git.iko.soy/nix-container
on master help sign in
Always include Nix (with certs + flakes config) in the image
d6edb81iko
README.md+2
compare with master
unifiedsplit
@@ -41,6 +41,8 @@ is **required**; there is no default set.
41```
41```
42
42
43Your host shell (`$SHELL`) is added and run automatically — no need to list it.
43Your host shell (`$SHELL`) is added and run automatically — no need to list it.
44+**Nix itself** is always included too (with CA certs and `nix-command`/`flakes`
45+enabled, single-user), so you can run `nix` inside the container.
44
46
45Point at a different file with `-c`/`--config`:
47Point at a different file with `-c`/`--config`:
46
48
flake.nix+15−2
@@ -108,10 +108,19 @@
108 # buildEnv only *symlinks* paths (never runs them), so build it
108 # buildEnv only *symlinks* paths (never runs them), so build it
109 # on the host arch — the tree is arch-neutral and links the
109 # on the host arch — the tree is arch-neutral and links the
110 # (substituted) Linux store paths, sparing the Linux builder.
110 # (substituted) Linux store paths, sparing the Linux builder.
111+ #
112+ # Nix itself (+ CA certs) is always shipped, so every container
113+ # can use Nix; `initializeNixDatabase` registers the baked store.
111 copyToRoot = pkgsHost.buildEnv {
114 copyToRoot = pkgsHost.buildEnv {
112 name = "root";
115 name = "root";
113− paths = pkgList;
116+ paths = pkgList ++ [
117+ pkgsLinux.nix
118+ pkgsLinux.cacert
119+ ];
114− pathsToLink = [ "/bin" ];
120+ pathsToLink = [
121+ "/bin"
122+ "/etc/ssl"
123+ ];
115 };
124 };
116
125
117 initializeNixDatabase = true;
126 initializeNixDatabase = true;
@@ -127,6 +136,10 @@
127 "HOME=/root"
136 "HOME=/root"
128 # Marker so shells/scripts can detect they're in here.
137 # Marker so shells/scripts can detect they're in here.
129 "NIX_CONTAINER=1"
138 "NIX_CONTAINER=1"
139+ # Make the bundled Nix usable: TLS for substituters/flakes,
140+ # flake commands on, and single-user (no daemon/nixbld).
141+ "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
142+ "NIX_CONFIG=experimental-features = nix-command flakes\nbuild-users-group =\nsandbox = false"
130 ];
143 ];
131 };
144 };
132 }
145 }