feat: add and install nix as tool by matttrach · Pull Request #35 · rancher/ci-image

matttrach · 2026-05-11T20:21:30Z

This adds and installs Nix into a new Nix image.
It also adds a new build type archive_script which downloads an archive matching the checksum, extracts the install script and runs the installer. Nix has some specific install needs, so I added them into the archive_script template, making sure to switch on tool name. The normal case for archive_script will download the script from the url, extract the installer and run it. For Nix we need to add sudo and a new user, I added the user suse since that is standard on sles.

Closes #34

Signed-off-by: matttrach <matt.trachier@suse.com>

mallardduck · 2026-05-11T23:48:54Z

Overall looks okay, it's a solid idea for an area we should cover too. I will need to take a deeper look tomorrow to provide more complete review. My first feedback is around:

Nix has some specific install needs, so I added them into the archive_script template

I would prefer we ensure that the script and archive_script are rather generic and could be used to "add any shell script" to a base image. This keeps things consistent with the existing structure I setup for the project to have. Then we could additionally add some Nix specific logic in for handling that too.

matttrach · 2026-05-12T00:17:56Z

Like maybe a Nix template? Maybe we should have an "install-template" attribute in the deps.yaml to specify a template to insert into the dockerfile?

mallardduck · 2026-05-12T02:25:55Z

Like maybe a Nix template?

I was thinking that but then I started thinking about tool "before hooks" of some sort. I'm playing with something tonight and should have a PR this could be based on tomorrow.

mallardduck · 2026-05-12T04:26:01Z

Here is a new hooks feature to accommodate this PRs needs: #36. I think that this will be more flexible for all tools needs than some nix specific solutions here. Additionally it will consolidate all the "extra tool specific logic" into these new hook files.

After that PR the tool config will look different, use:

  - name: nix
    source: "https://releases.nixos.org/nix"
    mode: static
    version: 2.34.5
    checksums:
      linux/amd64: "0a0462692a10ff1eb8a608f713f38d1f25a208ad55963a9c00b239da398de5a1"
      linux/arm64: "771e4b6f719243b9481f19eaedfbbbacc2f4a0282d6e043df4f33bb449ea3c57"
    release:
      download_template: "{source}/nix-{version}/nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}.tar.xz"
      extract: "nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}/install"
      install_to_path: false  # Extract to /var/ci-tools/mytool/ for hooks

Then you will want to make:

hooks/nix-pre.tmpl with:

# Create unprivileged user for Nix installation
RUN useradd -m suse && \
    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

# Add suse user to runner group and create /etc/nix directory and configuration
RUN usermod -a -G runner suse && \
    sudo mkdir -p /etc/nix && \
    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
    sudo chown -R suse:runner /etc/nix && \
    sudo mkdir -p /nix && \
    sudo chown -R suse:runner /nix && \
    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local

And hooks/nix-post.tmpl of:

# Fix ownership and run Nix installer from the extracted archive
RUN set -e; \
    sudo chown -R suse:runner /var/ci-tools/nix

# Switch to unprivileged user for installation
USER suse
WORKDIR /home/suse
ENV USER=suse

RUN set -e; \
    case "${ARCH}" in \
        amd64) extract="nix-2.34.5-x86_64-linux/install" ;; \
        arm64) extract="nix-2.34.5-aarch64-linux/install" ;; \
        *) echo "unsupported architecture: ${ARCH}" >&2; exit 1 ;; \
    esac; \
    cd /var/ci-tools/nix && \
    ./${extract} --no-daemon

# Restore root user for remaining Dockerfile operations
USER root
ENV USER=root

macedogm · 2026-05-12T20:39:27Z

@matttrach can you please rebase your pr and update it to the new config of hooks made by @mallardduck in #36?

Signed-off-by: matttrach <matt.trachier@suse.com>

matttrach · 2026-05-12T23:04:00Z

The version variable allows further templates know the version selected in the deps.yaml. Without this the deps.yaml won't be the single source of truth for the version information.

macedogm · 2026-05-13T01:47:50Z

 	u := urlExt(url)
 	return strings.HasSuffix(u, ".gz") && !strings.HasSuffix(u, ".tar.gz")
 }
+


Suggested change

macedogm · 2026-05-13T01:49:21Z

    chmod 2755 /var/ci-tools

 {{range .Tools}}# {{.Name}} {{.Version}}
+ENV {{.Name}}_version="{{.Version}}"


I saw your comment about this line, but sorry, I didn't get exactly its need.

mallardduck · 2026-05-13T02:36:32Z

These are supposed to be in the project root as hooks/nix-pre.tmpl

mallardduck · 2026-05-13T02:45:14Z

The version variable allows further templates know the version selected in the deps.yaml. Without this the deps.yaml won't be the single source of truth for the version information.

