git.iko.soy/nix-container
on master help sign in
Always include Nix (with certs + flakes config) in the image
commitd6edb8191361eab1c494d5755c2f4d01fd0b1a46 authoriko <mail@iko.soy> dateSat 27 Jun 2026, 21:54 (3 months ago) parent39bbc75
2 files changed+17−2
compare with master
unifiedsplit
README.md+2 flake.nix+15−2
README.md+2
@@ -41,6 +41,8 @@ is **required**; there is no default set.
4141```
4242
4343Your host shell (`$SHELL`) is added and run automatically — no need to list it.
44+**Nix itself** is always included too (with CA certs and `nix-command`/`flakes`
45+enabled, single-user), so you can run `nix` inside the container.
4446
4547Point at a different file with `-c`/`--config`:
4648
flake.nix+15−2
@@ -108,10 +108,19 @@
108108 # buildEnv only *symlinks* paths (never runs them), so build it
109109 # on the host arch — the tree is arch-neutral and links the
110110 # (substituted) Linux store paths, sparing the Linux builder.
111+ #
112+ # Nix itself (+ CA certs) is always shipped, so every container
113+ # can use Nix; `initializeNixDatabase` registers the baked store.
111114 copyToRoot = pkgsHost.buildEnv {
112115 name = "root";
113− paths = pkgList;
114− pathsToLink = [ "/bin" ];
116+ paths = pkgList ++ [
117+ pkgsLinux.nix
118+ pkgsLinux.cacert
119+ ];
120+ pathsToLink = [
121+ "/bin"
122+ "/etc/ssl"
123+ ];
115124 };
116125
117126 initializeNixDatabase = true;
@@ -127,6 +136,10 @@
127136 "HOME=/root"
128137 # Marker so shells/scripts can detect they're in here.
129138 "NIX_CONTAINER=1"
139+ # Make the bundled Nix usable: TLS for substituters/flakes,
140+ # flake commands on, and single-user (no daemon/nixbld).
141+ "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
142+ "NIX_CONFIG=experimental-features = nix-command flakes\nbuild-users-group =\nsandbox = false"
130143 ];
131144 };
132145 }