From 6ef687cdfbc2d0ff194a4dfc7648762f66fe3836 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Wed, 3 Jun 2026 16:49:27 +0500 Subject: [PATCH] chore: remove Nix dev image from dogfood template and pipeline (#26022) --- .github/workflows/dogfood.yaml | 87 ++------ dogfood/coder/main.tf | 8 +- flake.nix | 65 +----- nix/docker.nix | 393 --------------------------------- 4 files changed, 30 insertions(+), 523 deletions(-) delete mode 100644 nix/docker.nix diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml index c87b48b5ee..9eef88cf9b 100644 --- a/.github/workflows/dogfood.yaml +++ b/.github/workflows/dogfood.yaml @@ -16,28 +16,26 @@ on: # registry); the Docker Hub push is gated on # `github.ref == 'refs/heads/main'`. Fork PRs skip the entire # base+mise-oci pipeline since GITHUB_TOKEN is read-only for - # packages; the nix matrix entry still runs. + # packages. # `deploy_template` runs `terraform init` + `validate` only; the # apply step and SHA/title gathering are gated on main. # # Pushes to main: `build_image` retags rolling tags on - # `codercom/oss-dogfood` (`:latest`, `:22.04`, `:26.04`), - # `codercom/oss-dogfood-vscode-coder` (`:latest`), and - # `codercom/oss-dogfood-nix` (`:latest`), plus a per-branch tag on - # each. The image-tooling validation runs as above before any - # push, so a broken image never reaches Docker Hub. + # `codercom/oss-dogfood` (`:latest`, `:22.04`, `:26.04`) and + # `codercom/oss-dogfood-vscode-coder` (`:latest`), plus a + # per-branch tag on each. The image-tooling validation runs as + # above before any push, so a broken image never reaches Docker + # Hub. # `deploy_template` runs `terraform apply` and creates new # `coderd_template` versions on dev.coder.com whose `name` is the - # commit short SHA. Content is unchanged when neither `dogfood/**` - # nor the flake files changed, so the new versions are cosmetic. + # commit short SHA. Content is unchanged when `dogfood/**` is + # unchanged, so the new versions are cosmetic. push: branches: - main paths: - "dogfood/**" - ".github/workflows/dogfood.yaml" - - "flake.lock" - - "flake.nix" - "mise.toml" - "mise.lock" - "scripts/dogfood/**" @@ -46,8 +44,6 @@ on: paths: - "dogfood/**" - ".github/workflows/dogfood.yaml" - - "flake.lock" - - "flake.nix" - "mise.toml" - "mise.lock" - "scripts/dogfood/**" @@ -62,7 +58,7 @@ jobs: strategy: fail-fast: false matrix: - image-version: ["22.04", "26.04", "nix"] + image-version: ["22.04", "26.04"] if: github.actor != 'dependabot[bot]' # Skip Dependabot PRs runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} @@ -83,34 +79,6 @@ jobs: with: persist-credentials: false - - name: Setup Nix - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34 - with: - # Pinning to 2.28 here, as Nix gets a "error: [json.exception.type_error.302] type must be array, but is string" - # on version 2.29 and above. - nix_version: "2.28.5" - if: matrix.image-version == 'nix' - - - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2 - with: - # restore and save a cache using this key - primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} - # if there's no cache hit, restore a cache by this prefix - restore-prefixes-first-match: nix-${{ runner.os }}- - # collect garbage until Nix store size (in bytes) is at most this number - # before trying to save a new cache - # 1G = 1073741824 - gc-max-store-size-linux: 5G - # do purge caches - purge: true - # purge all versions of the cache - purge-prefixes: nix-${{ runner.os }}- - # created more than this number of seconds ago relative to the start of the `Post Restore` phase - purge-created: 0 - # except the version with the `primary-key`, if it exists - purge-primary-key: never - if: matrix.image-version == 'nix' - - name: Get branch name id: branch-name uses: tj-actions/branch-names@5250492686b253f06fa55861556d1027b067aeb5 # v9.0.2 @@ -126,21 +94,19 @@ jobs: - name: Set up Depot CLI uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1 - if: matrix.image-version != 'nix' - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - if: matrix.image-version != 'nix' - name: Set up mise tools - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} uses: ./.github/actions/setup-mise - name: Compute image SHAs # Match the fork guard on the downstream consumers of these # outputs: nothing reads `steps.shas.outputs.