Implement NixOS container networking with networkd

[arianvp]

We are in the process to moving to networkd based networking for 20.03.

nixos-container module neither uses scripted networking nor systemd-based networking,
but its own set of scripts. We should move nixos-container to use networkd for setting up the network.

Currently if you enable networking.useNetworkd = true; , nixos-container will stop working because the default rules that networkd ships sets up DHCP on the ve-* and vz-* interfaces as it assumes these are created by systemd-nspawn and that's the documented behaviour for the tool (See https://github.com/NixOS/systemd/tree/nixos-v243/network)

the matches look like this:

# 80-container-ve.network
[Match]
Name=ve-*
Driver=veth
[Network]
# Default to using a /24 prefix, giving up to 253 addresses per virtual network.
Address=0.0.0.0/24
LinkLocalAddressing=yes
DHCPServer=yes
IPMasquerade=yes
LLDP=yes
EmitLLDP=customer-bridge

# 80-container-vz.network
[Match]
Name=vz-*
Driver=bridge
[Network]
# Default to using a /28 prefix, giving up to 13 addresses per container.
Address=0.0.0.0/28
LinkLocalAddressing=yes
DHCPServer=yes
IPMasquerade=yes
LLDP=yes
EmitLLDP=customer-bridge

We should come up with our own systemd.network files that implement all the features that nixos-container supports.

However, I would also like to have vanilla systemd-nspawn work as documented in the systemd manpages.

This means that the .network rules that nixos-container should generate should be:

1. more specific: e.g. Match=ve-mycontainer vs Match=ve-*
2. have a lower number than 80- such that they're executed before the ones shipped with systemd

Implementing this is a blocker for switching to useNetworkd=true by default.

Maintainer information:

# a list of nixpkgs attributes affected by the problem
attribute:
# a list of nixos modules affected by the problem
module:

cc @fpletz @flokli @andir @Mic92

[arianvp]

I'm not sure why this was labelled kind: bug. could someone remove that for me? :)

[ck3d]

If host and container uses networkd the network is configured correctly by networkd.
The the test nixos/tests/systemd-machinectl.nix tests that configuration.
I think there is no need for a special set of configuration files.

[arianvp]

I'm pretty sure that we need to take a more careful look especially since networkd takes ownership of the veth-pairs nixos-container makes by default. Weird things might happen that we currently don't test for. E.g. DHCP will be on by default and networkd is handing out IPs on the container interface, eventhough nixos-container sets useDHCP = false;

[arianvp]

At best, all the code that calls ip link up and ip link down can just go once we've switched to networkd

[Ma27]

@elseym discussed some ideas in the past and started an initial attempt at NixCon. We'll probably be able to create a proof of concept on the networkd-sprint next weekend :)

[bqv]

Is there a workaround for this?