test fix for ghcr

.github/workflows/build.yaml

@@ -11,7 +11,7 @@ jobs:
       - run: nix build -L .#nixos-runner
       - run: nix run .#push-container -- result
         env:
-          REGISTRY: ghcr.io/${{ github.repository_owner }}
+          REGISTRY: https://ghcr.io/${{ github.repository_owner }}
           REPOSITORY: nixos-runner
           USERNAME: ${{ github.actor }}
           PASSWORD: ${{ github.token }}

flake.lock

@@ -5,11 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1692799911,
+        "lastModified": 1710146030,
-        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -18,13 +18,81 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flakey-profile": {
+      "locked": {
+        "lastModified": 1712898590,
+        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "type": "github"
+      }
+    },
+    "lix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1723503926,
+        "narHash": "sha256-Rosl9iA9MybF5Bud4BTAQ9adbY81aGmPfV8dDBGl34s=",
+        "rev": "bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2.tar.gz?rev=bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.0.tar.gz"
+      }
+    },
+    "lix-module": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "flakey-profile": "flakey-profile",
+        "lix": "lix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1723510904,
+        "narHash": "sha256-zNW/rqNJwhq2lYmQf19wJerRuNimjhxHKmzrWWFJYts=",
+        "rev": "622a2253a071a1fb97a4d3c8103a91114acc1140",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/622a2253a071a1fb97a4d3c8103a91114acc1140.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.0.tar.gz"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1693158576,
+        "lastModified": 1725634671,
-        "narHash": "sha256-aRTTXkYvhXosGx535iAFUaoFboUrZSYb1Ooih/auGp0=",
+        "narHash": "sha256-v3rIhsJBOMLR8e/RNWxr828tB+WywYIoajrZKFM+0Gg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a999c1cc0c9eb2095729d5aa03e0d8f7ed256780",
+        "rev": "574d1eac1c200690e27b8eb4e24887f8df7ac27c",
         "type": "github"
       },
       "original": {
@@ -36,6 +104,7 @@
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
+        "lix-module": "lix-module",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -53,6 +122,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -8,471 +8,456 @@
     flake-utils = {
       url = "github:numtide/flake-utils";
     };
+    lix-module = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.0.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, flake-utils }@inputs:
+  outputs = {
-    (flake-utils.lib.eachDefaultSystem
+    self,
-      (system:
+    flake-utils,
-        let
+    lix-module,
-          pkgs = import nixpkgs {
+    nixpkgs,
-            inherit system;
+  }: (
-            config.permittedInsecurePackages = [
+    flake-utils.lib.eachDefaultSystem
-              "nodejs-16.20.2"
+    (
+      system: let
+        pkgs = import nixpkgs {
+          inherit system;
+          imports = [
+            lix-module.nixosModules.default
+          ];
+          nix.package = pkgs.lix;
+
+          # config.permittedInsecurePackages = [
+          #   "nodejs-16.20.2"
+          # ];
+          overlays = [
+            # (
+            #   self: super: {
+            #     regclient = let
+            #       pname = "regclient";
+            #       version = "0.5.1+";
+            #       src = pkgs.fetchFromGitHub {
+            #         owner = "regclient";
+            #         repo = "regclient";
+            #         rev = "72df49963a17092138854c5d9d7943deac1dde6b";
+            #         hash = "sha256-9k1VXtaHTF1GMIDs5qGzJkqPZa+ZKrWes+LakVKaQ38=";
+            #       };
+            #       vendorHash = "sha256-j+XidIgjJ5uw1d4OXRl3pjiW5Hvy7WqNM0KdVWMvWls=";
+            #     in
+            #       super.buildGoModule {
+            #         inherit pname version src vendorHash;
+            #         inherit (super.regclient) meta outputs postInstall;
+            #         ldflags = [
+            #           "-s"
+            #           "-w"
+            #           "-X main.VCSTag=v${version}"
+            #         ];
+            #         doCheck = false;
+            #       };
+            #   }
+            # )
+          ];
+        };
+        lib = pkgs.lib;
+        docker-client = pkgs.docker_26.override {
+          clientOnly = true;
+        };
+      in {
+        packages = {
+          nixos-runner = let
+            bundleNixpkgs = true;
+            channelName = "nixpkgs";
+            channelURL = "https://nixos.org/channels/nixos-unstable";
+            defaultPkgs = [
+              pkgs.bashInteractive
+              pkgs.bind.dnsutils
+              pkgs.coreutils-full
+              pkgs.curl
+              pkgs.dogdns
+              pkgs.gawk
+              pkgs.git
+              pkgs.glibc
+              pkgs.gnugrep
+              pkgs.gnused
+              pkgs.gzip
+              pkgs.iputils
+              pkgs.less
+              pkgs.lix
+              # pkgs.nix
+              pkgs.nodejs_20
+              pkgs.nushell
+              pkgs.more
+              pkgs.podman
+              pkgs.regctl
+              pkgs.stdenv.cc.cc.lib
+              pkgs.which
+
+              docker-client
+
+              self.packages.${system}.push-container
             ];
-            overlays = [
+
-              (
+            flake-registry = null;
-                self: super: {
+
-                  regclient =
+            users =
-                    let
+              {
-                      pname = "regclient";
+                root = {
-                      version = "0.5.1+";
+                  uid = 0;
-                      src = pkgs.fetchFromGitHub {
+                  shell = "${pkgs.bashInteractive}/bin/bash";
-                        owner = "regclient";
+                  home = "/root";
-                        repo = "regclient";
+                  gid = 0;
-                        rev = "72df49963a17092138854c5d9d7943deac1dde6b";
+                  groups = ["root"];
-                        hash = "sha256-9k1VXtaHTF1GMIDs5qGzJkqPZa+ZKrWes+LakVKaQ38=";
+                  description = "System administrator";
-                      };
+                };
-                      vendorHash = "sha256-j+XidIgjJ5uw1d4OXRl3pjiW5Hvy7WqNM0KdVWMvWls=";
+                nobody = {
-                    in
+                  uid = 65534;
-                    super.buildGoModule {
+                  shell = "${pkgs.shadow}/bin/nologin";
-                      inherit pname version src vendorHash;
+                  home = "/var/empty";
-                      inherit (super.regclient) meta outputs postInstall;
+                  gid = 65534;
-                      ldflags = [
+                  groups = ["nobody"];
-                        "-s"
+                  description = "Unprivileged account (don't use!)";
-                        "-w"
+                };
-                        "-X main.VCSTag=v${version}"
+              }
-                      ];
+              // lib.listToAttrs (
-                      doCheck = false;
+                map
+                (
+                  n: {
+                    name = "nixbld${toString n}";
+                    value = {
+                      uid = 30000 + n;
+                      gid = 30000;
+                      groups = ["nixbld"];
+                      description = "Nix build user ${toString n}";
                     };
-                }
+                  }
-              )
+                )
-            ];
+                (lib.lists.range 1 32)
-          };
+              );
-          lib = pkgs.lib;
-          docker-client = pkgs.docker_24.override {
-            clientOnly = true;
-          };
-        in
-        {
 
