update

dsl.nix

@@ -221,6 +221,13 @@ rec {
     `resources.fs`
     : Bind mounts, keyed by mount point.
 
+    `resources.devices`
+    : Host device nodes to expose, as paths. Bound into the container's `/dev`
+      and added to the unit's `DeviceAllow=` - the bind alone leaves the cgroup
+      denying `open()`. Nodes keep their host ownership, so a consumer inside
+      needs `isolation.privateUsers = "identity"` for the owning gid to mean
+      anything.
+
     `isolation.nixDaemon`
     : Whether the Nix daemon and CLI are available inside the container.
 
@@ -270,6 +277,7 @@ rec {
       cpuQuota = "${toString (cpu * 100)}%";
       memoryMax = resources.mem or "512M";
       bindMounts = resources.fs or { };
+      devices = resources.devices or [ ];
       allowsNixDaemon = isolation.nixDaemon or false;
       privateUsers = isolation.privateUsers or "pick";
 
@@ -285,6 +293,7 @@ rec {
         + lib.optionalString useIdmap ":idmap"
       ) allBindMounts;
       bindMountHostPaths = map (bm: bm.hostPath) (lib.attrValues allBindMounts);
+      deviceFlags = map (d: "--bind=${d}") devices;
       inherit (deriveIdentity ifPrefix.nspawn name)
         iface
         mac
@@ -363,6 +372,7 @@ rec {
         hostAddr
         bindMountHostPaths
         includedInTests
+        devices
         ;
       bindMounts = allBindMounts;
       kind = "nspawn";
@@ -370,7 +380,7 @@ rec {
       nixosContainer = {
         inherit autoStart privateUsers;
         bindMounts = { };
-        extraFlags = bindMountExtraFlags;
+        extraFlags = bindMountExtraFlags ++ deviceFlags;
         privateNetwork = true;
         extraVeths = linkVeths;
         config =
@@ -503,6 +513,7 @@ rec {
         ;
       inherit needsGateway;
       bindMountHostPaths = map (s: s.source) shares;
+      devices = [ ];
       kind = "vm";
       miscProperties = flattenMiscProp self miscProperties;
       microvmConfig = {
@@ -934,6 +945,7 @@ rec {
           startLimitBurst = 5;
           startLimitIntervalSec = 120;
           unitConfig.RequiresMountsFor = c.bindMountHostPaths;
+          serviceConfig.DeviceAllow = map (d: "${d} rw") c.devices;
         };
 
       # the host end of a link, for both kinds. nixos-containers only configures
@@ -1293,6 +1305,7 @@ rec {
         HOST_ADDR = ${pyDict pyStr (lib.mapAttrs (_: c: c.hostAddr) autoStartTestContainers)}
         IFACE = ${pyDict pyStr (lib.mapAttrs (_: c: c.iface) autoStartTestContainers)}
         KIND = ${pyDict pyStr (lib.mapAttrs (_: c: c.kind) autoStartTestContainers)}
+        DEVICES = ${pyDict pyList (lib.mapAttrs (_: c: c.devices) autoStartTestContainers)}
         # only nspawn guests can be entered with nsenter; a vm has no host-side
         # netns, so every probe that runs *inside* a guest is limited to these
         enterable = [c for c in included if KIND[c] == "nspawn"]