kyleandClaude Opus 5.5
75c2f1adbf
On straylight, with real containers from deploy/tools-image.nix, every claim held: no network without a grant, the limits, the file tools, http_fetch's host checks including a redirect and a tailnet name, and no leftovers. Two plan defects found there (curl globbing, podman pulling a missing image), five lower findings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
47 lines
1.9 KiB
Nix
47 lines
1.9 KiB
Nix
# The image every tool container runs from (M3b spec, section 7; the brief's authority contract 4).
|
|
# Built from this repository's source by Nix on the host that runs brokerd, loaded with
|
|
# `podman load`, and named by digest in brokerd.toml's `[runner] image`. Nothing is pulled at call
|
|
# time.
|
|
#
|
|
# nix-build deploy/tools-image.nix # from the repository root; result is an image tarball
|
|
# podman load < result
|
|
# podman image inspect --format '{{.Digest}}' localhost/boxmaker-tools:latest
|
|
#
|
|
# Contents: /bin/toolkit (static, musl), busybox with every applet (so /bin/sh is busybox's),
|
|
# /bin/curl (static), the CA bundle. No package manager, no compiler, nothing else.
|
|
{ pkgs ? import <nixpkgs> { } }:
|
|
let
|
|
static = pkgs.pkgsStatic;
|
|
src = pkgs.lib.cleanSourceWith {
|
|
src = ../.;
|
|
# Only what the build reads: no target/, no .state/, no docs.
|
|
filter = path: type:
|
|
let rel = pkgs.lib.removePrefix (toString ../. + "/") (toString path);
|
|
in rel == "Cargo.toml" || rel == "Cargo.lock"
|
|
|| rel == "crates" || pkgs.lib.hasPrefix "crates/" rel;
|
|
};
|
|
toolkit = static.rustPlatform.buildRustPackage {
|
|
pname = "boxmaker-toolkit";
|
|
version = "0.1.0";
|
|
inherit src;
|
|
cargoLock.lockFile = ../Cargo.lock;
|
|
cargoBuildFlags = [ "-p" "toolkit" ];
|
|
doCheck = false; # the tests run in `make gate`, on the development machine
|
|
};
|
|
root = pkgs.runCommand "boxmaker-tools-root" { } ''
|
|
mkdir -p $out/bin $out/etc/ssl/certs $out/tmp $out/run/egress
|
|
# busybox first: `cp -a` keeps the store's read-only modes, so make the copies writable after.
|
|
cp -a ${static.busybox}/bin/. $out/bin/
|
|
chmod -R u+w $out/bin
|
|
cp ${toolkit}/bin/toolkit $out/bin/toolkit
|
|
cp ${static.curl.bin}/bin/curl $out/bin/curl
|
|
cp ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
|
|
'';
|
|
in
|
|
pkgs.dockerTools.buildLayeredImage {
|
|
name = "boxmaker-tools";
|
|
tag = "latest";
|
|
contents = [ root ];
|
|
config.WorkingDir = "/tmp";
|
|
}
|