services.podman.enable
Whether to enable Podman, a daemonless container engine.
Type: boolean
Default:
false
Example:
true
Declared by:
services.podman.enableTypeChecks
Whether to enable type checks for podman quadlets.
Type: boolean
Default:
false
Example:
true
Declared by:
services.podman.package
The podman package to use.
Type: package
Default:
pkgs.podman
Declared by:
services.podman.autoUpdate.enable
Automatically update the podman images.
Type: boolean
Default:
true
Declared by:
services.podman.autoUpdate.onCalendar
The systemd OnCalendar expression for the update. See
systemd.time(7) for a description of the format.
Type: string
Default:
"Sun *-*-* 00:00"
Declared by:
services.podman.builds
Defines Podman build quadlet configurations.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
services.podman.builds.<name>.authFile
Path of the authentication file.
Type: null or absolute path
Default:
null
Declared by:
services.podman.builds.<name>.autoStart
Whether to start the build on boot. Requires user lingering.
Type: boolean
Default:
true
Declared by:
services.podman.builds.<name>.description
The description of the build.
Type: null or string
Default:
"Service for build \${name}"
Example:
"My Build"
Declared by:
services.podman.builds.<name>.environment
Environment variables to set in the build.
Type: attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))
Default:
{ }
Example:
{
VAR1 = "0:100";
VAR2 = true;
VAR3 = 5;
}
Declared by:
services.podman.builds.<name>.extraConfig
INI sections and values to populate the Build Quadlet.
Type: attribute set of attribute set of ((attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))) or list of (null or boolean or signed integer or string or absolute path) or null or boolean or signed integer or string or absolute path)
Default:
{ }
Example:
{
Build = {
Arch = "aarch64";
};
Service = {
TimeoutStartSec = 15;
};
}
Declared by:
services.podman.builds.<name>.extraPodmanArgs
Extra arguments to pass to the podman build command.
Type: list of string
Default:
[ ]
Example:
[
"--retries 5"
]
Declared by:
services.podman.builds.<name>.file
Path to a Containerfile which contains instructions to build the image.
Type: string
Example:
`"xdg.configFile."containerfiles/my-img/Containerfile"`
or
`"https://github.com/.../my-img/Containerfile"`
Declared by:
services.podman.builds.<name>.labels
The labels to apply to the build.
Type: attribute set of string
Default:
{ }
Example:
{
app = "myapp";
some-label = "somelabel";
}
Declared by:
services.podman.builds.<name>.tags
Name associated with the build. First tag will always be “homemanager/<name>”.
Type: list of string
Default:
[ ]
Declared by:
services.podman.builds.<name>.tlsVerify
Require HTTPS and verification of certificates when contacting registries.
Type: boolean
Default:
true
Declared by:
services.podman.builds.<name>.workingDirectory
WorkingDirectory of the systemd unit file.
Type: null or absolute path
Default:
null
Declared by:
services.podman.containers
Defines Podman container quadlet configurations.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
services.podman.containers.<name>.addCapabilities
The capabilities to add to the container.
Type: list of string
Default:
[ ]
Example:
[
"CAP_DAC_OVERRIDE"
"CAP_IPC_OWNER"
]
Declared by:
services.podman.containers.<name>.autoStart
Whether to start the container on boot (requires user lingering).
Type: boolean
Default:
true
Declared by:
services.podman.containers.<name>.autoUpdate
The autoupdate policy for the container.
Type: one of <null>, “registry”, “local”
Default:
null
Example:
"registry"
Declared by:
services.podman.containers.<name>.description
The description of the container.
Type: null or string
Default:
null
Example:
"My Container"
Declared by:
services.podman.containers.<name>.devices
The devices to mount into the container
Type: list of string
Default:
[ ]
Example:
[
"/dev/<host>:/dev/<container>"
]
Declared by:
services.podman.containers.<name>.dropCapabilities
The capabilities to drop from the container.
Type: list of string
Default:
[ ]
Example:
[
"CAP_DAC_OVERRIDE"
"CAP_IPC_OWNER"
]
Declared by:
services.podman.containers.<name>.entrypoint
The container entrypoint.
Type: null or string
Default:
null
Example:
"/foo.sh"
Declared by:
services.podman.containers.<name>.environment
Environment variables to set in the container.
Type: attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))
Default:
{ }
Example:
{
VAR1 = "0:100";
VAR2 = true;
VAR3 = 5;
}
Declared by:
services.podman.containers.<name>.environmentFile
Paths to files containing container environment variables.