*` outside the # base-push + mise-oci pipeline, which is gated below. - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} id: shas env: IMAGE_VERSION: ${{ matrix.image-version }} @@ -153,8 +119,8 @@ jobs: - name: Login to GHCR # Fork PRs get a read-only GITHUB_TOKEN that cannot push to # ghcr.io. Skip the entire GHCR-dependent pipeline (base push + - # mise oci build) for fork PRs; the nix matrix entry still runs. - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + # mise oci build) for fork PRs. + if: ${{ !github.event.pull_request.head.repo.fork }} uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ghcr.io @@ -170,7 +136,7 @@ jobs: - name: Build base image uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0 - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} with: project: b4q6ltmpzh token: ${{ secrets.DEPOT_TOKEN }} @@ -191,7 +157,7 @@ jobs: ghcr.io/coder/oss-dogfood-base:${{ matrix.image-version }}-${{ steps.docker-tag-name.outputs.tag }} - name: Build mise oci layer - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} env: IMAGE_VERSION: ${{ matrix.image-version }} BASE_SHA: ${{ steps.shas.outputs.base_sha }} @@ -210,7 +176,7 @@ jobs: # daemon command, but its built-in registry server gives us a # simple two-hop path with no extra dependencies. - name: Load mise oci image into Docker daemon - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} env: IMAGE_VERSION: ${{ matrix.image-version }} run: | @@ -230,7 +196,7 @@ jobs: # lint, and a fat build inside it. Failures here block the # Docker Hub push below so broken images never reach workspaces. - name: Test image tooling - if: matrix.image-version != 'nix' && !github.event.pull_request.head.repo.fork + if: ${{ !github.event.pull_request.head.repo.fork }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: ./scripts/dogfood_test_image.sh "dogfood-test:${{ matrix.image-version }}" @@ -279,25 +245,6 @@ jobs: tags: "codercom/oss-dogfood-vscode-coder:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood-vscode-coder:latest" if: matrix.image-version == '22.04' - - name: Build Nix image - run: nix build .#dev_image - if: matrix.image-version == 'nix' - - - name: Push Nix image - if: matrix.image-version == 'nix' && github.ref == 'refs/heads/main' - run: | - docker load -i result - - CURRENT_SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem') - - docker image tag "codercom/oss-dogfood-nix:latest-$CURRENT_SYSTEM" "codercom/oss-dogfood-nix:${DOCKER_TAG}" - docker image push "codercom/oss-dogfood-nix:${DOCKER_TAG}" - - docker image tag "codercom/oss-dogfood-nix:latest-$CURRENT_SYSTEM" "codercom/oss-dogfood-nix:latest" - docker image push "codercom/oss-dogfood-nix:latest" - env: - DOCKER_TAG: ${{ steps.docker-tag-name.outputs.tag }} - deploy_template: needs: build_image runs-on: ubuntu-latest diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf index ad576e543f..29eb753b5e 100644 --- a/dogfood/coder/main.tf +++ b/dogfood/coder/main.tf @@ -126,8 +126,7 @@ locals { // Older style option values, where the option value was just supposed to // be the exact name of the image on Docker hub. In practice, this is rather // restrictive because the image_type parameter is immutable. - "codercom/oss-dogfood:latest" = "codercom/oss-dogfood:latest" - "codercom/oss-dogfood-nix:latest" = "codercom/oss-dogfood-nix:latest" + "codercom/oss-dogfood:latest" = "codercom/oss-dogfood:latest" "ubuntu-latest" = "codercom/oss-dogfood:26.04" } @@ -148,11 +147,6 @@ data "coder_parameter" "image_type" { name = "Ubuntu 22.04 (Legacy)" value = "codercom/oss-dogfood:latest" } - option { - icon = "/icon/nix.svg" - name = "Dogfood Nix (Experimental)" - value = "codercom/oss-dogfood-nix:latest" - } } locals { diff --git a/flake.nix b/flake.nix index 5b92eb07ce..0494413197 100644 --- a/flake.nix +++ b/flake.nix @@ -263,8 +263,6 @@ ] ++ frontendPackages; - docker = pkgs.callPackage ./nix/docker.nix { }; - # buildSite packages the site directory. buildSite = pnpm2nix.packages.${system}.mkPnpmPackage { inherit nodejs pnpm; @@ -340,59 +338,20 @@ }; }; - packages = - { - default = packages.