From f7ee2706c2aaef359dd05b6910dcbfa6b3493dee Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 2 Dec 2020 12:16:56 +0100 Subject: [PATCH 1/2] dockerTools.fakeNss: init This provides a /etc/passwd and /etc/group that contain root and nobody. Useful when packaging binaries that insist on using nss to look up username/groups (like nginx). The current nginx example used the `runAsRoot` parameter to setup /etc/group and /etc/passwd (which also doesn't exist in buildLayeredImage), so we can now just use fakeNss there and use buildLayeredImage. --- pkgs/build-support/docker/default.nix | 23 ++++++++++++++++++++++- pkgs/build-support/docker/examples.nix | 17 +++++++---------- 2 files changed, 29 insertions(+), 11 deletions(-) diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index db1062e1b5d..c992cf4fbb8 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -29,6 +29,7 @@ writeReferencesToFile, writeScript, writeText, + writeTextDir, writePython3, system, # Note: This is the cross system we're compiling for }: @@ -70,7 +71,7 @@ in rec { examples = callPackage ./examples.nix { - inherit buildImage pullImage shadowSetup buildImageWithNixDb; + inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb; }; pullImage = let @@ -684,6 +685,26 @@ rec { in result; + # Provide a /etc/passwd and /etc/group that contain root and nobody. + # Useful when packaging binaries that insist on using nss to look up + # username/groups (like nginx). + fakeNss = symlinkJoin { + name = "fake-nss"; + paths = [ + (writeTextDir "etc/passwd" '' + root:x:0:0:root user:/var/empty:/bin/sh + nobody:x:65534:65534:nobody:/var/empty:/bin/sh + '') + (writeTextDir "etc/group" '' + root:x:0: + nobody:x:65534: + '') + (runCommand "var-empty" {} '' + mkdir -p $out/var/empty + '') + ]; + }; + # Build an image and populate its nix database with the provided # contents. The main purpose is to be able to use nix commands in # the container. diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix index 3f30f1a2adb..85ddeb25740 100644 --- a/pkgs/build-support/docker/examples.nix +++ b/pkgs/build-support/docker/examples.nix @@ -7,7 +7,7 @@ # $ nix-build '' -A dockerTools.examples.redis # $ docker load < result -{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }: +{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }: rec { # 1. basic example @@ -44,7 +44,7 @@ rec { nginx = let nginxPort = "80"; nginxConf = pkgs.writeText "nginx.conf" '' - user nginx nginx; + user nobody nobody; daemon off; error_log /dev/stdout info; pid /dev/null; @@ -64,10 +64,13 @@ rec {

Hello from NGINX

''; in - buildImage { + buildLayeredImage { name = "nginx-container"; tag = "latest"; - contents = pkgs.nginx; + contents = [ + fakeNss + pkgs.nginx + ]; extraCommands = '' # nginx still tries to read this directory even if error_log @@ -75,12 +78,6 @@ rec { mkdir -p var/log/nginx mkdir -p var/cache/nginx ''; - runAsRoot = '' - #!${pkgs.stdenv.shell} - ${shadowSetup} - groupadd --system nginx - useradd --system --gid nginx nginx - ''; config = { Cmd = [ "nginx" "-c" nginxConf ]; From e054694925bcef63629365559c3987cd19556109 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 2 Dec 2020 14:51:06 +0100 Subject: [PATCH 2/2] dockerTools.binSh: init --- pkgs/build-support/docker/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index c992cf4fbb8..b30ac5c7765 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -1,4 +1,5 @@ { + bashInteractive, buildPackages, cacert, callPackage, @@ -688,6 +689,7 @@ rec { # Provide a /etc/passwd and /etc/group that contain root and nobody. # Useful when packaging binaries that insist on using nss to look up # username/groups (like nginx). + # /bin/sh is fine to not exist, and provided by another shim. fakeNss = symlinkJoin { name = "fake-nss"; paths = [ @@ -705,6 +707,12 @@ rec { ]; }; + # This provides /bin/sh, pointing to bashInteractive. + binSh = runCommand "bin-sh" {} '' + mkdir -p $out/bin + ln -s ${bashInteractive}/bin/bash $out/bin/sh + ''; + # Build an image and populate its nix database with the provided # contents. The main purpose is to be able to use nix commands in # the container.