Override NixOS module to run service in dedicated namespace

sh4k0 · February 9, 2026, 12:18pm

I would like to run arbitrary services (in this case, qBittorrent) in a dedicated network namespace. To leverage the healthy default provided by NixOS modules, I would also like to make use of the qBittorrent NixOS module provided in nixpkgs: nixpkgs/nixos/modules/services/torrent/qbittorrent.nix at 23d72dabcb3b12469f57b37170fcbc1789bd7457 · NixOS/nixpkgs · GitHub

As from my understanding, it is possible to confine systemd services to an arbitrary network namespace simply by setting the NetworkNamespacePath attribute in ServiceConfig. Unfortunately, the qBittorrent NixOS module does not provide an option to set it, and ships a systemd service with healthy defaults:

github.com/NixOS/nixpkgs

nixos/modules/services/torrent/qbittorrent.nix

23d72dabc


      
          serviceConfig = {
            Type = "simple";
            User = cfg.user;
            Group = cfg.group;
            ExecStart = utils.escapeSystemdExecArgs (
              [
                (getExe cfg.package)
                "--profile=${cfg.profileDir}"
              ]
              ++ optionals (cfg.webuiPort != null) [ "--webui-port=${toString cfg.webuiPort}" ]
              ++ optionals (cfg.torrentingPort != null) [ "--torrenting-port=${toString cfg.torrentingPort}" ]
              ++ cfg.extraArgs
            );
            TimeoutStopSec = 1800;
          
            # https://github.com/qbittorrent/qBittorrent/pull/6806#discussion_r121478661
            PrivateTmp = false;
          
            PrivateNetwork = false;
            RemoveIPC = true;

This file has been truncated. show original

Is there a way to apply an “overlay” to the original NixOS module, in order to modify the systemd services it includes to run in an arbitrary network namespace?

waffle8946 · February 9, 2026, 12:50pm

systemd.services.qbittorrent.serviceConfig.NetworkNamespacePath = "...";