${system}; + packages = { + default = packages.${system}; - proto_gen_go = proto_gen_go_1_30; - site = buildSite; + proto_gen_go = proto_gen_go_1_30; + site = buildSite; - # Copying `OS_ARCHES` from the Makefile. - x86_64-linux = buildFat "linux_amd64"; - aarch64-linux = buildFat "linux_arm64"; - x86_64-darwin = buildFat "darwin_amd64"; - aarch64-darwin = buildFat "darwin_arm64"; - x86_64-windows = buildFat "windows_amd64.exe"; - aarch64-windows = buildFat "windows_arm64.exe"; - } - // (pkgs.lib.optionalAttrs pkgs.stdenv.isLinux { - dev_image = docker.buildNixShellImage rec { - name = "codercom/oss-dogfood-nix"; - tag = "latest-${system}"; - - # (ThomasK33): Workaround for images with too many layers (>64 layers) causing sysbox - # to have issues on dogfood envs. - maxLayers = 32; - - uname = "coder"; - homeDirectory = "/home/${uname}"; - releaseName = version; - - drv = devShells.default.overrideAttrs (oldAttrs: { - buildInputs = - (with pkgs; [ - coreutils - nix.out - curl.bin # Ensure the actual curl binary is included in the PATH - glibc.bin # Ensure the glibc binaries are included in the PATH - jq.bin - binutils # ld and strings - filebrowser # Ensure that we're not redownloading filebrowser on each launch - systemd.out - service-wrapper - docker_26 - shadow.out - su - ncurses.out # clear - unzip - zip - gzip - procps # free - ]) - ++ oldAttrs.buildInputs; - }); - }; - }); + # Copying `OS_ARCHES` from the Makefile. + x86_64-linux = buildFat "linux_amd64"; + aarch64-linux = buildFat "linux_arm64"; + x86_64-darwin = buildFat "darwin_amd64"; + aarch64-darwin = buildFat "darwin_arm64"; + x86_64-windows = buildFat "windows_amd64.exe"; + aarch64-windows = buildFat "windows_arm64.exe"; + }; } ); } diff --git a/nix/docker.nix b/nix/docker.nix deleted file mode 100644 index 9455c74c81..0000000000 --- a/nix/docker.nix +++ /dev/null @@ -1,393 +0,0 @@ -# (ThomasK33): Inlined the relevant dockerTools functions, so that we can -# set the maxLayers attribute on the attribute set passed -# to the buildNixShellImage function. -# -# I'll create an upstream PR to nixpkgs with those changes, making this -# eventually unnecessary and ripe for removal. -{ - lib, - dockerTools, - devShellTools, - bashInteractive, - fakeNss, - runCommand, - writeShellScriptBin, - writeText, - writeTextFile, - writeTextDir, - cacert, - storeDir ? builtins.storeDir, - pigz, - zstd, - stdenv, - glibc, - sudo, -}: -let - inherit (lib) - optionalString - ; - - inherit (devShellTools) - valueToString - ; - - inherit (dockerTools) - streamLayeredImage - usrBinEnv - caCertificates - ; - - # This provides /bin/sh, pointing to bashInteractive. - # The use of bashInteractive here is intentional to support cases like `docker run -it `, so keep these use cases in mind if making any changes to how this works. - binSh = runCommand "bin-sh" { } '' - mkdir -p $out/bin - ln -s ${bashInteractive}/bin/bash $out/bin/sh - ln -s ${bashInteractive}/bin/bash $out/bin/bash - ''; - - etcNixConf = writeTextDir "etc/nix/nix.conf" '' - experimental-features = nix-command flakes - ''; - - etcPamdSudoFile = writeText "pam-sudo" '' - # Allow root to bypass authentication (optional) - auth sufficient pam_rootok.so - - # For all users, always allow auth - auth sufficient pam_permit.so - - # Do not perform any account management checks - account sufficient pam_permit.so - - # No password management here (only needed if you are changing passwords) - # password requisite pam_unix.so nullok yescrypt - - # Keep session logging if desired - session required pam_unix.so - ''; - - etcPamdSudo = runCommand "etc-pamd-sudo" { } '' - mkdir -p $out/etc/pam.d/ - ln -s ${etcPamdSudoFile} $out/etc/pam.d/sudo - ln -s ${etcPamdSudoFile} $out/etc/pam.d/su - ''; - - compressors = { - none = { - ext = ""; - nativeInputs = [ ]; - compress = "cat"; - decompress = "cat"; - }; - gz = { - ext = ".gz"; - nativeInputs = [ pigz ]; - compress = "pigz -p$NIX_BUILD_CORES -nTR"; - decompress = "pigz -d -p$NIX_BUILD_CORES"; - }; - zstd = { - ext = ".zst"; - nativeInputs = [ zstd ]; - compress = "zstd -T$NIX_BUILD_CORES"; - decompress = "zstd -d -T$NIX_BUILD_CORES"; - }; - }; - compressorForImage = - compressor: imageName: - compressors.