-          packages = {
+            groups = {
-            nixos-runner =
+              root.gid = 0;
+              nixbld.gid = 30000;
+              nobody.gid = 65534;
+            };
+
+            userToPasswd = (
+              data: {
+                uid,
+                gid ? 65534,
+                home ? "/var/empty",
+                description ? "",
+                shell ? "/bin/false",
+                ...
+              }: "${data}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
+            );
+
+            passwdContents = (
+              lib.concatStringsSep "\n"
+              (lib.attrValues (lib.mapAttrs userToPasswd users))
+            );
+
+            userToShadow = username: {...}: "${username}:!:1::::::";
+
+            shadowContents = (
+              lib.concatStringsSep "\n"
+              (lib.attrValues (lib.mapAttrs userToShadow users))
+            );
+
+            groupMemberMap = (
               let
-                bundleNixpkgs = true;
+                # Create a flat list of user/group mappings
-                channelName = "nixpkgs";
+                mappings = (
-                channelURL = "https://nixos.org/channels/nixos-unstable";
+                  builtins.foldl'
-                defaultPkgs = [
-                  pkgs.bashInteractive
-                  pkgs.bind.dnsutils
-                  pkgs.coreutils-full
-                  pkgs.curl
-                  pkgs.dogdns
-                  pkgs.gawk
-                  pkgs.git
-                  pkgs.glibc
-                  pkgs.gnugrep
-                  pkgs.gnused
-                  pkgs.gzip
-                  pkgs.iputils
-                  pkgs.nix
-                  pkgs.nodejs-16_x
-                  pkgs.nushell
-                  pkgs.podman
-                  pkgs.regctl
-                  pkgs.stdenv.cc.cc.lib
-
-                  docker-client
-
-                  # self.packages.${system}.podman-push-container
-                  # self.packages.${system}.docker-push-container
-                  self.packages.${system}.push-container
-                ];
-
-                flake-registry = null;
-
-                users = {
-                  root = {
-                    uid = 0;
-                    shell = "${pkgs.bashInteractive}/bin/bash";
-                    home = "/root";
-                    gid = 0;
-                    groups = [ "root" ];
-                    description = "System administrator";
-                  };
-                  nobody = {
-                    uid = 65534;
-                    shell = "${pkgs.shadow}/bin/nologin";
-                    home = "/var/empty";
-                    gid = 65534;
-                    groups = [ "nobody" ];
-                    description = "Unprivileged account (don't use!)";
-                  };
-                } // lib.listToAttrs (
-                  map
-                    (
-                      n: {
-                        name = "nixbld${toString n}";
-                        value = {
-                          uid = 30000 + n;
-                          gid = 30000;
-                          groups = [ "nixbld" ];
-                          description = "Nix build user ${toString n}";
-                        };
-                      }
-                    )
-                    (lib.lists.range 1 32)
-                );
-
-                groups = {
-                  root.gid = 0;
-                  nixbld.gid = 30000;
-                  nobody.gid = 65534;
-                };
-
-                userToPasswd = (
-                  k:
-                  { uid
-                  , gid ? 65534
-                  , home ? "/var/empty"
-                  , description ? ""
-                  , shell ? "/bin/false"
-                  , groups ? [ ]
-                  }: "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
-                );
-
-                passwdContents = (
-                  lib.concatStringsSep "\n"
-                    (lib.attrValues (lib.mapAttrs userToPasswd users))
-                );
-
-                userToShadow = k: { ... }: "${k}:!:1::::::";
-
-                shadowContents = (
-                  lib.concatStringsSep "\n"
-                    (lib.attrValues (lib.mapAttrs userToShadow users))
-                );
-
-                groupMemberMap = (
-                  let
-                    # Create a flat list of user/group mappings
-                    mappings = (
-                      builtins.foldl'
-                        (
-                          acc: user:
-                            let
-                              groups = users.${user}.groups or [ ];
-                            in
-                            acc ++ map
-                              (group: {
-                                inherit user group;
-                              })
-                              groups
-                        )
-                        [ ]
-                        (lib.attrNames users)
-                    );
-                  in
                   (
-                    builtins.foldl'
+                    acc: user: let
-                      (
+                      groups = users.${user}.groups or [];
-                        acc: v: acc // {
-                          ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
-                        }
-                      )
-                      { }
-                      mappings)
-                );
-
-                groupToGroup = k: { gid }:
-                  let
-                    members = groupMemberMap.${k} or [ ];
-                  in
-                  "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-
-                groupContents = (
-                  lib.concatStringsSep "\n"
-                    (lib.attrValues (lib.mapAttrs groupToGroup groups))
-                );
-
-                defaultNixConf = {
-                  sandbox = "false";
-                  build-users-group = "nixbld";
-                  trusted-public-keys = [
-                    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-                  ];
-                  experimental-features = [
-                    "flakes"
-                    "nix-command"
-                  ];
-                };
-
-                nixConfContents = (lib.concatStringsSep "\n" (lib.mapAttrsFlatten
-                  (n: v:
-                    let
-                      vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
                     in
-                    "${n} = ${vStr}")
+                      acc
-                  defaultNixConf)) + "\n";
+                      ++ map
+                      (group: {
+                        inherit user group;
+                      })
+                      groups
+                  )
+                  []
+                  (lib.attrNames users)
+                );
+              in (
+                builtins.foldl'
+                (
+                  acc: v:
+                    acc
+                    // {
+                      ${v.group} = acc.${v.group} or [] ++ [v.user];
+                    }
+                )
+                {}
+                mappings
+              )
+            );
 
