commit 00ff15426544cb349d9212a78569c6607f4d08e8 · pyrox.dev/nixpkgs

+29
doc/builders/images/dockertools.section.md
···

       321
       321
        
       ```

     

       322
       322
        
       

     

       323
       323
        
       Creating base files like `/etc/passwd` or `/etc/login.defs` is necessary for shadow-utils to manipulate users and groups.

     

       324
       324
       +
       

     

       325
       325
       +
       ## fakeNss {#ssec-pkgs-dockerTools-fakeNss}

     

       326
       326
       +
       

     

       327
       327
       +
       If your primary goal is providing a basic skeleton for user lookups to work,

     

       328
       328
       +
       and/or a lesser privileged user, adding `pkgs.fakeNss` to

     

       329
       329
       +
       the container image root might be the better choice than a custom script

     

       330
       330
       +
       running `useradd` and friends.

     

       331
       331
       +
       

     

       332
       332
       +
       It provides a `/etc/passwd` and `/etc/group`, containing `root` and `nobody`

     

       333
       333
       +
       users and groups.

     

       334
       334
       +
       

     

       335
       335
       +
       It also provides a `/etc/nsswitch.conf`, configuring NSS host resolution to

     

       336
       336
       +
       first check `/etc/hosts`, before checking DNS, as the default in the absence of

     

       337
       337
       +
       a config file (`dns [!UNAVAIL=return] files`) is quite unexpected.

     

       338
       338
       +
       

     

       339
       339
       +
       You can pair it with `binSh`, which provides `bin/sh` as a symlink

     

       340
       340
       +
       to `bashInteractive` (as `/bin/sh` is configured as a shell).

     

       341
       341
       +
       

     

       342
       342
       +
       ```nix

     

       343
       343
       +
       buildImage {

     

       344
       344
       +
         name = "shadow-basic";

     

       345
       345
       +
       

     

       346
       346
       +
         copyToRoot = pkgs.buildEnv {

     

       347
       347
       +
           name = "image-root";

     

       348
       348
       +
           paths = [ binSh pkgs.fakeNss ];

     

       349
       349
       +
           pathsToLink = [ "/bin" "/etc" "/var" ];

     

       350
       350
       +
         };

     

       351
       351
       +
       }

     

       352
       352
       +
       ```