NixOS 17.09: update container example in NixOS manual

[c0c0n3]

Issue description

Hi guys,
After reading the NixOS manual section on imperative container management, I followed the instructions there to run a web server in the container but then wasn't able to access the web server from the host using the curl command specified in the example. It looks like the example should also mention to allow incoming traffic on port 80 in the container config?

Steps to reproduce

Run all the commands specified in the NixOS manual section on imperative container management up to the point where you update the container's config to run a web server:

# nixos-container update foo --config 'services.httpd.enable = true; \
       services.httpd.adminAddr = "foo@example.org";'

Trying to run the next line in the example

# curl http://$(nixos-container show-ip foo)/

will result in curl hanging as packets are dropped, which you can see by running e.g. tcpdump. Adding this line to the container's config:

networking.firewall.allowedTCPPorts = [ 80 ];

fixed it for me. Maybe this should be mentioned in the manual? By the same token, it might also be worth mentioning that if Network Manager is running, you'll have to add this line for the example to work:

networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];

I know this is mentioned in a later section, but I reckon it's best to make it explicit? In fact, even though Network Manager is disabled by default, some modules, like Gnome 3, enable it automatically so whoever reads the example may not be aware Network Manager is up just because they didn't explicitly enable it in their configuration.

Technical details

• System: NixOS: 17.03.882.d1c477e007 (Gorilla)
• Nix version: 1.11.8
• Nixpkgs version: 17.03.882.d1c477e007

[danbst]

I guess the example was written in times when firewall was off by default.
Created a PR for that (#25180)

[danbst]

but sorry about your second issue - I have no opinion on that. Unfortunately I've marked my PR as "Closes #25174", so this issue may be autoclosed without resolution on this.

[c0c0n3]

cool, no prob. i only reported the issue cos they asked me to on #nixos. but yah, even if in general docs can be improved, there's enough info that peeps can easily figure out what's missing or ask on #nixos just like I did. I guess that was a long way to say: don't stress about it :-)