-                containerSettings = ''
+            groupToGroup = k: {gid}: let
-                  [engine]
+              members = groupMemberMap.${k} or [];
-                  init_path = "${pkgs.catatonit}/bin/catatonit"
+            in "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-                  helper_binaries_dir = [ "${pkgs.podman}/libexec/podman" ]
 
-                  [network]
+            groupContents = (
-                  cni_plugin_dirs = [ "${pkgs.cni-plugins}/bin" ]
+              lib.concatStringsSep "\n"
-                  network_backend = "netavark"
+              (lib.attrValues (lib.mapAttrs groupToGroup groups))
-                '';
+            );
 
-                containerStorage = ''
+            defaultNixConf = {
-                  [storage]
+              sandbox = "false";
-                  driver = "overlay"
+              build-users-group = "nixbld";
-                  graphroot = "/var/lib/containers/storage"
+              trusted-public-keys = [
-                  runroot = "/run/containers/storage"
+                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-                '';
+              ];
+              experimental-features = [
+                "flakes"
+                "nix-command"
+              ];
+            };
 
-                containerRegistries = ''
+            nixConfContents =
-                  [registries]
+              (lib.concatStringsSep "\n" (
-                  [registries.block]
+                lib.attrsets.mapAttrsToList (
-                  registries = [ ]
+                  n: v: let
+                    vStr =
+                      if builtins.isList v
+                      then lib.concatStringsSep " " v
+                      else v;
+                  in "${n} = ${vStr}"
+                )
+                defaultNixConf
+              ))
+              + "\n";
 
-                  [registries.insecure]
+            containerSettings = ''
-                  registries = [ ]
+              [engine]
+              init_path = "${pkgs.catatonit}/bin/catatonit"
+              helper_binaries_dir = [ "${pkgs.podman}/libexec/podman" ]
 
-                  [registries.search]
+              [network]
-                  registries = [ "docker.io", "quay.io" ]
+              cni_plugin_dirs = [ "${pkgs.cni-plugins}/bin" ]
-                '';
+              network_backend = "netavark"
+            '';
 
