summary refs log tree commit diff
path: root/nixos/modules/virtualisation/docker.nix
Commit message (Collapse)AuthorAge
* make all daemon settings defaultBob van der Linden2021-12-19
|
* remove quotes for kebab-case settingsBob van der Linden2021-12-19
|
* move cli options to json daemon settingsBob van der Linden2021-12-19
|
* use pkgs.formats.jsonBob van der Linden2021-12-19
|
* rename daemonConfig -> daemon.settingsBob van der Linden2021-12-19
|
* nixos/docker: add daemonConfig optionBob van der Linden2021-12-19
| | | | | Adds the virtualisation.docker.daemonConfig option that allows changing Docker daemon settings as done in daemon.conf.
* nixos/doc: clean up defaults and examplesNaïm Favier2021-10-04
|
* nixos/docker: fix evaluation when NAT is enabled tooLuke Granger-Brown2021-05-13
| | | | | | | | | | Both networking.nat.enable and virtualisation.docker.enable now want to make sure that the IP forwarding sysctl is enabled, but the module system dislikes that both modules contain this option. Realistically this should be refactored a bit, so that the Docker module automatically enables the NAT module instead, but this is a more obvious fix.
* nixos/docker: ensure ipv4 forwarding is enabledLaurynas Alekna2021-05-08
| | | | Fixes #118656
* nixos/docker: re-add network.targetJörg Thalheim2021-03-25
| | | | | | Currently if docker starts concurrently with firewall.service/systemd-networkd it breaks both due to iptables/netlink logs.
* docker: fix socket activation raceMark Vainomaa2021-02-01
|
* nixos/docker: change misleading error messageMilan Pässler2021-01-15
| | | | | | The socketActivation option was removed, but later on socket activation was added back without the option to disable it. The description now reflects that socket activation is used unconditionally in the current setup.
* docker: fix systemd socket activationMark Vainomaa2021-01-15
|
* Merge pull request #108862 from cpcloud/refactor-nvidia-containersJörg Thalheim2021-01-15
|\
| * nixos/docker: remove nvidia-container-runtime/config.toml creation from modulePhillip Cloud2021-01-10
| |
* | docker: 19.03.4 -> 20.10.2 (#108960)Mark Vainomaa2021-01-13
|/ | | | This commit refactors the build process to handle Docker engine and CLI split.
* systemd: switch to unified cgroup hierarchy by defaultFlorian Klink2020-11-19
| | | | | | | | | | | | | See https://www.redhat.com/sysadmin/fedora-31-control-group-v2 for details on why this is desirable, and how it impacts containers. Users that need to keep using the old cgroup hierarchy can re-enable it by setting `systemd.unifiedCgroupHierarchy` to `false`. Well-known candidates not supporting that hierarchy, like docker and hidepid=… will disable it automatically. Fixes #73800
* nixos/docker: explicitly load kernel modulesryneeverett2020-07-18
| | | | | | | | | | | This is analogous to #70447. With security.lockKernelModules=true, docker commands result in the following error without at least loading veth: $ docker run hello-world /nix/store/mr50kaan2vs4gc40ymwncb2vci25aq7z-docker-19.03.2/libexec/docker/docker: Error response from daemon: failed to create endpoint epic_kare on network bridge: failed to add the host (veth8b381f3) <=> sandbox (veth348e197) pair interfaces: operation not supported. ERRO[0003] error waiting for container: context canceled
* docker: fix typomkenigs2019-05-22
|
* nixos/docker: /var/run -> /runBob van der Linden2019-03-24
|
* nixos/docker: add enableNvidia optionAverell Dalton2019-02-27
|
* nixos/modules: users.(extraUsers|extraGroup->users|group)Florian Klink2018-06-30
|
* docker: Allow package selection in moduleTim Steinbach2017-09-04
|
* docker module: fix autoPrune.enable descriptionFranz Pletz2017-07-21
| | | | cc #27503
* docker service: add option to do automatic pruningPascal Bach2017-07-20
| | | | | | | This allows to run the prune job periodically on a machine. By default the if enabled the job is run once a week. The structure is similar to how system.autoUpgrade works.
* docker: pass all proxy variables to docker daemonPascal Bach2017-04-26
| | | | This makes things as noProxy work too.
