nixos/modules/virtualisation/lxd.nix

   1 # Systemd services for lxd.
   2
   3 { config, lib, pkgs, ... }:
   4
   5 with lib;
   6
   7 let
   8
   9   cfg = config.virtualisation.lxd;
  10   zfsCfg = config.boot.zfs;
  11
  12 in
  13
  14 {
  15   ###### interface
  16
  17   options = {
  18     virtualisation.lxd = {
  19       enable = mkOption {
  20         type = types.bool;
  21         default = false;
  22         description = ''
  23           This option enables lxd, a daemon that manages
  24           containers. Users in the "lxd" group can interact with
  25           the daemon (e.g. to start or stop containers) using the
  26           <command>lxc</command> command line tool, among others.
  27
  28           Most of the time, you'll also want to start lxcfs, so
  29           that containers can "see" the limits:
  30           <code>
  31             virtualisation.lxc.lxcfs.enable = true;
  32           </code>
  33         '';
  34       };
  35
  36       package = mkOption {
  37         type = types.package;
  38         default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
  39         defaultText = "pkgs.lxd";
  40         description = ''
  41           The LXD package to use.
  42         '';
  43       };
  44
  45       lxcPackage = mkOption {
  46         type = types.package;
  47         default = pkgs.lxc;
  48         defaultText = "pkgs.lxc";
  49         description = ''
  50           The LXC package to use with LXD (required for AppArmor profiles).
  51         '';
  52       };
  53
  54       zfsPackage = mkOption {
  55         type = types.package;
  56         default = with pkgs; if zfsCfg.enableUnstable then zfsUnstable else zfs;
  57         defaultText = "pkgs.zfs";
  58         description = ''
  59           The ZFS package to use with LXD.
  60         '';
  61       };
  62
  63       zfsSupport = mkOption {
  64         type = types.bool;
  65         default = false;
  66         description = ''
  67           Enables lxd to use zfs as a storage for containers.
  68
  69           This option is enabled by default if a zfs pool is configured
  70           with nixos.
  71         '';
  72       };
  73
  74       recommendedSysctlSettings = mkOption {
  75         type = types.bool;
  76         default = false;
  77         description = ''
  78           enables various settings to avoid common pitfalls when
  79           running containers requiring many file operations.
  80           Fixes errors like "Too many open files" or
  81           "neighbour: ndisc_cache: neighbor table overflow!".
  82           See https://lxd.readthedocs.io/en/latest/production-setup/
  83           for details.
  84         '';
  85       };
  86     };
  87   };
  88
  89   ###### implementation
  90
  91   config = mkIf cfg.enable {
  92     environment.systemPackages = [ cfg.package ];
  93
  94     security.apparmor = {
  95       enable = true;
  96       profiles = {
  97         "bin.lxc-start" = ''
  98           #include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start
  99         '';
 100         "lxc-containers" = ''
 101           #include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
 102         '';
 103       };
 104       includes = [ (cfg.lxcPackage+"/etc/apparmor.d") ];
 105     };
 106
 107     systemd.services.lxd = {
 108       description = "LXD Container Management Daemon";
 109
 110       wantedBy = [ "multi-user.target" ];
 111       after = [ "systemd-udev-settle.service" ];
 112
 113       path = lib.optional cfg.zfsSupport cfg.zfsPackage;
 114
 115       preStart = ''
 116         mkdir -m 0755 -p /var/lib/lxc/rootfs
 117       '';
 118
 119       serviceConfig = {
 120         ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
 121         Type = "simple";
 122         KillMode = "process"; # when stopping, leave the containers alone
 123         LimitMEMLOCK = "infinity";
 124         LimitNOFILE = "1048576";
 125         LimitNPROC = "infinity";
 126         TasksMax = "infinity";
 127
 128         # By default, `lxd` loads configuration files from hard-coded
 129         # `/usr/share/lxc/config` - since this is a no-go for us, we have to
 130         # explicitly tell it where the actual configuration files are
 131         Environment = mkIf (config.virtualisation.lxc.lxcfs.enable)
 132           "LXD_LXC_TEMPLATE_CONFIG=${pkgs.lxcfs}/share/lxc/config";
 133       };
 134     };
 135
 136     users.groups.lxd.gid = config.ids.gids.lxd;
 137
 138     users.users.root = {
 139       subUidRanges = [ { startUid = 1000000; count = 65536; } ];
 140       subGidRanges = [ { startGid = 1000000; count = 65536; } ];
 141     };
 142
 143     boot.kernel.sysctl = mkIf cfg.recommendedSysctlSettings {
 144       "fs.inotify.max_queued_events" = 1048576;
 145       "fs.inotify.max_user_instances" = 1048576;
 146       "fs.inotify.max_user_watches" = 1048576;
 147       "vm.max_map_count" = 262144;
 148       "kernel.dmesg_restrict" = 1;
 149       "net.ipv4.neigh.default.gc_thresh3" = 8192;
 150       "net.ipv6.neigh.default.gc_thresh3" = 8192;
 151       "kernel.keys.maxkeys" = 2000;
 152     };
 153   };
 154 }