-                containerPolicy = builtins.toJSON {
+            containerStorage = ''
-                  default = [
+              [storage]
+              driver = "overlay"
+              graphroot = "/var/lib/containers/storage"
+              runroot = "/run/containers/storage"
+            '';
+
+            containerRegistries = ''
+              [registries]
+              [registries.block]
+              registries = [ ]
+
+              [registries.insecure]
+              registries = [ ]
+
+              [registries.search]
+              registries = [ "docker.io", "quay.io" ]
+            '';
+
+            containerPolicy = builtins.toJSON {
+              default = [
+                {
+                  type = "insecureAcceptAnything";
+                }
+              ];
+              transports = {
+                docker-daemon = {
+                  "" = [
                     {
                       type = "insecureAcceptAnything";
                     }
                   ];
-                  transports = {
-                    docker-daemon = {
-                      "" = [
-                        {
-                          type = "insecureAcceptAnything";
-                        }
-                      ];
-                    };
-                  };
-                };
-
-                baseSystem =
-                  let
-                    nixpkgs = pkgs.path;
-                    channel = pkgs.runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
-                      mkdir $out
-                      if [ "$bundleNixpkgs" ]; then
-                        ln -s ${nixpkgs} $out/nixpkgs
-                        echo "[]" > $out/manifest.nix
-                      fi
-                    '';
-                    rootEnv = pkgs.buildPackages.buildEnv {
-                      name = "root-profile-env";
-                      paths = defaultPkgs;
-                    };
-                    manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
-                      cat > $out <<EOF
-                      [
-                      ${lib.concatStringsSep "\n" (builtins.map (drv: let
-                        outputs = drv.outputsToInstall or [ "out" ];
-                      in ''
-                        {
-                          ${lib.concatStringsSep "\n" (builtins.map (output: ''
-                            ${output} = { outPath = "${lib.getOutput output drv}"; };
-                          '') outputs)}
-                          outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
-                          name = "${drv.name}";
-                          outPath = "${drv}";
-                          system = "${drv.system}";
-                          type = "derivation";
-                          meta = { };
-                        }
-                      '') defaultPkgs)}
-                      ]
-                      EOF
-                    '';
-                    profile = pkgs.buildPackages.runCommand "user-environment" { } ''
-                      mkdir $out
-                      cp -a ${rootEnv}/* $out/
-                      ln -s ${manifest} $out/manifest.nix
-                    '';
-                  in
-                  pkgs.runCommand "base-system"
-                    {
-                      inherit
-                        containerPolicy
-                        containerRegistries
-                        containerSettings
-                        containerStorage
-                        groupContents
-                        nixConfContents
-                        passwdContents
-                        shadowContents;
-                      passAsFile = [
-                        "containerPolicy"
-                        "containerRegistries"
-                        "containerSettings"
-                        "containerStorage"
-                        "groupContents"
-                        "nixConfContents"
-                        "passwdContents"
-                        "shadowContents"
-                      ];
-                      allowSubstitutes = false;
-                      preferLocalBuild = true;
-                    } ''
-                    env
-                    set -x
-                    mkdir -p $out/etc
-                    mkdir -p $out/etc/ssl/certs
-                    ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
-                    cat $passwdContentsPath > $out/etc/passwd
-                    echo "" >> $out/etc/passwd
-                    cat $groupContentsPath > $out/etc/group
-                    echo "" >> $out/etc/group
-                    cat $shadowContentsPath > $out/etc/shadow
-                    echo "" >> $out/etc/shadow
-                    mkdir -p $out/usr
-                    ln -s /nix/var/nix/profiles/share $out/usr/