Type: list of string
Default:
[ ]
Example:
[
"/etc/environment"
"/etc/other-env"
]
Declared by:
services.podman.containers.<name>.exec
The command to run after the container start.
Type: null or string
Default:
null
Example:
"sleep inf"
Declared by:
services.podman.containers.<name>.extraConfig
INI sections and values to populate the Container Quadlet.
Type: attribute set of attribute set of ((attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))) or list of (null or boolean or signed integer or string or absolute path) or null or boolean or signed integer or string or absolute path)
Default:
{ }
Example:
{
Container = {
User = 1000;
};
Service = {
TimeoutStartSec = 15;
};
}
Declared by:
services.podman.containers.<name>.extraPodmanArgs
Extra arguments to pass to the podman run command.
Type: list of string
Default:
[ ]
Example:
[
"--security-opt=no-new-privileges"
"--security-opt=seccomp=unconfined"
]
Declared by:
services.podman.containers.<name>.group
The group ID inside the container.
Type: null or signed integer or string
Default:
null
Declared by:
services.podman.containers.<name>.image
The container image.
Type: string
Example:
"registry.access.redhat.com/ubi9-minimal:latest"
Declared by:
services.podman.containers.<name>.ip4
Set an IPv4 address for the container.
Type: null or string
Default:
null
Declared by:
services.podman.containers.<name>.ip6
Set an IPv6 address for the container.
Type: null or string
Default:
null
Declared by:
services.podman.containers.<name>.labels
The labels to apply to the container.
Type: attribute set of string
Default:
{ }
Example:
{
app = "myapp";
some-label = "somelabel";
}
Declared by:
services.podman.containers.<name>.network
The network mode or network/s to connect the container to. Equivalent
to podman run --network=<option>.
Type: string or list of string
Default:
[ ]
Example:
"host"
or
"bridge_network_1"
or
[ "bridge_network_1" "bridge_network_2" ]
Declared by:
services.podman.containers.<name>.networkAlias
Network aliases for the container.
Type: list of string
Default:
[ ]
Example:
[
"mycontainer"
"web"
]
Declared by:
services.podman.containers.<name>.ports
A mapping of ports between host and container
Type: list of string
Default:
[ ]
Example:
[
"8080:80"
"8443:443"
]
Declared by:
services.podman.containers.<name>.user
The user ID inside the container.
Type: null or signed integer or string
Default:
null
Declared by:
services.podman.containers.<name>.userNS
Use a user namespace for the container.
Type: null or string
Default:
null
Declared by:
services.podman.containers.<name>.volumes
The volumes to mount into the container.
Type: list of string
Default:
[ ]
Example:
[
"/tmp:/tmp"
"/var/run/test.secret:/etc/secret:ro"
]
Declared by:
services.podman.extraPackages
Extra packages added to PATH when creating Podman machines.
Type: list of package
Default:
[ pkgs.openssh ]
Example:
with pkgs; [ openssh hello ];
Declared by:
services.podman.images
Defines Podman image quadlet configurations.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
services.podman.images.<name>.authFile
Path of the authentication file used to connect to registry.
Type: null or absolute path
Default:
null
Declared by:
services.podman.images.<name>.autoStart
Whether to pull the image on boot. Requires user lingering.
Type: boolean
Default:
true
Declared by:
services.podman.images.<name>.certDir
Path of certificates (*.{crt,cert,key}) used to connect to registry.
Type: null or absolute path
Default:
null
Declared by:
services.podman.images.<name>.decryptionKeyFile
Path to key used for decryption of images.
Type: null or absolute path
Default:
null
Declared by:
services.podman.images.<name>.description
The description of the image.
Type: null or string
Default:
"Service for image \${name}"
Example:
"My Image"
Declared by:
services.podman.images.<name>.extraConfig
INI sections and values to populate the Image Quadlet.
Type: attribute set of attribute set of ((attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))) or list of (null or boolean or signed integer or string or absolute path) or null or boolean or signed integer or string or absolute path)
Default:
{ }
Example:
{
Image = {
ContainersConfModule = "/etc/nvd.conf";
};
}
Declared by:
services.podman.images.<name>.extraPodmanArgs
Extra arguments to pass to the podman image pull command.
Type: list of string
Default:
[ ]
Example:
[
"--os=linux"
]
Declared by:
services.podman.images.<name>.image
Image to pull.
Type: string
Example:
"quay.io/centos/centos:latest"
Declared by:
services.podman.images.<name>.password
Password used to connect to registry. (Will be visible in nix store)
Type: null or string
Default:
null
Example:
"P@ssw0rd"
Declared by:
services.podman.images.<name>.tag
FQIN of referenced Image when source is a file or directory archive.
