the conversion procedure is simple: - find all things that look like options, ie calls to either `mkOption` or `lib.mkOption` that take an attrset. remember the attrset as the option - for all options, find a `description` attribute who's value is not a call to `mdDoc` or `lib.mdDoc` - textually convert the entire value of the attribute to MD with a few simple regexes (the set from mdize-module.sh) - if the change produced a change in the manual output, discard - if the change kept the manual unchanged, add some text to the description to make sure we've actually found an option. if the manual changes this time, keep the converted description this procedure converts 80% of nixos options to markdown. around 2000 options remain to be inspected, but most of those fail the "does not change the manual output check": currently the MD conversion process does not faithfully convert docbook tags like <code> and <package>, so any option using such tags will not be converted at all.
252 lines
7.2 KiB
Nix
252 lines
7.2 KiB
Nix
# Systemd services for docker.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.virtualisation.docker;
|
|
proxy_env = config.networking.proxy.envVars;
|
|
settingsFormat = pkgs.formats.json {};
|
|
daemonSettingsFile = settingsFormat.generate "daemon.json" cfg.daemon.settings;
|
|
in
|
|
|
|
{
|
|
###### interface
|
|
|
|
options.virtualisation.docker = {
|
|
enable =
|
|
mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description =
|
|
lib.mdDoc ''
|
|
This option enables docker, a daemon that manages
|
|
linux containers. Users in the "docker" group can interact with
|
|
the daemon (e.g. to start or stop containers) using the
|
|
{command}`docker` command line tool.
|
|
'';
|
|
};
|
|
|
|
listenOptions =
|
|
mkOption {
|
|
type = types.listOf types.str;
|
|
default = ["/run/docker.sock"];
|
|
description =
|
|
lib.mdDoc ''
|
|
A list of unix and tcp docker should listen to. The format follows
|
|
ListenStream as described in systemd.socket(5).
|
|
'';
|
|
};
|
|
|
|
enableOnBoot =
|
|
mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description =
|
|
lib.mdDoc ''
|
|
When enabled dockerd is started on boot. This is required for
|
|
containers which are created with the
|
|
`--restart=always` flag to work. If this option is
|
|
disabled, docker might be started on demand by socket activation.
|
|
'';
|
|
};
|
|
|
|
daemon.settings =
|
|
mkOption {
|
|
type = settingsFormat.type;
|
|
default = { };
|
|
example = {
|
|
ipv6 = true;
|
|
"fixed-cidr-v6" = "fd00::/80";
|
|
};
|
|
description = lib.mdDoc ''
|
|
Configuration for docker daemon. The attributes are serialized to JSON used as daemon.conf.
|
|
See https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file
|
|
'';
|
|
};
|
|
|
|
enableNvidia =
|
|
mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = lib.mdDoc ''
|
|
Enable nvidia-docker wrapper, supporting NVIDIA GPUs inside docker containers.
|
|
'';
|
|
};
|
|
|
|
liveRestore =
|
|
mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description =
|
|
lib.mdDoc ''
|
|
Allow dockerd to be restarted without affecting running container.
|
|
This option is incompatible with docker swarm.
|
|
'';
|
|
};
|
|
|
|
storageDriver =
|
|
mkOption {
|
|
type = types.nullOr (types.enum ["aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs"]);
|
|
default = null;
|
|
description =
|
|
lib.mdDoc ''
|
|
This option determines which Docker storage driver to use. By default
|
|
it let's docker automatically choose preferred storage driver.
|
|
'';
|
|
};
|
|
|
|
logDriver =
|
|
mkOption {
|
|
type = types.enum ["none" "json-file" "syslog" "journald" "gelf" "fluentd" "awslogs" "splunk" "etwlogs" "gcplogs"];
|
|
default = "journald";
|
|
description =
|
|
lib.mdDoc ''
|
|
This option determines which Docker log driver to use.
|
|
'';
|
|
};
|
|
|
|
extraOptions =
|
|
mkOption {
|
|
type = types.separatedString " ";
|
|
default = "";
|
|
description =
|
|
lib.mdDoc ''
|
|
The extra command-line options to pass to
|
|
{command}`docker` daemon.
|
|
'';
|
|
};
|
|
|
|
autoPrune = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = lib.mdDoc ''
|
|
Whether to periodically prune Docker resources. If enabled, a
|
|
systemd timer will run `docker system prune -f`
|
|
as specified by the `dates` option.
