NixOS has traditionally enabled the `ext` family of file systems by
default. Originally, when switching to systemd initrd, we wanted to
transition to making this explicit so that initrds could be made
without `ext`. The problem is that anyone with `fsType = "auto";` for
an `ext` file system in initrd will fail to boot, which is not really
an acceptable regression as we switch to systemd initrd by default.
By removing `default = "auto"` from `fsType`, we rule out the vast
majority of these regressions as eval errors, since most users of
`fsType = "auto"` for ext file systems are using it because of the
default value.
In hindsight, this is probably what #225352 was really about.
This shares a lot in common with the
<nixos/modules/virtualisation/nixos-containers.nix> infrastructure, but
is designed to behave like our `qemu-vm.nix` profile (provides a lot of
the same `virtualisation.*` options, produces a simple script you can
run).
This lays the groundwork to be able to rework the nixos test
infrastructure to allow for containers as well as qemu nodes. That work
isn't quite done yet, but if you want more context, you can see the
followup work in <https://github.com/applicative-systems/nixpkgs/compare/nspawn-container-profile...applicative-systems:nixpkgs:nixos-test-containers>.
Credit due to the [Clan.lol](https://clan.lol/) team for first
implementing this. I'm just cleaning it up and making it play nicely
with upstream.
To try it out, create a `demo.nix`:
```nix
let
pkgs = import ./. { };
mkContainer =
{
nodeNumber,
vlans,
}:
pkgs.nixos (
{
config,
modulesPath,
pkgs,
lib,
...
}:
let
interfaces = lib.attrValues config.virtualisation.allInterfaces;
# Automatically assign IP addresses to requested interfaces.
assignIPs = lib.filter (i: i.assignIP) interfaces;
ipInterfaces = lib.forEach assignIPs (
i:
lib.nameValuePair i.name {
ipv4.addresses = [
{
address = "192.168.${toString i.vlan}.${toString nodeNumber}";
prefixLength = 24;
}
];
}
);
in
{
imports = [ "${modulesPath}/virtualisation/nspawn-container" ];
users.users.root.password = "";
networking.hostName = "c${toString nodeNumber}";
virtualisation.vlans = vlans;
networking.interfaces = lib.listToAttrs ipInterfaces;
environment.systemPackages = [ pkgs.neovim ];
system.stateVersion = lib.trivial.release;
}
);
in
{
container1 = mkContainer {
nodeNumber = 1;
vlans = [ 1 ];
};
container2 = mkContainer {
nodeNumber = 2;
vlans = [ 2 ];
};
container12 = mkContainer {
nodeNumber = 12;
vlans = [
1
2
];
};
}
```
Build and run the machines in separate terminals (unfortunately,
`systemd-nspawn` requires `sudo`):
```console
$ sudo $(nix-build ./demo.nix -A container1.config.system.build.nspawn)/bin/run-c1-nspawn
$ sudo $(nix-build ./demo.nix -A container2.config.system.build.nspawn)/bin/run-c2-nspawn
$ sudo $(nix-build ./demo.nix -A container12.config.system.build.nspawn)/bin/run-c12-nspawn
```
You can log into this machines as `root`, and verify they can ping each
other:
`c1` can ping `c12`:
```
[root@c1:~]# ping 192.168.1.12 -c 1
PING 192.168.1.12 (192.168.1.12) 56(84) bytes of data.
64 bytes from 192.168.1.12: icmp_seq=1 ttl=64 time=0.164 ms
...
```
So can `c2`:
```
[root@c2:~]# ping 192.168.2.12
PING 192.168.2.12 (192.168.2.12) 56(84) bytes of data.
64 bytes from 192.168.2.12: icmp_seq=1 ttl=64 time=0.127 ms
```
This will ensure reproducibility between different nixos systems, where
one system has store optimization enabled (which will hardling similar
files in the nix store) and the other doesn't. Without the flag, the
same image, built on the two different systems, will have a different
number of inodes. The flag will dereference hardlinks and copy them
into the image as different inodes.
Signed-off-by: Paul Meyer <katexochen0@gmail.com>
This patch adds a NixOS test for Limine on BIOS systems. It also fixes
some formatting in `nixos/lib/make-disk-image.nix`.
Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
This patch adds the option `virtualisation.useBootPartition` which
creates a separate boot partition on BIOS systems using the new
`legacy+boot` partition layout type in `nixos/lib/make-disk-image.nix`.
This option allows for TPM to provisionned before the control is handed
over to the qemu VM.
This is useful to add EK certificates.
The socket has been split in two, a server socket as well as the control
socket for compatibility with the tpm2-tss swtpm TCTI.