${compressor} - or (throw "in docker image ${imageName}: compressor must be one of: [${toString builtins.attrNames compressors}]"); - - streamNixShellImage = - { - drv, - name ? drv.name + "-env", - tag ? null, - uid ? 1000, - gid ? 1000, - homeDirectory ? "/build", - shell ? bashInteractive + "/bin/bash", - command ? null, - run ? null, - maxLayers ? 100, - uname ? "nixbld", - releaseName ? "0.0.0", - }: - assert lib.assertMsg (!(drv.drvAttrs.__structuredAttrs or false)) - "streamNixShellImage: Does not work with the derivation ${drv.name} because it uses __structuredAttrs"; - assert lib.assertMsg ( - command == null || run == null - ) "streamNixShellImage: Can't specify both command and run"; - let - - # A binary that calls the command to build the derivation - builder = writeShellScriptBin "buildDerivation" '' - exec ${lib.escapeShellArg (valueToString drv.drvAttrs.builder)} ${lib.escapeShellArgs (map valueToString drv.drvAttrs.args)} - ''; - - staticPath = "${dirOf shell}:${ - lib.makeBinPath ( - (lib.flatten [ - builder - drv.buildInputs - ]) - ++ [ "/usr" ] - ) - }"; - - # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L493-L526 - rcfile = writeText "nix-shell-rc" '' - unset PATH - dontAddDisableDepTrack=1 - # TODO: https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L506 - [ -e $stdenv/setup ] && source $stdenv/setup - PATH=${staticPath}:"$PATH" - SHELL=${lib.escapeShellArg shell} - BASH=${lib.escapeShellArg shell} - set +e - [ -n "$PS1" -a -z "$NIX_SHELL_PRESERVE_PROMPT" ] && PS1='\n\[\033[1;32m\][nix-shell:\w]\$\[\033[0m\] ' - if [ "$(type -t runHook)" = function ]; then - runHook shellHook - fi - unset NIX_ENFORCE_PURITY - shopt -u nullglob - shopt -s execfail - ${optionalString (command != null || run != null) '' - ${optionalString (command != null) command} - ${optionalString (run != null) run} - exit - ''} - ''; - - etcSudoers = writeTextDir "etc/sudoers" '' - root ALL=(ALL) ALL - ${toString uname} ALL=(ALL) NOPASSWD:ALL - ''; - - # Add our Docker init script - dockerInit = writeTextFile { - name = "initd-docker"; - destination = "/etc/init.d/docker"; - executable = true; - - text = '' - #!/usr/bin/env sh - ### BEGIN INIT INFO - # Provides: docker - # Required-Start: $remote_fs $syslog - # Required-Stop: $remote_fs $syslog - # Default-Start: 2 3 4 5 - # Default-Stop: 0 1 6 - # Short-Description: Start and stop Docker daemon - # Description: This script starts and stops the Docker daemon. - ### END INIT INFO - - case "$1" in - start) - echo "Starting dockerd" - SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" dockerd --group=${toString gid} & - ;; - stop) - echo "Stopping dockerd" - killall dockerd - ;; - restart) - $0 stop - $0 start - ;; - *) - echo "Usage: $0 {start|stop|restart}" - exit 1 - ;; - esac - exit 0 - ''; - }; - - etcReleaseName = writeTextDir "etc/coderniximage-release" '' - ${releaseName} - ''; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/globals.hh#L464-L465 - sandboxBuildDir = "/build"; - - drvEnv = - devShellTools.unstructuredDerivationInputEnv { inherit (drv) drvAttrs; } - // devShellTools.derivationOutputEnv { - outputList = drv.outputs; - outputMap = drv; - }; - - # Environment variables set in the image - envVars = - { - - # Root certificates for internet access - SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt"; - NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt"; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1027-L1030 - # PATH = "/path-not-set"; - # Allows calling bash and `buildDerivation` as the Cmd - PATH = staticPath; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1032-L1038 - HOME = homeDirectory; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1040-L1044 - NIX_STORE = storeDir; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1046-L1047 - # TODO: Make configurable? - NIX_BUILD_CORES = "1"; - - # Make sure we get the libraries for C and C++ in. - LD_LIBRARY_PATH = lib.makeLibraryPath [ stdenv.cc.cc ]; - } - // drvEnv - // rec { - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1008-L1010 - NIX_BUILD_TOP = sandboxBuildDir; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1012-L1013 - TMPDIR = TMP; - TEMPDIR = TMP; - TMP = "/tmp"; - TEMP = TMP; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1015-L1019 - PWD = homeDirectory; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1071-L1074 - # We don't set it here because the output here isn't handled in any special way - # NIX_LOG_FD = "2"; - - # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1076-L1077 - TERM = "xterm-256color"; - }; - - in - streamLayeredImage { - inherit name tag maxLayers; - contents = [ - binSh - usrBinEnv - caCertificates - etcNixConf - etcSudoers - etcPamdSudo - etcReleaseName - (fakeNss.override { - # Allows programs to look up the build user's home directory - # https://github.com/NixOS/nix/blob/ffe155abd36366a870482625543f9bf924a58281/src/libstore/build/local-derivation-goal.cc#L906-L910 - # Slightly differs however: We use the passed-in homeDirectory instead of sandboxBuildDir. - # We're doing this because it's arguably a bug in Nix that sandboxBuildDir is used here: https://github.com/NixOS/nix/issues/6379 - extraPasswdLines = [ - "${toString uname}:x:${toString uid}:${toString gid}:Build user:${homeDirectory}:${lib.escapeShellArg shell}" - ]; - extraGroupLines = [ - "${toString uname}:!:${toString gid}:" - "docker:!:${toString (builtins.sub gid 1)}:${toString uname}" - ]; - }) - dockerInit - ]; - - fakeRootCommands = '' - # Effectively a single-user installation of Nix, giving the user full - # control over the Nix store. Needed for building the derivation this - # shell is for, but also in case one wants to use Nix inside the - # image - mkdir -p ./nix/{store,var/nix} ./etc/nix - chown -R ${toString uid}:${toString gid} ./nix ./etc/nix - - # Gives the user control over the build directory - mkdir -p .${sandboxBuildDir} - chown -R ${toString uid}:${toString gid} .${sandboxBuildDir} - - mkdir -p .${homeDirectory} - chown -R ${toString uid}:${toString gid} .${homeDirectory} - - mkdir -p ./tmp - chown -R ${toString uid}:${toString gid} ./tmp - - mkdir -p ./etc/skel - chown -R ${toString uid}:${toString gid} ./etc/skel - - # Create traditional /lib or /lib64 as needed. - # For aarch64 (arm64): - if [ -e "${glibc}/lib/ld-linux-aarch64.so.1" ]; then - mkdir -p ./lib - ln -s "${glibc}/lib/ld-linux-aarch64.so.1" ./lib/ld-linux-aarch64.so.1 - fi - - # For x86_64: - if [ -e "${glibc}/lib64/ld-linux-x86-64.so.2" ]; then - mkdir -p ./lib64 - ln -s "${glibc}/lib64/ld-linux-x86-64.so.2" ./lib64/ld-linux-x86-64.so.2 - fi - - # Copy sudo from the Nix store to a "normal" path in the container - mkdir -p ./usr/bin - cp ${sudo}/bin/sudo ./usr/bin/sudo - - # Ensure root owns it & set setuid bit - chown 0:0 ./usr/bin/sudo - chmod 4755 ./usr/bin/sudo - - chown root:root ./etc/pam.d/sudo - chown root:root ./etc/pam.d/su - chown root:root ./etc/sudoers - - # Create /var/run and chown it so docker command - # doesnt encounter permission issues. - mkdir -p ./var/run/ - chown -R ${toString uid}:${toString gid} ./var/run/ - ''; - - # Run this image as the given uid/gid - config.User = "${toString uid}:${toString gid}"; - config.Cmd = - # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L185-L186 - # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L534-L536 - if run == null then - [ - shell - "--rcfile" - rcfile - ] - else - [ - shell - rcfile - ]; - config.WorkingDir = homeDirectory; - config.Env = lib.mapAttrsToList (name: value: "${name}=${value}") envVars; - }; -in -{ - inherit streamNixShellImage; - - # This function streams a docker image that behaves like a nix-shell for a derivation - # Docs: doc/build-helpers/images/dockertools.section.md - # Tests: nixos/tests/docker-tools-nix-shell.nix - - # Wrapper around streamNixShellImage to build an image from the result - # Docs: doc/build-helpers/images/dockertools.section.md - # Tests: nixos/tests/docker-tools-nix-shell.nix - buildNixShellImage = - { - drv, - compressor ? "gz", - ... - }@args: - let - stream = streamNixShellImage (builtins.removeAttrs args [ "compressor" ]); - compress = compressorForImage compressor drv.name; - in - runCommand "${drv.name}-env.tar${compress.ext}" { - inherit (stream) imageName; - passthru = { inherit (stream) imageTag; }; - nativeBuildInputs = compress.nativeInputs; - } "${stream} | ${compress.compress} > $out"; -}