-                    mkdir -p $out/nix/var/nix/gcroots
-                    mkdir -p $out/tmp
-                    mkdir -p $out/var/tmp
-                    mkdir -p $out/etc/nix
-                    cat $nixConfContentsPath > $out/etc/nix/nix.conf
-                    mkdir -p $out/root
-                    mkdir -p $out/nix/var/nix/profiles/per-user/root
-
-                    mkdir -p $out/etc/containers
-                    mkdir -p $out/etc/containers/networks
-                    mkdir -p $out/var/lib/containers/storage
-                    mkdir -p $out/run/containers/storage
-                    cat $containerSettingsPath > $out/etc/containers/containers.conf
-                    cat $containerStoragePath > $out/etc/containers/storage.conf
-                    cat $containerRegistriesPath > $out/etc/containers/registry.conf
-                    cat $containerPolicyPath > $out/etc/containers/policy.json
-
-                    ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
-                    ln -s $out/nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
-                    ln -s /nix/var/nix/profiles/default $out/root/.nix-profile
-                    ln -s ${channel} $out/nix/var/nix/profiles/per-user/root/channels-1-link
-                    ln -s $out/nix/var/nix/profiles/per-user/root/channels-1-link $out/nix/var/nix/profiles/per-user/root/channels
-                    mkdir -p $out/root/.nix-defexpr
-                    ln -s $out/nix/var/nix/profiles/per-user/root/channels $out/root/.nix-defexpr/channels
-                    echo "${channelURL} ${channelName}" > $out/root/.nix-channels
-                    mkdir -p $out/bin $out/usr/bin
-                    ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
-                    ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
-                  '' + (lib.optionalString (flake-registry != null) ''
-                    nixCacheDir="/root/.cache/nix"
-                    mkdir -p $out$nixCacheDir
-                    globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
-                    ln -s ${flake-registry}/flake-registry.json $out$globalFlakeRegistryPath
-                    mkdir -p $out/nix/var/nix/gcroots/auto
-                    rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
-                    ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
-                  '');
-              in
-              pkgs.dockerTools.buildLayeredImageWithNixDb {
-                name = "nixos-runner";
-                tag = "latest";
-                maxLayers = 2;
-                contents = [
-                  baseSystem
-                ] ++ defaultPkgs;
-                extraCommands = ''
-                  rm -rf nix-support
-                  ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles
-                '';
-                fakeRootCommands = ''
-                  chmod 1777 tmp
-                  chmod 1777 var/tmp
-                '';
-                config = {
-                  Cmd = [ "${pkgs.bashInteractive}/bin/bash" ];
-                  Env = [
-                    "USER=root"
-                    "PATH=${lib.concatStringsSep ":" [
-                      "/root/.nix-profile/bin"
-                      "/nix/var/nix/profiles/default/bin"
-                      "/nix/var/nix/profiles/default/sbin"
-                    ]}"
-                    "MANPATH=${lib.concatStringsSep ":" [
-                      "/root/.nix-profile/share/man"
-                      "/nix/var/nix/profiles/default/share/man"
-                    ]}"
-                    "LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath [pkgs.glibc pkgs.stdenv.cc.cc.lib]}"
-                    "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-                    "GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-                    "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-                    "NIX_PATH=/nix/var/nix/profiles/per-user/root/channels:/root/.nix-defexpr/channels"
-                  ];
                 };
               };
-            # podman-push-container = pkgs.writeTextFile {
-            #   name = "podman-push-container";
-            #   destination = "/bin/podman-push-container";
-            #   text = builtins.replaceStrings
-            #     [
-            #       "@nushell@"
-            #       "@client@"
-            #     ]
-            #     [
-            #       "${pkgs.nushell}/bin/nu"
-            #       "${pkgs.podman}/bin/podman"
-            #     ]
-            #     (builtins.readFile ./push-container.nu);
-            #   executable = true;
-            # };
-            # docker-push-container = pkgs.writeTextFile {
-            #   name = "docker-push-container";
-            #   destination = "/bin/docker-push-container";
-            #   text = builtins.replaceStrings
