You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
2.5 KiB
60 lines
2.5 KiB
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-declarative-containers">
|
|
<title>Declarative Container Specification</title>
|
|
|
|
<para>
|
|
You can also specify containers and their configuration in the host’s
|
|
<filename>configuration.nix</filename>. For example, the following specifies
|
|
that there shall be a container named <literal>database</literal> running
|
|
PostgreSQL:
|
|
<programlisting>
|
|
containers.database =
|
|
{ config =
|
|
{ config, pkgs, ... }:
|
|
{ <xref linkend="opt-services.postgresql.enable"/> = true;
|
|
<xref linkend="opt-services.postgresql.package"/> = pkgs.postgresql_9_6;
|
|
};
|
|
};
|
|
</programlisting>
|
|
If you run <literal>nixos-rebuild switch</literal>, the container will be
|
|
built. If the container was already running, it will be updated in place,
|
|
without rebooting. The container can be configured to start automatically by
|
|
setting <literal>containers.database.autoStart = true</literal> in its
|
|
configuration.
|
|
</para>
|
|
|
|
<para>
|
|
By default, declarative containers share the network namespace of the host,
|
|
meaning that they can listen on (privileged) ports. However, they cannot
|
|
change the network configuration. You can give a container its own network as
|
|
follows:
|
|
<programlisting>
|
|
containers.database = {
|
|
<link linkend="opt-containers._name_.privateNetwork">privateNetwork</link> = true;
|
|
<link linkend="opt-containers._name_.hostAddress">hostAddress</link> = "192.168.100.10";
|
|
<link linkend="opt-containers._name_.localAddress">localAddress</link> = "192.168.100.11";
|
|
};
|
|
</programlisting>
|
|
This gives the container a private virtual Ethernet interface with IP address
|
|
<literal>192.168.100.11</literal>, which is hooked up to a virtual Ethernet
|
|
interface on the host with IP address <literal>192.168.100.10</literal>. (See
|
|
the next section for details on container networking.)
|
|
</para>
|
|
|
|
<para>
|
|
To disable the container, just remove it from
|
|
<filename>configuration.nix</filename> and run <literal>nixos-rebuild
|
|
switch</literal>. Note that this will not delete the root directory of the
|
|
container in <literal>/var/lib/containers</literal>. Containers can be
|
|
destroyed using the imperative method: <literal>nixos-container destroy
|
|
foo</literal>.
|
|
</para>
|
|
|
|
<para>
|
|
Declarative containers can be started and stopped using the corresponding
|
|
systemd service, e.g. <literal>systemctl start container@database</literal>.
|
|
</para>
|
|
</section>
|
|
|