git.iko.soy/typeable/nixpkgs
on master help sign in
dockerTools.fakeNss: init

This provides a /etc/passwd and /etc/group that contain root and nobody. Useful when packaging binaries that insist on using nss to look up username/groups (like nginx). The current nginx example used the `runAsRoot` parameter to setup /etc/group and /etc/passwd (which also doesn't exist in buildLayeredImage), so we can now just use fakeNss there and use buildLayeredImage.

commitf7ee2706c2aaef359dd05b6910dcbfa6b3493dee authorFlorian Klink <flokli@flokli.de> dateWed 2 Dec 2020, 12:16 (6 years ago) parentfc7f72e
2 files changed+29−11
compare with master
unifiedsplit
pkgs/build-support/docker/default.nix+22−1 pkgs/build-support/docker/examples.nix+7−10
pkgs/build-support/docker/default.nix+22−1
@@ -29,6 +29,7 @@
2929 writeReferencesToFile,
3030 writeScript,
3131 writeText,
32+ writeTextDir,
3233 writePython3,
3334 system, # Note: This is the cross system we're compiling for
3435}:
@@ -70,7 +71,7 @@ in
7071rec {
7172
7273 examples = callPackage ./examples.nix {
73− inherit buildImage pullImage shadowSetup buildImageWithNixDb;
74+ inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
7475 };
7576
7677 pullImage = let
@@ -684,6 +685,26 @@ rec {
684685 in
685686 result;
686687
688+ # Provide a /etc/passwd and /etc/group that contain root and nobody.
689+ # Useful when packaging binaries that insist on using nss to look up
690+ # username/groups (like nginx).
691+ fakeNss = symlinkJoin {
692+ name = "fake-nss";
693+ paths = [
694+ (writeTextDir "etc/passwd" ''
695+ root:x:0:0:root user:/var/empty:/bin/sh
696+ nobody:x:65534:65534:nobody:/var/empty:/bin/sh
697+ '')
698+ (writeTextDir "etc/group" ''
699+ root:x:0:
700+ nobody:x:65534:
701+ '')
702+ (runCommand "var-empty" {} ''
703+ mkdir -p $out/var/empty
704+ '')
705+ ];
706+ };
707+
687708 # Build an image and populate its nix database with the provided
688709 # contents. The main purpose is to be able to use nix commands in
689710 # the container.
pkgs/build-support/docker/examples.nix+7−10
@@ -7,7 +7,7 @@
77# $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
88# $ docker load < result
99
10−{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
10+{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
1111
1212rec {
1313 # 1. basic example
@@ -44,7 +44,7 @@ rec {
4444 nginx = let
4545 nginxPort = "80";
4646 nginxConf = pkgs.writeText "nginx.conf" ''
47− user nginx nginx;
47+ user nobody nobody;
4848 daemon off;
4949 error_log /dev/stdout info;
5050 pid /dev/null;
@@ -64,10 +64,13 @@ rec {
6464 <html><body><h1>Hello from NGINX</h1></body></html>
6565 '';
6666 in
67− buildImage {
67+ buildLayeredImage {
6868 name = "nginx-container";
6969 tag = "latest";
70− contents = pkgs.nginx;
70+ contents = [
71+ fakeNss
72+ pkgs.nginx
73+ ];
7174
7275 extraCommands = ''
7376 # nginx still tries to read this directory even if error_log
@@ -75,12 +78,6 @@ rec {
7578 mkdir -p var/log/nginx
7679 mkdir -p var/cache/nginx
7780 '';
78− runAsRoot = ''
79− #!${pkgs.stdenv.shell}
80− ${shadowSetup}
81− groupadd --system nginx
82− useradd --system --gid nginx nginx
83− '';
8481
8582 config = {
8683 Cmd = [ "nginx" "-c" nginxConf ];