wip: tarless nix OCI builder

.github/workflows/test.yml

@@ -26,6 +26,14 @@ jobs:
       - name: Install Nix prerequisites
         if: ${{ matrix.test == 'nix' }}
         run: nix-env -i nix-eval-jobs -f '<nixpkgs>'
+      - name: Setup Nix cache
+        if: ${{ matrix.test == 'nix' }}
+        uses: ryanccn/attic-action@v0
+        with:
+          endpoint: https://attic.brainhive.nl/
+          cache: steiger
+          token: ${{ secrets.ATTIC_TOKEN }}
+          inputs-from: .
       - name: Install Bazel prerequisites
         if: ${{ matrix.test == 'bazel' }}
         run: |

.gitignore

@@ -1,3 +1,3 @@
-/target
-/result
+target
+result
 .direnv

README.md

@@ -70,7 +70,6 @@ Requirements
         };
 
         config.Cmd = ["/bin/hello"];
-        compressor = "none";
       };
     };
 

flake.nix

@@ -1,8 +1,7 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    nixpkgs-ocitools.url = "github:brainhivenl/nixpkgs/oci/refactor";
-
+    nix-filter.url = "github:numtide/nix-filter";
     crane.url = "github:ipetkov/crane";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
@@ -12,11 +11,13 @@
 
   outputs = {
     self,
+    nix-filter,
     nixpkgs,
     crane,
     ...
-  } @ inputs: let
+  }: let
     inherit (nixpkgs) lib;
+    filter = nix-filter.lib;
 
     forEachSystem = fun:
       lib.genAttrs (lib.systems.flakeExposed) (
@@ -35,13 +36,21 @@
     packages = forEachSystem (
       pkgs: let
         craneLib = crane.mkLib pkgs;
+        src = filter {
+          root = ./.;
+          include = [
+            ./Cargo.toml
+            ./Cargo.lock
+            ./src
+          ];
+        };
         commonArgs = {
-          src = craneLib.cleanCargoSource ./.;
+          inherit src;
           strictDeps = true;
           buildInputs = lib.optionals pkgs.stdenv.isDarwin [pkgs.libiconv];
         };
-      in {
-        default = craneLib.buildPackage (
+
+        steiger = craneLib.buildPackage (
           commonArgs
           // {
             cargoArtifacts = craneLib.buildDepsOnly commonArgs;
@@ -53,30 +62,49 @@
             NIX_EVAL_JOBS_BINARY = lib.getExe pkgs.nix-eval-jobs;
           }
         );
+      in {
+        default = steiger;
+        ociTools = pkgs.callPackage ./oci-tools {};
+
+        image = let
+          ociTools = self.packages.${pkgs.stdenv.hostPlatform.system}.ociTools;
+        in
+          ociTools.buildImage {
+            name = "test-image";
+            layers = [
+              (pkgs.writeClosure [pkgs.dockerTools.caCertificates pkgs.hello])
+            ];
+            pathsToLink = ["/bin" "/etc"];
+          };
       }
     );
 
     checks = forEachSystem (pkgs: {
-      inherit (self.packages.${pkgs.system}) default;
+      inherit (self.packages.${pkgs.stdenv.hostPlatform.system}) default;
     });
 
     devShells = forEachSystem (
-      pkgs: let
-        craneLib = crane.mkLib pkgs;
-      in {
-        default = craneLib.devShell {
+      pkgs: {
+        default = (crane.mkLib pkgs).devShell {
           packages = [
             pkgs.rust-analyzer
             pkgs.nix-eval-jobs
           ];
         };
+        steiger = pkgs.mkShell {
+          packages = [self.packages.${pkgs.stdenv.hostPlatform.system}.default];
+        };
       }
     );
 
-    overlays.ociTools = final: prev: let
-      pkgs = import inputs.nixpkgs-ocitools {inherit (final) system;};
-    in {
-      inherit (pkgs) ociTools;
+    overlays = {
+      default = final: prev: {
+        steiger = self.packages.${final.stdenv.hostPlatform.system}.default;
+        ociTools = self.packages.${final.stdenv.hostPlatform.system}.ociTools;
+      };
+      ociTools = final: prev: {
+        ociTools = self.packages.${final.stdenv.hostPlatform.system}.ociTools;
+      };
     };
   };
 }

oci-tools.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenvNoCC,
+  runCommand,
+  writeClosure,
+  closureInfo,
+  steiger,
+}: let
+  defaultArch = let
+    inherit (stdenvNoCC.targetPlatform) system;
+  in (
+    if lib.hasPrefix "aarch64-" system
+    then "arm64"
+    else if lib.hasPrefix "x86_64-" system
+    then "amd64"
+    else throw "unsupported system: ${system}"
+  );
+
+  joinLines = lib.concatStringsSep "\n";
+
+  # split derivation into 2 seperate closures separating the main package and it's dependencies
+  splitDeps = drv: let
+    fullClosure = closureInfo {rootPaths = [drv];};
+    depsPaths = runCommand "deps-paths" {} ''
+      grep -v "${drv}" ${fullClosure}/store-paths > $out
+    '';
+    drvPaths = runCommand "app-paths" {} ''
+      echo "${drv}" > $out
+    '';
+  in
+    map (closure: {inherit closure;}) [depsPaths drvPaths];
+
+  # writeClosure wrapper which allows direct closure passthrough
+  writeLayerClosure = layer:
+    if layer ? closure
+    then layer.closure
+    else writeClosure layer;
+
+  buildImage = {
+    name,
+    tag ? "latest",
+    layers,
+    pathsToLink ? null,
+    config ? {},
+    os ? "linux",
+    arch ? defaultArch,
+  }:
+    runCommand name
+    {nativeBuildInputs = [steiger];}
+    # sh
+    ''
+      steiger nix-to-oci \
+          ${joinLines (map (closure: "--closure=${closure} \\") (map writeLayerClosure layers))}
+          ${joinLines (map (path: "--link-path=${path} \\") pathsToLink)}
+          --out-path $out \
+          --name='${name}' \
+          --tag='${tag}' \
+          --os='${os}' \
+          --arch='${arch}' \
+          --config='${builtins.toJSON config}'
+    '';
+in {
+  inherit splitDeps buildImage;
+}