In this blog post, we will cover developing nix packages and testing them in docker. We will set up a container with the proper environment to build nix packages, and then we will test build existing packages from the nixpkgs repo. This lays the foundation for using docker to test your own nix packages.
First, a quick introduction to Nix. Nix is a purely functional package manager. Nix expressions, a simple functional language, declaratively define each package. A Nix expression describes everything that goes into a package build action, known as a derivation. Because it’s a functional language, it’s easy to support building variants of a package: turn the Nix expression into a function and call it any number of times with the appropriate arguments. Due to the hashing scheme, variants don’t conflict with each other in the Nix store. More details regarding Nix packages and NixOS can be found here.
To begin, we must write the Dockerfile that will be used to build the development environment. We need to declare the baseimage to be used (centos7), install a few dependencies in order to install nix and clone nixpkgs repo. We also need to set up the nix user and permissions:
FROM centos:latest
MAINTAINER “Fernando J Pando” <nando@********.com>
RUN yum -y install bzip2 perl-Digest-SHA git
RUN adduser nixuser && groupadd nixbld && usermod -aG nixbld nixuser
RUN mkdir -m 0755 /nix && chown nixuser /nix
USER nixuser
WORKDIR /home/nixuser
We clone the nixpkgs github repo (this can be set to any fork/branch for testing):
RUN git clone https://github.com/nixos/nixpkgs.git
We download the nix installer (latest stable 1.11.4):
RUN curl https://nixos.org/nix/install -o nix.install.sh
We are now ready to set up the environment that will allow us to build nix packages in this container. There are several environment variables that need to be set for this to work, and we can pull them from the environment script provided by nix installation (~/.nix-profile/etc/profile.d/nix.sh). For easy reference, here is that file:
[code language=”bash”]
# Set the default profile.
if ! [ -L &amp;quot;$NIX_LINK&amp;quot; ]; then
echo &amp;quot;creating $NIX_LINK&amp;quot; &amp;gt;&amp;amp;2
_NIX_DEF_LINK=/nix/var/nix/profiles/default
/nix/store/xmlp6pyxi6hi3vazw9821nlhhiap6z63-coreutils-8.24/bin/ln -s &amp;quot;$_NIX_DEF_LINK&amp;quot; &amp;quot;$NIX_LINK&amp;quot;
fi
export PATH=$NIX_LINK/bin:$NIX_LINK/sbin:$PATH
# Subscribe the user to the Nixpkgs channel by default.
if [ ! -e $HOME/.nix-channels ]; then
echo &amp;quot;https://nixos.org/channels/nixpkgs-unstable nixpkgs&amp;quot; &amp;gt; $HOME/.nix-channels
fi
# Append ~/.nix-defexpr/channels/nixpkgs to $NIX_PATH so that
# &amp;lt;nixpkgs&amp;gt; paths work when the user has fetched the Nixpkgs
# channel.
export NIX_PATH=${NIX_PATH:+$NIX_PATH:}nixpkgs=$HOME/.nix-defexpr/channels/nixpkgs
