submodule source,
+      # Do not build conmon and squashfuse from the Git submodule sources,
       # Use Nixpkgs provided version
       extraConfigureFlags = [
         "--without-conmon"
+        "--without-squashfuse"
       ];
 
       extraDescription = " (Sylabs Inc's fork of Singularity, a.k.a. SingularityCE)";
diff --git a/pkgs/applications/virtualization/stratovirt/default.nix b/pkgs/applications/virtualization/stratovirt/default.nix
index b9fbc191d9c..75641547ad2 100644
--- a/pkgs/applications/virtualization/stratovirt/default.nix
+++ b/pkgs/applications/virtualization/stratovirt/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stratovirt";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchgit {
     url = "https://gitee.com/openeuler/stratovirt.git";
     rev = "v${version}";
-    sha256 = "sha256-K99CmaBrJu30/12FxnsNsDKsTyX4f2uQSO7cwHsPuDw=";
+    sha256 = "sha256-f5710f7Lz7ul1DYrC0CAfDR+7e1NrE9ESPdB8nlVUKw=";
   };
   patches = [ ./micro_vm-allow-SYS_clock_gettime.patch ];
 
-  cargoSha256 = "sha256-SFIOGGRzGkVWHIXkviVWuhDN29pa0uD3GqKh+G421xI=";
+  cargoSha256 = "sha256-prs7zkPAKQ99gjW7gy+4+CgEgGhaTTCLPTbLk/ZHdts=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch b/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch
index 6aa0da30c44..11d2a0e88e1 100644
--- a/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch
+++ b/pkgs/applications/virtualization/stratovirt/micro_vm-allow-SYS_clock_gettime.patch
@@ -1,4 +1,4 @@
-From af3001b1b2697ae3165e2fdf47a560fd9ab19a68 Mon Sep 17 00:00:00 2001
+From c5ef87eb831f7f77c0564dd1dce92a579e7c4747 Mon Sep 17 00:00:00 2001
 From: Astro <astro@spaceboyz.net>
 Date: Sun, 18 Jun 2023 23:10:23 +0200
 Subject: [PATCH] micro_vm: allow SYS_clock_gettime
@@ -8,13 +8,13 @@ Subject: [PATCH] micro_vm: allow SYS_clock_gettime
  1 file changed, 2 insertions(+)
 
 diff --git a/machine/src/micro_vm/syscall.rs b/machine/src/micro_vm/syscall.rs
-index 89ce5c29..2a6aa0cc 100644
+index c37d3f4e..f9e7cce2 100644
 --- a/machine/src/micro_vm/syscall.rs
 +++ b/machine/src/micro_vm/syscall.rs
-@@ -128,6 +128,8 @@ pub fn syscall_whitelist() -> Vec<BpfRule> {
-         #[cfg(all(target_env = "gnu", target_arch = "x86_64"))]
+@@ -125,6 +125,8 @@ pub fn syscall_whitelist() -> Vec<BpfRule> {
          BpfRule::new(libc::SYS_readlink),
          BpfRule::new(libc::SYS_getrandom),
+         BpfRule::new(libc::SYS_fallocate),
 +        #[cfg(target_env = "gnu")]
 +        BpfRule::new(libc::SYS_clock_gettime),
          madvise_rule(),
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index 89dc9fd5683..ae1130fd146 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "1.6.0";
+  version = "2.0.0";
 
   src = fetchurl {
     url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    sha256 = "1n052nwsccc3sr0jqnvhyl0six8wi46vysxjchwrdm8brnsdpf84";
+    sha256 = "sha256-uDNB49HF++WTV28VkfZCt32zkp+h0W5xXAuqtaFTmPI=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 163812bdccf..b3225633289 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook, gtk-vnc
 , vte, avahi, dconf, gobject-introspection, libvirt-glib, system-libvirt
-, gsettings-desktop-schemas, libosinfo, gnome, gtksourceview4, docutils, cpio
+, gsettings-desktop-schemas, gst_all_1, libosinfo, gnome, gtksourceview4, docutils, cpio
 , e2fsprogs, findutils, gzip, cdrtools, xorriso, fetchpatch
 , desktopToDarwinBundle, stdenv
 , spiceSupport ? true, spice-gtk ? null
@@ -21,10 +21,12 @@ python3.pkgs.buildPythonApplication rec {
     intltool file
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
     docutils
+    wrapGAppsHook
   ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
 
