ci-images/img/builder.nix

{
  buildah,
  fakeNss,
  git,
  lib',
  nix,
  nix-output-monitor,
  nodejs_24,
  podman,
  writeTextFile,

  name,
  ...
}:
let
  policy = (
    writeTextFile {
      name = "policy.json";
      text = ''
        {
          "default": [{"type": "insecureAcceptAnything"}]
        }
      '';
      destination = "/etc/containers/policy.json";
    }
  );
  nix-conf = writeTextFile {
    name = "nix.conf";
    text = ''
      extra-experimental-features = nix-command flakes
    '';
    destination = "/etc/nix/nix.conf";
  };
in
lib'.mkImage {
  name = name "builder";
  contents = lib'.basePackages ++ [
    buildah
    (fakeNss.override {
      extraPasswdLines = [
        "nixbld:x:1001:1001:Build user:/home/nixbld:/noshell"
      ];
      extraGroupLines = [
        "nixbld:!:1001:nixbld"
      ];
    })
    git
    nix
    nix-conf
    nix-output-monitor
    nodejs_24
    podman
    policy
  ];
  includeNixDB = true;
}