Builder is working, kinda

.github/workflows/build.yml

@@ -20,6 +20,5 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - run: |
-          nix build ".#${{ matrix.image }}"
-          podman import result "src.thehellings.com/greg/${{ matrix.image }}"
+          nix run ".#${{ matrix.image }}.importToPodman"
           podman images

flake.nix

@@ -28,24 +28,28 @@
           ...
         }:
         let
-            lib' = import ./lib { inherit (pkgs) lib; };
+          lib' = import ./lib.nix {
+            inherit (inputs.nix2container.packages.${system}) nix2container;
+            inherit (pkgs) lib;
+          };
         in
         {
           _module.args = {
             pkgs = import nixpkgs {
               inherit system;
               config.allowUnfree = true;
-            };
               lib = lib';
             };
+          };
           packages =
             let
               inherit (pkgs) callPackage;
-              name = n: "registry.thehellings.com/greg/ci-images/${n}";
+              name = n: "src.thehellings.com/greg/${n}";
             in
             {
+              base = lib'.baseImage pkgs;
               bitwarden = callPackage ./img/bitwarden.nix { inherit name; };
-              builder = callPackage ./img/builder.nix { inherit name; };
+              builder = callPackage ./img/builder.nix { inherit name lib'; };
               immich = callPackage ./img/immich.nix { inherit name; };
               sword-container-builder = callPackage ./img/sword-container-builder.nix { inherit name; };
               vm-test = callPackage ./img/vm-test.nix { inherit name; };

img/builder.nix

@@ -1,21 +1,19 @@
 {
-  bashInteractive,
   buildah,
-  dockerTools,
   git,
-  lib,
+  lib',
   nix,
   nix-output-monitor,
   pkgs,
   podman,
-  writeShellApplication,
+  writeTextFile,
 
   name,
   ...
 }:
 let
   policy = (
-    pkgs.writeTextFile {
+    writeTextFile {
       name = "policy.json";
       text = ''
         {
@@ -25,49 +23,34 @@ let
       destination = "/etc/containers/policy.json";
     }
   );
-  activate = writeShellApplication {
-    name = "activate";
-    runtimeInputs = [ bashInteractive ];
+  nix-conf = writeTextFile {
+    name = "nix.conf";
     text = ''
-      mkdir -p /etc/containers
-      cp ${policy}/etc/containers/policy.json /etc/containers/policy.json;
-      bash "$@"
+      experimental-features = nix-command flakes
     '';
+    destination = "/etc/nix/nix.conf";
   };
 in
-(import "${nix.src.outPath}/docker.nix" {
-  inherit pkgs;
+lib'.mkImage pkgs {
   name = name "builder";
-  tag = "latest";
-
-  bundleNixpkgs = false;
-  Cmd = [
-    (lib.getExe activate)
+  copyToRoot = pkgs.buildEnv {
+    name = "policy";
+    paths = [
+      policy
+      nix-conf
     ];
-  extraPkgs = [
+  };
+  initializeNixDatabase = true;
+  layers = [
+    {
+      deps = [
         buildah
-    dockerTools.caCertificates
+        git
+        nix
         nix-output-monitor
         podman
         policy
       ];
-  flake-registry = (pkgs.formats.json { }).generate "flake-registry.json" ({
-    version = 2;
-    flakes.nixpkgs = {
-      exact = true;
-      from = {
-        id = "nixpkgs";
-        type = "indirect";
-      };
-      to = "${pkgs.path}";
-    };
-  });
-  gitMinimal = git; # We want the full version in this
-  maxLayers = 111;
-  nixConf = {
-    experimental-features = [
-      "nix-command"
-      "flakes"
+    }
   ];
-  };
-})
+}

lib.nix

@@ -1,45 +1,65 @@
-{ lib, nix2container, pkgs, ... }:
+{ nix2container, lib, ... }:
 
-lib.extend (
-	final: prev: {
-		img = {
-			baseImage = final.img.mkImage {
-				name = "base";
-				layers = [
-					(final.img.baseLayer pkgs)
-				];
+rec {
+  baseImage =
+    pkgs:
+    mkImage {
+      inherit pkgs;
+      name = "src.thehellings.com/greg/base";
     };
 
-			baseLayer = pkgs: with pkgs; {
+  baseLayer =
+    pkgs: with pkgs; {
       deps = [
+        (pkgs.buildEnv {
+          name = "base-env";
+          paths = [
             bashInteractive
-					coreutils
+            coreutils-full
             dockerTools.binSh
             dockerTools.caCertificates
+            dockerTools.shadowSetup
             dockerTools.usrBinEnv
             findutils
             gnugrep
             gnused
           ];
+        })
+      ];
     };
 
-			foldLayers = let
-				merge = parents: current: let
-					layer = nix2container.buildlayer( current // {
+  foldLayers =
+    let
+      merge =
+        parents: current:
+        let
+          layer = nix2container.buildLayer (
+            current
+            // {
               layers = parents;
-					});
+            }
+          );
         in
         parents ++ [ layer ];
     in
-				layers: final.foldl merge [] layers;
+    layers: lib.foldl merge [ ] layers;
 
-			mkImage = {
-				name,
-				layers ? [],
-			}: nix2container.buildImage {
-				inherit name;
-				layers = final.img.foldLayers layers;
-			};
+  mkImage =
+    pkgs: config:
+    let
+      base = baseLayer pkgs;
+      path = pkgs.lib.makeBinPath (base.deps ++ lib.flatten (builtins.map (e: e.deps) config.layers));
+    in
+    nix2container.buildImage (
+      (lib.mergeAttrs {
+        tag = "latest";
+        config = {
+          Env = [ "PATH=${path}" ];
+          Cmd = [ "${pkgs.bashInteractive}/bin/bash" ];
         };
+      } config)
+      // {
+        layers = foldLayers ([ base ] ++ config.layers);
       }
-)
+    );
+}