   buildInputs = [
-    wrapGAppsHook
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     libvirt-glib vte dconf gtk-vnc gnome.adwaita-icon-theme avahi
     gsettings-desktop-schemas libosinfo gtksourceview4
   ] ++ lib.optional spiceSupport spice-gtk;
@@ -83,7 +85,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    homepage = "http://virt-manager.org";
+    homepage = "https://virt-manager.org";
     description = "Desktop user interface for managing virtual machines";
     longDescription = ''
       The virt-manager application is a desktop user interface for managing
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 0e24dd9b08f..58d9edb269a 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
   };
   passthru = {
     updateInfo = {
-      downloadPage = "http://virt-manager.org/download.html";
+      downloadPage = "https://virt-manager.org/download.html";
     };
   };
 }
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index b425ccedb28..ebdf09fd837 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -25,14 +25,14 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  version = "7.0.10";
+  version = "7.0.12";
 in stdenv.mkDerivation {
   pname = "virtualbox";
   inherit version;
 
   src = fetchurl {
     url = "https://download.virtualbox.org/virtualbox/${version}/VirtualBox-${version}.tar.bz2";
-    sha256 = "0b1e6d8b7f87d017c7fae37f80586acff04f799ffc1d51e995954d6415dee371";
+    sha256 = "d76634c6ccf62503726a5aeae6c78a3462474c51a0ebe4942591ccc2d939890a";
   };
 
   outputs = [ "out" "modsrc" ];
diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix
index 8c19504a3ab..c7057c2de76 100644
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@@ -12,7 +12,7 @@ fetchurl rec {
     # Manually sha256sum the extensionPack file, must be hex!
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
-    let value = "af84dccac488df72bfaeb1eb8c922ba466668561a6ac05c64a7f8b6ebdddbaeb";
+    let value = "dbf7ce39e5c021d420fc6b2045b084a68fc5172937192bd70c3207efa786278d";
     in assert (builtins.stringLength value) == 64; value;
 
   meta = {
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index f365e435150..3d6fc0a64c0 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "bbabd89b8fff38a257bab039a278f0c4dc4426eff6e4238c1db01edb7284186a";
+    sha256 = "b37f6aabe5a32e8b96ccca01f37fb49f4fd06674f1b29bc8fe0f423ead37b917";
   };
 
   KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
diff --git a/pkgs/applications/virtualization/vmware-workstation/default.nix b/pkgs/applications/virtualization/vmware-workstation/default.nix
index 8fe79b6e237..8fe79b6e237 100755..100644
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
diff --git a/pkgs/applications/virtualization/youki/default.nix b/pkgs/applications/virtualization/youki/default.nix
index 808f9135150..a179b4568a7 100644
--- a/pkgs/applications/virtualization/youki/default.nix
+++ b/pkgs/applications/virtualization/youki/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "youki";
-  version = "0.1.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Nz3paJiR5Jtv8gLBq6mBUyLDfIFJCpnc/RMsDLT09Vg=";
+    sha256 = "sha256-XoHGRCGLEG/a6gb+3ejYoeOuIml64U/p6CcxsFLoTWY=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "-p" "youki" ];
   cargoTestFlags = [ "-p" "youki" ];
 
-  cargoHash = "sha256-luzKyN09lauflAict9zqVdGPbDLFAfe5P8121a5YBsA=";
+  cargoHash = "sha256-L5IhOPo8BDQAvaSs3IJzJHN0TbgmUcEyv60IDLN4kn0=";
 
   meta = with lib; {
     description = "A container runtime written in Rust";