Flake: build nix containers
* Add flake for building nixos containers for forgejo actions
This commit is contained in:
parent
74b4cf63fe
commit
50181d9e57
3 changed files with 275 additions and 0 deletions
10
fake_nixpkgs/default.nix
Normal file
10
fake_nixpkgs/default.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
_:
|
||||
throw ''
|
||||
This container doesn't include nixpkgs.
|
||||
|
||||
The best way to work around that is to pin your dependencies. See
|
||||
https://nix.dev/tutorials/towards-reproducibility-pinning-nixpkgs.html
|
||||
|
||||
Or if you must, override the NIX_PATH environment variable with eg:
|
||||
"NIX_PATH=nixpkgs=channel:nixos-unstable"
|
||||
''
|
||||
78
flake.lock
generated
Normal file
78
flake.lock
generated
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
{
|
||||
"nodes": {
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1738702386,
|
||||
"narHash": "sha256-nJj8f78AYAxl/zqLiFGXn5Im1qjFKU8yBPKoWEeZN5M=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "030ba1976b7c0e1a67d9716b17308ccdab5b381e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-24.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1738680400,
|
||||
"narHash": "sha256-ooLh+XW8jfa+91F1nhf9OF7qhuA/y1ChLx6lXDNeY5U=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "799ba5bffed04ced7067a91798353d360788b30d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
187
flake.nix
Normal file
187
flake.nix
Normal file
|
|
@ -0,0 +1,187 @@
|
|||
{
|
||||
description = "Nix-based oci images for actions";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
nixpkgs-unstable,
|
||||
flake-utils,
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
inherit (nixpkgs) lib;
|
||||
imagePackages =
|
||||
pkgs: with pkgs; [
|
||||
bashInteractive
|
||||
cacert
|
||||
coreutils
|
||||
curl
|
||||
docker
|
||||
findutils
|
||||
gawk
|
||||
gitFull
|
||||
gnugrep
|
||||
gnutar
|
||||
gzip
|
||||
jq
|
||||
nodejs
|
||||
openssl
|
||||
openssh
|
||||
rsync
|
||||
sudo
|
||||
wget
|
||||
xz
|
||||
makeWrapper
|
||||
bats
|
||||
shellcheck
|
||||
reuse
|
||||
lix
|
||||
sops
|
||||
nvd
|
||||
];
|
||||
containerLambda =
|
||||
name: tag: pkgs':
|
||||
let
|
||||
pkgs = import pkgs' { inherit system; };
|
||||
in
|
||||
pkgs.dockerTools.buildImageWithNixDb {
|
||||
name = "git.flyinggecko.org/oci-images/nixos-runner/${name}";
|
||||
tag = tag;
|
||||
copyToRoot =
|
||||
with pkgs;
|
||||
(imagePackages pkgs)
|
||||
++ [
|
||||
(pkgs.writeTextFile {
|
||||
name = "passwd";
|
||||
destination = "/etc/passwd";
|
||||
text = builtins.concatStringsSep "\n" [
|
||||
"root:x:0:0:System administrator:/root:/bin/bash"
|
||||
"nixbld1:x:30001:30000:Nix build user 1:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld2:x:30002:30000:Nix build user 2:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld3:x:30003:30000:Nix build user 3:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld4:x:30004:30000:Nix build user 4:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld5:x:30005:30000:Nix build user 5:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld6:x:30006:30000:Nix build user 6:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld7:x:30007:30000:Nix build user 7:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld8:x:30008:30000:Nix build user 8:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld9:x:30009:30000:Nix build user 9:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld10:x:30010:30000:Nix build user 10:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld11:x:30011:30000:Nix build user 11:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld12:x:30012:30000:Nix build user 12:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld13:x:30013:30000:Nix build user 13:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld14:x:30014:30000:Nix build user 14:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld15:x:30015:30000:Nix build user 15:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld16:x:30016:30000:Nix build user 16:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld17:x:30017:30000:Nix