@@ -72,94 +72,99 @@
7272 # Host package set, for the wrapper app below.
7373 pkgsHost = nixpkgs.legacyPackages.${system};
7474
75− # Name/tag baked into the image's OCI config.
75+ # Default image name (for `copyWith`); `c init` passes a per-directory
76+ # name (`nix-container-<dir>`) to `copyWithShell` instead.
7677 imageName = "nix-container";
7778 imageTag = "latest";
7879
79− # Fish prompt config, installed at /root/.config/fish/config.fish
80− # (fish reads $HOME/.config/fish).
81− fishConfig = pkgsLinux.writeText "config.fish" ''
82− # No welcome banner.
83− set -g fish_greeting
84−
85− # Define the prompt as a function so fish renders it before every
86− # command; at top level it would run once at startup and be ignored.
87− function fish_prompt
88− set -l nix_shell_info
89− if set -q IN_NIX_SHELL; or set -q IN_NIX_RUN
90− set nix_shell_info ' ❄️'
91− end
92−
93− set -l cwd (prompt_pwd)
94−
95− set -l bookmark_info
96− if jj root 2>/dev/null >/dev/null
97− set -l jj_bookmark (jj log -r 'heads(::@ & bookmarks())' -T 'local_bookmarks ++ "\n"' --no-graph 2>/dev/null | tail -1)
98− if test -n "$jj_bookmark"
99− set bookmark_info ' ' (set_color brmagenta) $jj_bookmark (set_color normal)
100− end
101− end
102−
103− echo -n -s (set_color $fish_color_cwd) $cwd (set_color normal) $bookmark_info ' 🏗️' $nix_shell_info '> '
104− end
105− '';
106−
107− # Lay the config out at the path fish reads.
108− fishRoot = pkgsLinux.runCommand "fish-config-root" { } ''
109− mkdir -p "$out/root/.config/fish"
110− cp ${fishConfig} "$out/root/.config/fish/config.fish"
111− '';
112−
113− # Build the OCI image from a `{ pkgs, nur }: [ ... ]` package function.
114− # The fish prompt config is always added; the default `cmd` is
115− # /bin/fish, so the package set should include `fish` (warned about
116− # below if missing) or override `config.cmd`.
80+ # Build the OCI image (named `name`) from a `{ pkgs, nur }: [ ... ]`
81+ # package function, for the named shell. The image's `cmd` is herdr
82+ # (the session `c start` attaches to); the shell is the default `$SHELL`
83+ # (what herdr panes spawn) and is added automatically, so `container.nix`
84+ # lists only your extras. Nix (+ CA certs) and the ncurses terminfo
85+ # database are always shipped too. Nothing here is fish-specific: the
86+ # TERM fixup happens host-side in `c` (passed via `-e TERM` at create).
11787 mkImage =
118− packages:
119− let
120− pkgList = packages {
121− pkgs = pkgsLinux;
122− nur = nurPkgs;
88+ name: shell: packages:
89+ n2c.buildImage {
90+ inherit name;
91+ tag = imageTag;
92+ inherit arch;
93+
94+ # A plain, single-process root filesystem. No NixOS, no systemd.
95+ # buildEnv only *symlinks* paths (never runs them), so build it on
96+ # the host arch — the tree is arch-neutral and links the
97+ # (substituted) Linux store paths, sparing the Linux builder.
98+ copyToRoot = pkgsHost.buildEnv {
99+ name = "root";
100+ paths =
101+ packages {
102+ pkgs = pkgsLinux;
103+ nur = nurPkgs;
104+ }
105+ # The shell (cmd + $SHELL), when it exists in nixpkgs.
106+ ++ pkgsLinux.lib.optional (pkgsLinux ? ${shell}) pkgsLinux.${shell}
107+ ++ [
108+ pkgsLinux.nix
109+ pkgsLinux.cacert
110+ # Basic userland (ls, cat, cp, sleep, …) so the container is
111+ # usable out of the box and tools that shell out don't fail.
112+ pkgsLinux.coreutils-full
113+ # Networking glue glibc needs: /etc/nsswitch.conf (+passwd,
114+ # group) so DNS/host lookups resolve, and /etc/protocols,
115+ # /etc/services. Without these, hostname resolution fails.
116+ pkgsLinux.fakeNss
117+ pkgsLinux.iana-etc
118+ # The terminfo database (+ tput/clear/reset) so TUIs find the
119+ # entry for whatever TERM `c` passes in and render correctly.
120+ pkgsLinux.ncurses
121+ # The session `c start` always launches.
122+ pkgsLinux.herdr
123+ ];
124+ # Link all of /etc so the above files (nsswitch.conf, protocols,
125+ # services, passwd, group, ssl certs) are present.