Type: null or string
Default:
null
Example:
"quay.io/centos/centos:latest"
Declared by:
services.podman.images.<name>.tlsVerify
Require HTTPS and verification of certificates when contacting registries.
Type: boolean
Default:
true
Declared by:
services.podman.images.<name>.username
Username used to connect to registry.
Type: null or string
Default:
null
Example:
"bob"
Declared by:
services.podman.machines
Declarative podman machine configurations.
Type: attribute set of (submodule)
Default:
{ }
Example:
{
dev-machine = {
autoStart = true;
cpus = 4;
diskSize = 100;
memory = 8192;
swap = 2048;
timezone = "UTC";
volumes = [
"/Users:/Users"
];
watchdogInterval = 30;
};
testing = {
autoStart = false;
cpus = 2;
diskSize = 50;
image = "ghcr.io/your-org/custom-image:latest";
memory = 4096;
username = "podman";
};
}
Declared by:
services.podman.machines.<name>.autoStart
Whether to automatically start this machine on login.
Type: boolean
Default:
true
Example:
false
Declared by:
services.podman.machines.<name>.cpus
Number of CPUs to allocate to the machine. If null, uses podman’s default.
Type: null or (positive integer, meaning >0)
Default:
null
Example:
2
Declared by:
services.podman.machines.<name>.diskSize
Disk size in GB for the machine. If null, uses podman’s default.
Type: null or (positive integer, meaning >0)
Default:
null
Example:
200
Declared by:
services.podman.machines.<name>.image
Bootable image to use for the machine. If null, uses podman’s default.
Type: null or string
Default:
null
Declared by:
services.podman.machines.<name>.memory
Memory in MB to allocate to the machine. If null, uses podman’s default.
Type: null or (positive integer, meaning >0)
Default:
null
Example:
8192
Declared by:
services.podman.machines.<name>.rootful
Whether to run the machine in rootful mode. If null, uses podman’s default. Rootful mode runs containers as root inside the VM.
Type: null or boolean
Default:
null
Example:
true
Declared by:
services.podman.machines.<name>.swap
Swap size in MB for the machine. If null, uses podman’s default.
Type: null or (positive integer, meaning >0)
Default:
null
Example:
2048
Declared by:
services.podman.machines.<name>.timezone
Timezone to set in the machine. If null, uses podman’s default.
Type: null or string
Default:
null
Example:
"UTC"
Declared by:
services.podman.machines.<name>.username
Username used in the machine image. If null, uses podman’s default.
Type: null or string
Default:
null
Example:
"user"
Declared by:
services.podman.machines.<name>.volumes
Volumes to mount in the machine, specified as source:target pairs.
Type: list of string
Default:
[
"/Users:/Users"
"/private:/private"
"/var/folders:/var/folders"
]
Example:
[
"/Users:/Users"
]
Declared by:
services.podman.machines.<name>.watchdogInterval
Interval in seconds to check if the machine is running
Type: positive integer, meaning >0
Default:
30
Example:
60
Declared by:
services.podman.networks
Defines Podman network quadlet configurations.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
services.podman.networks.<name>.autoStart
Whether to start the network on boot (requires user lingering).
Type: boolean
Default:
true
Declared by:
services.podman.networks.<name>.description
The description of the network.
Type: null or string
Default:
null
Example:
"My Network"
Declared by:
services.podman.networks.<name>.driver
The network driver to use.
Type: null or string
Default:
null
Example:
"bridge"
Declared by:
services.podman.networks.<name>.extraConfig
INI sections and values to populate the Network Quadlet
Type: attribute set of attribute set of ((attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))) or list of (null or boolean or signed integer or string or absolute path) or null or boolean or signed integer or string or absolute path)
Default:
{ }
Example:
{
Network = {
ContainerConfModule = "/etc/nvd.conf";
};
Service = {
TimeoutStartSec = 30;
};
}
Declared by:
services.podman.networks.<name>.extraPodmanArgs
Extra arguments to pass to the podman network create command.
Type: list of string
Default:
[ ]
Example:
[
"--dns=192.168.55.1"
"--ipam-driver"
]
Declared by:
services.podman.networks.<name>.gateway
The gateway IP to use for the network.
Type: null or string
Default:
null
Example:
"192.168.20.1"
Declared by:
services.podman.networks.<name>.internal
Whether the network should be internal
Type: null or boolean
Default:
null
Declared by:
services.podman.networks.<name>.labels
The labels to apply to the network.
