diff options
author | Eelco Dolstra <eelco.dolstra@logicblox.com> | 2014-03-18 10:49:25 +0100 |
---|---|---|
committer | Eelco Dolstra <eelco.dolstra@logicblox.com> | 2014-03-18 10:49:25 +0100 |
commit | 895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2 (patch) | |
tree | 34a2e3560b478ec3fdc4a50ba34ff13972f93f89 /nixos/modules/services/networking | |
parent | ac215779dd1fdfe58d75bcc22cb6a5b0a58744a4 (diff) | |
download | nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar.gz nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar.bz2 nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar.lz nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar.xz nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.tar.zst nixlib-895bcdd1cb9f98ba032c78d996f3ebc89fd60bc2.zip |
Add support for running a container with a private network interface
For example, the following sets up a container named ‘foo’. The container will have a single network interface eth0, with IP address 10.231.136.2. The host will have an interface c-foo with IP address 10.231.136.1. systemd.containers.foo = { privateNetwork = true; hostAddress = "10.231.136.1"; localAddress = "10.231.136.2"; config = { services.openssh.enable = true; }; }; With ‘privateNetwork = true’, the container has the CAP_NET_ADMIN capability, allowing it to do arbitrary network configuration, such as setting up firewall rules. This is secure because it cannot touch the interfaces of the host. The helper program ‘run-in-netns’ is needed at the moment because ‘ip netns exec’ doesn't quite do the right thing (it remounts /sys without bind-mounting the original /sys/fs/cgroups).
Diffstat (limited to 'nixos/modules/services/networking')
-rw-r--r-- | nixos/modules/services/networking/dhcpcd.nix | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix index d4ec96a18f6f..38a21a723d97 100644 --- a/nixos/modules/services/networking/dhcpcd.nix +++ b/nixos/modules/services/networking/dhcpcd.nix @@ -34,8 +34,9 @@ let # Ignore peth* devices; on Xen, they're renamed physical # Ethernet cards used for bridging. Likewise for vif* and tap* - # (Xen) and virbr* and vnet* (libvirt). - denyinterfaces ${toString ignoredInterfaces} peth* vif* tap* tun* virbr* vnet* vboxnet* + # (Xen) and virbr* and vnet* (libvirt) and c-* and ctmp-* (NixOS + # containers). + denyinterfaces ${toString ignoredInterfaces} peth* vif* tap* tun* virbr* vnet* vboxnet* c-* ctmp-* ${config.networking.dhcpcd.extraConfig} ''; |