@@ -72,99 +72,66 @@
7272 # Host package set, for the wrapper app below.
7373 pkgsHost = nixpkgs.legacyPackages.${system};
7474
75− # Default image name (for `copyWith`); `c init` passes a per-directory
76− # name (`nix-container-<dir>`) to `copyWithShell` instead.
75+ # Name/tag baked into the image's OCI config.
7776 imageName = "nix-container";
7877 imageTag = "latest";
7978
80− # Build the OCI image (named `name`) from a `{ pkgs, nur }: [ ... ]`
81− # package function, for the named shell. The image's `cmd` is herdr
82− # (the session `c start` attaches to); the shell is the default `$SHELL`
83− # (what herdr panes spawn) and is added automatically, so `container.nix`
84− # lists only your extras. Nix (+ CA certs) and the ncurses terminfo
85− # database are always shipped too. Nothing here is fish-specific: the
86− # TERM fixup happens host-side in `c` (passed via `-e TERM` at create).
79+ # Build the OCI image from a `{ pkgs, nur }: [ ... ]` package function.
80+ # The default `cmd` is /bin/fish; `c init` runs your host login shell
81+ # instead and adds it automatically (see `copyWithShell`). The warning
82+ # below only catches an image left with no shell at all.
8783 mkImage =
88− name: shell: packages:
89− n2c.buildImage {
90− inherit name;
91− tag = imageTag;
92− inherit arch;
93−
94− # A plain, single-process root filesystem. No NixOS, no systemd.
95− # buildEnv only *symlinks* paths (never runs them), so build it on
96− # the host arch — the tree is arch-neutral and links the
97− # (substituted) Linux store paths, sparing the Linux builder.
98− copyToRoot = pkgsHost.buildEnv {
99− name = "root";
100− paths =
101− packages {
102− pkgs = pkgsLinux;
103− nur = nurPkgs;
104− }
105− # The shell (cmd + $SHELL), when it exists in nixpkgs.
106− ++ pkgsLinux.lib.optional (pkgsLinux ? ${shell}) pkgsLinux.${shell}
107− ++ [
108− pkgsLinux.nix
109− pkgsLinux.cacert
110− # Basic userland (ls, cat, cp, sleep, …) so the container is
111− # usable out of the box and tools that shell out don't fail.
112− pkgsLinux.coreutils-full
113− # Networking glue glibc needs: /etc/nsswitch.conf (+passwd,
114− # group) so DNS/host lookups resolve, and /etc/protocols,
115− # /etc/services. Without these, hostname resolution fails.
116− pkgsLinux.fakeNss
117− pkgsLinux.iana-etc
118− # The terminfo database (+ tput/clear/reset) so TUIs find the
119− # entry for whatever TERM `c` passes in and render correctly.
120− pkgsLinux.ncurses
121− # The session `c start` always launches.
122− pkgsLinux.herdr
123− ];
124− # Link all of /etc so the above files (nsswitch.conf, protocols,
125− # services, passwd, group, ssl certs) are present.
126− pathsToLink = [
127− "/bin"
128− "/etc"
129− ];
84+ packages:
85+ let
86+ pkgList = packages {
87+ pkgs = pkgsLinux;
88+ nur = nurPkgs;
13089 };
90+ hasShell = builtins.any (
91+ p:
92+ builtins.elem (p.pname or "") [
93+ "fish"
94+ "bash"
95+ "zsh"
96+ ]
97+ ) pkgList;
98+ in
99+ pkgsLinux.lib.warnIf (!hasShell)
100+ "nix-container: the package set has no shell (fish/bash/zsh) — the container's command may not exist (`c init` runs your host shell)."
101+ (
102+ n2c.buildImage {
103+ name = imageName;
104+ tag = imageTag;
105+ inherit arch;
131106
132− initializeNixDatabase = true;
107+ # A plain, single-process root filesystem. No NixOS, no systemd.
108+ copyToRoot = pkgsLinux.buildEnv {
109+ name = "root";
110+ paths = pkgList;
111+ pathsToLink = [ "/bin" ];
112+ };
133113
134− config = {
135− # `cmd` (not `entrypoint`): the default command, *replaced* by any
136− # command passed to `container run/create`. Plain herdr here;
137− # `c init` overrides it with `herdr session attach <dir>-container` so
138− # the session is named per project. `c start` attaches via
139− # `container start -ai`; exiting herdr (PID1) stops the container.
