!VhzbGHamdfMiGxpXyg:robins.wtf

NixOS LXC

33 Members
lxc, lxd, incus discussions related to NixOS14 Servers

Load older messages


SenderMessageTime
27 May 2024
@adam:robins.wtfadamcstephensyeah i'm using the nixos 6.6 lts13:58:22
@hexa:lossy.networkhexayeah, just if you have set a capab boundingset13:58:41
@adam:robins.wtfadamcstephens
❯ /nix/store/d5f5grj684mp1xl6h7llgr2cklpdg2z4-criu-3.19/bin/criu check
CRIU needs to have the CAP_SYS_ADMIN or the CAP_CHECKPOINT_RESTORE capability:
setcap cap_checkpoint_restore+eip /nix/store/d5f5grj684mp1xl6h7llgr2cklpdg2z4-criu-3.19/bin/criu
~ adam@blank
❯ sudo /nix/store/d5f5grj684mp1xl6h7llgr2cklpdg2z4-criu-3.19/bin/criu check
Looks good.
~ adam@blank
❯ sudo systemd-analyze security incus | rg sys_admin
✗ CapabilityBoundingSet=~CAP_SYS_ADMIN                        Service has administrator privileges 

14:01:31
@hexa:lossy.networkhexaand the "or" is not misleading?14:13:23
@adam:robins.wtfadamcstephensincus runs as root with admin capability. is that not sufficient?14:23:59
@hexa:lossy.networkhexathe messages implies that14:31:50
@hexa:lossy.networkhexajust want to rule out we're missing anything obvious due to that sentence being dogshit14:32:10
@adam:robins.wtfadamcstephens yeah, agreed. i figured the sudo exec showed it should work 15:27:18
@adam:robins.wtfadamcstephensnow you have me doubting it :)15:27:27
@hexa:lossy.networkhexasudo is unconstrained root access15:29:08
@hexa:lossy.networkhexa if your incus systemd units don't have hardening (CapabilityBoundingSet in this case), then all is well 15:29:41
@adam:robins.wtfadamcstephensthey don't15:38:27
28 May 2024
@hexa:lossy.networkhexa
# incus launch images:nixos/unstable nixos -c security.secureboot=false
Launching nixos
Error: Failed instance creation: Failed creating instance record: Unknown configuration key: security.secureboot
11:54:50
@hexa:lossy.networkhexaon 6.0.0 🤔11:54:57
@hexa:lossy.networkhexa missing --vm flag in wiki example, fixed 11:57:20
@adam:robins.wtfadamcstephensthanks for fixing13:06:45
@hexa:lossy.networkhexaonline migration with zfs is working fine14:11:58
@hexa:lossy.networkhexaloving the remote cli acccess to the cluster14:12:09
@hexa:lossy.networkhexaa bit annoying that it is stuck with a single node14:14:54
@hexa:lossy.networkhexaimage.png
Download image.png
14:25:02
@hexa:lossy.networkhexathe capitalization is off14:25:12
@adam:robins.wtfadamcstephenshmm, i'm not sure where that comes from14:39:18
@adam:robins.wtfadamcstephens
In reply to @hexa:lossy.network
a bit annoying that it is stuck with a single node
what does this mean?
14:39:26
@hexa:lossy.networkhexa so you can set up your local CLI to use remotes14:41:38
@hexa:lossy.networkhexa * so, you can set up your local CLI to control remote clusters over the HTTP API14:42:51
@hexa:lossy.networkhexa incus config trust add foo prints a token 14:43:06
@hexa:lossy.networkhexa and you can configure that with incus remote add somecluster <token> 14:43:19
@hexa:lossy.networkhexa and then incus remote switch somecluster 14:43:26
@hexa:lossy.networkhexa but this isn't somecluster, it is somehostofsomecluster only 14:43:40
@adam:robins.wtfadamcstephensahh, so the remote isn't cluster aware14:43:56

Show newer messages


Back to Room ListRoom Version: 10