This repository has no description
configs.autoupdate: use the nix daemon in containers
sync-containers3 containers (radio, yellow) get the host's
/nix/var/nix/db bind-mounted read-only, so nixos-upgrade failed every
night with "opening lock file /nix/var/nix/db/big-lock: Read-only file
system". Talk to the bind-mounted daemon socket instead, like the
autoswitch service does. Only for boot.isContainer, so other machines
are unaffected by that part.
The guard reported "cannot reach" for any nix flake metadata failure,
including this one; say what actually happened instead. nix's own
error is already on stderr above it.
author
Hermes
committer
lassulus
date
(Oct 17, 2026, 9:33 AM CEST)
commit
0abe5e59
0abe5e59d273a557c8179e205e9c67dd8b63bf9b
parent
f63a2e8e
f63a2e8ea18c8b1cd0464c48d5f37d3843bf2f42
+7
-2
+7
-2
configs/autoupdate.nix
+7
-2
configs/autoupdate.nix
···
37
37
done
38
38
if [ "$deployed" -eq 0 ]; then deployed=$(stat -c %Y /run/current-system); fi
39
39
if ! meta=$(nix flake metadata --refresh --json ${lib.escapeShellArg flake}); then
40
-
echo "autoupgrade: cannot reach ${flake}; letting nixos-upgrade report the error"
40
+
echo "autoupgrade: nix flake metadata ${flake} failed; upgrading unpinned and letting nixos-upgrade report any error"
41
41
exit 0
42
42
fi
43
43
remote=$(jq -r '.lastModified // 0' <<<"$meta")
···
54
54
system.autoUpgrade = {
55
55
enable = true;
56
56
# Goes into the nixos-upgrade script unquoted, so the shell expands the
57
-
# pinned revision. Without a rev file (guard could not reach the flake)
57
+
# pinned revision. Without a rev file (guard could not read the flake)
58
58
# the ref stays unpinned and the recorded revision becomes unknown.
59
59
flake = "${flake}/$(cat ${revFile} 2>/dev/null)";
60
60
randomizedDelaySec = "6h";
61
+
};
62
+
63
+
# Containers get the host's nix db read-only; go through the daemon socket.
64
+
systemd.services.nixos-upgrade.environment = lib.mkIf config.boot.isContainer {
65
+
NIX_REMOTE = "daemon";
61
66
};
62
67
63
68
systemd.services.nixos-upgrade.serviceConfig = {