WIP rootless docker

README.md

@@ -1,3 +1,15 @@
 # nix-docker
 
 Template for making Nix-based LXC containers in Proxmox to run Docker
+
+## NFS Mounts
+
+Needs to be done in a privileged container because AppArmor makes it a pain in the ass
+
+- [Unprivileged LXC containers](https://pve.proxmox.com/wiki/Unprivileged_LXC_containers)
+- [Mount NFS inside LXC containers](https://theorangeone.net/posts/mount-nfs-inside-lxc/)
+- [How to allow specific Proxmox LXC containers to mount NFS shares on the network?](https://unix.stackexchange.com/questions/450308/how-to-allow-specific-proxmox-lxc-containers-to-mount-nfs-shares-on-the-network)
+
+## Docker
+
+- [Docker on NixOS](https://nixos.wiki/wiki/Docker)

configuration.nix

@@ -10,6 +10,7 @@ in
     (import "${builtins.fetchTarball https://github.com/nix-community/home-manager/archive/release-24.05.tar.gz}/nixos")
     (fetchTarball "https://github.com/nix-community/nixos-vscode-server/tarball/master")
     ./users.nix
+    # ./mounts.nix
   ];
 
   environment.systemPackages = with pkgs; [
@@ -26,14 +27,17 @@ in
   services.openssh.enable = true;
 
   # Networking stuff
-  # networking.interfaces.eth0.useDHCP = true;
-  # services.resolved = { enable = true; dns = "default"; };
-  # services.resolved.enable = true;
-  # networking.nameservers = [ "192.168.1.1" ];
-  # services.avahi = { enable = true; nssmdns4 = true; };
+  services.avahi = { enable = true; nssmdns4 = true; };
 
-  # Enables some tools
-  virtualisation.docker.enable = true;
+  # https://nixos.wiki/wiki/Docker
+  virtualisation.docker = {
+    enable = true;
+    # https://docs.docker.com/engine/security/rootless/
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
   services.vscode-server.enable = true;
   
   system.activationScripts.startup = ''

users.nix

@@ -4,7 +4,7 @@
     isNormalUser = true;
     extraGroups = [
       "wheel"   # needed for sudo without password
-      "docker"  # needed for docker without sudo
+      # "docker"  # needed for docker without sudo
     ];
     openssh.authorizedKeys.keyFiles = [
       "/root/.ssh/authorized_keys" # should already have your public SSH key inside