@@ -237,6 +237,43 @@ in rec {
237237 };
238238 };
239239
240+ dockerImage = args@{exe, name, version}: let
241+ dockerImageSetupScript = nixpkgs.dockerTools.shellScript "dockersetup.sh" ''
242+ set -ex
243+
244+ ${nixpkgs.dockerTools.shadowSetup}
245+ echo 'nobody:x:99:99:Nobody:/:/sbin/nologin' >> /etc/passwd
246+ echo 'nobody:*:17416:0:99999:7:::' >> /etc/shadow
247+ echo 'nobody:x:99:' >> /etc/group
248+ echo 'nobody:::' >> /etc/gshadow
249+
250+ mkdir -p /var/run/backend
251+ ln -sft /var/run/backend '${exe}'/*
252+ ${nixpkgs.findutils}/bin/find /var/run/backend
253+
254+ chown 99:99 /var/run/backend
255+ '';
256+
257+ in nixpkgs.dockerTools.buildImage {
258+ name = name;
259+ tag = version;
260+ contents = [ nixpkgs.iana-etc nixpkgs.cacert ];
261+ runAsRoot = dockerImageSetupScript;
262+ keepContentsDirlinks = true;
263+ config = {
264+
265+ Env = [
266+ ("PATH=" + builtins.concatStringsSep(":")([
267+ "/var/run/backend"
268+ ]))
269+ ];
270+ Expose = 8000;
271+ Entrypoint = ["/var/run/backend/backend"];
272+ WorkingDir = "/var/run/backend";
273+ User = "99:99";
274+ };
275+ };
276+
240277 serverExe = backend: frontend: assets: optimizationLevel: version:
241278 pkgs.runCommand "serverExe" {} ''
242279 mkdir $out
@@ -353,6 +390,8 @@ in rec {
353390 exe = serverOn system dummyVersion;
354391 server = args@{ hostName, adminEmail, routeHost, enableHttps, version }:
355392 server (args // { exe = linuxExe version; });
393+ dockerImage = args@{ name, version }:
394+ dockerImage (args // { exe = linuxExe version; });
356395 obelisk = import (base + "/.obelisk/impl") {};
357396 };
358397 haskellPackageSets = {