Commit e371299aac27

Vincent Demeester <vincent@sbr.pm>
2022-02-22 18:05:59
systems/modules: fix buildkitd socket rights
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
1 parent 173690f
Changed files (1)
systems
modules
virtualisation
systems/modules/virtualisation/buildkit.nix
@@ -44,34 +44,27 @@ in
     users.groups.buildkit.gid = 350;
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
-
     systemd.services.buildkitd = {
       after = [ "network.target" "containerd.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = [
-          ""
-          ''
-            ${cfg.package}/bin/buildkitd \
-              ${cfg.extraOptions}
-          ''
-        ];
+        ExecStart = ''${cfg.package}/bin/buildkitd --addr=unix:///run/buildkit/buildkitd.sock --group=buildkit ${cfg.extraOptions}'';
+        Delegate = "yes";
+        KillMode = "process";
+        Type = "notify";
+        Restart = "always";
+        RestartSec = "10";
+
+        # "limits" defined below are adopted from upstream: https://github.com/containerd/containerd/blob/master/containerd.service
+        LimitNPROC = "infinity";
+        LimitCORE = "infinity";
+        LimitNOFILE = "infinity";
+        TasksMax = "infinity";
+        OOMScoreAdjust = "-999";
       };
       path = [ cfg.package ] ++ cfg.packages;
     };
 
-
-    systemd.sockets.buildkitd = {
-      description = "Buildkitd Socket for the API";
-      wantedBy = [ "sockets.target" ];
-      socketConfig = {
-        ListenStream = "/run/buildkitd/buildkitd.sock";
-        SocketMode = "0660";
-        SocketUser = "root";
-        SocketGroup = "buildkit";
-      };
-    };
-
   };