update

2026-09-11 14:43:43 -05:00
parent 3605fc36ef
commit 9721112d67
3 changed files with 51 additions and 44 deletions
@@ -76,14 +76,6 @@ let
      miscProperties = self._sshpiperRegister routingInfo;
    };

-  kvmTrait = {
-    containerConfig =
-      { pkgs, ... }:
-      {
-        users.users.runner.extraGroups = [ "kvm" ];
-        environment.systemPackages = [ pkgs.qemu_kvm ];
-      };
-  };
 in
 {
  ssh-admin = mkSsh {
@@ -126,32 +118,27 @@ in
  ssh-generic = mkSsh {
    name = "ssh-generic";
    net.access = [ { to = "@internet"; } ];
+    # /dev/kvm keeps its host ownership, so the kvm gid must not be shifted.
+    isolation.privateUsers = "identity";
    resources = {
      fs."/home/runner/data" = {
        hostPath = "${data}/ssh/generic";
        isReadOnly = false;
      };
+      devices = [ "/dev/kvm" ];
      mem = "16G";
      cpu = 65;
    };
-    traits = [ kvmTrait ];
-    isolation.allowedDevices = [
+    packages = with pkgs; [ qemu_kvm ];
+    traits = [
      {
-        node = "/dev/kvm";
-        modifier = "rw";
+        containerConfig =
+          { config, ... }:
+          {
+            users.groups.kvm.gid = config.ids.gids.kvm;
+            users.users.runner.extraGroups = [ "kvm" ];
+          };
      }
-      {
-        node = "/dev/vhost-net";
-        modifier = "rw";
-      }
-      {
-        node = "/dev/net/tun";
-        modifier = "rwm";
-      }
-    ];
-    isolation.additionalCapabilities = [
-      "CAP_NET_ADMIN"
-      "CAP_MKNOD"
    ];
    routingInfo = [
      {