I’m very fresh to NixOS here and I’m looking to migrate a small home Fedora server to NixOS. It currently hosts a handful of popular docker images using rootless podman (eg. Unifi controller). They are each started with generated systemd units.
I’m looking for some guidance/best practice around maintaining config for the podman containers - how much of this should/can be done with nix config vs manually setting up the containers in user accounts? I’m a bit lost at this stage and there doesn’t appear to be a heap of documentation on using podman with NixOS yet.
NixOS has native support for the unifi controller (I’m using it), so in that specific case, I would absolutely use that rather than a container.
I wouldn’t run anything manually. Sure, you can run the binaries using whatever container image you want, but I that case I would still configure it via the NixOS module system.
I’m in exactly the same situation as you, thinking of switching my fedora server to NixOS , I run all my containers via systemd units, using podman as my user, so rootless containers. As you say there isn’t alot of documentation about this setup yet and from what I can tell rootless podman isn’t supported well at the moment in NixOS.
I was thinking the same as you probably, use the module as shown in the wiki, in my config.nix to run each container using systemd. However, have the unit files in my user home directory for each container still. I’m not sure this will work though. I will be testing this soon on a disused thinkpad to ‘trial and error’ getting this working.
I initially went down the route of manually configuring systemd unit files for the containers using systemd.user.services and trying to enable it with a user but it was getting unwieldy and I didn’t end up getting it to work properly. I figured even if I did then managing them ongoing would be a headache if there were changes in podman moving forward.
In the end, everything I needed was available in nixpkgs, so I’ve been gone that route instead on the advice of @peterhoeg. The only thing that’s frustrating is that mongodb takes forever to recompile for each new version (needed by unifi).
Yeah I did consider not using containers and using nixpkgs , unfortunately not all the containers I use are available as pkgs. So a bit of work ahead for me, getting it working.
I also struggled with this several months ago while moving to a NixOS/podman server. I ended up having to run the containers as systemd system services but used the
User= directive to at least drop most permissions to user level. Not ideal, but it’s working well.
Happy to share configuration.
Yes please , I know you shared previously on another thread I’m on, but the paste bin expired.
Oops, updated the other link, but here is my podman configuration.