colima: init

[bryanhonof]

Adds https://github.com/abiosoft/colima as a system service so that users on macOS can use docker and other container tools like they'd do on Linux.
Creates a new user called colima to host the service on, and optionally creates a socket under /var/run/docker.sock so that the Docker CLI can interact with it from any user who's in the _colima group. This is similar to how Docker works on Linux.

This could be a gateway into implementing virtualisation.docker.enable in nix-darwin.

Refs: #1182

[jessevdp]

Just by pure coincidence I happen to really need Colima today to get docker running through nix-darwin on my new MacBook. So I just grabbed this module, added it to my config, and enabled it. Worked wonders! Super happy I spotted this PR! 😆

Since I'm an absolute noob I did have a tiny bit of trouble.. I expected it to be as simple as services.colima.enable bing, bang, boom -> docker works. So I was a bit surprised that I needed some explicit config.

Here's my darwin/docker.nix:

{
  pkgs,
  ...
}: {
  environment.systemPackages = with pkgs; [
    docker
  ];

  services.colima = {
    enable = true;
    createDockerSocket = true;
    groupMembers = [
      "my-username"
    ];
  };
}

All that to say that yes: I do want to use Colima for docker (by putting the socket in place). And yes: my user is explicitly allowed to access this socket.

There's probably a really good reason for this! In the end this (presumably) all has to do with:

This could be a gateway into implementing virtualisation.docker.enable in nix-darwin.

Still, I thought I'd share my experience as a novice user.

I'd love to see this get merged. Happy hacking! 😎

[bryanhonof]

@jessevdp thanks for the kind words.

All that to say that yes: I do want to use Colima for docker (by putting the socket in place). And yes: my user is explicitly allowed to access this socket.

I made it also include the Docker CLI when you enable the compatibility now. Adding the user, I believe, should still be a separate step/config. I could have it throw a warning, though, but that might pollute the output.

[bryanhonof]

Wrong button :)

[bryanhonof]

Actually, I think I just ran into an issue whilst trying to mount stuff with docker run --volume .... Perhaps I have to run the VM as root instead of a separate user...

[bestlem]

I have sucessfully run colima as a home-manager package so does not have to be root.

However colima does try and add to the Docker container a mount to the Users home directory. So in this case creating a home directory for the colima user might be sufficient.

[bryanhonof]

@bestlem Yes, but I cannot mount let's say some else's home directory. Currently, the launchd colima daemon starts under the colima user, mounting /tmp/colima and /Users/colima, the latter of which doesn't even exist. Now, I'm running under the user bryan, and I'd like to do docker run --volume "$PWD:/somewhere". This will just mount an empty directory as per their FAQ.

Running Colima with home manager probably mounts that second /Users/$USER correctly.

Note that I'm trying to use Colima to provide a similar workflow as installing docker on Linux has. I do want multiple user to be able to interact with the VM correctly.

Yeah, I tried just mounting someone's home to test it out, this happens:

{"level":"fatal","msg":"mkdir /Users/github: permission denied","time":"2025-01-23T14:14:04+01:00"}

[bryanhonof]

Haha,

"must not run as the root"

[bryanhonof]

Adding the colima user to the staff group seems to help. It allows me to use the --mount flag in colima start to mount other directories outside of the colima user.

[jessevdp]

I think I just ran into this bind-mount issue too!

Keep in mind that I'm still using the setup duplicated from when this PR was initially openend.. I'm not sure much has changed in that regard.

But... I tried to run a VSCode devcontainer setup that attempts to use a bind mount. The folder I mounted is empty inside the container, and when I attempt touch foo.txt when attached to the container I get "Permission denied".

Any clue how to make this seamless? Can we configure that staff group membership from this module or is that a bad idea?

[bestlem]

Isn't staff a bad idea - as that is the group for actual users.

Why does this have to be setup as a central user - colima works in home-manager that is as per the current user.

[jessevdp]

I’m also curious about that! As somewhat of a noob I just accepted that part of this module as being “a best practice”. But I’m interested to learn why it would or wouldn’t be a good idea?

I guess because this is a darwin module you’d want the service to be shared and usable by multiple users?

[jessevdp]

@bryanhonof why did you choose uid and gid 400? They seem to be taken already on my (relatively new) Mac?

dscacheutil -q group

-- snip --

name: com.apple.access_remote_ae
password: *
gid: 400

-- snip --

[niklaskorz]

Suggested change

	architectue = mkOption {
	architecture = mkOption {

[niklaskorz]

And all other occurences of "architectue" -> "architecture"

[niklaskorz]

Suggested change

	enableDockerCompatability = mkOption {
	enableDockerCompatibility = mkOption {

[niklaskorz]

And of course all other occurences of "compatability" -> "compatibility"