git.iko.soy/obelisk
on master help sign in
remove cargo culted shadowSetup
4bc2397Dan Bornside
default.nix+6−18
compare with master
unifiedsplit
@@ -238,30 +238,18 @@ in rec {
238 };
238 };
239
239
240 dockerImage = args@{exe, name, version}: let
240 dockerImage = args@{exe, name, version}: let
241− dockerImageSetupScript = nixpkgs.dockerTools.shellScript "dockersetup.sh" ''
241+ appDirSetupScript = nixpkgs.runCommand "appDirSetupScript.sh" {} ''
242− set -ex
243−
244− ${nixpkgs.dockerTools.shadowSetup}
245− echo 'nobody:x:99:99:Nobody:/:/sbin/nologin' >> /etc/passwd
246− echo 'nobody:*:17416:0:99999:7:::' >> /etc/shadow
247− echo 'nobody:x:99:' >> /etc/group
248− echo 'nobody:::' >> /etc/gshadow
249−
250− mkdir -p /var/run/backend
242+ mkdir -p $out/var/run/backend
251− ln -sft /var/run/backend '${exe}'/*
243+ ln -sft $out/var/run/backend '${exe}'/*
252− ${nixpkgs.findutils}/bin/find /var/run/backend
244+ ${nixpkgs.findutils}/bin/find $out/var/run/backend
253−
254− chown 99:99 /var/run/backend
255− '';
245+ '';
256
246
257 in nixpkgs.dockerTools.buildImage {
247 in nixpkgs.dockerTools.buildImage {
258 name = name;
248 name = name;
259 tag = version;
249 tag = version;
260− contents = [ nixpkgs.iana-etc nixpkgs.cacert ];
250+ contents = [ nixpkgs.iana-etc nixpkgs.cacert appDirSetupScript ];
261− runAsRoot = dockerImageSetupScript;
262 keepContentsDirlinks = true;
251 keepContentsDirlinks = true;
263 config = {
252 config = {
264−
265 Env = [
253 Env = [
266 ("PATH=" + builtins.concatStringsSep(":")([
254 ("PATH=" + builtins.concatStringsSep(":")([
267 "/var/run/backend"
255 "/var/run/backend"