Type: attribute set of string
Default:
{ }
Example:
{
app = "myapp";
some-label = "somelabel";
}
Declared by:
services.podman.networks.<name>.subnet
The subnet to use for the network.
Type: null or string
Default:
null
Example:
"192.168.20.0/24"
Declared by:
services.podman.settings.containers
containers.conf configuration
Type: TOML value
Default:
{ }
Declared by:
services.podman.settings.mounts
mounts.conf configuration
Type: list of string
Default:
[ ]
Declared by:
services.podman.settings.policy
Signature verification policy file.
If this option is empty the default policy file from
skopeo will be used.
Type: attribute set
Default:
{ }
Example:
{
default = [
{
type = "insecureAcceptAnything";
}
];
transports = {
docker-daemon = {
"" = [
{
type = "insecureAcceptAnything";
}
];
};
};
}
Declared by:
services.podman.settings.registries.block
List of blocked repositories.
Type: list of string
Default:
[ ]
Declared by:
services.podman.settings.registries.insecure
List of insecure repositories.
Type: list of string
Default:
[ ]
Declared by:
services.podman.settings.registries.registry
List of per-registry configuration entries.
Prefer this over the deprecated insecure and block lists.
Type: list of (submodule)
Default:
[ ]
Declared by:
services.podman.settings.registries.registry.*.blocked
Whether the registry is blocked.
Type: null or boolean
Default:
null
Declared by:
services.podman.settings.registries.registry.*.insecure
Whether the registry is insecure.
Type: null or boolean
Default:
null
Declared by:
services.podman.settings.registries.registry.*.location
Registry location.
Type: string
Declared by:
services.podman.settings.registries.search
List of repositories to search.
Type: list of string
Default:
[
"docker.io"
]
Declared by:
services.podman.settings.storage
storage.conf configuration
Type: TOML value
Declared by:
services.podman.useDefaultMachine
Whether to create and use the default podman machine.
The default machine will be named podman-machine-default and configured with podmans default values.
Type: boolean (read only)
Default:
false
Declared by:
services.podman.volumes
Defines Podman volume quadlet configurations.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
services.podman.volumes.<name>.autoStart
Whether to create the volume on boot.
Type: boolean
Default:
true
Declared by:
services.podman.volumes.<name>.copy
Copy content of the image located at the mountpoint of the volume on first run.
Type: boolean
Default:
true
Declared by:
services.podman.volumes.<name>.description
The description of the volume.
Type: null or string
Default:
"Service for volume \${name}"
Example:
"My Volume"
Declared by:
services.podman.volumes.<name>.device
The path of a device which is mounted for the volume.
Type: null or string
Default:
null
Example:
"tmpfs"
Declared by:
services.podman.volumes.<name>.driver
The volume driver to use.
Type: null or string
Default:
null
Example:
"image"
Declared by:
services.podman.volumes.<name>.extraConfig
INI sections and values to populate the Volume Quadlet.
Type: attribute set of attribute set of ((attribute set of (null or boolean or signed integer or string or absolute path or list of (null or boolean or signed integer or string or absolute path))) or list of (null or boolean or signed integer or string or absolute path) or null or boolean or signed integer or string or absolute path)
Default:
{ }
Example:
{
Volume = {
ContainerConfModule = "/etc/nvd.conf";
};
}
Declared by:
services.podman.volumes.<name>.extraPodmanArgs
Extra arguments to pass to the podman volume create command.
Type: list of string
Default:
[ ]
Example:
[
"--opt copy"
]
Declared by:
services.podman.volumes.<name>.group
The group ID owning the volume inside the container.
Type: null or signed integer or string
Default:
null
Declared by:
services.podman.volumes.<name>.image
Specifies the image the volume is based on when Driver is set to the image.
Type: null or string
Default:
null
Example:
"quay.io/centos/centos:latest"
Declared by:
services.podman.volumes.<name>.labels
The labels to apply to the volume.
Type: attribute set of string
Default:
{ }
Example:
{
app = "myapp";
some-label = "somelabel";
}
Declared by:
services.podman.volumes.<name>.preserve
Whether the volume should be preserved if it is removed from the configuration. Setting this to false will cause the volume to be deleted if the volume is removed from the configuration
Type: boolean
Default:
true
Declared by:
services.podman.volumes.<name>.type
Filesystem type of Device. (used as -t in mount commands)
Type: null or string
Default:
null
Example:
"tmpfs"
Declared by:
services.podman.volumes.<name>.user
The user ID owning the volume inside the container.
Type: null or signed integer or string
Default:
null
Declared by: