fix bug

dsl.nix

@@ -222,11 +222,13 @@ rec {
     : Bind mounts, keyed by mount point.
 
     `resources.devices`
-    : Host device nodes to expose, as paths. Bound into the container's `/dev`
+    : Host device nodes to expose, as paths, added to the unit's
-      and added to the unit's `DeviceAllow=` - the bind alone leaves the cgroup
+      `DeviceAllow=`. nspawn populates a handful of privileged devices
-      denying `open()`. Nodes keep their host ownership, so a consumer inside
+      (`/dev/kvm`, `/dev/net/tun`, ...) into the container's own `/dev` once
-      needs `isolation.privateUsers = "identity"` for the owning gid to mean
+      the cgroup allows it, and silently skips ones the host doesn't have -
-      anything.
+      no `resources.fs` bind mount needed. Nodes keep their host ownership,
+      so a consumer inside needs `isolation.privateUsers = "identity"` for
+      the owning gid to mean anything.
 
     `isolation.nixDaemon`
     : Whether the Nix daemon and CLI are available inside the container.
@@ -293,7 +295,6 @@ rec {
         + lib.optionalString useIdmap ":idmap"
       ) allBindMounts;
       bindMountHostPaths = map (bm: bm.hostPath) (lib.attrValues allBindMounts);
-      deviceFlags = map (d: "--bind=${d}") devices;
       inherit (deriveIdentity ifPrefix.nspawn name)
         iface
         mac
@@ -380,7 +381,7 @@ rec {
       nixosContainer = {
         inherit autoStart privateUsers;
         bindMounts = { };
-        extraFlags = bindMountExtraFlags ++ deviceFlags;
+        extraFlags = bindMountExtraFlags;
         privateNetwork = true;
         extraVeths = linkVeths;
         config =

tests/server-n0/integration.py

@@ -333,6 +333,11 @@ with subtest("(functional): published ports follow the container's lifetime"):
 with subtest("(functional): declared devices are usable in-container"):
     for name, devices in DEVICES.items():
         for dev in devices:
+            if server.execute(f"test -e {dev}")[0] != 0:
+                # host lacks the device (e.g. /dev/kvm without nested
+                # virtualization, as in this test's own VM) - nspawn skips
+                # populating it in-container, so there's nothing to check.
+                continue
             # opened, not stat'd: without DeviceAllow= the node is still visible
             server.succeed(ct_cmd(name, f"exec 3<> {dev}"))