Change:
Describe the bug Podman's packaging isn't following the spirit of Nix, as far as I can tell. It seems to pull in a bunch of run-time executable dependencies via PATH resolution instead of build-time resolution. To Reproduce nix-shell -p podman --run podman based on the module, it looks like several run-time executables are referenced through PATH resolution instead of build-time pinning: Expected behavior Nix's build products should have stable references to their run-time dependencies whenever possible. Given podman's rootless container support, I doubly expected to give a usable podman.
Maintainer cc
Hmm im not sure how I feel about this. Podman is agnostic of container runtime for example. So it not having a path to either runc or crun is a feature. But conmon should probably be referenced by nix path yes. And utillinux too. We could perhaps default to runc runtime and let people opt to crun?
check out this PR from
I see the issue here. We could also discuss if it generally would make sense to have a build-time config feature for podman. Having strong defaults without configuration could be achieved that way for NixOS, too.
Is this expected to work without registry and policy files in ?
I would like it to, and it sounds like there is upstream work to make that possible.
This already works with rootless podman if you have the appropriate subuib/subgids set up. If is merged will work out of the box on NixOS.

Discussion:
inherit (lib) mkOption types; <ins> podmanPackage = (pkgs.podman.override { inherit (cfg) extraPackages; }); </ins> # Provides a fake "docker" binary mapping to podman <del> dockerCompat = pkgs.runCommandNoCC "${pkgs.podman.pname}-docker-compat-${pkgs.podman.version}" { </del> <ins> dockerCompat = pkgs.runCommandNoCC "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" { </ins> outputs = [ "out" "bin" "man" ]; <del> inherit (pkgs.podman) meta; </del> <ins> inherit (podmanPackage) meta; </ins> } '' mkdir $out mkdir -p $bin/bin <del> ln -s ${pkgs.podman.bin}/bin/podman $bin/bin/docker </del> <ins> ln -s ${podmanPackage.bin}/bin/podman $bin/bin/docker </ins> mkdir -p $man/share/man/man1 <del> for f in ${pkgs.podman.man}/share/man/man1/*; do </del> <ins> for f in ${podmanPackage.man}/share/man/man1/*; do </ins> basename=$(basename $f | sed s/podman/docker/g) ln -s $f $man/share/man/man1/$basename done

''; }; <ins> extraPackages = mkOption { type = with types; listOf package; default = [ ]; example = lib.literalExample '' [ pkgs.gvisor ] ''; description = '' Extra packages to be installed in the Podman wrapper. ''; }; </ins> libpod = mkOption { default = {}; description = "Libpod configuration";

config = lib.mkIf cfg.enable { <del> environment.systemPackages = [ pkgs.podman # Docker compat pkgs.runc # Default container runtime pkgs.crun # Default container runtime (cgroups v2) pkgs.conmon # Container runtime monitor pkgs.slirp4netns # User-mode networking for unprivileged namespaces pkgs.fuse-overlayfs # CoW for images, much faster than default vfs pkgs.utillinux # nsenter pkgs.iptables ] ++ lib.optional cfg.dockerCompat dockerCompat; </del> <ins> environment.systemPackages = [ podmanPackage ] ++ lib.optional cfg.dockerCompat dockerCompat; </ins> environment.etc."containers/libpod.conf".text = '' cni_plugin_dir = ["${pkgs.cni-plugins}/bin/"] <del> cni_config_dir = "/etc/cni/net.d/" </del> '' + cfg.libpod.extraConfig; <del> environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman.src}/cni/87-podman-bridge.conflist"; </del> <ins> environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist"; </ins> # Enable common /etc/containers configuration virtualisation.containers.enable = true;

<ins> { podman-unwrapped , runCommand , makeWrapper , lib , extraPackages ? [] , podman # Docker compat , runc # Default container runtime , crun # Default container runtime (cgroups v2) , conmon # Container runtime monitor , slirp4netns # User-mode networking for unprivileged namespaces , fuse-overlayfs # CoW for images, much faster than default vfs , utillinux # nsenter , cni-plugins , iptables }: let podman = podman-unwrapped; binPath = lib.makeBinPath ([ runc crun conmon slirp4netns fuse-overlayfs utillinux iptables ] ++ extraPackages); in runCommand podman.name { inherit (podman) name pname version meta outputs; nativeBuildInputs = [ makeWrapper ]; } '' # Symlink everything but $bin from podman-unwrapped ${ lib.concatMapStringsSep "n" (o: "ln -s ${podman.${o}} ${placeholder o}") (builtins.filter (o: o != "bin") podman.outputs)} mkdir -p $bin/bin ln -s ${podman-unwrapped}/share $bin/share makeWrapper ${podman-unwrapped}/bin/podman $bin/bin/podman  --prefix PATH : ${binPath} '' </ins>

podiff = callPackage ../tools/text/podiff { }; <del> podman = callPackage ../applications/virtualization/podman { }; </del> <ins> podman = callPackage ../applications/virtualization/podman/wrapper.nix { }; podman-unwrapped = callPackage ../applications/virtualization/podman { }; </ins> podman-compose = python3Packages.callPackage ../applications/virtualization/podman-compose {};