137 lines
3.9 KiB
Nix
137 lines
3.9 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
bonlib,
|
|
extraPaths ? [],
|
|
...
|
|
}:
|
|
let
|
|
nixPath = pkgs.writeText "nixpkgsError" ''_: throw '''
|
|
This container doesn't include nixpkgs.
|
|
Hint: override the NIX_PATH environment variable with eg:
|
|
"NIX_PATH=nixpkgs=channel:nixos-unstable"
|
|
''' '';
|
|
|
|
builderIds = let forEach = n: if n == 1 then [n] else [n] ++ forEach (n - 1); in forEach 32;
|
|
|
|
withFakeNss = with pkgs; [
|
|
(writeTextDir "etc/passwd" (
|
|
builtins.concatStringsSep "\n" (
|
|
map (n: "nixbld${toString n}:x:${toString (30000 + n)}:30000:Nix build user ${toString n}:/var/empty:/bin/false") builderIds)
|
|
+ "\n" + ''
|
|
root:x:0:0:System administrator:/root:${bashInteractive}/bin/bash
|
|
nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:${shadow}/bin/nologin
|
|
''))
|
|
|
|
(writeTextDir "etc/group" ''
|
|
root:x:0:
|
|
wheel:x:1:
|
|
kmem:x:2:
|
|
tty:x:3:
|
|
messagebus:x:4:
|
|
disk:x:6:
|
|
audio:x:17:
|
|
floppy:x:18:
|
|
uucp:x:19:
|
|
lp:x:20:
|
|
cdrom:x:24:
|
|
tape:x:25:
|
|
video:x:26:
|
|
dialout:x:27:
|
|
utmp:x:29:
|
|
adm:x:55:
|
|
keys:x:96:
|
|
users:x:100:
|
|
input:x:174:
|
|
nixbld:x:30000:${builtins.concatStringsSep "," (map (n: "nixbld${toString n}") builderIds)}
|
|
nogroup:x:65534:
|
|
'')
|
|
|
|
(writeTextDir "etc/nsswitch.conf" ''
|
|
passwd: files mymachines systemd
|
|
group: files mymachines systemd
|
|
shadow: files
|
|
|
|
hosts: files mymachines dns myhostname
|
|
networks: files
|
|
|
|
ethers: files
|
|
services: files
|
|
protocols: files
|
|
rpc: files
|
|
'')
|
|
];
|
|
|
|
withNixConf = with pkgs; [
|
|
(writeTextDir "etc/nix/nix.conf" ''
|
|
accept-flake-config = true
|
|
experimental-features = nix-command flakes
|
|
show-trace = true
|
|
max-jobs = auto
|
|
trusted-users = root
|
|
'')
|
|
];
|
|
|
|
in pkgs.dockerTools.buildImageWithNixDb {
|
|
name = "nix-minimal";
|
|
tag = "latest";
|
|
|
|
copyToRoot = pkgs.buildEnv {
|
|
name = "image-root";
|
|
pathsToLink = [ "/bin" "/etc" ];
|
|
paths = with pkgs; [
|
|
dockerTools.usrBinEnv
|
|
|
|
coreutils
|
|
bashInteractive
|
|
nix
|
|
|
|
cacert
|
|
gnutar
|
|
gzip
|
|
xz
|
|
openssh
|
|
((git.override {
|
|
perlSupport = false;
|
|
pythonSupport = false;
|
|
withpcre2 = false;
|
|
withManual = false;
|
|
}).overrideAttrs (_: { doInstallCheck = false; }))
|
|
|
|
iana-etc
|
|
] ++ withFakeNss ++ withNixConf ++ extraPaths;
|
|
};
|
|
|
|
runAsRoot = with pkgs; ''
|
|
#!${runtimeShell}
|
|
${dockerTools.shadowSetup}
|
|
'';
|
|
|
|
config = {
|
|
Cmd = [ "/bin/bash" ];
|
|
Env = [
|
|
"USER=root"
|
|
"PATH=/bin:/usr/bin:/nix/var/nix/profiles/default/bin"
|
|
"PAGER=cat"
|
|
"ENV=/etc/profile.d/nix.sh"
|
|
"BASH_ENV=/etc/profile.d/nix.sh"
|
|
"SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
|
"NIX_BUILD_SHELL=/bin/bash"
|
|
"NIX_PATH=nixpkgs=${nixPath}"
|
|
];
|
|
};
|
|
} // {
|
|
meta = with lib; {
|
|
homepage = "https://vcs.elnafo.ru/L-Nafaryus/bonfire";
|
|
description = "Minimal image with a Nix package manager";
|
|
longDescription = ''
|
|
Minimal docker image with Nix package manager (https://nixos.org/).
|
|
Enabled features: nix-command, flakes.
|
|
Versions: latest
|
|
'';
|
|
platforms = platforms.linux;
|
|
license = licenses.lgpl21Plus;
|
|
maintainers = with bonlib.maintainers; [ L-Nafaryus ];
|
|
};
|
|
}
|