diff options
| author | Florian Klink <flokli@flokli.de> | 2020-12-02 12:16:56 +0100 |
|---|---|---|
| committer | Florian Klink <flokli@flokli.de> | 2020-12-02 14:56:07 +0100 |
| commit | f7ee2706c2aaef359dd05b6910dcbfa6b3493dee (patch) | |
| tree | 858fe43de8f43e20380b110b1264ae54d196b27a | |
| parent | fc7f72e1446b6eee70a0287cde9dbd84098e6625 (diff) | |
dockerTools.fakeNss: init
This provides a /etc/passwd and /etc/group that contain root and nobody.
Useful when packaging binaries that insist on using nss to look up
username/groups (like nginx).
The current nginx example used the `runAsRoot` parameter to setup
/etc/group and /etc/passwd (which also doesn't exist in
buildLayeredImage), so we can now just use fakeNss there and use
buildLayeredImage.
| -rw-r--r-- | pkgs/build-support/docker/default.nix | 23 | ||||
| -rw-r--r-- | pkgs/build-support/docker/examples.nix | 17 |
2 files changed, 29 insertions, 11 deletions
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index db1062e1b5d8..c992cf4fbb8e 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -29,6 +29,7 @@ writeReferencesToFile, writeScript, writeText, + writeTextDir, writePython3, system, # Note: This is the cross system we're compiling for }: @@ -70,7 +71,7 @@ in rec { examples = callPackage ./examples.nix { - inherit buildImage pullImage shadowSetup buildImageWithNixDb; + inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb; }; pullImage = let @@ -684,6 +685,26 @@ rec { in result; + # Provide a /etc/passwd and /etc/group that contain root and nobody. + # Useful when packaging binaries that insist on using nss to look up + # username/groups (like nginx). + fakeNss = symlinkJoin { + name = "fake-nss"; + paths = [ + (writeTextDir "etc/passwd" '' + root:x:0:0:root user:/var/empty:/bin/sh + nobody:x:65534:65534:nobody:/var/empty:/bin/sh + '') + (writeTextDir "etc/group" '' + root:x:0: + nobody:x:65534: + '') + (runCommand "var-empty" {} '' + mkdir -p $out/var/empty + '') + ]; + }; + # Build an image and populate its nix database with the provided # contents. The main purpose is to be able to use nix commands in # the container. diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix index 3f30f1a2adb4..85ddeb257405 100644 --- a/pkgs/build-support/docker/examples.nix +++ b/pkgs/build-support/docker/examples.nix @@ -7,7 +7,7 @@ # $ nix-build '<nixpkgs>' -A dockerTools.examples.redis # $ docker load < result -{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }: +{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }: rec { # 1. basic example @@ -44,7 +44,7 @@ rec { nginx = let nginxPort = "80"; nginxConf = pkgs.writeText "nginx.conf" '' - user nginx nginx; + user nobody nobody; daemon off; error_log /dev/stdout info; pid /dev/null; @@ -64,10 +64,13 @@ rec { <html><body><h1>Hello from NGINX</h1></body></html> ''; in - buildImage { + buildLayeredImage { name = "nginx-container"; tag = "latest"; - contents = pkgs.nginx; + contents = [ + fakeNss + pkgs.nginx + ]; extraCommands = '' # nginx still tries to read this directory even if error_log @@ -75,12 +78,6 @@ rec { mkdir -p var/log/nginx mkdir -p var/cache/nginx ''; - runAsRoot = '' - #!${pkgs.stdenv.shell} - ${shadowSetup} - groupadd --system nginx - useradd --system --gid nginx nginx - ''; config = { Cmd = [ "nginx" "-c" nginxConf ]; |