Archived
beatzaplentyandClaude Sonnet 4.6
720399b00d
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s
NixOS's group activation uses plain groupmod, which silently skips the GID change when SSSD exposes the same GID (50010) via the IPA docker-access group through NSS. Add an activation script that runs after the normal 'groups' step and applies groupmod --non-unique so the local docker group can share GID 50010 with the SSSD-provided IPA group. If the GID actually changes on a live system the script also restarts docker.socket + docker.service so the socket is recreated with the new GID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.8 KiB
Nix
46 lines
1.8 KiB
Nix
{ lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
gid = toString vars.dockerAccessGid;
|
|
in
|
|
{
|
|
virtualisation.docker = {
|
|
enable = true;
|
|
package = pkgs.docker;
|
|
};
|
|
# Pin the docker group GID to match the IPA "docker-access" group so that
|
|
# IPA group membership alone grants access to the Docker socket. Any user
|
|
# whose supplementary groups (resolved by SSSD from IPA) include GID
|
|
# vars.dockerAccessGid will pass the socket group-permission check without
|
|
# any per-host users.groups.docker.members entry.
|
|
users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
|
|
users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
|
|
environment.systemPackages = with pkgs; [
|
|
docker-compose
|
|
docker-buildx
|
|
];
|
|
|
|
# NixOS's group activation uses plain `groupmod` without --non-unique.
|
|
# When SSSD is active it exposes the IPA "docker-access" group at
|
|
# vars.dockerAccessGid via NSS, so groupmod sees that GID as already in
|
|
# use and silently skips the change (warning: "not applying GID change").
|
|
# This script runs after the normal "groups" step and applies the change
|
|
# with --non-unique (which lets the local docker group share the GID with
|
|
# the SSSD-provided IPA group). If the GID actually changed it also
|
|
# restarts docker.socket so the socket is recreated with the new GID.
|
|
system.activationScripts.docker-group-gid = {
|
|
deps = [ "groups" ];
|
|
text = ''
|
|
current=$(grep "^docker:" /etc/group | cut -d: -f3)
|
|
if [ "$current" != "${gid}" ]; then
|
|
${pkgs.shadow}/bin/groupmod --non-unique -g ${gid} docker
|
|
if ${pkgs.systemd}/bin/systemctl is-active --quiet docker.socket; then
|
|
${pkgs.systemd}/bin/systemctl stop docker.service docker.socket
|
|
rm -f /var/run/docker.sock
|
|
${pkgs.systemd}/bin/systemctl start docker.socket docker.service
|
|
fi
|
|
fi
|
|
'';
|
|
};
|
|
}
|