# NixOS container limitations
**URL:** https://discourse.nixos.org/t/nixos-container-limitations/1835
**Category:** Help
**Created:** [January 6, 2019, 7:19pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835 "2019-01-06T19:19:40Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@asbachb](https://discourse.nixos.org/u/asbachb)
#### Post date: [January 6, 2019, 7:19pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/1 "2019-01-06T19:19:40Z")
I saw the note in NixOS manual ([NixOS Manual](https://nixos.org/nixos/manual/index.html#ch-containers)):
> Warning: Currently, NixOS containers are not perfectly isolated from the host system. This means that a user with root access to the container can do things that affect the host. So you should not give container root access to untrusted users.
Is there any detail why there’s that limitation and if currently someone is working on that.
---
### Author:  [@aszlig](https://discourse.nixos.org/u/aszlig)
#### Post date: [January 6, 2019, 7:37pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/2 "2019-01-06T19:37:15Z")
The reason for this is that it uses `systemd-nspawn` and at the time the implementation was written there was no support for user namespaces. Nowadays however we could add support for that…
---
### Author:  [@asbachb](https://discourse.nixos.org/u/asbachb)
#### Post date: [January 6, 2019, 7:49pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/3 "2019-01-06T19:49:03Z")
> Nowadays however we could add support for that…
I guess that would be a great feature and would eliminate some use cases where docker or lxc or lxd is used today.
---
### Author:  [@aszlig](https://discourse.nixos.org/u/aszlig)
#### Post date: [January 6, 2019, 7:49pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/4 "2019-01-06T19:49:31Z")
Just found a PR that does exactly that:
[https://github.com/NixOS/nixpkgs/pull/28425](https://github.com/NixOS/nixpkgs/pull/28425)
Until it is merged (once the issues are resolved), you could add `-U` to [`extraFlags`](https://nixos.org/nixos/manual/options.html#opt-containers._name_.extraFlags) on a per-case basis.
---
### Author:  [@asbachb](https://discourse.nixos.org/u/asbachb)
#### Post date: [January 6, 2019, 8:09pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/5 "2019-01-06T20:09:20Z")
Thanks for clearification!
---
### Author:  [@davidak](https://discourse.nixos.org/u/davidak)
#### Post date: [August 29, 2019, 10:12am UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/6 "2019-08-29T10:12:38Z")
A fix was merged to master 9 days before!
[https://github.com/NixOS/nixpkgs/pull/67130](https://github.com/NixOS/nixpkgs/pull/67130)
---
### Author:  [@uvNikita](https://discourse.nixos.org/u/uvNikita)
#### Post date: [August 29, 2019, 2:09pm UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/7 "2019-08-29T14:09:04Z")
It had to be reverted for now, unfortunately. The new PR is here: [[WIP] nixos/containers: add unprivileged option by uvNikita · Pull Request #67336 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/67336)
---
### Author:  [@SRGOM](https://discourse.nixos.org/u/SRGOM)
#### Post date: [October 27, 2019, 7:08am UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/8 "2019-10-27T07:08:22Z")
The consensus seems to be that containers in general do not add any extra security. Be it Docker/lxc/nspawn. Do not use containers to add security. Use VMs
---
### Author:  [@7c6f434c](https://discourse.nixos.org/u/7c6f434c)
#### Post date: [October 27, 2019, 7:40am UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/9 "2019-10-27T07:40:14Z")
> The consensus seems to be that containers in general do not add any extra security. Be it Docker/lxc/nspawn. Do not use containers to add security. Use VMs
Saying they never add any extra security is an overstatement. Of course there has been a security problem where root-in-container was not enough to exploit but root-in-VM was sufficient… But on average VMs are probably safer.
---
### Author:  [@SRGOM](https://discourse.nixos.org/u/SRGOM)
#### Post date: [October 27, 2019, 8:47am UTC](https://discourse.nixos.org/t/nixos-container-limitations/1835/10 "2019-10-27T08:47:13Z")
> Root-in-vm was sufficient.
Can you link please? You have added layer of security- breaking out of a hypervisor is a barrier too