diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 30fc03f..40d56b1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,6 +20,5 @@ jobs: steps: - uses: actions/checkout@v5 - run: | - nix build ".#${{ matrix.image }}" - podman import result "src.thehellings.com/greg/${{ matrix.image }}" + nix run ".#${{ matrix.image }}.importToPodman" podman images diff --git a/flake.nix b/flake.nix index eb07123..2847e93 100644 --- a/flake.nix +++ b/flake.nix @@ -28,24 +28,28 @@ ... }: let - lib' = import ./lib { inherit (pkgs) lib; }; + lib' = import ./lib.nix { + inherit (inputs.nix2container.packages.${system}) nix2container; + inherit (pkgs) lib; + }; in { _module.args = { pkgs = import nixpkgs { - inherit system; - config.allowUnfree = true; + inherit system; + config.allowUnfree = true; + lib = lib'; }; - lib = lib'; }; packages = let inherit (pkgs) callPackage; - name = n: "registry.thehellings.com/greg/ci-images/${n}"; + name = n: "src.thehellings.com/greg/${n}"; in { + base = lib'.baseImage pkgs; bitwarden = callPackage ./img/bitwarden.nix { inherit name; }; - builder = callPackage ./img/builder.nix { inherit name; }; + builder = callPackage ./img/builder.nix { inherit name lib'; }; immich = callPackage ./img/immich.nix { inherit name; }; sword-container-builder = callPackage ./img/sword-container-builder.nix { inherit name; }; vm-test = callPackage ./img/vm-test.nix { inherit name; }; diff --git a/img/builder.nix b/img/builder.nix index ee8cac3..162565f 100644 --- a/img/builder.nix +++ b/img/builder.nix @@ -1,21 +1,19 @@ { - bashInteractive, buildah, - dockerTools, git, - lib, + lib', nix, nix-output-monitor, pkgs, podman, - writeShellApplication, + writeTextFile, name, ... }: let policy = ( - pkgs.writeTextFile { + writeTextFile { name = "policy.json"; text = '' { @@ -25,49 +23,34 @@ let destination = "/etc/containers/policy.json"; } ); - activate = writeShellApplication { - name = "activate"; - runtimeInputs = [ bashInteractive ]; + nix-conf = writeTextFile { + name = "nix.conf"; text = '' - mkdir -p /etc/containers - cp ${policy}/etc/containers/policy.json /etc/containers/policy.json; - bash "$@" + experimental-features = nix-command flakes ''; + destination = "/etc/nix/nix.conf"; }; in -(import "${nix.src.outPath}/docker.nix" { - inherit pkgs; +lib'.mkImage pkgs { name = name "builder"; - tag = "latest"; - - bundleNixpkgs = false; - Cmd = [ - (lib.getExe activate) - ]; - extraPkgs = [ - buildah - dockerTools.caCertificates - nix-output-monitor - podman - policy - ]; - flake-registry = (pkgs.formats.json { }).generate "flake-registry.json" ({ - version = 2; - flakes.nixpkgs = { - exact = true; - from = { - id = "nixpkgs"; - type = "indirect"; - }; - to = "${pkgs.path}"; - }; - }); - gitMinimal = git; # We want the full version in this - maxLayers = 111; - nixConf = { - experimental-features = [ - "nix-command" - "flakes" + copyToRoot = pkgs.buildEnv { + name = "policy"; + paths = [ + policy + nix-conf ]; }; -}) + initializeNixDatabase = true; + layers = [ + { + deps = [ + buildah + git + nix + nix-output-monitor + podman + policy + ]; + } + ]; +} diff --git a/lib.nix b/lib.nix index d017eb3..2860d1f 100644 --- a/lib.nix +++ b/lib.nix @@ -1,45 +1,65 @@ -{ lib, nix2container, pkgs, ... }: +{ nix2container, lib, ... }: -lib.extend ( - final: prev: { - img = { - baseImage = final.img.mkImage { - name = "base"; - layers = [ - (final.img.baseLayer pkgs) - ]; - }; +rec { + baseImage = + pkgs: + mkImage { + inherit pkgs; + name = "src.thehellings.com/greg/base"; + }; - baseLayer = pkgs: with pkgs; { - deps = [ - bashInteractive - coreutils - dockerTools.binSh - dockerTools.caCertificates - dockerTools.usrBinEnv - findutils - gnugrep - gnused - ]; - }; + baseLayer = + pkgs: with pkgs; { + deps = [ + (pkgs.buildEnv { + name = "base-env"; + paths = [ + bashInteractive + coreutils-full + dockerTools.binSh + dockerTools.caCertificates + dockerTools.shadowSetup + dockerTools.usrBinEnv + findutils + gnugrep + gnused + ]; + }) + ]; + }; - foldLayers = let - merge = parents: current: let - layer = nix2container.buildlayer( current // { - layers = parents; - }); - in - parents ++ [ layer ]; - in - layers: final.foldl merge [] layers; + foldLayers = + let + merge = + parents: current: + let + layer = nix2container.buildLayer ( + current + // { + layers = parents; + } + ); + in + parents ++ [ layer ]; + in + layers: lib.foldl merge [ ] layers; - mkImage = { - name, - layers ? [], - }: nix2container.buildImage { - inherit name; - layers = final.img.foldLayers layers; - }; - }; - } -) + mkImage = + pkgs: config: + let + base = baseLayer pkgs; + path = pkgs.lib.makeBinPath (base.deps ++ lib.flatten (builtins.map (e: e.deps) config.layers)); + in + nix2container.buildImage ( + (lib.mergeAttrs { + tag = "latest"; + config = { + Env = [ "PATH=${path}" ]; + Cmd = [ "${pkgs.bashInteractive}/bin/bash" ]; + }; + } config) + // { + layers = foldLayers ([ base ] ++ config.layers); + } + ); +}