I’m currently considering moving some of my docker containers to NixOs containers for easier maintenance. But since some of them are exposed to the world, I’m wondering if there’s any particular security consideration I should watch out for that aren’t an issue in docker.
Well, the nixos container is really a systemd-nspawn container. What kind of exposure are you talking about here?
1 Like
Selfhosted websites. Stuff like navidrome, redmine, copyparty, and a few next.js sites (Those are what I’m more scared of as it seems that there’s a security vulnerability every day :/). As well as renovate which can deal with potentially supply chain attacked packages
I understand that it’s not as secure as vms, but docker is enough, so I want the exact same “Everything is secure unless you find a flaw in the kernel or the container runtime” level of security (I trust systemd and kernel to fix those issues)
As far as i know, docker is not known for security… Just running as root is a large issue. I’m definitely not an expert, but if you trust systemd, there are a lot of security options you can add to services like navidrome etc.
If you’re really worried about kernel isolation, use a VM. Other than that, you’re probably fine 
3 Likes
NixOS containers as theyre designed are not meant to be a security boundary. I’m not 100% certain the steps needed to make them one. You’re gonna have more luck researching the security properties of nspawn, as thats what we build on.
1 Like
If you want even more security than docker, NixVirt allow you to configure libvirt domains ( virtual machines, way more secure ) in nix fashion or use a tool like GitHub - aksiksi/compose2nix: Generate a NixOS config from a Docker Compose project. · GitHub to simply convert your dockerfiles into the oci-containers option and simply continue to use docker.
You may be interested in microvm.nix:
There are also some things you can change to make NixOS containers more secure, privateUsers = "pick"; and privateNetwork = true;. But they still will have access to the Nix daemon socket.
For the record, the main thing to be concerned about with container runtimes like Docker/Podman/even systemd-nspawn is more of kernel-level escape bugs and not exposing too much to the container. Rootless containers help some here, but AFAIK NixOS containers can’t do that.
3 Likes