nix-daemon.conf.in: add tmpfiles file to create nix/daemon-socket directory #6285

flokli · 2022-03-18T15:17:04Z

nix-daemon.socket is used to socket-activate nix-daemon.service when
/nix/var/nix/daemon-socket/socket is accessed.

In container usecases, sometimes /nix/var/nix/daemon-socket is
bind-mounted read-only into the container.

In these cases, we want to skip starting nix-daemon.socket.

However, since systemd 250, ConditionPathIsReadWrite is also not met
if /nix/var/nix/daemon-socket doesn't exist at all. This means, a
regular NixOS system will skip starting nix-daemon.socket:

[ 237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket).

To prevent this from happening, ship a tmpfiles file that'll cause the
directory to be created if it doesn't exist already.

In the case of NixOS, we can just add Nix to systemd.tmpfiles.packages
and have these files picked up automatically.

…ectory nix-daemon.socket is used to socket-activate nix-daemon.service when /nix/var/nix/daemon-socket/socket is accessed. In container usecases, sometimes /nix/var/nix/daemon-socket is bind-mounted read-only into the container. In these cases, we want to skip starting nix-daemon.socket. However, since systemd 250, `ConditionPathIsReadWrite` is also not met if /nix/var/nix/daemon-socket doesn't exist at all. This means, a regular NixOS system will skip starting nix-daemon.socket: > [ 237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket). To prevent this from happening, ship a tmpfiles file that'll cause the directory to be created if it doesn't exist already. In the case of NixOS, we can just add Nix to `systemd.tmpfiles.packages` and have these files picked up automatically.

Ericson2314 · 2022-03-18T16:09:38Z

@flokli this line of thinking makes sense to me, but I am never up to date on the systemd details I don't take my own judgement here very seriously :).

Ericson2314 · 2022-03-18T16:14:39Z

As the the container stuff, I like how this ignores it.

It would be good to reach out the systemd people on this, but I think there ought to be something more explicit about when a service inside the container is to be provided by outside the container. E.g. perhaps the inner one should have a different .service file that says "host delegated" or similar? (I am also unclear whether running systemd inside containers is standard practice or not.)

flokli · 2022-03-18T16:46:06Z

It would be good to reach out the systemd people on this, but I think there ought to be something more explicit about when a service inside the container is to be provided by outside the container. E.g. perhaps the inner one should have a different .service file that says "host delegated" or similar? (I am also unclear whether running systemd inside containers is standard practice or not.)

nixos-container create foo; nixos-container start foo; machinectl shell foo will get you into a NixOS container, with its own systemd. That's nothing new, and what the ConditionPathIsReadWrite= check was also used for - in the case of a bind-ro directory (what nixos-container start foo does), the nix-daemon startup was skipped. This also didn't regress, so we don't need to involve systemd into that.

What regressed was that the unit file is now getting skipped on the host, because ConditionPathIsReadWrite= now will also skip it the folder doesn't exist at all (which is reasonable, it previously just worked by accident).

The tmpfiles file here will now make sure a directory is present on the host, and will still properly skip as intended inside the container (and leave the read-only bind mount alone)

Ericson2314 · 2022-03-18T17:08:54Z

@flokli If the container has its own systemd, shouldn't it also have its own unit files (or "active" unit files?)? I would want the inner systemd to one of:

Not know about the nix-daemon service at all. The socket just exists, and socket activation will stil lwork.
Know it is provided by the external systemd, so in addition to the above, there could be a limited protocol also for the inside being able to request that the outside systemd start the service, recreate the socket, etc.

flokli · 2022-03-18T18:39:18Z

1. Not know about the `nix-daemon` service at all. The socket just exists, and socket activation will stil lwork. 2. Know it is provided by the external systemd, so in addition to the above, there could be a limited protocol also for the inside being able to request that the outside systemd start the service, recreate the socket, etc.

Yes, we could introduce an option to not install the nix-daemon, and corresponding unit files, and default to using this in non-NixOS, and then possibly drop the "skip if something else provides the socket". But this is somewhat orthogonal to this PR. With systemd 250, nix-daemon on the host gets skipped (on non-NixOS too), and the tmpfile config introduced here makes sure the folder is present, so the socket unit isn't skipping anymore.

Ericson2314 · 2022-03-18T18:44:06Z

Yeah agreed it is orthogonal. I leave it to @edolstra to review this, but this seems like a good thing to do. I made it so it is possible to disable the nix daemon in NixOS, and that should probably be used instead until systemd has the extra magic.

The Nix-provided `nix-daemon.socket` file has a > ConditionPathIsReadWrite=/nix/var/nix/daemon-socket/socket line, to skip that unit if /nix/var/nix/daemon-socket/socket is read-only (which is the case in some nixos-containers with that folder bind-ro-mounted from the host). In these cases, the unit was skipped. Systemd 250 (rightfully) started to also skip in these cases: > [ 237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket). However, systemd < 250 didn't skip if /nix/var/nix/daemon-socket/socket didn't /exist at all/, and we were relying on this bug in the case for fresh NixOS systems, to have /nix/var/nix/daemon-socket/socket created initially. Move the creation of that folder to systemd-tmpfiles, by shipping an appropriate file in `${nixPackage}/lib/tmpfiles.d/nix-daemon.conf` (NixOS/nix#6285). In the meantime, set a systemd tmpfiles rule manually in NixOS. This has been tested to still work with read-only bind-mounted /nix/var/nix/daemon-socket/socket in containers, it'll keep them read-only ;-)

flokli · 2022-03-21T10:58:12Z

I made it so it is possible to disable the nix daemon in NixOS, and that should probably be used instead until systemd has the extra magic.

systemd doesn't need any extra magic for this. We just need to have something creating that folder, other than the .socket unit. For now, I moved this to a downstream systemd.tmpfile.rules in NixOS/nixpkgs#164644 to unblock the channels.

