From 4154640637a7b4031a8ad8ce3649228cb99b8ab1 Mon Sep 17 00:00:00 2001
From: Richie Cahill <Richie@tmmworkshop.com>
Date: Fri, 11 Sep 2026 14:19:58 -0400
Subject: [PATCH] feat(jeeves): move container state to dedicated ZFS dataset

- add a performance-tuned media/containers dataset
- store Docker and NixOS container state on the dataset
- prepare storage directories after ZFS mounts
- bind NixOS container state to its required path
- configure snapshot retention for container storage
---
 systems/jeeves/containers.nix       | 71 +++++++++++++++++++++++++++++
 systems/jeeves/default.nix          |  1 +
 systems/jeeves/scripts/zfs.sh       |  1 +
 systems/jeeves/snapshot_config.toml |  6 +++
 systems/jeeves/vars.nix             |  1 +
 5 files changed, 80 insertions(+)
 create mode 100644 systems/jeeves/containers.nix

diff --git a/systems/jeeves/containers.nix b/systems/jeeves/containers.nix
new file mode 100644
index 0000000..f3719b7
--- /dev/null
+++ b/systems/jeeves/containers.nix
@@ -0,0 +1,71 @@
+{ pkgs, ... }:
+let
+  vars = import ./vars.nix;
+in
+{
+  virtualisation.docker.daemon.settings."data-root" = "${vars.containers}/docker";
+
+  # nixos-container hardcodes its state directory to /var/lib/nixos-containers,
+  # so route it to the shared container dataset with a bind mount.
+  fileSystems."/var/lib/nixos-containers" = {
+    device = "${vars.containers}/nixos-containers";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+
+  systemd.services = {
+    prepare-docker-storage = {
+      description = "Create Docker storage directory";
+      requiredBy = [ "docker.service" ];
+      before = [ "docker.service" ];
+      requires = [ "zfs-mount.service" ];
+      after = [ "zfs-mount.service" ];
+      path = [
+        pkgs.coreutils
+        pkgs.util-linux
+      ];
+
+      unitConfig = {
+        DefaultDependencies = false;
+        RequiresMountsFor = [ "/nix" ];
+      };
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        mountpoint -q ${vars.containers}
+        install -d -m 0710 ${vars.containers}/docker
+      '';
+    };
+
+    prepare-nixos-container-storage = {
+      description = "Create NixOS container storage directory";
+      requiredBy = [ "var-lib-nixos\\x2dcontainers.mount" ];
+      before = [ "var-lib-nixos\\x2dcontainers.mount" ];
+      requires = [ "zfs-mount.service" ];
+      after = [ "zfs-mount.service" ];
+      path = [
+        pkgs.coreutils
+        pkgs.util-linux
+      ];
+
+      unitConfig = {
+        DefaultDependencies = false;
+        RequiresMountsFor = [ "/nix" ];
+      };
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        mountpoint -q ${vars.containers}
+        install -d -m 0755 ${vars.containers}/nixos-containers
+      '';
+    };
+  };
+}
diff --git a/systems/jeeves/default.nix b/systems/jeeves/default.nix
index 494df08..9f1a836 100644
--- a/systems/jeeves/default.nix
+++ b/systems/jeeves/default.nix
@@ -18,6 +18,7 @@ in
     ./monitoring
     ./docker
     ./services
+    ./containers.nix
     ./hardware.nix
     ./networking
     ./programs.nix
diff --git a/systems/jeeves/scripts/zfs.sh b/systems/jeeves/scripts/zfs.sh
index a0a09f2..7cbed28 100644
--- a/systems/jeeves/scripts/zfs.sh
+++ b/systems/jeeves/scripts/zfs.sh
@@ -17,6 +17,7 @@ sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnode
 # media datasets
 sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
 sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
+sudo zfs create media/secure/containers -o mountpoint=/zfs/media/containers -o compression=lz4 -o sync=disabled -o redundant_metadata=some -o normalization=none -o utf8only=off
 sudo zfs create media/secure/docker -o compression=zstd-9
 sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
 sudo zfs create media/secure/notes -o copies=2
diff --git a/systems/jeeves/snapshot_config.toml b/systems/jeeves/snapshot_config.toml
index 4e2141d..68d80f1 100644
--- a/systems/jeeves/snapshot_config.toml
+++ b/systems/jeeves/snapshot_config.toml
@@ -66,6 +66,12 @@ daily = 30
 monthly = 12
 
 # media
+["media/secure/containers"]
+15_min = 2
+hourly = 0
+daily = 0
+monthly = 0
+
 ["media/temp"]
 15_min = 2
 hourly = 0
diff --git a/systems/jeeves/vars.nix b/systems/jeeves/vars.nix
index e96da4c..ebcb6b9 100644
--- a/systems/jeeves/vars.nix
+++ b/systems/jeeves/vars.nix
@@ -5,6 +5,7 @@ let
 in
 {
   inherit zfs_media zfs_storage zfs_scratch;
+  containers = "${zfs_media}/containers";
   database = "${zfs_media}/database";
   docker = "${zfs_media}/docker";
   docker_configs = "${zfs_media}/docker/configs";