Note that useNixStoreImage exists now

I'm disappointed that it doesn't work.  :(

When it's fixed, it can replace this module.

diff --git a/README b/README
index f0be89d6e4d4d9d655b5fdab285f20eb7f48ccde..c0aea3118c77365ecab039b34c239d44abe64e51 100644 (file)
--- a/README
+++ b/README
@@ -2,3 +2,6 @@ Isolate NixOS QEMU VMs from each other and from the host by using a
 squashfs for the VM's /nix/store that contains only the VM's dependencies
 (like the installer has) rather than a virtio mount of the host's entire
 /nix/store.
 squashfs for the VM's /nix/store that contains only the VM's dependencies
 (like the installer has) rather than a virtio mount of the host's entire
 /nix/store.

+
+**Update:** `virtualisation.useNixStoreImage` exists now!  But it doesn't
+work!  :(  See the note in `checks/mount-grep.nix`

diff --git a/checks/mount-grep.nix b/checks/mount-grep.nix
index 5be45d722a839cbdad1e74196e41fa3bf8ceb317..99084eaf3b8f461b9c934287a72db00e14f26fa6 100644 (file)
--- a/checks/mount-grep.nix
+++ b/checks/mount-grep.nix
@@ -1,20 +1,31 @@
-{ pkgs, ... }: {
+{ lib, pkgs, ... }: {

   name = "qemu-private-store-mount-grep";
 
   nodes = {
     shared = _: { };
     private = _: { imports = [ ../modules/qemu-vm-isolation.nix ]; };
   name = "qemu-private-store-mount-grep";
 
   nodes = {
     shared = _: { };
     private = _: { imports = [ ../modules/qemu-vm-isolation.nix ]; };

+    useNixStoreImage = {
+      virtualisation = {
+        sharedDirectories = lib.mkForce { };
+        useNixStoreImage = true;
+      };
+    };

   };
 
   testScript = ''
     start_all()
     shared.wait_for_unit("multi-user.target")
     private.wait_for_unit("multi-user.target")
   };
 
   testScript = ''
     start_all()
     shared.wait_for_unit("multi-user.target")
     private.wait_for_unit("multi-user.target")

+    useNixStoreImage.wait_for_unit("multi-user.target")

 
     shared.succeed("[[ $(mount | grep -c virt) -gt 0 ]]")
     private.succeed("[[ $(mount | grep -c virt) -eq 0 ]]")
 
     shared.succeed("[[ $(mount | grep -c virt) -gt 0 ]]")
     private.succeed("[[ $(mount | grep -c virt) -eq 0 ]]")

+    useNixStoreImage.succeed("[[ $(mount | grep -c virt) -eq 0 ]]")

 
     shared.succeed("[[ -e ${pkgs.pv} ]]")
     private.fail("[[ -e ${pkgs.pv} ]]")
 
     shared.succeed("[[ -e ${pkgs.pv} ]]")
     private.fail("[[ -e ${pkgs.pv} ]]")

+
+    # useNixStoreImage isn't ready until this works:
+    # useNixStoreImage.fail("[[ -e ${pkgs.pv} ]]")

   '';
 }
   '';
 }