build user 17:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld18:x:30018:30000:Nix build user 18:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld19:x:30019:30000:Nix build user 19:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld20:x:30020:30000:Nix build user 20:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld21:x:30021:30000:Nix build user 21:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld22:x:30022:30000:Nix build user 22:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld23:x:30023:30000:Nix build user 23:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld24:x:30024:30000:Nix build user 24:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld25:x:30025:30000:Nix build user 25:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld26:x:30026:30000:Nix build user 26:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld27:x:30027:30000:Nix build user 27:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld28:x:30028:30000:Nix build user 28:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld29:x:30029:30000:Nix build user 29:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld30:x:30030:30000:Nix build user 30:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld31:x:30031:30000:Nix build user 31:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nixbld32:x:30032:30000:Nix build user 32:/var/empty:/run/current-system/sw/bin/nologin"
|
||||
"nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:/run/current-system/sw/bin/nologin"
|
||||
];
|
||||
})
|
||||
(pkgs.writeTextFile {
|
||||
name = "group";
|
||||
destination = "/etc/group";
|
||||
text = builtins.concatStringsSep "\n" [
|
||||
"root:x:0:"
|
||||
"wheel:x:1:"
|
||||
"kmem:x:2:"
|
||||
"tty:x:3:"
|
||||
"messagebus:x:4:"
|
||||
"disk:x:6:"
|
||||
"audio:x:17:"
|
||||
"floppy:x:18:"
|
||||
"uucp:x:19:"
|
||||
"lp:x:20:"
|
||||
"cdrom:x:24:"
|
||||
"tape:x:25:"
|
||||
"video:x:26:"
|
||||
"dialout:x:27:"
|
||||
"utmp:x:29:"
|
||||
"adm:x:55:"
|
||||
"keys:x:96:"
|
||||
"users:x:100:"
|
||||
"input:x:174:"
|
||||
"nixbld:x:30000:nixbld1,nixbld10,nixbld11,nixbld12,nixbld13,nixbld14,nixbld15,nixbld16,nixbld17,nixbld18,nixbld19,nixbld2,nixbld20,nixbld21,nixbld22,nixbld23,nixbld24,nixbld25,nixbld26,nixbld27,nixbld28,nixbld29,nixbld3,nixbld30,nixbld31,nixbld32,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9"
|
||||
"nogroup:x:65534:"
|
||||
];
|
||||
})
|
||||
(pkgs.writeTextFile {
|
||||
name = "nsswitch.conf";
|
||||
destination = "/etc/nsswitch.conf";
|
||||
text = builtins.concatStringsSep "\n" [
|
||||
"passwd: files mymachines systemd"
|
||||
"group: files mymachines systemd"
|
||||
"shadow: files"
|
||||
"hosts: files mymachines dns myhostname"
|
||||
"networks: files"
|
||||
"ethers: files"
|
||||
"services: files"
|
||||
"protocols: files"
|
||||
"rpc: files"
|
||||
];
|
||||
})
|
||||
(pkgs.writeTextFile {
|
||||
name = "nix.conf";
|
||||
destination = "/etc/nix/nix.conf";
|
||||
text = builtins.concatStringsSep "\n" [
|
||||
"accept-flake-config = true"
|
||||
"experimental-features = nix-command flakes"
|
||||
"substituters = https://cache.nixos.org"
|
||||
"trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
];
|
||||
})
|
||||
];
|
||||
extraCommands = builtins.concatStringsSep "\n" [
|
||||
# /usr/bin/env
|
||||
"mkdir usr"
|
||||
"ln -s ../bin usr/bin"
|
||||
# create /tmp
|
||||
"mkdir -m 1777 tmp"
|
||||
# root needs a home
|
||||
"mkdir -vp root"
|
||||
];
|
||||
config = {
|
||||
Cmd = [ "/bin/bash" ];
|
||||
Env = [
|
||||
"LANG=en_GB.UTF-8"
|
||||
"ENV=/etc/profile.d/nix.sh"
|
||||
"BASH_ENV=/etc/profile.d/nix.sh"
|
||||
"NIX_BUILD_SHELL=/bin/bash"
|
||||
"NIX_PATH=nixpkgs=${./fake_nixpkgs}"
|
||||
"PAGER=cat"
|
||||
"PATH=/usr/bin:/bin"
|
||||
"SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
||||
"USER=root"
|
||||
];
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
packages = {
|
||||
nixos-2411 = containerLambda "nixos" "24.11" nixpkgs;
|
||||
nixos-unstable = containerLambda "nixos" "unstable" nixpkgs-unstable;
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue