From 9317570735b68b744004ca6ac9c2fb7b175ff131 Mon Sep 17 00:00:00 2001
From: Laurynas Alekna <laurynas@alekna.org>
Date: Fri, 7 May 2021 20:46:21 +0100
Subject: [PATCH] nixos/docker: ensure ipv4 forwarding is enabled
Fixes #118656
---
nixos/modules/virtualisation/docker.nix | 4 ++++
nixos/tests/docker.nix | 3 +++
2 files changed, 7 insertions(+)
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 3eb0de3a8559..954e33ff24a3 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -150,6 +150,10 @@ in
config = mkIf cfg.enable (mkMerge [{
boot.kernelModules = [ "bridge" "veth" ];
+ boot.kernel.sysctl = {
+ "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
+ "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
+ };
environment.systemPackages = [ cfg.package ]
++ optional cfg.enableNvidia pkgs.nvidia-docker;
users.groups.docker.gid = config.ids.gids.docker;
diff --git a/nixos/tests/docker.nix b/nixos/tests/docker.nix
index 58e33535ed31..dee7480eb4a9 100644
--- a/nixos/tests/docker.nix
+++ b/nixos/tests/docker.nix
@@ -45,5 +45,8 @@ import ./make-test-python.nix ({ pkgs, ...} : {
# Must match version 4 times to ensure client and server git commits and versions are correct
docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
+ docker.succeed("systemctl restart systemd-sysctl")
+ docker.succeed("grep 1 /proc/sys/net/ipv4/conf/all/forwarding")
+ docker.succeed("grep 1 /proc/sys/net/ipv4/conf/default/forwarding")
'';
})