asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

docker -> podman

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 10:38:35 +02:00
commit 23ca86c7d5
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 49 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

50
modules/security.nix
View file

@ -14,19 +14,30 @@
# Linux Audit Framework
security.auditd.enable = true;
security.audit.enable = true;
security.audit.rules = [
"-a exit,always -F arch=b64 -S execve"
"-w /etc/passwd -p wa -k passwd_changes"
"-w /etc/shadow -p wa -k shadow_changes"
];
# Kernel Hardening
security.protectKernelImage = true;
# Sysctl hardening
boot.kernel.sysctl = {
"kernel.kptr_restrict" = 1;
"kernel.dmesg_restrict" = 1;
"kernel.kptr_restrict" = 2;
"kernel.sysrq" = 0;
"kernel.unprivileged_userns_clone" = 1; # Required for rootless Podman
"kernel.yama.ptrace_scope" = 1;
"kernel.unprivileged_bpf_disabled" = 1;
"net.ipv4.conf.all.log_martians" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.default.log_martians" = 1;
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
};
@ -37,4 +48,41 @@
dbus.enable = true;
implicitPolicyTarget = "block";
};
security.pam.loginLimits = [
{ domain = "*"; item = "core"; type = "-"; value = "0"; }
];
systemd.services.systemd-udevd.serviceConfig = {
PrivateNetwork = true;
RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
};
# Podman socket for all users
systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true; # System-wide /var/run/docker.sock symlink
defaultNetwork.settings.dns_enabled = true;
};
oci-containers.backend = "podman";
};
virtualisation.docker.enable = lib.mkForce false;
# Set DOCKER_HOST to point to the user rootless socket automatically
environment.extraInit = ''
if [ -z "$DOCKER_HOST" -a -S "/run/user/$(id -u)/podman/podman.sock" ]; then
export DOCKER_HOST="unix:///run/user/$(id -u)/podman/podman.sock"
fi
'';
environment.systemPackages = with pkgs; [
lynis
audit
tcpdump
];
}