126+ pathsToLink = [
127+ "/bin"
128+ "/etc"
129+ ];
123130 };
124− in
125− pkgsLinux.lib.warnIf (!builtins.any (p: (p.pname or "") == "fish") pkgList)
126− "nix-container: config.cmd is /bin/fish but the package set has no `fish` — the container will fail to start unless something provides /bin/fish (or change config.cmd)."
127− (
128− n2c.buildImage {
129− name = imageName;
130− tag = imageTag;
131− inherit arch;
132−
133− # A plain, single-process root filesystem. No NixOS, no systemd.
134− copyToRoot = pkgsLinux.buildEnv {
135− name = "root";
136− paths = pkgList ++ [ fishRoot ];
137− pathsToLink = [
138− "/bin"
139− "/root"
140− ];
141− };
142131
143− initializeNixDatabase = true;
144−
145− config = {
146− # `cmd` (not `entrypoint`): it's the default command and is
147− # *replaced* by `container run … -- <cmd>`. An entrypoint would
148− # be prepended instead, so `run … -- /bin/sh` would become
149− # `/bin/bash /bin/sh` and fail with "cannot execute binary file".
150− cmd = [ "/bin/fish" ];
151− env = [
152− "PATH=/bin"
153− # fish reads its prompt from $HOME/.config/fish/config.fish.
154− "HOME=/root"
155− ];
156− };
157− }
158− );
132+ initializeNixDatabase = true;
133+
134+ config = {
135+ # `cmd` (not `entrypoint`): the default command, *replaced* by any
136+ # command passed to `container run/create`. Plain herdr here;
137+ # `c init` overrides it with `herdr session attach <dir>-container` so
138+ # the session is named per project. `c start` attaches via
139+ # `container start -ai`; exiting herdr (PID1) stops the container.
140+ cmd = [ "/bin/herdr" ];
141+ env = [
142+ "PATH=/bin"
143+ "HOME=/root"
144+ # Default shell for tools that spawn one (herdr panes, etc.).
145+ "SHELL=/bin/${shell}"
146+ # Marker so shells/scripts can detect they're in here.
147+ "NIX_CONTAINER=1"
148+ # Advertise truecolor for 24-bit-aware tools; `c` passes the
149+ # resolved TERM via -e (the runtime would otherwise force xterm).
150+ "COLORTERM=truecolor"
151+ # A UTF-8 locale so tools handle multibyte/wide characters
152+ # correctly. glibc ships C.UTF-8 built in, so this needs no
153+ # locale-archive.
154+ "LANG=C.UTF-8"
155+ # CA trust for every TLS client (curl/git/…) and Nix.
156+ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
157+ "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
158+ # Make the bundled Nix usable: flake commands on, and
159+ # single-user (no daemon/nixbld).
160+ "NIX_CONFIG=experimental-features = nix-command flakes\nbuild-users-group =\nsandbox = false"
161+ ];
162+ };
163+ };
159164
160165 # `nix run . -- init|start` runs the bundled `c` manager script. Its
161166 # `init` builds the image from the project's `container.nix` (via
162− # `lib.copyWith`); the script finds the flake from its own (store)
167+ # `lib.copyWithShell`); the script finds the flake from its own (store)
163168 # location, so this works from a checkout or straight from
164169 # `nix run github:…/nix-container`.
165170 cApp = pkgsHost.writeShellScriptBin "c" ''
@@ -172,15 +177,22 @@
172177 default = flake-utils.lib.mkApp { drv = cApp; };
173178 };
174179
175− # Build helpers. `c init` uses `copyWith` to honour a per-project
176− # `container.nix`:
180+ # Build helpers take a `{ pkgs, nur }: [ ... ]` packages function (the
181+ # `packages` attr of a project's `container.nix`). `c init` uses
182+ # `copyWithShell` (host shell baked in); `copyWith` is the generic form:
177183 # (builtins.getFlake "github:…/nix-container")
178− # .lib.<system>.copyWith (import ./container.nix)
184+ # .lib.<system>.copyWith (import ./container.nix).packages
179185 lib = {
180186 inherit mkImage;
181− # skopeo copy app (`skopeo copy nix:<image> "$@"`) for an image built
182− # from a `{ pkgs, nur }: [ ... ]` function.
183− copyWith = packages: (mkImage packages).copyTo;
187+ # Build the image's `copyTo` script (a skopeo-copy wrapper) from a
188+ # `{ pkgs, nur }: [ ... ]` function, named `imageName`. Defaults the
189+ # shell (cmd + $SHELL) to bash; use `copyWithShell` to pick another.
190+ copyWith = packages: (mkImage imageName "bash" packages).copyTo;
191+ # Like `copyWith`, but for the given image `name` and shell — `c init`
192+ # passes `nix-container-<dir>` and the host login shell, which is added
193+ # to the image and used as cmd + $SHELL without being listed in
194+ # `container.nix`.
195+ copyWithShell = name: shell: packages: (mkImage name shell packages).copyTo;
184196 };
185197 }
186198 );