Change:
Describe the bug So, I seem to be seeing an issue that more or less exactly matches the description of on nixos today. I have a number of containers hosting websites, and none of them are shut down gracefully when I shut the host down. I must wait for the 90-second systemd timeout, and see them forcibly shut down. The mysql database in one container doesn't seem to enjoy this. If I shut down a container manually, via , it works flawlessly. But somehow this is not triggered when I shut down the host. To Reproduce There are details, but the meat and potatoes is that I have some containers defined in my , and then try to reboot my host with . Additional context My containers reside on ZFS filesystems? That's all I can think of. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata
I have the same issue. Note that I am very new to NixOS, so I might have missed something This is a workaround that works for me:

Discussion:
'' #! ${pkgs.runtimeShell} -e <ins> # Exit early if we're asked to shut down. trap "exit 0" SIGRTMIN+3 </ins> # Initialise the container side of the veth pair. if [ -n "$HOST_ADDRESS" ]   || [ -n "$HOST_ADDRESS6" ]  || [ -n "$LOCAL_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS6" ] ||

${concatStringsSep "n" (mapAttrsToList renderExtraVeth cfg.extraVeths)} <del> # Start the regular stage 1 script. exec "$1" </del> <ins> # Start the regular stage 2 script. # We source instead of exec to not lose an early stop signal, which is # also the only _reliable_ shutdown signal we have since early stop # does not execute ExecStop* commands. set +e . "$1" </ins> '' );

''} # Run systemd-nspawn without startup notification (we'll <del> # wait for the container systemd to signal readiness). </del> <ins> # wait for the container systemd to signal readiness) # Kill signal handling means systemd-nspawn will pass a system-halt signal # to the container systemd when it receives SIGTERM for container shutdown; # containerInit and stage2 have to handle this as well. </ins> exec ${config.systemd.package}/bin/systemd-nspawn  --keep-unit  -M "$INSTANCE" -D "$root" $extraFlags  $EXTRA_NSPAWN_FLAGS  --notify-ready=yes  <ins> --kill-signal=SIGRTMIN+3  </ins> --bind-ro=/nix/store  --bind-ro=/nix/var/nix/db  --bind-ro=/nix/var/nix/daemon-socket 

Slice = "machine.slice"; Delegate = true; <del> # Hack: we don't want to kill systemd-nspawn, since we call # "machinectl poweroff" in preStop to shut down the # container cleanly. But systemd requires sending a signal # (at least if we want remaining processes to be killed # after the timeout). So send an ignored signal. </del> <ins> # We rely on systemd-nspawn turning a SIGTERM to itself into a shutdown # signal (SIGRTMIN+3) for the inner container. </ins> KillMode = "mixed"; <del> KillSignal = "WINCH"; </del> <ins> KillSignal = "TERM"; </ins> DevicePolicy = "closed"; DeviceAllow = map (d: "${d.node} ${d.modifier}") cfg.allowedDevices;

postStart = postStartScript dummyConfig; <del> preStop = "machinectl poweroff $INSTANCE"; </del> restartIfChanged = false; serviceConfig = serviceDirectives dummyConfig;

machine.succeed(f"nixos-container stop {id1}") machine.succeed(f"nixos-container start {id1}") <ins> # clear serial backlog for next tests machine.succeed("logger eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d") machine.wait_for_console_text( "eat console backlog 3ea46eb2-7f82-4f70-b810-3f00e3dd4c4d" ) with subtest("Stop a container early"): machine.succeed(f"nixos-container stop {id1}") machine.succeed(f"nixos-container start {id1} &") machine.wait_for_console_text("Stage 2") machine.succeed(f"nixos-container stop {id1}") machine.wait_for_console_text(f"Container {id1} exited successfully") machine.succeed(f"nixos-container start {id1}") with subtest("Stop a container without machined (regression test for #109695)"): machine.systemctl("stop systemd-machined") machine.succeed(f"nixos-container stop {id1}") machine.wait_for_console_text(f"Container {id1} has been shut down") machine.succeed(f"nixos-container start {id1}") </ins> with subtest("tmpfiles are present"): machine.log("creating container tmpfiles") machine.succeed(