NixOS config for dev container Supply chain attacks has been active recently, and the latest Shai-Hulud was the last push. In addition to the security benefit, I hope migrating project development inside container makes my future migration to NixOS easier by slimming down the host (GUI + git + basic tools).

Changes

7 changed files (+516/-1)

• .editorconfig
  • @@ -31,3 +31,7 @@ indent_style = space
    # Zig compiler rejects tabs. indent_style = space indent_size = 4 + + [*.{yml,yaml}] + # YAML the language cannot handle tabs. + indent_style = space
• .gitignore
  • @@ -20,3 +20,10 @@
    # Although not appears on working tree via Nix build, directly running # `zig build` inside `nix develop` is useful for development. zig-out + + # Nix build generates this too generic named symlink by default. + /result + + # distrobuilder output files. + incus.tar.xz + rootfs.squashfs
• dprint.jsonc
  • @@ -22,6 +22,7 @@
    "https://plugins.dprint.dev/g-plane/malva-v0.12.1.wasm", "https://plugins.dprint.dev/exec-0.5.1.json@492414e39dea4dccc07b4af796d2f4efdb89e84bae2bd4e1e924c0cc050855bf", "https://plugins.dprint.dev/RubixDev/stylua-v0.2.1.wasm", + "https://plugins.dprint.dev/g-plane/pretty_yaml-v0.5.1.wasm", ], "lineWidth": 90,
  • @@ -32,6 +33,7 @@
    "json": {}, "markdown": {}, "toml": {}, + "yaml": {}, "malva": {}, "exec": { "cwd": "${configDir}",
• features/home/default.nix
  • @@ -27,6 +27,11 @@ let
    in { options.features.home = { + useNix = lib.mkOption { + type = lib.types.bool; + default = true; + }; + username = lib.mkOption { type = lib.types.nonEmptyStr;
  • @@ -83,7 +88,7 @@ in
    }; nix = { - package = pkgs.nix; + package = lib.mkIf cfg.useNix pkgs.nix; extraOptions = '' experimental-features = nix-command flakes
• flake.nix
  • @@ -225,6 +225,125 @@
    }; }; + nixosConfigurations = { + nixos-workerbee = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ + "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix" + home-manager.nixosModules.home-manager + ( + { pkgs, ... }: + { + system.stateVersion = "25.11"; + + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + + networking.hostName = "workerhive"; + networking.firewall.enable = false; + + environment.systemPackages = with pkgs; [ neovim ]; + + programs.fish = { + enable = true; + }; + + users.defaultUserShell = pkgs.fish; + + users.users = { + workerbee = { + uid = 1000; + isNormalUser = true; + }; + }; + + home-manager.users.workerbee = { + imports = [ + ./features + ( + { config, pkgs, ... }: + { + home.stateVersion = "23.11"; + + features = pkgs.lib.mkDefault { + identity = { + name = "Shota FUJI"; + email = "pockawoooh@gmail.com"; + }; + + scm.enable = true; + + home = { + username = "workerbee"; + timezone = "Asia/Tokyo"; + locale = "en_US.UTF-8"; + useNix = false; + }; + + dev = { + enable = true; + + lsp = { + enable = true; + + langs = with config.features.dev.lsp; [ + elm + typescript + deno + go + css + html + zig + gleam + ]; + }; + }; + }; + } + ) + ]; + }; + } + ) + ]; + }; + }; + + apps = builtins.listToAttrs ( + builtins.map ( + system: + let + pkgs = nixpkgs.legacyPackages.${system}; + in + { + name = system; + value = { + incus-import = + let + bin = pkgs.writeShellApplication { + name = "incus-import"; + + text = '' + set +e + set -x + + CONFIG_NAME=$1 + SQUASHFS=$(nix build .#nixosConfigurations."$CONFIG_NAME".config.system.build.squashfs --no-link --print-out-paths) + METADATA=$(nix build .#nixosConfigurations."$CONFIG_NAME".config.system.build.metadata --no-link --print-out-paths) + + incus image import --alias "$CONFIG_NAME" "$METADATA"/tarball/*.tar.xz "$SQUASHFS"/nixos-lxc-image-${system}.squashfs + ''; + }; + in + { + type = "app"; + program = "${bin}/bin/incus-import"; + }; + }; + } + ) availableSystems + ); + devShell = builtins.listToAttrs ( builtins.map ( system:
• images/README.md (new)
  • @@ -0,0 +1,22 @@
    + <!-- + Copyright 2025 Shota FUJI <pockawoooh@gmail.com> + + Permission to use, copy, modify, and/or distribute this software for any + purpose with or without fee is hereby granted. + + THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH + REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, + INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR + OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + PERFORMANCE OF THIS SOFTWARE. + + SPDX-License-Identifier: 0BSD + --> + + # distrobuilder images + + This directory contains [distrobuilder](https://linuxcontainers.org/distrobuilder/docs/latest/) image definition files. + + See [distrobuilder documentation](https://linuxcontainers.org/distrobuilder/docs/latest/howto/build/) and output of `--help` option.
