pyrox.dev
1{ pkgs, lib, ... }:
2{
3 name = "containers-tmpfs";
4 meta = {
5 maintainers = with lib.maintainers; [ patryk27 ];
6 };
7
8 nodes.machine =
9 { pkgs, ... }:
10 {
11 imports = [ ../modules/installer/cd-dvd/channel.nix ];
12 virtualisation.writableStore = true;
13
14 containers.tmpfs = {
15 autoStart = true;
16 tmpfs = [
17 # Mount var as a tmpfs
18 "/var"
19
20 # Add a nested mount inside a tmpfs
21 "/var/log"
22
23 # Add a tmpfs on a path that does not exist
24 "/some/random/path"
25 ];
26 config = { };
27 };
28
29 virtualisation.additionalPaths = [ pkgs.stdenv ];
30 };
31
32 testScript = ''
33 machine.wait_for_unit("default.target")
34 assert "tmpfs" in machine.succeed("nixos-container list")
35
36 with subtest("tmpfs container is up"):
37 assert "up" in machine.succeed("nixos-container status tmpfs")
38
39
40 def tmpfs_cmd(command):
41 return f"nixos-container run tmpfs -- {command} 2>/dev/null"
42
43
44 with subtest("/var is mounted as a tmpfs"):
45 machine.succeed(tmpfs_cmd("mountpoint -q /var"))
46
47 with subtest("/var/log is mounted as a tmpfs"):
48 assert "What: tmpfs" in machine.succeed(
49 tmpfs_cmd("systemctl status var-log.mount --no-pager")
50 )
51 machine.succeed(tmpfs_cmd("mountpoint -q /var/log"))
52
53 with subtest("/some/random/path is mounted as a tmpfs"):
54 assert "What: tmpfs" in machine.succeed(
55 tmpfs_cmd("systemctl status some-random-path.mount --no-pager")
56 )
57 machine.succeed(tmpfs_cmd("mountpoint -q /some/random/path"))
58
59 with subtest(
60 "files created in the container in a non-tmpfs directory are visible on the host."
61 ):
62 # This establishes legitimacy for the following tests
63 machine.succeed(
64 tmpfs_cmd("touch /root/test.file"),
65 tmpfs_cmd("ls -l /root | grep -q test.file"),
66 "test -e /var/lib/nixos-containers/tmpfs/root/test.file",
67 )
68
69 with subtest(
70 "/some/random/path is writable and that files created there are not "
71 + "in the hosts container dir but in the tmpfs"
72 ):
73 machine.succeed(
74 tmpfs_cmd("touch /some/random/path/test.file"),
75 tmpfs_cmd("test -e /some/random/path/test.file"),
76 )
77 machine.fail("test -e /var/lib/nixos-containers/tmpfs/some/random/path/test.file")
78
79 with subtest(
80 "files created in the hosts container dir in a path where a tmpfs "
81 + "file system has been mounted are not visible to the container as "
82 + "they do not exist in the tmpfs"
83 ):
84 machine.succeed(
85 "touch /var/lib/nixos-containers/tmpfs/var/test.file",
86 "test -e /var/lib/nixos-containers/tmpfs/var/test.file",
87 "ls -l /var/lib/nixos-containers/tmpfs/var/ | grep -q test.file 2>/dev/null",
88 )
89 machine.fail(tmpfs_cmd("ls -l /var | grep -q test.file"))
90 '';
91}