···

       
59
       
 
       
      "net.ipv6.conf.all.autoconf" = false;

     

       
60
       
 
       
      "net.ipv6.conf.all.accept_ra" = false;

     

       
61
       
 
       


     

       
62
       
-
       
      "net.ipv4.ping_group_range" = "0 65536";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
63
       
 
       
    };

     

       
64
       
 
       
  };

     

       
65
       
 
       
}

     

···

       
59
       
 
       
      "net.ipv6.conf.all.autoconf" = false;

     

       
60
       
 
       
      "net.ipv6.conf.all.accept_ra" = false;

     

       
61
       
 
       


     

       
62
       
+
       
      "kernel.kptr_restrict" = 2;

     

       
63
       
+
       
      "kernel.dmesg_restrict" = 0;

     

       
64
       
+
       
      "kernel.sysrq" = 4;

     

       
65
       
+
       
      "kernel.unprivileged_bpf_disabled" = true;

     

       
66
       
+
       
      "kernel.perf_event_paranoid" = 3;

     

       
67
       
+
       
      "kernel.yama.ptrace_scope" = 2;

     

       
68
       
+
       
      "kernel.kexec_load_disabled" = true;

     

       
69
       
+
       
      "net.core.bpf_jit_harden" = 2;

     

       
70
       
+
       
      "dev.tty.ldisc_autoload" = false;

     

       
71
       
 
       
    };

     

       
72
       
 
       
  };

     

       
73
       
 
       
}

     

···

       
12
       
 
       
      description = "Whether to enable Podman.";

     

       
13
       
 
       
      type = types.bool;

     

       
14
       
 
       
    };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
  };

     

       
16
       
 
       


     

       
17
       
 
       
  config = mkIf cfg.enable && cfgRoot.enable {

     
···

       
25
       
 
       
          dns_enabled = true;

     

       
26
       
 
       
        };

     

       
27
       
 
       
      };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
28
       
 
       
    };

     

       
29
       
 
       
  };

     

       
30
       
 
       
}

     

···

       
12
       
 
       
      description = "Whether to enable Podman.";

     

       
13
       
 
       
      type = types.bool;

     

       
14
       
 
       
    };

     

       
15
       
+
       


     

       
16
       
+
       
    tweakKernel = mkEnableOption "Whether to tweak kernel configuration";

     

       
17
       
 
       
  };

     

       
18
       
 
       


     

       
19
       
 
       
  config = mkIf cfg.enable && cfgRoot.enable {

     
···

       
27
       
 
       
          dns_enabled = true;

     

       
28
       
 
       
        };

     

       
29
       
 
       
      };

     

       
30
       
+
       
    };

     

       
31
       
+
       


     

       
32
       
+
       
    boot.kernel.sysctl = mkIf cfg.tweakKernel {

     

       
33
       
+
       
      "kernel.unprivileged_userns_clone" = true;

     

       
34
       
+
       
      "net.ipv4.ping_group_range" = "0 65536";

     

       
35
       
 
       
    };

     

       
36
       
 
       
  };

     

       
37
       
 
       
}