nix-containers/flake.nix

{
  description = "various nix-based docker containers";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = {
    self,
    nixpkgs,
    flake-utils,
    ...
  } @ inputs:
    flake-utils.lib.eachSystem ["aarch64-linux" "x86_64-linux"] (system: let
      pkgs = import nixpkgs {inherit system;};
    in rec {
      formatter = pkgs.alejandra;
      packages = {
        buildImage = pkgs.dockerTools.buildLayeredImageWithNixDb {
          name = "darkkirb/nix-containers";
          tag = "build-container";
          contents = with pkgs; [
            bashInteractive
            gzip
            skopeo
            nix
            coreutils
            nixpkgs
            git
          ];
          config.Env = [
            "USER=nobody"
          ];
          maxLayers = 125;
          enableFakechroot = true;
          fakeRootCommands = ''
            mkdir /etc/nix
            echo "substituters = https://cache.nixos.org/ https://f000.backblazeb2.com/file/cache-chir-rs/" >> /etc/nix/nix.conf
            echo "trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nixcache:8KKuGz95Pk4UJ5W/Ni+pN+v+LDTkMMFV4yrGmAYgkDg= hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" >> /etc/nix/nix.conf
            echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
            mkdir /etc/containers
            echo '{"default": [{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json
            mkdir -p /nix/inputs
            ln ${nixpkgs} /nix/inputs/nixpkgs
          '';
        };
      };
    });
}