diff options
author | Robert Hensing <robert@roberthensing.nl> | 2021-10-01 13:47:01 +0200 |
---|---|---|
committer | Robert Hensing <robert@roberthensing.nl> | 2021-10-06 22:45:04 +0200 |
commit | 48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c (patch) | |
tree | 652a2873d26324607e5f3948bb94d50fa4b44634 | |
parent | 1d5953184a6489980e7ad9169c91b48af4b92383 (diff) | |
download | nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar.gz nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar.bz2 nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar.lz nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar.xz nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.tar.zst nixpkgs-48cfdc8ca57bbd88b3d16ddb0c83c2be6a643f8c.zip |
dockerTools: Add store dependencies of the customization layer
-rw-r--r-- | nixos/tests/docker-tools.nix | 20 | ||||
-rw-r--r-- | pkgs/build-support/docker/default.nix | 4 | ||||
-rw-r--r-- | pkgs/build-support/docker/examples.nix | 4 |
3 files changed, 22 insertions, 6 deletions
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix index e482223436f..d2c2ca286ff 100644 --- a/nixos/tests/docker-tools.nix +++ b/nixos/tests/docker-tools.nix @@ -276,15 +276,22 @@ import ./make-test-python.nix ({ pkgs, ... }: { # Ensure the image has the correct number of layers assert len(set_of_layers("layered-bulk-layer")) == 4 - with subtest("Ensure correct behavior when no store is needed"): + with subtest("Ensure only minimal paths are added to the store"): + # TODO: make an example that has no store paths, for example by making + # busybox non-self-referential. + # This check tests that buildLayeredImage can build images that don't need a store. docker.succeed( "docker load --input='${pkgs.dockerTools.examples.no-store-paths}'" ) - # This check may be loosened to allow an *empty* store rather than *no* store. - docker.succeed("docker run --rm no-store-paths ls /") - docker.fail("docker run --rm no-store-paths ls /nix/store") + docker.succeed("docker run --rm no-store-paths ls / >/dev/console") + + # If busybox isn't self-referential, we need this line + # docker.fail("docker run --rm no-store-paths ls /nix/store >/dev/console") + # However, it currently is self-referential, so we check that it is the + # only store path. + docker.succeed("diff <(docker run --rm no-store-paths ls /nix/store) <(basename ${pkgs.pkgsStatic.busybox}) >/dev/console") with subtest("Ensure buildLayeredImage does not change store path contents."): docker.succeed( @@ -379,6 +386,11 @@ import ./make-test-python.nix ({ pkgs, ... }: { "docker run --rm ${examples.layeredImageWithFakeRootCommands.imageName} sh -c 'stat -c '%u' /home/jane | grep -E ^1000$'" ) + with subtest("The image contains store paths referenced by the fakeRootCommands output"): + docker.succeed( + "docker run --rm ${examples.layeredImageWithFakeRootCommands.imageName} /hello/bin/hello" + ) + with subtest("exportImage produces a valid tarball"): docker.succeed( "tar -tf ${examples.exportBash} | grep '\./bin/bash' > /dev/null" diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index 47fd99c12f8..fa71d430002 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -864,13 +864,13 @@ rec { }; closureRoots = lib.optionals includeStorePaths /* normally true */ ( - [ baseJson ] ++ contentsList + [ baseJson customisationLayer ] ); overallClosure = writeText "closure" (lib.concatStringsSep " " closureRoots); # These derivations are only created as implementation details of docker-tools, # so they'll be excluded from the created images. - unnecessaryDrvs = [ baseJson overallClosure ]; + unnecessaryDrvs = [ baseJson overallClosure customisationLayer ]; conf = runCommand "${baseName}-conf.json" { diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix index 9f6823a5878..0f7c3bd2820 100644 --- a/pkgs/build-support/docker/examples.nix +++ b/pkgs/build-support/docker/examples.nix @@ -350,6 +350,9 @@ rec { # This removes sharing of busybox and is not recommended. We do this # to make the example suitable as a test case with working binaries. cp -r ${pkgs.pkgsStatic.busybox}/* . + + # This is a "build" dependency that will not appear in the image + ${pkgs.hello}/bin/hello ''; }; @@ -504,6 +507,7 @@ rec { fakeRootCommands = '' mkdir -p ./home/jane chown 1000 ./home/jane + ln -s ${pkgs.pkgsStatic.hello} ./hello ''; }; |