Change:
Containers spawned by nixos-container fall back to old cgroup hierarchy, which does not support proper delegation of resource limits to processes running in that container. Steps to reproduce the behavior: will show Tainted: cgroupsv1 will show a mount This will be allowed to consume all memory of the machine until it runs out, the 4G cap is not enforced I expected the container to use a unified cgroup hierarchy, same as on the host, with full delegation and control over its subtree.
This is the log from , using declarative containers: I thought it could be relevant, but after googling around, these seem like errors that happen after systemd decided to use cgroupv1. I'm not sure how to debug its decision to use legacy cgroups inthe first place.
According to , systemd-nspawn tries to detect the systemd-version used in the container by locating a shared library with the version of systemd in the name. you can see the paths searched. The lookup fails on nix-based containers and systemd-nspawn falls back to legacy cgroups. You can test this yourself by symlinking from your Nix store to in your container. After restarting, reports .
Thanks, that was it. I also noticed this in the code But the following is not enough to enable it: Running didn't help either, so I'm not sure how you're supposed to use it. Should we add a symlink as a workaround? I think it'd make sense to fix it for all users of nixos-containers by defining it somewhere around here:
According to , This is not what we want. The environment variable is a good find though. I'm not sure why did not work for you, but adding to the following line worked. Can you reproduce this fix? PS: A PR fixing this issue would ideally include a regression test (almost like ) checking if the container runs with .
That worked! I can see with that the container is no longer tainted. Working on a PR now

Discussion:
githubId = 1276854; name = "Florian Peter"; }; <ins> farnoy = { email = "jakub@okonski.org"; github = "farnoy"; githubId = 345808; name = "Jakub Okoński"; }; </ins> fbeffa = { email = "beffa@fbengineering.ch"; github = "fedeinthemix";

fi ''} <ins> export SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1 </ins> # Run systemd-nspawn without startup notification (we'll # wait for the container systemd to signal readiness) # Kill signal handling means systemd-nspawn will pass a system-halt signal

containers-reloadable = handleTest ./containers-reloadable.nix {}; containers-restart_networking = handleTest ./containers-restart_networking.nix {}; containers-tmpfs = handleTest ./containers-tmpfs.nix {}; <ins> containers-unified-hierarchy = handleTest ./containers-unified-hierarchy.nix {}; </ins> convos = handleTest ./convos.nix {}; corerad = handleTest ./corerad.nix {}; coturn = handleTest ./coturn.nix {};

<ins> import ./make-test-python.nix ({ pkgs, lib, ... }: { name = "containers-unified-hierarchy"; meta = { maintainers = with lib.maintainers; [ farnoy ]; }; nodes.machine = { ... }: { containers = { test-container = { autoStart = true; config = { }; }; }; }; testScript = '' machine.wait_for_unit("default.target") machine.succeed("echo 'stat -fc %T /sys/fs/cgroup/ | grep cgroup2fs' | nixos-container root-login test-container") ''; }) </ins>

containers-ip containers-tmpfs containers-ephemeral <ins> containers-unified-hierarchy </ins> ; }; };