nixos-containers: allow hard-coding container veth MAC address & add IPv6 SLAAC test case #462775
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
lschuermann
force-pushed
the
dev/container-mac-address
branch
from
a510b17 to
7fffb0e
Compare
nixpkgs-ci
bot
removed
the
9.needs: reviewer
lschuermann
force-pushed
the
dev/container-mac-address
branch
2 times, most recently
from
71cf738 to
d76b2c4
Compare
lschuermann
force-pushed
the
dev/container-mac-address
branch
from
d76b2c4 to
f185342
Compare
When using a NixOS container with `privateNetwork = true;` (i.e., a veth network device), it automatically gets assigned a random, locally administered unicast MAC address. While this is fine for many purposes, when attaching this container to a larger Layer 2 network where it interacts with other services, like an external DHCP server or IPv6 gateway sending out router advertisements, the MAC address of the container matters. This commit thus adds a `macAddress` option to containers. If set, this MAC address will be assigned to the container-side of the `veth` interface very early during container boot (before executing the stage 2 init script). This is crucial to ensure that no services run in the container using the prior, random MAC automatically assigned to the `veth` device. Otherweise, I've had problems using systemd units or the activation scripts to set the address early enough during container boot to use it, for example, for IPv6 SLAAC address assignment.
lschuermann
force-pushed
the
dev/container-mac-address
branch
from
f185342 to
6125858
Compare
lschuermann
force-pushed
the
dev/container-mac-address
branch
from
6125858 to
f82e24c
Compare
aleclearmind
approved these changes
Nov 19, 2025
nixpkgs-ci
bot
added
the
12.approvals: 1
Member
Author
|
Member
Author
|
Friendly ping on this PR! 😄 |
|
@lschuermann I cannot do anything more than approve it. You'll need to find someone that can merge. AFAIU posting on discourse or on the right matrix channel can help. I just gave me review, cannot help any further as of now. |
This adds a test for a NixOS container being assigned an IPv6 address and route using stateless auto-configuration, using IPv6 router advertisements sent using systemd-networkd by the host. It exercises the newly added `macAddress` option for the container, as it relies on the container self-assigning an address in the specific IPv6 prefix based on its stable MAC address. It can also serve as an example for how one may bridge a NixOS container into an existing network, and assign it stable IPv4 / IPv6 addresses via DHCP and RAs.
lschuermann
force-pushed
the
dev/container-mac-address
branch
from
f82e24c to
dee54f2
Compare
Member
Author
@aleclearmind Sorry, I didn't mean to bug you specifically. I guess I don't of a good way to get the attention of a committer on this, as this seems awfully specific for the "PRs ready for review" Discourse thread, and I can't easily tell who's responsible for this subsystem. I'll go ahead and ping @Ma27 @emilazy @r-vdp who've recently merged substantive PRs to |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds an option to set the MAC address of the container-side network interface for NixOS containers. It then uses this option in a test case that demonstrates how this can use to assign a stable IPv6 address to a container via stateless auto-configuration.
nixos-containers: allow hard-coding container veth MAC addressWhen using a NixOS container with
privateNetwork = true;(i.e., a veth network device), it automatically gets assigned a random, locally administered unicast MAC address. While this is fine for many purposes, when attaching this container to a larger Layer 2 network where it interacts with other services, like an external DHCP server or IPv6 gateway sending out router advertisements, the MAC address of the container matters.This commit thus adds a
macAddressoption to containers. If set, this MAC address will be assigned to the container-side of thevethinterface early during container boot (before stage 2 init). This is crucial to ensure that no services run in the container using the prior, random MAC automatically assigned to thevethdevice. Otherweise, I've had problems using systemd units or the activation scripts to set the address early enough during container boot to use it, for example, for IPv6 SLAAC address assignment.nixos/tests: add test for NixOS container using IPv6 SLAACFinally, the second commit adds a test for a NixOS container being assigned an IPv6 address and route using stateless auto-configuration, using IPv6 router advertisements sent using systemd-networkd by the host.
It exercises the newly added
macAddressoption for the container, as it relies on the container self-assigning an address in the specific IPv6 prefix based on its stable MAC address. It can also serve as an example for how one may bridge a NixOS container into an existing network, and assign it stable IPv4 / IPv6 addresses via DHCP and RAs.Things done
Built all
container-*tests:nix-build -A nixosTests.containers-bridge -A nixosTests.containers-custom-pkgs -A nixosTests.containers-ephemeral -A nixosTests.containers-extra_veth -A nixosTests.containers-hosts -A nixosTests.containers-imperative -A nixosTests.containers-ip -A nixosTests.containers-ipv6-slaac -A nixosTests.containers-macvlans -A nixosTests.containers-names -A nixosTests.containers-nested -A nixosTests.containers-physical_interfaces -A nixosTests.containers-portforward -A nixosTests.containers-reloadable -A nixosTests.containers-require-bind-mounts -A nixosTests.containers-restart_networking -A nixosTests.containers-tmpfs -A nixosTests.containers-unified-hierarchypassthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.Add a 👍 reaction to pull requests you find important.