# Set $SSL_CERT_FILE so that Nixpkgs applications like curl work.
if [ -e /etc/ssl/certs/ca-certificates.crt ]; then # NixOS, Ubuntu, Debian, Gentoo, Arch
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
elif [ -e /etc/ssl/certs/ca-bundle.crt ]; then # Old NixOS
export SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
elif [ -e /etc/pki/tls/certs/ca-bundle.crt ]; then # Fedora, CentOS
export SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
elif [ -e &amp;quot;$NIX_LINK/etc/ssl/certs/ca-bundle.crt&amp;quot; ]; then # fall back to cacert in Nix profile
export SSL_CERT_FILE=&amp;quot;$NIX_LINK/etc/ssl/certs/ca-bundle.crt&amp;quot;
elif [ -e &amp;quot;$NIX_LINK/etc/ca-bundle.crt&amp;quot; ]; then # old cacert in Nix profile
export SSL_CERT_FILE=&amp;quot;$NIX_LINK/etc/ca-bundle.crt&amp;quot;
fi
[/code]
We pull out the relevant environment given a Docker base Centos7 image:
ENV USER=nixuser
ENV HOME=/home/nixuser
ENV _NIX_DEF_LINK=/nix/var/nix/profiles/default
ENV SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
ENV NIX_LINK=$HOME/.nix-profile
ENV PATH=$NIX_LINK/bin:$NIX_LINK/sbin:$PATH
ENV NIX_PATH=${NIX_PATH:+$NIX_PATH:}nixpkgs=$HOME/.nix-defexpr/channels/nixpkgs
RUN echo “https://nixos.org/channels/nixpkgs-unstable nixpkgs” > $HOME/.nix-channels
RUN ln -sfv $_NIX_DEF_LINK $NIX_LINK
Now that the environment has been set up, we are ready to install nix:
RUN bash /home/nixuser/nix.install.sh
The last step is to set the working directory to the cloned github nixpkgs directory, so testing will execute from there when the container is run:
WORKDIR /home/nixuser/nixpkgs
At this point, we are ready to build the container:
docker build . -t nand0p/nixpkgs-devel
Conversely, you can pull this container image from docker hub:
docker pull nand0p/nixpkgs-devel
(NOTE: The docker hub image will contain a version of the nixpkgs repo from the time the container image was built. If you are testing on the bleeding edge, always build the container fresh before testing.)
Once the container is ready, we can now begin test building an existing nix package:
docker run -ti nand0p/nixpkgs-devel nix-build -A nginx
The above command will test build the nginx package inside your new docker container. It will also build all the dependencies. In order to test the package interactively to ensure to resulting binary works as expected, the container can be launched with bash:
docker run -ti nand0p/nixpkgs-devel bash
[nixuser@aa2c8e29c5e9 nixpkgs]$
Once you have shell inside the container, you can build and test run the package:
[nixuser@aa2c8e29c5e9 nixpkgs]$ nix-build -A nginx
/nix/store/7axviwfzbsqy50zznfxb7jzfvmg9pmwx-nginx-1.10.1
[nixuser@aa2c8e29c5e9 nixpkgs]$ /nix/store/7axviwfzbsqy50zznfxb7jzfvmg9pmwx-nginx-1.10.1/bin/nginx -V
nginx version: nginx/1.10.1
built by gcc 5.4.0 (GCC)
built with OpenSSL 1.0.2h 3 May 2016
TLS SNI support enabled
configure arguments: –prefix=/nix/store/7axviwfzbsqy50zznfxb7jzfvmg9pmwx-nginx-1.10.1 –with-http_ssl_module –with-http_v2_module –with-http_realip_module –with-http_addition_module –with-http_xslt_module –with-http_image_filter_module –with-http_geoip_module –with-http_sub_module –with-http_dav_module –with-http_flv_module –with-http_mp4_module –with-http_gunzip_module –with-http_gzip_static_module –with-http_auth_request_module –with-http_random_index_module –with-http_secure_link_module –with-http_degradation_module –with-http_stub_status_module –with-ipv6 –with-file-aio –add-module=/nix/store/vbfb8z3hgymbaz59wa54qf33yl84jii7-nginx-rtmp-module-v1.1.7-src –add-module=/nix/store/ps5s8q9v91l03972gw0h4l9iazx062km-nginx-dav-ext-module-v0.0.3-src –add-module=/nix/store/46sjsnbkx7rgwgn3pgigcfaygrs2cx30-headers-more-nginx-module-v0.26-src –with-cc-opt=’-fPIE -fstack-protector-all –param ssp-buffer-size=4 -O2 -D_FORTIFY_SOURCE=2′ –with-ld-opt=’-pie -Wl,-z,relro,-z,now’
Thanks for reading, and stay tuned for part II, where we will modify a nix package for our custom needs, and test it against our own fork of the nixpkgs repo.
|
Stelligent Amazon Pollycast
 |
