Skip to content

Commit 6b4578c

Browse files
kylecarbskylecarbs
committed
Add comments to our Nix
1 parent d900e19 commit 6b4578c

File tree

1 file changed

+70
-42
lines changed

1 file changed

+70
-42
lines changed

‎flake.nix

Lines changed: 70 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -58,20 +58,21 @@
5858
zstd
5959
];
6060

61-
# Start with an Ubuntu image!
61+
# This is the base image for our Docker container used for development.
62+
# Use `nix-prefetch-docker ubuntu --arch amd64 --image-tag lunar` to get this.
6263
baseDevEnvImage = pkgs.dockerTools.pullImage {
6364
imageName = "ubuntu";
6465
imageDigest = "sha256:7a520eeb6c18bc6d32a21bb7edcf673a7830813c169645d51c949cecb62387d0";
6566
sha256 = "ajZzFSG/q7F5wAXfBOPpYBT+aVy8lqAXtBzkmAe2SeE=";
6667
finalImageName = "ubuntu";
6768
finalImageTag = "lunar";
6869
};
69-
# Build the image and modify it to have the "coder" user.
70+
# This is an intermediate stage that adds sudo with the setuid bit set.
71+
# Nix doesn't allow setuid binaries in the store, so we have to do this
72+
# in a separate stage.
7073
intermediateDevEnvImage = pkgs.dockerTools.buildImage {
7174
name = "intermediate";
7275
fromImage = baseDevEnvImage;
73-
# This replaces the "ubuntu" user with "coder" and
74-
# gives it sudo privileges!
7576
runAsRoot = ''
7677
#!${pkgs.runtimeShell}
7778
${pkgs.dockerTools.shadowSetup}
@@ -83,64 +84,91 @@
8384
--uid=1000 \
8485
--user-group \
8586
--groups docker
86-
cp ${pkgs.sudo}/bin/sudo /usr/bin/sudo
87-
chmod 4755 /usr/bin/sudo
87+
cp ${pkgs.sudo}/bin/sudo usr/bin/sudo
88+
chmod 4755 usr/bin/sudo
89+
mkdir -p /etc/init.d
8890
'';
8991
};
90-
91-
devEnvPath = "PATH=${pkgs.lib.makeBinPath devShellPackages}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/coder/go/bin";
92-
dockerDebianInit = pkgs.fetchFromGitHub {
93-
owner = "moby";
94-
repo = "moby";
95-
rev = "ae737656f9817fbd5afab96aa083754cfb81aab0";
96-
sha256 = "sha256-oS3WplsxhKHCuHwL4/ytsCNJ1N/SZhlUZmzZTf81AoE=";
97-
};
92+
# Environment variables that live in `/etc/environment` in the container.
93+
# These will also be applied to the container config.
94+
devEnvVars = [
95+
"PATH=${pkgs.lib.makeBinPath devShellPackages}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/coder/go/bin"
96+
#This setting prevents Go from using the public checksum database for
97+
# our module path prefixes. It is required because these are in private
98+
# repositories that require authentication.
99+
#
100+
# For details, see: https://golang.org/ref/mod#private-modules
101+
"GOPRIVATE=coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
102+
# Increase memory allocation to NodeJS
103+
"NODE_OPTIONS=--max_old_space_size=8192"
104+
];
105+
# Builds a layered image with all the tools included!
98106
devEnvImage = pkgs.dockerTools.streamLayeredImage {
99107
name = "codercom/oss-dogfood";
100108
tag = "testing";
101109
fromImage = intermediateDevEnvImage;
102110
maxLayers = 64;
103-
extraCommands = ''
104-
mkdir -p etc
105-
echo ${devEnvPath} > etc/environment
106-
107-
mkdir -p etc/default
108-
echo 'DOCKERD=${pkgs.docker}/bin/dockerd' > etc/default/docker
109-
mkdir -p etc/init.d
110-
cp ${dockerDebianInit}/contrib/init/sysvinit-debian/docker etc/init.d/docker
111-
echo "coder ALL=(ALL) NOPASSWD:ALL" >etc/sudoers
112-
mkdir -p etc/pam.d
113-
cat > etc/pam.d/other <<EOF
111+
contents = [
112+
# Required for `sudo` to persist the proper `PATH`.
113+
(
114+
pkgs.writeTextDir "etc/environment" (pkgs.lib.strings.concatLines devEnvVars)
115+
)
116+
# Allows `coder` to use `sudo` without a password.
117+
(
118+
pkgs.writeTextDir "etc/sudoers" ''
119+
coder ALL=(ALL) NOPASSWD:ALL
120+
''
121+
)
122+
# Also allows `coder` to use `sudo` without a password.
123+
(
124+
pkgs.writeTextDir "etc/pam.d/other" ''
114125
account sufficient pam_unix.so
115126
auth sufficient pam_rootok.so
116127
password requisite pam_unix.so nullok yescrypt
117128
session required pam_unix.so
118-
EOF
119-
mkdir -p etc/ssl/certs
120-
cp -r ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt etc/ssl/certs/ca-certificates.crt
121-
'';
129+
''
130+
)
131+
# This is the debian script for managing Docker with `sudo service docker ...`.
132+
(
133+
pkgs.writeTextFile {
134+
name = "docker";
135+
destination = "/etc/init.d/docker";
136+
executable = true;
137+
text = (builtins.readFile (
138+
pkgs.fetchFromGitHub
139+
{
140+
owner = "moby";
141+
repo = "moby";
142+
rev = "ae737656f9817fbd5afab96aa083754cfb81aab0";
143+
sha256 = "sha256-oS3WplsxhKHCuHwL4/ytsCNJ1N/SZhlUZmzZTf81AoE=";
144+
} + "/contrib/init/sysvinit-debian/docker"
145+
));
146+
}
147+
)
148+
# The Docker script above looks here for the daemon binary location.
149+
# Because we're injecting it with Nix, it's not in the default spot.
150+
(
151+
pkgs.writeTextDir "etc/default/docker" ''
152+
DOCKERD=${pkgs.docker}/bin/dockerd
153+
''
154+
)
155+
# The same as `sudo apt install ca-certificates -y'.
156+
(
157+
pkgs.writeTextDir "etc/ssl/certs/ca-certificates.crt"
158+
(builtins.readFile "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt")
159+
)
160+
];
122161

123162
config = {
124-
Env = [
125-
devEnvPath
126-
#This setting prevents Go from using the public checksum database for
127-
# our module path prefixes. It is required because these are in private
128-
# repositories that require authentication.
129-
#
130-
# For details, see: https://golang.org/ref/mod#private-modules
131-
"GOPRIVATE=coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
132-
# Increase memory allocation to NodeJS
133-
"NODE_OPTIONS=--max_old_space_size=8192"
134-
];
163+
Env = devEnvVars;
135164
Entrypoint = [ "/bin/bash" ];
136165
User = "coder";
137166
};
138167
};
139168
in
140169
{
141170
packages = {
142-
devEnvironmentDocker = devEnvImage;
143-
# other packages you want to define for this system
171+
devEnvImage = devEnvImage;
144172
};
145173
defaultPackage = formatter; # or replace it with your desired default package.
146174
devShell = pkgs.mkShell { buildInputs = devShellPackages; };

0 commit comments

Comments
 (0)