add nerdctl wrapper

viperML · Nov 28, 2023 · 58b769e · 58b769e
1 parent 733f338
commit 58b769e
Showing 1 changed file with 26 additions and 2 deletions.
diff --git a/modules/nixos/containerd.nix b/modules/nixos/containerd.nix
@@ -1,5 +1,15 @@
-{pkgs, ...}: {
-  environment.systemPackages = with pkgs; [
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  groupName = "containerd";
+  nerdctl = pkgs.nerdctl.override {
+    makeWrapper = pkgs.makeBinaryWrapper;
+  };
+in {
+  environment.systemPackages =[
     nerdctl
   ];
 
@@ -24,4 +34,18 @@
       requires = ["containerd.service"];
     };
   };
+
+  users.groups.${groupName} = {
+    members = config.users.groups.wheel.members;
+  };
+
+  security.wrappers = {
+    "nerdctl" = {
+      setuid = true;
+      owner = "root";
+      group = groupName;
+      permissions = "u+rx,g+rx";
+      source = lib.getExe nerdctl;
+    };
+  };
 }