Upgrade docker to 1.1.2 and add docker module

This version of module has disabled socketActivation, because until
nixos upgrade systemd to at least 214, systemd does not support
SocketGroup. So socket is created with "root" group when
socketActivation enabled. Should be fixed as soon as systemd upgraded.

Includes changes from #3015 and supersedes #3028

3 files changed, 111 insertions, 0 deletions

diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index c337b9e61919..4ba81dadb315 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -250,6 +250,7 @@
       znc = 128;
       polipo = 129;
       mopidy = 130;
+      docker = 131;
 
       # When adding a gid, make sure it doesn't match an existing uid. And don't use gids above 399!
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0c511a072a78..c444204c0b6a 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -335,6 +335,7 @@
   ./testing/service-runner.nix
   ./virtualisation/container-config.nix
   ./virtualisation/containers.nix
+  ./virtualisation/docker.nix
   ./virtualisation/libvirtd.nix
   #./virtualisation/nova.nix
   ./virtualisation/virtualbox-guest.nix
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
new file mode 100644
index 000000000000..a0aa61353269
--- /dev/null
+++ b/nixos/modules/virtualisation/docker.nix
@@ -0,0 +1,109 @@
+# Systemd services for docker.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.virtualisation.docker;
+
+in
+
+{
+  ###### interface
+
+  options.virtualisation.docker = {
+    enable =
+      mkOption {
+        type = types.bool;
+        default = false;
+        description =
+          ''
+            This option enables docker, a daemon that manages
+            linux containers. Users in the "docker" group can interact with
+            the daemon (e.g. to start or stop containers) using the
+            <command>docker</command> command line tool.
+          '';
+      };
+    socketActivation =
+      mkOption {
+        type = types.bool;
+        default = false;
+        description =
+          ''
+            This option enables docker with socket activation. I.e. docker will
+            start when first called by client.
+
+            Note: This is false by default because systemd lower than 214 that
+            nixos uses so far, doesn't support SocketGroup option, so socket
+            created by docker has root group now. This will likely be changed
+            in future.  So set this option explicitly to false if you wish.
+          '';
+      };
+    extraOptions =
+      mkOption {
+        type = types.str;
+        default = "";
+        description =
+          ''
+            The extra command-line options to pass to
+            <command>docker</command> daemon.
+          '';
+      };
+
+
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable (mkMerge [
+    { environment.systemPackages = [ pkgs.docker ];
+    }
+    (mkIf cfg.socketActivation {
+
+      systemd.services.docker = {
+        description = "Docker Application Container Engine";
+        after = [ "network.target" "docker.socket" ];
+        requires = [ "docker.socket" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.docker}/bin/docker --daemon=true --host=fd:// --group=docker ${cfg.extraOptions}";
+          #  I'm not sure if that limits aren't too high, but it's what
+          #  goes in config bundled with docker itself
+          LimitNOFILE = 1048576;
+          LimitNPROC = 1048576;
+        };
+      };
+
+      systemd.sockets.docker = {
+        description = "Docker Socket for the API";
+        wantedBy = [ "sockets.target" ];
+        socketConfig = {
+          ListenStream = "/var/run/docker.sock";
+          SocketMode = "0660";
+          SocketUser = "root";
+          SocketGroup = "docker";
+        };
+      };
+    })
+    (mkIf (!cfg.socketActivation) {
+
+      systemd.services.docker = {
+        description = "Docker Application Container Engine";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.docker}/bin/docker --daemon=true --group=docker ${cfg.extraOptions}";
+          #  I'm not sure if that limits aren't too high, but it's what
+          #  goes in config bundled with docker itself
+          LimitNOFILE = 1048576;
+          LimitNPROC = 1048576;
+        };
+
+        # Presumably some containers are running we don't want to interrupt
+        restartIfChanged = false;
+      };
+    })
+  ]);
+
+}