🤔 Ok - I see where you might want to add the version env. However I think that I see this as highlighting a different gap in the hook mechanism. Think this should be pretty easy to extend so that the hook templates have context of and access to variables related to their package.

OK - 2 things I see a super simple fix that is pretty obvious in hindsight. Gist being that even InstallToPath=false should extract the same way we do for InstallToPath=true just to a different place not in PATH. So we can probably go with that to immediately unblock this.

To save us some cycles I also prepared a branch to validate this produces expected results: main...fix-test

I don't use nix but the dockerfile fully builds for me now so I think that's a good sign.

The other part is "Hook Variables" which could allow Hook files to be more complex if needed. However the first fix will make it moot - so this becomes a future "nice to have".

macedogm · 2026-05-13T20:50:13Z

@matttrach #39 is merged and will require a new rebase and re-run to update your code, please.

macedogm · 2026-05-18T16:45:48Z

@mallardduck I think that we should be good to merge this one, wdyt?

mallardduck · 2026-05-19T16:26:28Z

    chmod 2755 /var/ci-tools

 {{range .Tools}}# {{.Name}} {{.Version}}
+ENV {{.Name}}_version="{{.Version}}"


Suggested change

ENV {{.Name}}_version="{{.Version}}"

I don't think we need this any more - a design goal of this system is to not need to know the specific version number of a tool. The changes I made to the other PR should allow things to work without this.

mallardduck · 2026-05-19T16:27:51Z

@@ -0,0 +1,21 @@
+# Fix ownership and run Nix installer from the extracted archive


This whole file needs to move to hooks/nix-post.tmpl per my example: main...fix-test

mallardduck · 2026-05-19T16:28:17Z

Same as other one - this whole file should live at: hooks/ per example main...fix-test

mallardduck · 2026-05-19T16:28:53Z

            helm: helmv4
        go_version: 1.26.2
        description: CI image with Go 1.26 toolchain
+    nix:


Because the hooks are not in the expected path the lock file does not track them as it should.

macedogm · 2026-05-29T02:32:29Z

@matttrach can you please check Dan's comment so when can merge this pr?

feat: add and install nix as tool

e2e7319

Signed-off-by: matttrach <matt.trachier@suse.com>

matttrach requested review from a team, mallardduck and tashima42 as code owners May 11, 2026 20:21

mallardduck mentioned this pull request May 12, 2026

feat: add tool template hooks #36

Merged

matttrach added 4 commits May 12, 2026 15:43

Merge branch 'main' into add-nix

0f27d7f

fix: adjust to new hook system

1f830f6

Signed-off-by: matttrach <matt.trachier@suse.com>

fix: remove is script url function

e6891fd

Signed-off-by: matttrach <matt.trachier@suse.com>

fix: add version variable in docker template

5655201

Signed-off-by: matttrach <matt.trachier@suse.com>

macedogm reviewed May 13, 2026

View reviewed changes

mallardduck reviewed May 13, 2026

View reviewed changes

Merge branch 'main' into add-nix

bf3e26b

macedogm approved these changes May 18, 2026

View reviewed changes

macedogm requested a review from mallardduck May 18, 2026 16:45

mallardduck requested changes May 19, 2026

View reviewed changes

		@@ -0,0 +1,21 @@
		# Fix ownership and run Nix installer from the extracted archive

Conversation

matttrach commented May 11, 2026 • edited by macedogm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mallardduck commented May 11, 2026

Uh oh!

matttrach commented May 12, 2026

Uh oh!

mallardduck commented May 12, 2026

Uh oh!

mallardduck commented May 12, 2026

Uh oh!

macedogm commented May 12, 2026

Uh oh!

matttrach commented May 12, 2026

Uh oh!

macedogm May 13, 2026

Choose a reason for hiding this comment

Uh oh!

macedogm May 13, 2026

Choose a reason for hiding this comment

Uh oh!

mallardduck May 13, 2026

Choose a reason for hiding this comment

Uh oh!

mallardduck commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

macedogm commented May 13, 2026

Uh oh!

macedogm commented May 18, 2026

Uh oh!

mallardduck May 19, 2026

Choose a reason for hiding this comment

Uh oh!

mallardduck May 19, 2026

Choose a reason for hiding this comment

Uh oh!

mallardduck May 19, 2026

Choose a reason for hiding this comment

Uh oh!

mallardduck May 19, 2026

Choose a reason for hiding this comment

Uh oh!

macedogm commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

matttrach commented May 11, 2026 •

edited by macedogm

Loading

mallardduck commented May 13, 2026 •

edited

Loading