-            #     [
-            #       "@nushell@"
-            #       "@client@"
-            #     ]
-            #     [
-            #       "${pkgs.nushell}/bin/nu"
-            #       "${docker-client}/bin/docker"
-            #     ]
-            #     (builtins.readFile ./push-container.nu);
-            #   executable = true;
-            # };
-            push-container = pkgs.writeTextFile {
-              name = "push-container";
-              destination = "/bin/push-container";
-              text = builtins.replaceStrings
-                [
-                  "@nushell@"
-                  "@regctl@"
-                ]
-                [
-                  "${pkgs.nushell}/bin/nu"
-                  "${pkgs.regctl}/bin/regctl"
-                ]
-                (builtins.readFile ./push-container.nu);
-              executable = true;
             };
-          };
+
-          apps = {
+            baseSystem = let
-            # podman-push-container = {
+              nixpkgs = pkgs.path;
-            #   type = "app";
+              channel = pkgs.runCommand "channel-nixos" {inherit bundleNixpkgs;} ''
-            #   program = "${self.packages.${system}.podman-push-container}/bin/podman-push-container";
+                mkdir $out
-            # };
+                if [ "$bundleNixpkgs" ]; then
-            # docker-push-container = {
+                  ln -s ${nixpkgs} $out/nixpkgs
-            #   type = "app";
+                  echo "[]" > $out/manifest.nix
-            #   program = "${self.packages.${system}.docker-push-container}/bin/docker-push-container";
+                fi
-            # };
+              '';
-            push-container = {
+              rootEnv = pkgs.buildPackages.buildEnv {
-              type = "app";
+                name = "root-profile-env";
-              program = "${self.packages.${system}.push-container}/bin/push-container";
+                paths = defaultPkgs;
+              };
+              manifest = pkgs.buildPackages.runCommand "manifest.nix" {} ''
+                cat > $out <<EOF
+                [
+                ${lib.concatStringsSep "\n" (builtins.map (drv: let
+                    outputs = drv.outputsToInstall or ["out"];
+                  in ''
+                    {
+                      ${lib.concatStringsSep "\n" (builtins.map (output: ''
+                        ${output} = { outPath = "${lib.getOutput output drv}"; };
+                      '')
+                      outputs)}
+                      outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
+                      name = "${drv.name}";
+                      outPath = "${drv}";
+                      system = "${drv.system}";
+                      type = "derivation";
+                      meta = { };
+                    }
+                  '')
+                  defaultPkgs)}
+                ]
+                EOF
+              '';
+              profile = pkgs.buildPackages.runCommand "user-environment" {} ''
+                mkdir $out
+                cp -a ${rootEnv}/* $out/
+                ln -s ${manifest} $out/manifest.nix
+              '';
+            in
+              pkgs.runCommand "base-system"
+              {
+                inherit
+                  containerPolicy
+                  containerRegistries
+                  containerSettings
+                  containerStorage
+                  groupContents
+                  nixConfContents
+                  passwdContents
+                  shadowContents
+                  ;
+                passAsFile = [
+                  "containerPolicy"
+                  "containerRegistries"
+                  "containerSettings"
+                  "containerStorage"
+                  "groupContents"
+                  "nixConfContents"
+                  "passwdContents"
+                  "shadowContents"
+                ];
+                allowSubstitutes = false;
+                preferLocalBuild = true;
+              } ''
+                env
+                set -x
+                mkdir -p $out/etc
+                mkdir -p $out/etc/ssl/certs
+                ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
+                cat $passwdContentsPath > $out/etc/passwd
+                echo "" >> $out/etc/passwd
+                cat $groupContentsPath > $out/etc/group
+                echo "" >> $out/etc/group
+                cat $shadowContentsPath > $out/etc/shadow
+                echo "" >> $out/etc/shadow
+                mkdir -p $out/usr
+                ln -s /nix/var/nix/profiles/share $out/usr/
+                mkdir -p $out/nix/var/nix/gcroots
+                mkdir -p $out/tmp
+                mkdir -p $out/var/tmp
+                mkdir -p $out/etc/nix
+                cat $nixConfContentsPath > $out/etc/nix/nix.conf
+                mkdir -p $out/root