Because the control socket may now be used for provisioning, the swtpm
does not terminate when a client disconnects, and the stop of the swtpm
daemon is now controlled by a call to `swtpm_ioctl`.
The script generation is using the *lib.imap* functions in several other places already so this spot using a shell script variable instead seems a bit off.
Moving the previous shell script code to Nix improves upon the Nix code by removing the additional *lib.optionalString* for the variable initialisation making the code more concise.
The shell code is reduced to a one-liner per disk image, making it much easier to determine that this is a templated loop.
Compare the previous:
```bash
idx=0
if ! test -e "empty$idx.qcow2"; then
/nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty$idx.qcow2" "20480M"
fi
idx=$((idx + 1))
if ! test -e "empty$idx.qcow2"; then
/nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty$idx.qcow2" "20480M"
fi
idx=$((idx + 1))
if ! test -e "empty$idx.qcow2"; then
/nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty$idx.qcow2" "20480M"
fi
idx=$((idx + 1))
```
and the new:
```bash
test -e "empty0.qcow2" || /nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty0.qcow2" "20480M"
test -e "empty1.qcow2" || /nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty1.qcow2" "20480M"
test -e "empty2.qcow2" || /nix/store/73n3qwfazqw8zwr1z840jsirjllqpg9v-qemu-host-cpu-only-for-vm-tests-9.0.2/bin/qemu-img create -f qcow2 "empty2.qcow2" "20480M"
```
While the line becomes slightly longer it also becomes immediately obvious on a visual level which parts are changing for each invocation (i.e. different disk sizes as well as the incremented counter stick out).
Since the "idx" variable is now embedded, this also becomes copy&pastable, and also shows the maximum index readily in the last line, as opposed to having to count the number of if statements otherwise.
None of this is *needed* of course.
Signed-off-by: benaryorg <binary@benary.org>
When `diskImage = null`, the root fs is a tmpfs instead of
`/dev/vda`. Thus, it doesn't have to wait for virtio modules to load
before being mounted. The root fs is a dependency of shared
directories by nature of being their parent directory. Without
depending on `/dev/vda`, these shared directories may attempt to mount
without virtio modules being loaded.
Because `virtualisation.diskSize = null` does result in a broken vm runner,
see https://github.com/NixOS/nixpkgs/issues/292901.
diskSize was declared to be nullable when it first got types in a
tree-wide commit:
30f0faac22
But it seemingly never actually supported it, as "${cfg.diskSize}M" is
passed to qemu-img create, which doesn't allow an empty size parameter.
closes: https://github.com/NixOS/nixpkgs/issues/292901
The mkfs.erofs utility has a lot of output by default that slows down
running tests. We don't need to capture any of the output from
mkfs.erofs, so we can suppress it.
Summary of this change:
- Simplify code.
- Stop a disk image from being cached in the binary cache.
- Make erofs Nix Store image build in an acceptable time outside of
testing environments (like `darwin.builder`).
- Do not regress on performance for tests that use many store paths in
their Nix store image.
- Slightly longer startup time for tests where not many store paths are
included in the image (these probably shouldn't use `useNixStoreImage`
anyways).
- Slightly longer startup time when inputs of VM do not change because
the Nix store image is not cached anymore.
Remove the `storeImage` built with make-disk-image.nix. This produced a
separate derivation which is then cached in the binary cache. These
types of images should be avoided because they gunk up the cache as they
change frequently. Now all Nix store images, whether read-only or
writable are based on the erofs image previously only used for read-only
images.
Additionally, simplify the way the erofs image is built by copying the
paths to include to a separate directory and build the erofs image from
there.
Before this change, the list of Nix store paths to include in the Nix
store image was converted to a complex regex that *excludes* all other
paths from a potentially large Nix store.
This previous approach suffers from two issues:
1. The regex is complex and, as admitted in the source code of the
includes-to-excludes.py script, most likely contains at least one
error. This means that it's unlikely that anyone will touch this
piece of software again.
2. When the Nix store image is built from a large Nix store (like when
you build the VM script to run outside of any testing context) this
regex becomes painfully slow. There is at least one prominent
use-case where this matters: `darwin.builder`.
Benchmarking impressions:
- Building Nix store via make-disk-image.nix takes ~25s
- Building Nix store as an erofs image takes ~4s
- Running nixosTests.qemu-vm-writable-store-image takes ~10s when
building the erofs image with the regex vs ~14s when building by
copying to a temporary directory.
- nixosTests.gitlab which had the biggest gains from the initial erofs
change takes the same time as before.
- On a host with ~140k paths in /nix/store, building the erofs image
with the regex takes 410s as opposed to 6s when copying to a temporary
directory.
