jingus/runner-images
Watch
1
0
Fork
You've already forked runner-images
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Contains container image definitions for use in my runner. Probably useless to you.
9 commits 2 branches 0 tags 22 KiB
  • Nix 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
jingus 82aa550706
All checks were successful
nix-runner image / build-and-push (push) Successful in 1m47s
Details
nix-runner: consume actions from main
2026-10-16 00:17:29 -05:00
.forgejo/workflows nix-runner: consume actions from main 2026-10-16 00:17:29 -05:00
nix-modules nix-runner: image moved from infra.jingus.dev (pinned to its nixpkgs rev for a byte-identical first build) 2026-10-15 22:34:48 -05:00
.gitignore Initial commit 2026-10-15 22:28:31 -05:00
flake.lock nix-runner: commit flake.lock generated on first CI build 2026-10-15 22:44:32 -05:00
flake.nix nix-runner: image moved from infra.jingus.dev (pinned to its nixpkgs rev for a byte-identical first build) 2026-10-15 22:34:48 -05:00
LICENSE Initial commit 2026-10-15 22:28:31 -05:00
README.md adopt publish-nix-image action; README documenting images and publishing 2026-10-16 00:06:16 -05:00

README.md

runner-images

Container image definitions for the Forgejo Actions runner on augustinus, built with nix (flake-parts + import-tree, mirroring infra.jingus.dev) and published to the Forgejo container registry. The runner itself (labels → images) lives in infra.jingus.dev → features/forgejo-runner.nix.

Images

Image Attribute Registry
nix-runner .#nix-runner-image git.jingus.dev/jingus/nix-runner

nix-runner

The image behind the nix runner label — everything a CI job needs to build with nix: the nix CLI (flakes enabled), git/node for actions/checkout, jq, curl, and the attic client. An /etc/nix/nix.conf is baked in that substitutes from cache.jingus.dev before cache.nixos.org, so every CI pull hits the private cache first.

Notes:

  • Single-user (root) store with sandbox = false — the nixbld group doesn't exist in-container and dockerTools derivations are never substitutable anyway.
  • The baked nix.conf must stay in sync with infra.jingus.dev → nix-modules/features/base.nix (substituters + trusted keys) — rotate attic keys in both repos.
  • The package must stay publicly readable under jingus' Forgejo packages so job runners can pull it anonymously.

Publishing

Automated on every push to main (.forgejo/workflows/nix-runner.yml) via jingus/actions:

  1. attic-cache pushes every locally built path to the binary cache.
  2. publish-nix-image computes the image's identity (its output store path hash, by pure eval) and publishes under that tag plus :latest. When the identity tag already exists, the build is skipped entirely (~1 minute no-op runs); superseded identity tags are pruned, keeping one rollback tag (docker pull …:<old-hash> to recover fast).

Manual fallback (e.g. if CI is broken). Note the gunzip: skopeo must not be handed the gzipped archive directly, or it re-synthesizes the manifest nondeterministically:

nix build .#nix-runner-image
gzip -dc result > /tmp/nix-runner.tar
nix shell nixpkgs#skopeo -c skopeo copy --insecure-policy \
  --dest-creds "jingus:<forgejo-token-with-write:package>" \
  docker-archive:/tmp/nix-runner.tar \
  docker://git.jingus.dev/jingus/nix-runner:latest

Adding an image

  1. nix-modules/packages/<name>/default.nix — a deterministic dockerTools.buildImage (no created = now; identity-tag skipping depends on reproducibility).
  2. .forgejo/workflows/<name>.yml — checkout → attic-cache → publish-nix-image, with the image path and attribute.
  3. Reference the registry image from a runner label in infra.jingus.dev → features/forgejo-runner.nix.