Nixos in a container truenas 26 beta 1

Apps and Virtualization
1

Any one running into issues running nixos inside an lxc (containers) with Truenas 26 Beta 1 ?

While trying to manage the container through the shell in the truenas UI I receive the following error

nsenter: failed to execute capsh: No such file or directory.

I also tried to install a fresh nixos container and the same error happens.

In addition inside the container I was running nebula vpn, however now it seems the container does not have permissions to access the /dev/net/tun adapter.

Could this be a default permissions issue with mapping UID/GIDs ?

Thanks,

2

You may need to run it as a privileged container? https://www.truenas.com/docs/scale/26/containers/managingcontainers/#running-nested-containers

3

This is a known issue related to how UI shell works in BETA1 (it relied on assumption that capsh was available in container). Being addressed for BETA2. The bug was reported regarding alpine linux, but this sounds much the same.

1 Like
4

Ah you’re right. And I was the reporter on that issue :sweat_smile:

5

I also want to access /dev/net/tun adapter within a container. This is to run a privileged Debian LXC container for installing podman and Unifi OS Server. I can install podman, but Unifi OS Server requires access to /dev/net/tun on the host. I don’t see a way to map a passthrough of /dev/net/tun from the host to the container using the TrueNAS 26 Beta 1 UI.

1 Like
6

I’m trying the available NixOS images on the 26.0.0-BETA.1 but it still fails, even after setting ID Map Type: Privileged and Capabilities Policy: Allow All probably because of the missing security.nesting=true setting, in terms of the old Incus container runner. When updating it with a new configuration I get:
```
@ nixos-rebuild switch --flake ‘.#reventlov’ --target-host root@reventlov --build-host root@192
.168.1.133 --use-substitutes
[…]
/nix/store/wkvc3p6ih0f7v7aqchj7lmn6j816sapf-zlib-1.3.2-dev
/nix/store/zzxvq8x8zmjyxmk79nfy99lvasq5hmav-zlib-ng-2.2.5
/nix/store/ch5qyrmkrk3rgafjxvv7qk9h18vrdm1v-zstd-1.5.7-man
/nix/store/30d12zr26jknnicjwfwvrffmifsqdgan-zvbi-0.2.44
error: this system does not support the kernel namespaces that are required for sandboxing; use ‘–no-sandbox’ to disable sandboxing
Command ‘ssh -o ControlMaster=auto -o ControlPath=/tmp/nixos-rebuild.77vo1ni_/ssh-%n -o ControlPersist=60 root@192.168.1.133 – nix --extra-experimental-features ‘’“’“‘nix-command flakes’”‘”’’ build ‘’“‘”‘/nix/store/psigiask6gnrxbr1p5hhx3pdap3gy3ls-nixos-system-reventlov-lxc-25.11.20260603.535f3e6.drv^*’“’”‘’ --print-out-paths --no-link’ returned non-zero exit status 1.
```

But because the subsystem managing the containers has changed so much I’m unable to fix this on my own… any pointers?

7

sorry for the formatting, apparently I cannot re-edit my previous post to fix it

8

The issue still exists on the BETA-2

9

I tried all three nixos images and I get a shell but nothing appears to install it’s just an empty / directory