steveej/nix2aci

Machinery for creating and running ACIs on Linux systems where Nix(OS) and rkt are available

nix2aci's Issues

os and arch labels have to be added manually

This is bothersome and has been fixed upstream in acbuild.

Buildtool (Go, GCC, etc.) version should be annotated in the manifest

This can help to identify builds compromised due to known security vulnerabilities

nix2aci should use upstream libraries (implemented in Go)

/etc handling is broken

First off, I love this program. We're using it to make ACIs for our production software, and it's effective, simple, and it works. So thanks for making it!

The handling of /etc in mkACI.py is broken. mkACI.py uses cp -aL when copying /etc. Since this follows symlinks, this is broken if /etc from the input derivations contains relative or absolute links outside of /nix/store. For instance, if a derivation contains a /usr/share/whatever directory, and /etc/whatever is symlinked to it, when cp -aL is ran, the files from /usr/share/whatever on the host system will be used instead of the files from the derivation.

I'd be interested in fixing this, but I'm not sure what the best way to do so is, or what the rationale behind this behavior is.

travis: should use language: nix

Any plans to migrate this into nixpkgs?

It seems like some of this work could be shared with dockerTools if we factored out common notions. That would help address NixOS/nixpkgs#20238 and such.

Image dependencies: useful?

Spaces not escaped properly

When one adds a mount point (and probably other things) that has a space in it, the space isn't properly escaped when passed into acbuild, causing acbuild to throw an error

...
++ acbuild --debug mount add config /var/lib/plexmediaserver/Library/Application Support
mount add: incorrect number of arguments
+ export EXT=0
+ EXT=0
+ /nix/store/6hrcxzwk3padb28i3phnmmz15bjjqaj3-findutils-4.4.2/bin/find .acbuild/ -type d -exec chmod +wr '{}' +
+ acbuild --debug end
Ending the build
+ exit
builder for '/nix/store/83cm1008c7q3f4jgyrjkb4xk7nbbk44q-plex.drv' failed with exit code 1
error: build of '/nix/store/83cm1008c7q3f4jgyrjkb4xk7nbbk44q-plex.drv' failed

The plex.nix file that causes this:

{ mkACI, pkgs, thin ? false, ... } @ args:
let 
  pkg = pkgs.plex;
in

mkACI rec {
  inherit pkgs;
  inherit thin;
  packages = [ pkg ];

  mounts = {
    "config" = "/var/lib/plexmediaserver/Library/Application Support";
    "media" = "/media";
  };

  ports = {
      "https" = [ "tcp" "32400" ];
  };

  exec = "/usr/lib/plexmediaserver/Plex Media Server";

  env = {
      "PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR" = "/var/lib/plexmediaserver/Library/Application Support";
      "PLEX_MEDIA_SERVER_HOME" = "/usr/lib/plexmediaserver";
      "PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS" = "6";
      "PLEX_MEDIA_SERVER_TMPDIR" = "/tmp";
      "LD_LIBRARY_PATH" = "/usr/lib/plexmediaserver";
      "LC_ALL" = "en_US.UTF-8";
      "LANG" = "en_US.UTF-8";
  };
}

Replace mkACI.py with a Nix expression

mkACI.py can be replaced with a Nix expression, which would get rid of the dependency on Python.

Tests needed

Following functionality needs testing

• Manifest validation
• Thin ACI
• Fat ACI
• Probably more

postprocess script is broken

$ ./result/postprocess.sh 
/usr/bin/env: bash -e: No such file or directory

/cc @Mic92

Investigate OCI support

Image compression should be adjustable