MicroVM.nix

You can enable an optional writable layer for the Nix store by setting microvm.writableStoreOverlay.

Important Requirements & Caveats:

1. The path must be located on a writable filesystem.
2. Do not use 9p or virtiofs shares for the overlay. The Linux overlay filesystem requires a compatible filesystem for the upper (writable) layer. You must use a volume (block device) for the overlay path.
3. Persistence: The Nix database will forget all built packages after a reboot (it only retains what is needed for the VM's NixOS system). It is recommended to delete and recreate the overlay after MicroVM shutdown or before startup.

To implement this, set the overlay path and create a volume mounted at that same path.

{ config, ... }:
{
  microvm.writableStoreOverlay = "/nix/.rw-store";

  microvm.volumes = [ {
    image = "nix-store-overlay.img";
    mountPoint = config.microvm.writableStoreOverlay;
    size = 2048;
  }; }];
}

You can centralize MicroVM logs on the host without network transport by sharing the journal directory via virtiofs.

1. Set microvm.machineId in the MicroVM configuration so journald can identify the host.
2. Configure a virtiofs share in microvm.shares to map the host's journal directory to the MicroVM's /var/log/journal.
3. On the host, use systemd.tmpfiles.rules to create symlinks for each MicroVM's journal under the host's /var/log/journal.
4. Use journalctl --merge on the host to view all logs together.

# MicroVM configuration
microvm.shares = [ { 
  source = "/var/lib/microvms/${config.networking.hostName}/journal";
  mountPoint = "/var/log/journal";
  tag = "journal";
  proto = "virtiofs";
  socket = "journal.sock";
} ];

# Host configuration
systemd.tmpfiles.rules = map (vmHost: 
  let 
    machineId = self.lib.addresses.machineId.${vmHost}; 
  in 
    "L+ /var/log/journal/${machineId} - - - - /var/lib/microvms/${vmHost}/journal/${machineId}"
) (builtins.attrNames self.lib.addresses.machineId);

To make MicroVMs reachable on your local network, you can create a bridge (br0) that links your host's physical Ethernet port (e.g., eno1) with the MicroVM's TAP interfaces (e.g., vm-*).

Note: You must adjust the example IP addresses and interface names (eno1) to match your specific network environment. The vm-* pattern must match the id specified in your MicroVM definition.

systemd.network.enable = true;

systemd.network.networks."10-lan" = {
  matchConfig.Name = ["eno1" "vm-*"];
  networkConfig = {
    Bridge = "br0";
  };
};

systemd.network.netdevs."br0" = {
  netdevConfig = {
    Name = "br0";
    Kind = "bridge";
  };
};

systemd.network.networks."10-lan-bridge" = {
  matchConfig.Name = "br0";
  networkConfig = {
    Address = ["192.168.1.2/24" "2001:db8::a/64"];
    Gateway = "192.168.1.1";
    DNS = ["192.168.1.1"];
    IPv6AcceptRA = true;
  };
  linkConfig.RequiredForOnline = "routable";
};

MACVTAP interfaces attach to a host's physical network interface, allowing the MicroVM to join the same Ethernet segment with its own MAC address.

Manual Setup

If running a MicroVM interactively from a package, follow these steps:

1. Define the parent LINK (e.g., eth0) and the ID (the microvm.interfaces.*.id).
2. Create the interface using ip l add.
3. Obtain the interface index.
4. Grant user permissions to the tap device.

Configuration via host module

When using the host module, MACVTAP interfaces are created via systemd service dependencies. You must specify a link attribute (the parent interface) and a mode attribute (the MACVTAP filtering mode) for each interface.

# Parent interface:
LINK=eth0
# MACVTAP interface, as specified under microvm.interfaces.*.id:
ID=microvm1
# Create the interface
sudo ip l add link $LINK name $ID type macvtap mode bridge
# Obtain the interface index number
IFINDEX=$(cat /sys/class/net/$ID/ifindex)
# Grant yourself permission
sudo chown $USER /dev/tap$IFINDEX