140− cmd = [ "/bin/herdr" ];
141− env = [
142− "PATH=/bin"
143− "HOME=/root"
144− # Default shell for tools that spawn one (herdr panes, etc.).
145− "SHELL=/bin/${shell}"
146− # Marker so shells/scripts can detect they're in here.
147− "NIX_CONTAINER=1"
148− # Advertise truecolor for 24-bit-aware tools; `c` passes the
149− # resolved TERM via -e (the runtime would otherwise force xterm).
150− "COLORTERM=truecolor"
151− # A UTF-8 locale so tools handle multibyte/wide characters
152− # correctly. glibc ships C.UTF-8 built in, so this needs no
153− # locale-archive.
154− "LANG=C.UTF-8"
155− # CA trust for every TLS client (curl/git/…) and Nix.
156− "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
157− "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
158− # Make the bundled Nix usable: flake commands on, and
159− # single-user (no daemon/nixbld).
160− "NIX_CONFIG=experimental-features = nix-command flakes\nbuild-users-group =\nsandbox = false"
161− ];
162− };
163− };
114+ initializeNixDatabase = true;
115+
116+ config = {
117+ # `cmd` (not `entrypoint`): it's the default command and is
118+ # *replaced* by `container run … -- <cmd>`. An entrypoint would
119+ # be prepended instead, so `run … -- /bin/sh` would become
120+ # `/bin/bash /bin/sh` and fail with "cannot execute binary file".
121+ cmd = [ "/bin/fish" ];
122+ env = [
123+ "PATH=/bin"
124+ "HOME=/root"
125+ # Marker so shells/scripts can detect they're in here.
126+ "NIX_CONTAINER=1"
127+ ];
128+ };
129+ }
130+ );
164131
165132 # `nix run . -- init|start` runs the bundled `c` manager script. Its
166133 # `init` builds the image from the project's `container.nix` (via
167− # `lib.copyWithShell`); the script finds the flake from its own (store)
134+ # `lib.copyWith`); the script finds the flake from its own (store)
168135 # location, so this works from a checkout or straight from
169136 # `nix run github:…/nix-container`.
170137 cApp = pkgsHost.writeShellScriptBin "c" ''
@@ -177,22 +144,24 @@
177144 default = flake-utils.lib.mkApp { drv = cApp; };
178145 };
179146
180− # Build helpers take a `{ pkgs, nur }: [ ... ]` packages function (the
181− # `packages` attr of a project's `container.nix`). `c init` uses
182− # `copyWithShell` (host shell baked in); `copyWith` is the generic form:
147+ # Build helpers. `c init` uses `copyWith` to honour a per-project
148+ # `container.nix`:
183149 # (builtins.getFlake "github:…/nix-container")
184− # .lib.<system>.copyWith (import ./container.nix).packages
150+ # .lib.<system>.copyWith (import ./container.nix)
185151 lib = {
186152 inherit mkImage;
187− # Build the image's `copyTo` script (a skopeo-copy wrapper) from a
188− # `{ pkgs, nur }: [ ... ]` function, named `imageName`. Defaults the
189− # shell (cmd + $SHELL) to bash; use `copyWithShell` to pick another.
190− copyWith = packages: (mkImage imageName "bash" packages).copyTo;
191− # Like `copyWith`, but for the given image `name` and shell — `c init`
192− # passes `nix-container-<dir>` and the host login shell, which is added
193− # to the image and used as cmd + $SHELL without being listed in
194− # `container.nix`.
195− copyWithShell = name: shell: packages: (mkImage name shell packages).copyTo;
153+ # skopeo copy app (`skopeo copy nix:<image> "$@"`) for an image built
154+ # from a `{ pkgs, nur }: [ ... ]` function.
155+ copyWith = packages: (mkImage packages).copyTo;
156+ # Like `copyWith`, but also adds the named shell package (when it
157+ # exists in nixpkgs) so `c init` can run the host shell without it
158+ # being listed in `container.nix`.
159+ copyWithShell =
160+ shell: packages:
161+ (mkImage (
162+ { pkgs, nur }:
163+ packages { inherit pkgs nur; } ++ pkgs.lib.optional (pkgs ? ${shell}) pkgs.${shell}
164+ )).copyTo;
196165 };
197166 }
198167 );