frcc experiments (#1)

Co-authored-by: Autumn Liu <al63244@my.utexas.edu>
Co-authored-by: Floweynt <50057682+Floweynt@users.noreply.github.com>
Reviewed-on: #1
Co-authored-by: autumn <aut.tea7@gmail.com>

containers/server-n0/ssh.nix

@@ -61,16 +61,29 @@ let
       net ? { },
       resources ? { },
       traits ? [ ],
+      isolation ? { },
     }:
     mkContainer {
       inherit name;
       inherit net resources;
       svc.autoStart = true;
-      isolation.nixDaemon = nixDaemon;
+      isolation = {
+        inherit nixDaemon;
+      }
+      // isolation;
       traits = [ sshTrait ] ++ traits;
       packages = with pkgs; [ tmux ] ++ packages;
       miscProperties = self._sshpiperRegister routingInfo;
     };
+
+  kvmTrait = {
+    containerConfig =
+      { pkgs, ... }:
+      {
+        users.users.runner.extraGroups = [ "kvm" ];
+        environment.systemPackages = [ pkgs.qemu_kvm ];
+      };
+  };
 in
 {
   ssh-admin = mkSsh {
@@ -121,6 +134,25 @@ in
       mem = "16G";
       cpu = 65;
     };
+    traits = [ kvmTrait ];
+    isolation.allowedDevices = [
+      {
+        node = "/dev/kvm";
+        modifier = "rw";
+      }
+      {
+        node = "/dev/vhost-net";
+        modifier = "rw";
+      }
+      {
+        node = "/dev/net/tun";
+        modifier = "rwm";
+      }
+    ];
+    isolation.additionalCapabilities = [
+      "CAP_NET_ADMIN"
+      "CAP_MKNOD"
+    ];
     routingInfo = [
       {
         username = "autumn";