Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Nix container images #3

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

WIP: Nix container images #3

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5fe80c5
import nlewo/nix-container-images
zimbatm Mar 16, 2019
5452a54
nix: redefine in terms of nix-container-images
zimbatm Mar 16, 2019
9ba34c6
Use niv to fetch the nix-container-images repository (#5)
nlewo Apr 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,16 @@
{ nixpkgs ? <nixpkgs> }:
let
nix-container-images = builtins.fetchTarball {
url = "https://github.com/nlewo/nix-container-images/archive/7577da87f7249442b51359e36a0f0493949a14d6.tar.gz";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do you intend to keep this up-to-date?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now it's manual, but an updater script would be nice

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about using Niv?
I don't know if it is relevant but we could also use Niv to fetch NixOS releases which seem to be fetched by the CI. Correct me if I'm wrong.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah niv could work but the hard part is mostly around CI. make a cron-like job that updates and pushes updates if it works. Mic92 already did something like that for NUR so I might steal that.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also have this project for automated updates:

https://github.com/Mic92/iana-etc/blob/master/ci/deploy.sh

Setting up secrets is sometimes a hassle in travis, when you mix up travis.org and travis.com keys.

sha256 = "0cv3b8gngvb2my1rqs2kxszmwb3s3i72j1wp6jin5f1wjp9km32w";
};
in
import nixpkgs {
# docker images run on Linux
system = "x86_64-linux";
config = {};
overlays = [
(import "${nix-container-images}/overlay.nix")
(import ./overlay.nix)
];
}
75 changes: 23 additions & 52 deletions images/nix/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,56 +1,27 @@
{ dockerTools
, bash
, cacert
, coreutils
, curl
, gitMinimal
, gnutar
, gzip
, iana-etc
, nix
, xz
}:
{ path, lib, nix }:
let
image = dockerTools.buildImageWithNixDb {
inherit (nix) name;

contents = [
./root
coreutils
# add /bin/sh
bash
nix

# runtime dependencies of nix
cacert
gitMinimal
gnutar
gzip
xz

# for haskell binaries
iana-etc
];

extraCommands = ''
# for /usr/bin/env
mkdir usr
ln -s ../bin usr/bin
channel =
builtins.replaceStrings
["\n"]
[""]
"nixos-${builtins.readFile "${path}/.version"}";
in
lib.makeImage {
image = {
name = "nix";
tag = "latest";

# make sure /tmp exists
mkdir -m 0777 tmp
'';
run = ''
chmod u+w root
echo 'https://nixos.org/channels/${channel} nixpkgs' > root/.nix-channels
'';

config = {
Cmd = [ "/bin/bash" ];
Env = [
"ENV=/etc/profile.d/nix.sh"
"NIX_PATH=nixpkgs=channel:nixpkgs-unstable"
"PAGER=cat"
"PATH=/usr/bin:/bin"
"SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
];
interactive = true;
};
};
in
image // { meta = nix.meta // image.meta; }
environment.systemPackages = [ nix ];
nix = {
enable = true;
useSandbox = false;
package = nix;
};
}