+                mkdir -p $out/nix/var/nix/profiles/per-user/root
+
+                mkdir -p $out/etc/containers
+                mkdir -p $out/etc/containers/networks
+                mkdir -p $out/var/lib/containers/storage
+                mkdir -p $out/run/containers/storage
+                cat $containerSettingsPath > $out/etc/containers/containers.conf
+                cat $containerStoragePath > $out/etc/containers/storage.conf
+                cat $containerRegistriesPath > $out/etc/containers/registry.conf
+                cat $containerPolicyPath > $out/etc/containers/policy.json
+
+                ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
+                ln -s $out/nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+                ln -s /nix/var/nix/profiles/default $out/root/.nix-profile
+                ln -s ${channel} $out/nix/var/nix/profiles/per-user/root/channels-1-link
+                ln -s $out/nix/var/nix/profiles/per-user/root/channels-1-link $out/nix/var/nix/profiles/per-user/root/channels
+                mkdir -p $out/root/.nix-defexpr
+                ln -s $out/nix/var/nix/profiles/per-user/root/channels $out/root/.nix-defexpr/channels
+                echo "${channelURL} ${channelName}" > $out/root/.nix-channels
+                mkdir -p $out/bin $out/usr/bin
+                ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
+                ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
+              ''
+              + (lib.optionalString (flake-registry != null) ''
+                nixCacheDir="/root/.cache/nix"
+                mkdir -p $out$nixCacheDir
+                globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
+                ln -s ${flake-registry}/flake-registry.json $out$globalFlakeRegistryPath
+                mkdir -p $out/nix/var/nix/gcroots/auto
+                rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+                ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
+              '');
+          in
+            pkgs.dockerTools.buildLayeredImageWithNixDb {
+              name = "nixos-runner";
+              tag = "latest";
+              maxLayers = 2;
+              contents =
+                [
+                  baseSystem
+                ]
+                ++ defaultPkgs;
+              extraCommands = ''
+                rm -rf nix-support
+                ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles
+              '';
+              fakeRootCommands = ''
+                chmod 1777 tmp
+                chmod 1777 var/tmp
+              '';
+              config = {
+                Cmd = ["${pkgs.bashInteractive}/bin/bash"];
+                Env = [
+                  "USER=root"
+                  "PATH=${lib.concatStringsSep ":" [
+                    "/root/.nix-profile/bin"
+                    "/nix/var/nix/profiles/default/bin"
+                    "/nix/var/nix/profiles/default/sbin"
+                  ]}"
+                  "MANPATH=${lib.concatStringsSep ":" [
+                    "/root/.nix-profile/share/man"
+                    "/nix/var/nix/profiles/default/share/man"
+                  ]}"
+                  "LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath [pkgs.glibc pkgs.stdenv.cc.cc.lib]}"
+                  "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+                  "GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+                  "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+                  "NIX_PATH=/nix/var/nix/profiles/per-user/root/channels:/root/.nix-defexpr/channels"
+                ];
+              };
             };
+          push-container = pkgs.writeTextFile {
+            name = "push-container";
+            destination = "/bin/push-container";
+            text = lib.concatStringsSep "\n" [
+              "#!${pkgs.nushell}/bin/nu"
+              ""
+              "alias regctl = ^${pkgs.regctl}/bin/regctl --verbosity warning"
+              "alias gzip = ^${pkgs.gzip}/bin/gzip"
+              ""
+              (builtins.readFile ./push-container.nu)
+            ];
+            executable = true;
           };
-        }
+        };
-      )
+        apps = {
-    );
+          push-container = {
+            type = "app";
+            program = "${self.packages.${system}.push-container}/bin/push-container";
+          };
+        };
+      }
+    )
+  );
 }

push-container.nu

@@ -1,4 +1,3 @@
-#!@nushell@
 def main [
     input: string # tar.gz file containing container image to be pushed to repository
     ...tags: string # Tags to be added to pushed container image
@@ -133,8 +132,6 @@ def main [
         }
     )
 
-    alias regctl = ^@regctl@ --verbosity warning
-    alias gzip = ^@gzip@
 
     regctl registry login $registry --user $auth.username --pass $auth.password