Shipping a tmpfiles file via lib/tmpfiles.d/nix-daemon.conf in Nix itself is the more canonical way to describe this, though, especially when interacting with other distros - so we should move to that once its in.

...into staging

flokli · 2022-03-22T11:41:54Z

@edolstra can you review this? Something equivalent ended up downstream in nixpkgs, but other distros packaging Nix might run into the same issues if they use our provided nix-daemon.service and bump to systemd 250.

edolstra · 2022-03-22T12:57:31Z

Should install-systemd-multi-user.sh be updated to install this file?

flokli · 2022-03-22T13:02:19Z

I wasn't aware of that script. I think so, yes. We should install it to /etc/tmpfiles.d/.

flokli · 2022-03-22T14:45:52Z

No, I read install-multi-user.sh, which executes install-systemd-multi-user.sh.

Its create_directories() function already does create the daemon folder, so we don't need to extend it.

edolstra · 2022-03-22T15:10:16Z

Shouldn't it run systemd-tmpfiles --create to create the socket directory?

Ericson2314 · 2022-03-22T15:22:36Z

@flokli I think @edolstra means, the systemd multi user installer does systemctl link "/nix/var/nix/profiles/default$SERVICE_SRC", but will that install the this new file too? Or just the service file?

flokli · 2022-03-22T16:22:52Z

install-multi-user.sh's create_directories() already creates the folder.

However, we can duplicate this in install-systemd-multi-user.sh too.

I made an attempt, assuming $out from Nix ends up in /nix/var/nix/profiles/default, and pushed it to this PR.

I lack the tooling to test this, review welcome.

scripts/install-systemd-multi-user.sh

…emon.conf, too While `create_directories()` from install-multi-user.sh seems to already create parts of the directory structure, it's marked as deprecated, and it won't hurt also copying over the tmpfiles config and have it execute once.

Ericson2314

If the tempfiles thing is good (which I am still fundamentally not qualified to answer, but I think it is) this seems like the right way to do it.

flokli · 2022-03-24T17:30:03Z

@edolstra can you make a call here?

flokli · 2022-03-24T20:55:28Z

Thanks! I assume this should be backported to the *-maintenance branches?

What's the process here? Can you do a cherry-pick, or do I open individual PRs?

edolstra · 2022-03-25T10:45:37Z

Before backporting, it would be great if somebody can test the installer with --daemon.

Artturin · 2022-03-25T22:59:47Z

scripts/install-systemd-multi-user.sh

+              ln -sfn /nix/var/nix/profiles/default/$TMPFILES_SRC $TMPFILES_DEST
+
+        _sudo "to run systemd-tmpfiles once to pick that path up" \
+             sytemd-tmpfiles create --prefix=/nix/var/nix


typo
fixed in #6319

flokli mentioned this pull request Mar 18, 2022

nix-daemon.socket.in: fix condition unit properties #6282

Closed

vcunat added a commit to NixOS/nixpkgs that referenced this pull request Mar 21, 2022

Merge #164644: nixos/nix-daemon: workaround NixOS/nix#6285

6facca0

...into staging

flokli mentioned this pull request Mar 22, 2022

nixos/nix-daemon: workaround NixOS/nix#6285 NixOS/nixpkgs#164644

Merged

13 tasks

Ericson2314 reviewed Mar 23, 2022

View reviewed changes

scripts/install-systemd-multi-user.sh Outdated Show resolved Hide resolved

flokli force-pushed the add-tmpfile branch from efb20f5 to 67af5f7 Compare March 23, 2022 12:51

Ericson2314 approved these changes Mar 24, 2022

View reviewed changes

edolstra merged commit c9148f4 into NixOS:master Mar 24, 2022

flokli deleted the add-tmpfile branch March 24, 2022 20:46

Artturin reviewed Mar 25, 2022

View reviewed changes

flokli mentioned this pull request Mar 28, 2022

scripts/install-systemd-multi-user.sh: fix typo #6319

Merged

Artturin mentioned this pull request Mar 30, 2022

Test macos/linux installer script for each push #4549

Merged

Uh oh!

nix-daemon.conf.in: add tmpfiles file to create nix/daemon-socket directory #6285

nix-daemon.conf.in: add tmpfiles file to create nix/daemon-socket directory #6285

Uh oh!

Conversation

flokli commented Mar 18, 2022

Uh oh!

Ericson2314 commented Mar 18, 2022

Uh oh!

Ericson2314 commented Mar 18, 2022

Uh oh!

flokli commented Mar 18, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ericson2314 commented Mar 18, 2022

Uh oh!

flokli commented Mar 18, 2022 via email

Uh oh!

Ericson2314 commented Mar 18, 2022

Uh oh!

flokli commented Mar 21, 2022

Uh oh!

flokli commented Mar 22, 2022

Uh oh!

edolstra commented Mar 22, 2022

Uh oh!

flokli commented Mar 22, 2022

Uh oh!

flokli commented Mar 22, 2022

Uh oh!

edolstra commented Mar 22, 2022

Uh oh!

Ericson2314 commented Mar 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

flokli commented Mar 22, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Ericson2314 left a comment

Choose a reason for hiding this comment

Uh oh!

flokli commented Mar 24, 2022

Uh oh!

flokli commented Mar 24, 2022

Uh oh!

edolstra commented Mar 25, 2022

Uh oh!

Artturin Mar 25, 2022

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

flokli commented Mar 18, 2022 •

edited

Loading

Ericson2314 commented Mar 22, 2022 •

edited

Loading

flokli commented Mar 22, 2022 •

edited

Loading