|
|
'';
|
|
};
|
|
|
|
flags = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
example = [ "--all" ];
|
|
description = lib.mdDoc ''
|
|
Any additional flags passed to {command}`docker system prune`.
|
|
'';
|
|
};
|
|
|
|
dates = mkOption {
|
|
default = "weekly";
|
|
type = types.str;
|
|
description = ''
|
|
Specification (in the format described by
|
|
<citerefentry><refentrytitle>systemd.time</refentrytitle>
|
|
<manvolnum>7</manvolnum></citerefentry>) of the time at
|
|
which the prune will occur.
|
|
'';
|
|
};
|
|
};
|
|
|
|
package = mkOption {
|
|
default = pkgs.docker;
|
|
defaultText = literalExpression "pkgs.docker";
|
|
type = types.package;
|
|
description = lib.mdDoc ''
|
|
Docker package to be used in the module.
|
|
'';
|
|
};
|
|
};
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable (mkMerge [{
|
|
boot.kernelModules = [ "bridge" "veth" ];
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.conf.all.forwarding" = mkOverride 98 true;
|
|
"net.ipv4.conf.default.forwarding" = mkOverride 98 true;
|
|
};
|
|
environment.systemPackages = [ cfg.package ]
|
|
++ optional cfg.enableNvidia pkgs.nvidia-docker;
|
|
users.groups.docker.gid = config.ids.gids.docker;
|
|
systemd.packages = [ cfg.package ];
|
|
|
|
systemd.services.docker = {
|
|
wantedBy = optional cfg.enableOnBoot "multi-user.target";
|
|
after = [ "network.target" "docker.socket" ];
|
|
requires = [ "docker.socket" ];
|
|
environment = proxy_env;
|
|
serviceConfig = {
|
|
Type = "notify";
|
|
ExecStart = [
|
|
""
|
|
''
|
|
${cfg.package}/bin/dockerd \
|
|
--config-file=${daemonSettingsFile} \
|
|
${cfg.extraOptions}
|
|
''];
|
|
ExecReload=[
|
|
""
|
|
"${pkgs.procps}/bin/kill -s HUP $MAINPID"
|
|
];
|
|
};
|
|
|
|
path = [ pkgs.kmod ] ++ optional (cfg.storageDriver == "zfs") pkgs.zfs
|
|
++ optional cfg.enableNvidia pkgs.nvidia-docker;
|
|
};
|
|
|
|
systemd.sockets.docker = {
|
|
description = "Docker Socket for the API";
|
|
wantedBy = [ "sockets.target" ];
|
|
socketConfig = {
|
|
ListenStream = cfg.listenOptions;
|
|
SocketMode = "0660";
|
|
SocketUser = "root";
|
|
SocketGroup = "docker";
|
|
};
|
|
};
|
|
|
|
systemd.services.docker-prune = {
|
|
description = "Prune docker resources";
|
|
|
|
restartIfChanged = false;
|
|
unitConfig.X-StopOnRemoval = false;
|
|
|
|
serviceConfig.Type = "oneshot";
|
|
|
|
script = ''
|
|
${cfg.package}/bin/docker system prune -f ${toString cfg.autoPrune.flags}
|
|
'';
|
|
|
|
startAt = optional cfg.autoPrune.enable cfg.autoPrune.dates;
|
|
};
|
|
|
|
assertions = [
|
|
{ assertion = cfg.enableNvidia -> config.hardware.opengl.driSupport32Bit or false;
|
|
message = "Option enableNvidia requires 32bit support libraries";
|
|
}];
|
|
|
|
virtualisation.docker.daemon.settings = {
|
|
group = "docker";
|
|
hosts = [ "fd://" ];
|
|
log-driver = mkDefault cfg.logDriver;
|
|
storage-driver = mkIf (cfg.storageDriver != null) (mkDefault cfg.storageDriver);
|
|
live-restore = mkDefault cfg.liveRestore;
|
|
runtimes = mkIf cfg.enableNvidia {
|
|
nvidia = {
|
|
path = "${pkgs.nvidia-docker}/bin/nvidia-container-runtime";
|
|
};
|
|
};
|
|
};
|
|
}
|
|
]);
|
|
|
|
imports = [
|
|
(mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active")
|
|
];
|
|
|
|
}
|