-
Notifications
You must be signed in to change notification settings - Fork 127
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move some tools to an externally usable overlay (#1544)
- Loading branch information
1 parent
4896948
commit 55a49f3
Showing
6 changed files
with
148 additions
and
133 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| { | ||
| createWorker = { | ||
| bash, | ||
| buildEnv, | ||
| nix2container, | ||
| coreutils, | ||
| gnused, | ||
| lib, | ||
| runCommand, | ||
| runtimeShell, | ||
| self, | ||
| }: let | ||
| # A temporary directory. Note that this doesn't set any permissions. Those | ||
| # need to be added explicitly in the final image arguments. | ||
| mkTmp = runCommand "mkTmp" {} '' | ||
| mkdir -p $out/tmp | ||
| ''; | ||
|
|
||
| # Permissions for the temporary directory. | ||
| mkTmpPerms = { | ||
| path = mkTmp; | ||
| regex = ".*"; | ||
| mode = "1777"; | ||
| uid = 0; # Owned by root. | ||
| gid = 0; # Owned by root. | ||
| }; | ||
|
|
||
| # Enable the shebang `#!/usr/bin/env bash`. | ||
| mkEnvSymlink = runCommand "mkEnvSymlink" {} '' | ||
| mkdir -p $out/usr/bin | ||
| ln -s /bin/env $out/usr/bin/env | ||
| ''; | ||
|
|
||
| user = "nativelink"; | ||
| group = "nativelink"; | ||
| uid = "1000"; | ||
| gid = "1000"; | ||
|
|
||
| mkUser = runCommand "mkUser" {} '' | ||
| mkdir -p $out/etc/pam.d | ||
| echo "root:x:0:0::/root:${runtimeShell}" > $out/etc/passwd | ||
| echo "${user}:x:${uid}:${gid}:::" >> $out/etc/passwd | ||
| echo "root:!x:::::::" > $out/etc/shadow | ||
| echo "${user}:!x:::::::" >> $out/etc/shadow | ||
| echo "root:x:0:" > $out/etc/group | ||
| echo "${group}:x:${gid}:" >> $out/etc/group | ||
| echo "root:x::" > $out/etc/gshadow | ||
| echo "${group}:x::" >> $out/etc/gshadow | ||
| cat > $out/etc/pam.d/other <<EOF | ||
| account sufficient pam_unix.so | ||
| auth sufficient pam_rootok.so | ||
| password requisite pam_unix.so nullok sha512 | ||
| session required pam_unix.so | ||
| EOF | ||
| touch $out/etc/login.defs | ||
| mkdir -p $out/home/${user} | ||
| ''; | ||
|
|
||
| # Set permissions for the user's home directory. | ||
| mkUserPerms = { | ||
| path = mkUser; | ||
| regex = "/home/${user}"; | ||
| mode = "0755"; | ||
| uid = lib.toInt uid; | ||
| gid = lib.toInt gid; | ||
| uname = user; | ||
| gname = group; | ||
| }; | ||
| in | ||
| # Create a container image from a base image with the nativelink executable | ||
| # added and set as entrypoint. This allows arbitrary base images to be | ||
| # "enriched" with nativelink to create worker images for cloud deployments. | ||
| image: | ||
| nix2container.buildImage { | ||
| name = "nativelink-worker-${image.imageName}"; | ||
| fromImage = image; | ||
| maxLayers = 20; | ||
| copyToRoot = [ | ||
| mkUser | ||
| mkTmp | ||
| mkEnvSymlink | ||
| (buildEnv { | ||
| name = "${image.imageName}-buildEnv"; | ||
| paths = [coreutils bash gnused]; | ||
| pathsToLink = ["/bin"]; | ||
| }) | ||
| ]; | ||
|
|
||
| perms = [ | ||
| mkUserPerms | ||
| mkTmpPerms | ||
| ]; | ||
|
|
||
| # Override the final image tag with the one from the base image to make | ||
| # the relationship between the toolchain and the worker extension more | ||
| # obvious. | ||
| tag = image.imageTag; | ||
|
|
||
| config = { | ||
| User = user; | ||
| WorkingDir = "/home/${user}"; | ||
| Labels = { | ||
| "org.opencontainers.image.description" = "NativeLink worker generated from ${image.imageName}."; | ||
| "org.opencontainers.image.documentation" = "https://github.com/TraceMachina/nativelink"; | ||
| "org.opencontainers.image.licenses" = "Apache-2.0"; | ||
| "org.opencontainers.image.revision" = "${self.rev or self.dirtyRev or "dirty"}"; | ||
| "org.opencontainers.image.source" = "https://github.com/TraceMachina/nativelink"; | ||
| "org.opencontainers.image.title" = "NativeLink worker for ${image.imageName}"; | ||
| "org.opencontainers.image.vendor" = "Trace Machina, Inc."; | ||
| }; | ||
| }; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| {nix2container}: final: _prev: { | ||
| inherit (nix2container.packages.${final.system}) nix2container; | ||
|
|
||
| # Note: Only put tools here that should be usable from external flakes. | ||
| nativelink-tools = { | ||
| local-image-test = final.callPackage ./local-image-test.nix {}; | ||
| publish-ghcr = final.callPackage ./publish-ghcr.nix {}; | ||
| native-cli = final.callPackage ../../native-cli/default.nix {}; | ||
|
|
||
| lib = { | ||
| createWorker = self: | ||
| final.callPackage (import ./create-worker.nix).createWorker { | ||
| inherit self; | ||
| }; | ||
| }; | ||
| }; | ||
| } |
File renamed without changes.
File renamed without changes.