From d84e7842a56b648d3ef6353983c7096d0447c525 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Mon, 23 May 2022 12:04:04 +0200 Subject: [PATCH 1/3] nixos/doc: document fakeNss, binSh --- doc/builders/images/dockertools.section.md | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md index 2a41d48cf134..29b5245d687e 100644 --- a/doc/builders/images/dockertools.section.md +++ b/doc/builders/images/dockertools.section.md @@ -321,3 +321,31 @@ buildImage { ``` Creating base files like `/etc/passwd` or `/etc/login.defs` is necessary for shadow-utils to manipulate users and groups. + +## fakeNss {#ssec-pkgs-dockerTools-fakeNss} + +If your primary goal is providing a basic skeleton for user lookups to work, +and/or a lesser privileged user, adding `pkgs.fakeNss` to +`build*Image.contents` might be the better choice than a custom script running +`useradd` and friends. + +It provides a `/etc/passwd` and `/etc/group`, containing `root` and `nobody` +users and groups. + +It also provides a `/etc/nsswitch.conf`, configuring NSS host resolution to +first check `/etc/hosts`, before checking DNS, as the default in the absence of +a config file (`dns [!UNAVAIL=return] files`) is quite unexpected. + +You usually might to pair it with binSh, which provides `bin/sh` as a symlink +to `bashInteractive` (as `/bin/sh` is configured as a shell). + +```nix +buildImage { + name = "shadow-basic"; + + contents = [ + binSh + fakeNss + ] +} +``` From 4393ed86794fa4e66161829d56937c8f135697ce Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Mon, 23 May 2022 23:34:54 +0200 Subject: [PATCH 2/3] Update doc/builders/images/dockertools.section.md Co-authored-by: Robert Hensing --- doc/builders/images/dockertools.section.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md index 29b5245d687e..89b35841d755 100644 --- a/doc/builders/images/dockertools.section.md +++ b/doc/builders/images/dockertools.section.md @@ -336,7 +336,7 @@ It also provides a `/etc/nsswitch.conf`, configuring NSS host resolution to first check `/etc/hosts`, before checking DNS, as the default in the absence of a config file (`dns [!UNAVAIL=return] files`) is quite unexpected. -You usually might to pair it with binSh, which provides `bin/sh` as a symlink +You can pair it with `binSh`, which provides `bin/sh` as a symlink to `bashInteractive` (as `/bin/sh` is configured as a shell). ```nix From 6e254a6c353b800234245daa071786bb5e6f44cd Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Mon, 1 Aug 2022 13:41:41 +0700 Subject: [PATCH 3/3] nixos/doc: update contents to copyToRoot contents is deprecated now, use the copyToRoot attribute. --- doc/builders/images/dockertools.section.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md index 89b35841d755..d8deb6cfbc8c 100644 --- a/doc/builders/images/dockertools.section.md +++ b/doc/builders/images/dockertools.section.md @@ -326,8 +326,8 @@ Creating base files like `/etc/passwd` or `/etc/login.defs` is necessary for sha If your primary goal is providing a basic skeleton for user lookups to work, and/or a lesser privileged user, adding `pkgs.fakeNss` to -`build*Image.contents` might be the better choice than a custom script running -`useradd` and friends. +the container image root might be the better choice than a custom script +running `useradd` and friends. It provides a `/etc/passwd` and `/etc/group`, containing `root` and `nobody` users and groups. @@ -343,9 +343,10 @@ to `bashInteractive` (as `/bin/sh` is configured as a shell). buildImage { name = "shadow-basic"; - contents = [ - binSh - fakeNss - ] + copyToRoot = pkgs.buildEnv { + name = "image-root"; + paths = [ binSh pkgs.fakeNss ]; + pathsToLink = [ "/bin" "/etc" "/var" ]; + }; } ```