* docker: fix socket permissionsAlexey Shmalko2017-04-03
| | | | | | | | | | | Docker socket is world writable. This means any user on the system is able to invoke docker command. (Which is equal to having a root access to the machine.) This commit makes socket group-writable and owned by docker group. Inspired by https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket
* docker: deprecate socketActivation optionJörg Thalheim2017-01-01
|
* docker: use upstream service file from packageJörg Thalheim2016-12-25
|
* docker: update service units from upstreamJörg Thalheim2016-12-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All the new options in detail: Enable docker in multi-user.target make container created with restart=always to start. We still want socket activation as it decouples dependencies between the existing of /var/run/docker.sock and the docker daemon. This means that services can rely on the availability of this socket. Fixes #11478 #21303 wantedBy = ["multi-user.target"]; This allows us to remove the postStart hack, as docker reports on its own when it is ready. Type=notify The following will set unset some limits because overhead in kernel's ressource accounting was observed. Note that these limit only apply to containerd. Containers will have their own limit set. LimitNPROC=infinity LimitCORE=infinity TasksMax=infinity Upgrades may require schema migrations. This can delay the startup of dockerd. TimeoutStartSec=0 Allows docker to create its own cgroup subhierarchy to apply ressource limits on containers. Delegate=true When dockerd is killed, container should be not affected to allow `live restore` to work. KillMode=process
* docker module: updatesJaka Hudoklin2016-09-13
| | | | | | | | | - logDriver option, use journald for logging by default - keep storage driver intact by default, as docker has sane defaults - do not choose storage driver in tests, docker will choose by itself - use dockerd binary as "docker daemon" command is deprecated and will be removed - add overlay2 to list of storage drivers
* nixos treewide: don't set MODULE_DIRNikolay Amiantov2016-08-19
|
* modprobe service: drop kmod wrapperNikolay Amiantov2016-08-19
|
* Revert "Merge branch 'modprobe-fix' of git://github.com/abbradar/nixpkgs"Shea Levy2016-08-15
| | | | | | | Was meant to go into staging, sorry This reverts commit 57b2d1e9b0dcdd1d25bd2d450174764b9417ffc1, reversing changes made to 760b2b9048ea775c319cb348d74447a20dea513e.
* nixos treewide: don't set MODULE_DIRNikolay Amiantov2016-08-16
|
* modprobe service: drop kmod wrapperNikolay Amiantov2016-08-16
|
* nixos/docker: use wrapped modprobeBenno Fünfstück2016-06-11
| | | | | | | | | We need to use wrapped modprobe, so that it finds the right modules. Docker needs modprobe to load overlay kernel module for example. This fixes an an error starting docker if the booted system's kernel version is different from the /run/current-system profile's one.
* docker module: fix kernel module loadingBenno Fünfstück2015-12-24
| | | | | | | | | The docker module used different code for socket-activated docker daemon than for the non-socket activated daemon. In particular, if the socket-activated daemon is used, then modprobe wasn't set up to be usable and in PATH for the docker daemon, which resulted in a failure to start the daemon with overlayfs as storageDriver if the `overlay` kernel module wasn't already loaded. This commit fixes that bug (which only appears if socket activation is used), and also reduces the duplication between code paths so that it's easier to keep both in sync in future.
* nixos/docker: enable socketActivation by defaultLuca Bruno2015-11-20
|
* nixos/docker: default storageDriver to "devicemapper"Bjørn Forsman2015-10-04
| | | | | | | | | | | | | | | | | | | | | Commit 9bfe92ecee ("docker: Minor improvements, fix failing test") added the services.docker.storageDriver option, made it mandatory but didn't give it a default value. This results in an ugly traceback when users enable docker, if they don't pay enough attention to also set the storageDriver option. (An attempt was made to add an assertion, but it didn't work, possibly because of how "mkMerge" works.) The arguments against a default value were that the optimal value depends on the filesystem on the host. This is, AFAICT, only in part true. (It seems some backends are filesystem agnostic.) Also, docker itself uses a default storage driver, "devicemapper", when no --storage-driver=x options are given. Hence, we use the same value as default. Add a FIXME comment that 'devicemapper' breaks NixOS VM tests (for yet unknown reasons), so we still run those with the 'overlay' driver. Closes #10100 and #10217.
* nixos/modules: simplify pkgs.zfs handlingBjørn Forsman2015-10-04
| | | | Thanks, @lethalman.
* nixos/docker: Include ZFS commands in PATH for ZFS storagedriverCasey Ransom2015-10-04
| | | | | | | | | | | When using the ZFS storagedriver in docker, it shells out for the ZFS commands. The path configuration for the systemd task does not include ZFS, so if the driver is set to ZFS, add ZFS utilities to the PATH. This will resolve https://github.com/NixOS/nixpkgs/issues/10127 [Bjørn: prefix commit message with "nixos/docker:", remove extra space before ';']
* nixos: fix some typesJan Malakhovski2015-09-18
|
* docker: Minor improvements, fix failing testRagnar Dahlén2015-09-04
| | | | | | - Replace usage of deprecated CLI flag `--daemon` - Introduce `storageDriver` option for module - Fix failing test by using `overlay` storage driver
* docker: allow the user to override postStartMateusz Kowalczyk2015-07-20
| | | | | My use-case: passing -H SOM.EIP.ADD.RES:PORT doesn't result in a .sock file so the service would never go up.
* nixos docker: fix service and testLuca Bruno2015-07-05
|
* nixos/docker: set extraOptions to separatedString typeJaka Hudoklin2015-04-25
| | | | | This change is needed if you want to pass extraOptions to docker in multiple nixos modules.
* nixos/docker: fix module, add simple testJaka Hudoklin2014-12-01
|
* nixos: add kubernetes moduleJaka Hudoklin2014-11-29
|
* docker: propagate nix.proxy into daemon environmentBoris Sukholitko2014-11-07
|
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-05-18 13:51:53 +0000