[Updates: 2024-10-21]
I found a working solution:
- Disable sandboxing in configuration.nix
- Build a tarball image using `nixos-generator -f lxc`
- Create an LXC container with `lxc-create -t none`
- Modify the config of the LXC container (e.g. specify rootfs path, set unconfined AppArmor)
- Create the rootfs directory and remove all POSIX ACL (setfacl --remove-all)
- Extract the tarball into rootfs/
I planned to try NixOS in LXC.
I have found a few successfull stories: 1, 2, 3. However they are all using Proxmox LXC, and/or the image file is for LXD.
First, I tried to download the official image via lxc-create. The image can boot, but I have trouble running `nix-channel --update`, which complains about sandboxing. I think it's related to unprivileged LXC containers. Further, as part of the nice feature of NixOS, I cannot easily disable sandbox from there.
Second, I tried to build a NixOS image from scratch, using nixos-generators. This is mentioned in the 3rd link above. This tools supports lxc format, however, lxc-create -t local does not like the metadata generated by this tool.
At this point I lost interests and decided the stop. The original idea is I might try NixOS longer if it is easier to maintain than Arch, but it doesn't seems so. If I have to make something work. Maybe I can use the generate image from option 2 to override the rootfs in option 1. Perhaps it'll work.
Comments