nixos/cri-o: add OCI seccomp bpf hook support
We now set the hooks dir correctly if the OCI hook is enabled. CRI-O
supports this specific hook from v1.20.0.
Signed-off-by: Sascha Grunert <mail@saschagrunert.de>
commite2b7bdd08d2fccaa5f714d35b78930c6091eb7e1
authorSascha Grunert <mail@saschagrunert.de>
dateThu 4 Feb 2021, 15:01 (6 years ago)
parentdc7101d
nixos/modules/virtualisation/cri-o.nix+4−1
@@ -103,7 +103,10 @@ in
103103 cgroup_manager = "systemd"
104104 log_level = "${cfg.logLevel}"
105105 pinns_path = "${cfg.package}/bin/pinns"
106− hooks_dir = []
106+ hooks_dir = [
107+ ${lib.optionalString config.virtualisation.containers.ociSeccompBpfHook.enable
108+ ''"${config.boot.kernelPackages.oci-seccomp-bpf-hook}",''}
109+ ]
107110
108111 ${optionalString (cfg.runtime != null) ''
109112 default_runtime = "${cfg.runtime}"