The streamLayeredImage wrapper invokes the image streamer at build time on
the build platform. It was built with makeWrapper, which bakes
targetPackages.runtimeShell into the shebang. Under cross compilation that
is the host shell, so the wrapper is not executable on the builder and
crashes (e.g. a Linux image built on a Darwin builder segfaults the
streamer).
This was fixed by switching to pkgsBuildBuild.makeWrapper (build == host == target)
so the shebang points at the build-platform shell.
The string added to `configureFlags` for building `hello`
for nixosTests example
«layered image with files owned by a user other than root»
had a leading space, leading to error
configure flags: --disable-dependency-tracking --prefix=/nix/store/kwdkh22lfr3irggg076jpydbk1556iax-hello-2.12.3 \ --program-prefix=layeredImageWithFakeRootCommands-
configure: error: invalid variable name: ' --program-prefix'
when running `./configure` for that custom `hello`, making
`nixosTests.allDrivers.docker-tools` fail.
The nobody/nogroup pair of should only ever be used by NFS to map remote
uid/guids that are missing locally. Every other use is an abuse and
generally a security concern.
Specifically, they're NOT some special user/group that can be used to
run programs without giving them any privileges. In fact, the opposite
is true: the more programs you run as nobody/nogroup the more valuable
files and resources become accessible to "nobody" and consequently
exposed to a potentially compromised program.
This removes mentions of nobody/nogroup from documentation and examples.
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
dockerTools streamNixShellImage implements a facsimile of the
environment created by the Nix build process. In order to keep track of
the Nix features implemented, the streamNixShellImage code has comments
containing hyperlinks indicating the corresponding Nix C++ code in the
GitHub repository.
As Nix 2.32.0 has now been released [1], this patch updates the GitHub
links to correspond to the code in the new version.
[1] https://discourse.nixos.org/t/nix-2-32-0-released/70528
This broke with #417132 where the previous behaviour of suppressing
errors of the export into $NIX_BUILD_TOP/env-vars when dumping env vars.
This error seems to stem from the non-existance of $NIX_BUILD_TOP. This
fix ensures the NIX_BUILD_TOP propagates into the proot environment.
Fixes build failure for nixos.tests.docker-tools.
The tar command below the changed line relied on the $out directory
being created but it is not being created after the commit below.
97ed6b4565
Closes#259770Closes#207050
The motivation for the former is to not execute the container as root,
so you don't have to `sudo -i` to perform podman management tasks.
The idea behind healthchecks is to be able to keep the unit in the
activating state until the container is healthy, only then then unit is
marked as active.
The following changes were necessary:
* Move the ctr-id into `/run/${containerName}` to make podman can
actually write to it since it's now in its RuntimeDirectory.
* Make `sdnotify` option configurable (`healthy` for healthchecks that
must pass, default remains `conmon`).
* Set Delegate=yes for `sdnotify=healthy` to make sure a rootless
container can actually talk to sd_notify[1].
* Add a warning that lingering must be enabled to have a `systemd --user`
instance running which is required for the cgroup support to work
properly.
* Added a testcase for rootless containers with both conmon and
healthchecks.
[1] https://github.com/containers/podman/discussions/20573#discussioncomment-7612481
When building with structuredAttrs, two things would happen:
- sourcing stdenv would fail, because $stdenv is not set.
- the error is swallowed because bash is called without -e.
Thus, the build appears to be successful at first, but could fail later
when anything depends on a sourced stdenv.
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
--argstr baseRev 78e9caf153
result/bin/apply-formatting $NIXPKGS_PATH
Since nix 2.20, `nix-store --add-fixed` doesn't accept paths where the
parent directory is a symlink. On macOS, /tmp is a symlink to
/private/tmp, which causes a "'/tmp' is a symlink" error:
```
$ nix run github:nixos/nixpkgs/24.11-beta#nix-prefetch-git -- --url https://github.com/IFTTT/polo.git --rev 316aa2ac210a45a7fc400ab921831493d5dd21b8 --hash sha256
Initialized empty Git repository in /private/tmp/git-checkout-tmp-1Bf9bIv7/polo-316aa2a/.git/
remote: Enumerating objects: 51, done.
remote: Counting objects: 100% (51/51), done.
remote: Compressing objects: 100% (42/42), done.
remote: Total 51 (delta 8), reused 19 (delta 5), pack-reused 0 (from 0)
Unpacking objects: 100% (51/51), 19.57 KiB | 541.00 KiB/s, done.
From https://github.com/IFTTT/polo
* branch HEAD -> FETCH_HEAD
Switched to a new branch 'fetchgit'
removing `.git'...
error: path '/tmp' is a symlink
```
Avoid this by resolving /tmp to a real directory in all the prefetch scripts
Allow customisation of the algorithm used to convert nix references
graph (created from docker image contents) to docker layers.
A collection of building blocks (python functions) is provided, which
use can assembled into a processing pipeline by specifying a list of
operations (and their initial arguments) via a nix list.
Nix references graph if first converted into a python igraph.Graph
object (with each vertex representing a nix path), which is then fed
into the user defined pipeline. Each stage in the pipeline represents a
function call, with initial arguments specified by the user in nix, and
the last argument being the result of the previous stage in the pipeline
(or the initial Graph object). Each step of the pipeline is expected to
produce a data structure consisting of arbitrarily nested lists/dicts
with Graph objects (representing docker layers) at it's leafs. The
result of the last stage in the pipeline is recursively flattened (with
each dict converted into list of values), until a flat list of Graphs
remains. This is then output as a json array of arrays (each Graph
converted into an array of paths).
This functionality is made available via new `layeringPipeline` argument
to the `streamLayeredImage`/`buildLayeredImage` functions. The default
value of the argument has been chosen to to preserve current layering
behaviour.
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Setting the image creation timestamp in the image metadata to a
constant date can cause problems with self-hosted container
registries, that need to e.g. prune old images. This timestamp is
also useful for debugging.
However, it is almost never useful to set the filesystem timestamp to
a constant value. Doing so not only causes the image to possibly no
longer be reproducible, but also removes any possibility of
deduplicating layers with other images, causing unnecessary storage
space usage.
Therefore, this commit introduces "mtime", a new parameter to
streamLayeredImage, which allows specifying the filesystem timestamps
separately from "created". For backwards compatibility, "mtime"
defaults to the value of "created".
Jörg Thalheim