22 lines
646 B
Nix
22 lines
646 B
Nix
{
|
|
# rootless only: no root daemon and no root-equivalent docker group
|
|
virtualisation.docker.rootless = {
|
|
enable = true;
|
|
setSocketVariable = true;
|
|
daemon.settings = {
|
|
dns = [
|
|
"1.1.1.1"
|
|
"8.8.8.8"
|
|
];
|
|
log-driver = "local";
|
|
registry-mirrors = [ "https://mirror.gcr.io" ];
|
|
};
|
|
};
|
|
|
|
# k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
|
|
systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
|
|
|
|
# let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
|
|
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
|
|
}
|