containers: use xtables lock file under /dev/shm

Author: burgerdev

packages/containers.nix

@@ -52,11 +52,10 @@ let
         ++ (with dockerTools; [ caCertificates ]);
       config = {
         Cmd = [ "${pkgs.contrast.coordinator}/bin/coordinator" ];
-        Env = [ "PATH=/bin" ]; # This is only here for policy generation.
-        Volumes = {
-          # Add /run folder so that iptables can create /run/xtables.lock
-          "/run" = { };
-        };
+        Env = [
+          "PATH=/bin" # Explicitly setting this prevents containerd from setting a default PATH.
+          "XTABLES_LOCKFILE=/dev/shm/xtables.lock" # Tells iptables where to create the lock file, since the default path does not exist in our image.
+        ];
       };
     };
 
@@ -75,11 +74,10 @@ let
       config = {
         # Use Entrypoint so we can append arguments.
         Entrypoint = [ "${pkgs.contrast.initializer}/bin/initializer" ];
-        Env = [ "PATH=/bin" ]; # This is only here for policy generation.
-        Volumes = {
-          # Add /run folder so that iptables can create /run/xtables.lock
-          "/run" = { };
-        };
+        Env = [
+          "PATH=/bin" # Explicitly setting this prevents containerd from setting a default PATH.
+          "XTABLES_LOCKFILE=/dev/shm/xtables.lock" # Tells iptables where to create the lock file, since the default path does not exist in our image.
+        ];
       };
     };
 
@@ -117,11 +115,10 @@ let
       config = {
         # Use Entrypoint so we can append arguments.
         Entrypoint = [ "${pkgs.service-mesh}/bin/service-mesh" ];
-        Env = [ "PATH=/bin" ];
-        Volumes = {
-          # Add /run folder so that iptables can create /run/xtables.lock
-          "/run" = { };
-        };
+        Env = [
+          "PATH=/bin"
+          "XTABLES_LOCKFILE=/dev/shm/xtables.lock" # Tells iptables where to create the lock file, since the default path does not exist in our image.
+        ];
       };
     };