Archived
beatzaplentyandClaude Sonnet 5
6b09a808ed
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s
The kernel's NFS client filesystem doesn't set FS_USERNS_MOUNT, so mounting
NFS from inside any non-init user namespace -- exactly what an unprivileged
LXC container's UID-mapped root runs in -- is rejected at the VFS layer
with EPERM, regardless of Proxmox's mount=nfs;nfs4 container feature (which
only patches the AppArmor layer). Confirmed live on the redeployed lxc-docker
container: TCP to the NFS server's port 2049 succeeds, the server's export
table matches the container's IP, and mount.nfs: Operation not permitted
still fires immediately with no corresponding denial anywhere in the
server's own logs -- a kernel-level rejection that no amount of DNS/
automount/export tweaking (this branch's earlier commits) could ever fix.
modules/platforms/lxc.nix now keys proxmoxLXC.privileged off hostName
("docker" -> true) rather than a blanket false, since build-types/docker.nix
is also composed for linode-docker/proxmox-docker, which don't import
proxmox-lxc.nix at all -- setting this option there would break their eval.
create-proxmox-resource.sh reads the value back via a new
flake_target_lxc_privileged helper instead of hardcoding --unprivileged 1,
so the two stay in sync automatically for every lxc-* target.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T48qgH3VTvs8wvwj44FEbE
55 lines
2.6 KiB
Bash
55 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared flake-introspection helpers for scripts/*.sh. Source alongside
|
|
# env.sh:
|
|
# source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/nix-eval.sh"
|
|
#
|
|
# NIX_EVAL_FLAGS: --no-use-registries so a call here never resolves through
|
|
# the user's global flake registry (every call targets this repo's own
|
|
# flake, or an explicit github: ref, not a registry alias); --no-accept-flake-config
|
|
# so a flake input's own nixConfig (e.g. a dependency's substituters) is
|
|
# never honored -- matches accept-flake-config = false already set repo-wide
|
|
# (see lib/nix-bootstrap.sh / CLAUDE.md). Reuse this array rather than
|
|
# retyping the two flags at each call site.
|
|
declare -a NIX_EVAL_FLAGS=(--no-use-registries --no-accept-flake-config)
|
|
|
|
# list_flake_targets <flake_ref>
|
|
# Prints the attribute names under <flake_ref>#nixosConfigurations, one per
|
|
# line, e.g.:
|
|
# list_flake_targets . # from inside the repo
|
|
# list_flake_targets "$repo_root" # from anywhere
|
|
list_flake_targets() {
|
|
local flake_ref="$1"
|
|
nix eval --json "${NIX_EVAL_FLAGS[@]}" \
|
|
"${flake_ref}#nixosConfigurations" --apply builtins.attrNames \
|
|
| jq -r '.[]'
|
|
}
|
|
|
|
# flake_target_hostname <flake_ref> <target>
|
|
# Prints one nixosConfigurations target's config.networking.hostName.
|
|
# Empty (not an error under set -e) if the target doesn't exist or the
|
|
# eval otherwise fails -- callers that need to distinguish "empty" from
|
|
# "eval failed" should check $? themselves instead of relying on this.
|
|
flake_target_hostname() {
|
|
local flake_ref="$1" target="$2"
|
|
nix eval --raw "${NIX_EVAL_FLAGS[@]}" \
|
|
"${flake_ref}#nixosConfigurations.${target}.config.networking.hostName" 2>/dev/null
|
|
}
|
|
|
|
# flake_target_lxc_privileged <flake_ref> <target>
|
|
# Prints "true" or "false" for one lxc-* target's config.proxmoxLXC.privileged
|
|
# (modules/platforms/lxc.nix is the single source of truth -- e.g.
|
|
# lxc-docker sets this true so it can NFS-mount; every other lxc-* host
|
|
# stays unprivileged). Only meaningful for lxc-* targets -- the option
|
|
# doesn't exist for linode-*/proxmox-* (nixpkgs' proxmox-lxc.nix, which
|
|
# declares it, is only ever imported by modules/platforms/lxc.nix). Empty
|
|
# (not an error under set -e) if the eval fails.
|
|
flake_target_lxc_privileged() {
|
|
local flake_ref="$1" target="$2"
|
|
# Not --raw: the option is a Nix boolean, and --raw can only coerce
|
|
# strings ("cannot coerce a Boolean to a string"). Plain `nix eval`
|
|
# prints a bare `true`/`false` for a boolean, which is exactly the
|
|
# string this needs.
|
|
nix eval "${NIX_EVAL_FLAGS[@]}" \
|
|
"${flake_ref}#nixosConfigurations.${target}.config.proxmoxLXC.privileged" 2>/dev/null
|
|
}
|