diff options
author | Robert Hensing <roberth@users.noreply.github.com> | 2024-02-14 23:38:44 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-02-14 23:38:44 +0100 |
commit | dcf985388cbb86934203217dbb60cb78f4885a54 (patch) | |
tree | 8485089b7224f13fc2a7d8f374d19fb40389589c | |
parent | 8affaaf9aebe9b5f4f39f8bb867c321283a237f0 (diff) | |
parent | 1f9e86f31462b395d77151469a53543a94e46c36 (diff) |
Merge pull request #271976 from r-k-b/fix-dockerTools-includeStorePaths
nixos/dockerTools: fix includeStorePaths when enableFakechroot
-rw-r--r-- | nixos/tests/docker-tools.nix | 15 | ||||
-rw-r--r-- | pkgs/build-support/docker/default.nix | 1 | ||||
-rw-r--r-- | pkgs/build-support/docker/examples.nix | 14 |
3 files changed, 30 insertions, 0 deletions
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix index 90af817e75ed3..f9d8b3ea64e42 100644 --- a/nixos/tests/docker-tools.nix +++ b/nixos/tests/docker-tools.nix @@ -71,14 +71,29 @@ in { docker.succeed("${examples.helloOnRoot} | docker load") docker.succeed("docker run --rm hello | grep -i hello") docker.succeed("docker image rm hello:latest") + with subtest("includeStorePath = false; breaks example"): docker.succeed("${examples.helloOnRootNoStore} | docker load") docker.fail("docker run --rm hello | grep -i hello") docker.succeed("docker image rm hello:latest") + with subtest("includeStorePath = false; breaks example (fakechroot)"): + docker.succeed("${examples.helloOnRootNoStoreFakechroot} | docker load") + docker.fail("docker run --rm hello | grep -i hello") + docker.succeed("docker image rm hello:latest") + + with subtest("Ensure ZERO paths are added to the store"): + docker.fail("${examples.helloOnRootNoStore} | ${pkgs.crane}/bin/crane export - - | tar t | grep 'nix/store/'") + with subtest("Ensure ZERO paths are added to the store (fakechroot)"): + docker.fail("${examples.helloOnRootNoStoreFakechroot} | ${pkgs.crane}/bin/crane export - - | tar t | grep 'nix/store/'") + with subtest("includeStorePath = false; works with mounted store"): docker.succeed("${examples.helloOnRootNoStore} | docker load") docker.succeed("docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello") docker.succeed("docker image rm hello:latest") + with subtest("includeStorePath = false; works with mounted store (fakechroot)"): + docker.succeed("${examples.helloOnRootNoStoreFakechroot} | docker load") + docker.succeed("docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello") + docker.succeed("docker image rm hello:latest") with subtest("Ensure Docker images use a stable date by default"): docker.succeed( diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix index 05a1a6fbbdaf1..3f61ecdb2a461 100644 --- a/pkgs/build-support/docker/default.nix +++ b/pkgs/build-support/docker/default.nix @@ -923,6 +923,7 @@ rec { --sort name \ --exclude=./proc \ --exclude=./sys \ + --exclude=.${builtins.storeDir} \ --numeric-owner --mtime "@$SOURCE_DATE_EPOCH" \ --hard-dereference \ -cf $out/layer.tar . diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix index 5784e650dc2e4..88f36d337f253 100644 --- a/pkgs/build-support/docker/examples.nix +++ b/pkgs/build-support/docker/examples.nix @@ -639,6 +639,20 @@ rec { includeStorePaths = false; }; + helloOnRootNoStoreFakechroot = pkgs.dockerTools.streamLayeredImage { + name = "hello"; + tag = "latest"; + contents = [ + (pkgs.buildEnv { + name = "hello-root"; + paths = [ pkgs.hello ]; + }) + ]; + config.Cmd = [ "hello" ]; + includeStorePaths = false; + enableFakechroot = true; + }; + etc = let inherit (pkgs) lib; |