build: use nix for building release images

.github/workflows/ci.yml

@@ -46,24 +46,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
 
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
+      - name: Restore /nix from cache
+        uses: ./.github/actions/restore-nix-cache
 
-      - name: Build MPC Node binary and image
+      - name: Build MPC Node image and load into Docker
         run: |
-          export NODE_IMAGE_NAME=test_image_tag_ci
-          ./deployment/build-images.sh --node
+          archive=$(nix build --no-link --print-out-paths .#node-image)
+          docker load < "$archive"
 
       - name: Check mpc-node docker image can initialize and start
-        run: |
-          export NODE_IMAGE_NAME=test_image_tag_ci
-          ./scripts/check-mpc-node-docker-starts.sh
+        run: ./scripts/check-mpc-node-docker-starts.sh
 
   docker-rust-launcher-build-and-verify:
     name: "Build Rust Launcher Docker image and verify"
@@ -80,29 +75,24 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo liblzma-dev podman
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
 
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
+      - name: Restore /nix from cache
+        uses: ./.github/actions/restore-nix-cache
 
       - name: Build Rust launcher docker image and verify its hash
         shell: bash
+        run: ./scripts/build-and-verify-rust-launcher-docker-image.sh
+
+      - name: Load launcher image into Docker
         run: |
-          ./scripts/build-and-verify-rust-launcher-docker-image.sh
+          archive=$(nix build --no-link --print-out-paths .#rust-launcher-image)
+          docker load < "$archive"
 
       - name: Run Rust launcher non-TEE runtime check
         shell: bash
-        run: |
-          ./scripts/check-mpc-node-docker-starts.sh --rust-launcher
+        run: ./scripts/check-mpc-node-docker-starts.sh --rust-launcher
 
   mpc-unittests:
     name: "Cargo test: ${{ matrix.group }}"

.github/workflows/docker_build_node.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-and-push-images:
     name: "Build and push Docker node image with commit hash"
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2404-x64-32x
     environment: production
     permissions:
       contents: read
@@ -26,26 +26,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
+
       - name: Login to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PAT }}
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
-
-      - name: Install skopeo
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo
-
       - name: Build and push node image
         run: |
           export NODE_IMAGE_NAME=mpc-node

.github/workflows/docker_build_node_gcp.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-and-push-images:
     name: "Build and push Docker node gcp image with commit hash"
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2404-x64-32x
     environment: production
     permissions:
       contents: read
@@ -26,26 +26,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
+
       - name: Login to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PAT }}
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
-
-      - name: Install skopeo
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo
-
       - name: Build and push node gcp image
         run: |
           export NODE_GCP_IMAGE_NAME=mpc-node-gcp

.github/workflows/docker_build_rust_launcher.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-and-push-images:
     name: "Build and push Rust launcher Docker image with commit hash"
-    runs-on: warp-ubuntu-2404-x64-8x
+    runs-on: warp-ubuntu-2404-x64-32x
     environment: production
     permissions:
       contents: read
@@ -26,19 +26,8 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo liblzma-dev podman
-
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
 
       - name: Login to Docker Hub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

README.md

@@ -123,9 +123,9 @@ cargo install cargo-insta
 
 ## Reproducible Builds
 
-Both the node and launcher Docker images support reproducible builds, ensuring identical binaries from the same source. Run `./deployment/build-images.sh` from the project root.
+Both the node and launcher Docker images support reproducible builds, ensuring identical binaries from the same source. The build is driven by Nix: run `./deployment/build-images.sh` from the project root, or invoke the derivations directly — `nix build .#node-image` produces an OCI tarball and `nix build .#node-image-manifest-digest` prints the digest operators vote for.
 
-For prerequisites and options, see [docs/reproducible-builds.md](docs/reproducible-builds.md).
+For prerequisites and the full set of derivations, see [docs/reproducible-builds.md](docs/reproducible-builds.md).
 
 ## Releases