lew/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use podman.user for rootless instead of mkForce on serviceConfig

Browse source 
The oci-containers module has native rootless support via podman.user
which handles cgroup delegation, runtime dirs, and cidfile paths.
Delegate=true workaround for NixOS/nixpkgs#410857.
This commit is contained in:
Lewis Wynne 2026-04-04 23:36:01 +01:00
parent b5be0575ee
commit 71f32ba49c
2 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/lab/dokuwiki.nix
View file

@ -1,4 +1,4 @@
{ lib, ... }: { ... }:
{ {
services.caddy.virtualHosts."wiki.ily.rs" = { services.caddy.virtualHosts."wiki.ily.rs" = {
extraConfig = '' extraConfig = ''
@ -9,6 +9,7 @@
virtualisation.oci-containers.containers.dokuwiki = { virtualisation.oci-containers.containers.dokuwiki = {
image = "lscr.io/linuxserver/dokuwiki:2025-05-14b-ls299"; image = "lscr.io/linuxserver/dokuwiki:2025-05-14b-ls299";
podman.user = "lew";
environment = { environment = {
PUID = "1000"; PUID = "1000";
PGID = "1000"; PGID = "1000";
@ -21,5 +22,6 @@
ports = [ "127.0.0.1:8070:80" ]; ports = [ "127.0.0.1:8070:80" ];
}; };
systemd.services.podman-dokuwiki.serviceConfig.User = lib.mkForce "lew"; # Workaround for NixOS/nixpkgs#410857 until backport of #475089 lands
systemd.services.podman-dokuwiki.serviceConfig.Delegate = true;
} }

6
hosts/lab/foundry.nix
View file

@ -1,4 +1,4 @@
{ lib, ... }: { ... }:
{ {
services.caddy.virtualHosts."foundry.ily.rs" = { services.caddy.virtualHosts."foundry.ily.rs" = {
extraConfig = '' extraConfig = ''
@ -12,6 +12,7 @@
cmd = [ "node" "main.js" "--dataPath=/data" ]; cmd = [ "node" "main.js" "--dataPath=/data" ];
workdir = "/app"; workdir = "/app";
user = "1000:1000"; user = "1000:1000";
podman.user = "lew";
volumes = [ volumes = [
"/srv/foundry/app:/app:ro" "/srv/foundry/app:/app:ro"
"/srv/foundry/data:/data" "/srv/foundry/data:/data"
@ -19,5 +20,6 @@
ports = [ "127.0.0.1:30000:30000" ]; ports = [ "127.0.0.1:30000:30000" ];
}; };
systemd.services.podman-foundry.serviceConfig.User = lib.mkForce "lew"; # Workaround for NixOS/nixpkgs#410857 until backport of #475089 lands
systemd.services.podman-foundry.serviceConfig.Delegate = true;
} }