• images/ubuntu-workerbee.yaml (new)
  • @@ -0,0 +1,356 @@
    + # Copyright 2019-2024 distrobuilder developers + # Copyright 2025 Shota FUJI <pockawoooh@gmail.com> + # + # Licensed under the Apache License, Version 2.0 (the "License"); + # you may not use this file except in compliance with the License. + # You may obtain a copy of the License at + # + # http://www.apache.org/licenses/LICENSE-2.0 + # + # Unless required by applicable law or agreed to in writing, software + # distributed under the License is distributed on an "AS IS" BASIS, + # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + # See the License for the specific language governing permissions and + # limitations under the License. + # + # SPDX-License-Identifier: Apache-2.0 + # + # distrobuilder image definition for general development task. + # This image is for projects using problematic tools such as aspect's Bazel rules + # that uses system tools with messed $PATH or tools not working without FHS. + # + # No development tool is installed at build time. Users are supposed to install + # Nix then apply ../#workerbee. Project specific softwares should be installed + # via Nix Flakes (devShell) or version manager tools (ASDF, mise.) + + image: + name: ubuntu-workerbee-x86_64 + distribution: ubuntu + release: plucky + description: |- + Ubuntu {{ image.release }} + architecture: x86_64 + + source: + downloader: debootstrap + same_as: gutsy + url: http://archive.ubuntu.com/ubuntu + keyserver: keyserver.ubuntu.com + keys: + - 0x790BC7277767219C42C86F933B4FE6ACC0B21F32 + - 0xf6ecb3762474eda9d21b7022871920d1991bc93c + + targets: + lxc: + create_message: |- + You just created an {{ image.description }} container. + + No default root or user password are set by LXC. + config: + - type: all + before: 5 + content: |- + lxc.include = LXC_TEMPLATE_CONFIG/ubuntu.common.conf + + - type: user + before: 5 + content: |- + lxc.include = LXC_TEMPLATE_CONFIG/ubuntu.userns.conf + + - type: all + after: 4 + content: |- + lxc.include = LXC_TEMPLATE_CONFIG/common.conf + + - type: user + after: 4 + content: |- + lxc.include = LXC_TEMPLATE_CONFIG/userns.conf + + - type: all + content: |- + lxc.arch = {{ image.architecture_personality }} + + files: + - path: /etc/hostname + generator: hostname + + - path: /etc/hosts + generator: hosts + + - path: /etc/resolvconf/resolv.conf.d/original + generator: remove + + - path: /etc/resolvconf/resolv.conf.d/tail + generator: remove + + - path: /etc/machine-id + generator: dump + + - path: /etc/user/profile + generator: copy + source: /etc/profile + + - path: /var/lib/dbus/machine-id + generator: remove + + - path: /etc/netplan/10-lxc.yaml + generator: dump + content: |- + network: + version: 2 + ethernets: + eth0: + dhcp4: true + dhcp-identifier: mac + releases: + - bionic + - eoan + - focal + - jammy + - noble + - oracular + - plucky + types: + - container + variants: + - default + + - path: /etc/netplan/10-lxc.yaml + generator: dump + content: |- + network: + version: 2 + ethernets: + enp5s0: + dhcp4: true + dhcp-identifier: mac + releases: + - bionic + - eoan + - focal + - jammy + - noble + - oracular + - plucky + types: + - vm + variants: + - default + + - name: meta-data + generator: cloud-init + variants: + - cloud + + - name: network-config + generator: cloud-init + variants: + - cloud + + - name: user-data + generator: cloud-init + variants: + - cloud + + - name: vendor-data + generator: cloud-init + variants: + - cloud + + - name: ext4 + generator: fstab + types: + - vm + + - name: incus-agent + generator: incus-agent + types: + - vm + + - path: /etc/default/grub.d/50-incus.cfg + generator: dump + content: |- + GRUB_RECORDFAIL_TIMEOUT=0 + GRUB_TIMEOUT=0 + GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} console=tty1 console=ttyS0" + GRUB_TERMINAL=console + types: + - vm + + - path: /etc/sudoers.d/90-incus + generator: dump + mode: 0440 + content: |- + # User rules for ubuntu + ubuntu ALL=(ALL) NOPASSWD:ALL + variants: + - default + + packages: + manager: apt + update: true + cleanup: true + sets: + - packages: + - fuse + - language-pack-en + - vim + - fish + - curl + action: install + + - packages: + - cloud-init + action: install + variants: + - cloud + + - packages: + - acpid + action: install + architectures: + - amd64 + - arm64 + types: + - vm + + - packages: + - grub-efi-amd64-signed + - shim-signed + action: install + architectures: + - amd64 + types: + - vm + + - packages: + - grub-efi-arm64-signed + action: install + architectures: + - arm64 + types: + - vm + + - packages: + - shim-signed + action: install + architectures: + - arm64 + releases: + - disco + - eoan + - focal + - jammy + - noble + - oracular + - plucky + types: + - vm + + - packages: + - linux-virtual + action: install + releases: + - bionic + - eoan + - focal + - jammy + - noble + - oracular + - plucky + types: + - vm + + - packages: + - os-prober + action: remove + types: + - vm + + repositories: + - name: sources.list + url: |- + deb http://archive.ubuntu.com/ubuntu {{ image.release }} main restricted universe multiverse + deb http://archive.ubuntu.com/ubuntu {{ image.release }}-updates main restricted universe multiverse + deb http://security.ubuntu.com/ubuntu {{ image.release }}-security main restricted universe multiverse + architectures: + - amd64 + - i386 + + - name: sources.list + url: |- + deb http://ports.ubuntu.com/ubuntu-ports {{ image.release }} main restricted universe multiverse + deb http://ports.ubuntu.com/ubuntu-ports {{ image.release }}-updates main restricted universe multiverse + deb http://ports.ubuntu.com/ubuntu-ports {{ image.release }}-security main restricted universe multiverse + architectures: + - armhf + - arm64 + - powerpc + - powerpc64 + - ppc64el + - riscv64 + + actions: + + # Create default user account + - trigger: post-update + action: |- + #!/bin/sh + set -eux + + getent group sudo >/dev/null 2>&1 || groupadd --system sudo + useradd --create-home -s /bin/fish -G sudo -U workerbee + variants: + - default + + # Enable systemd-networkd + - trigger: post-packages + action: |- + #!/bin/sh + set -eux + + systemctl enable systemd-networkd + releases: + - bionic + - eoan + - focal + - jammy + - noble + - oracular + - plucky + + - trigger: post-packages + action: |- + #!/bin/sh + set -eux + + # Make sure the locale is built and functional + locale-gen en_US.UTF-8 + update-locale LANG=en_US.UTF-8 + + # Cleanup underlying /run + mount -o bind / /mnt + rm -rf /mnt/run/* + umount /mnt + + # Cleanup temporary shadow paths + rm /etc/*- + + - trigger: post-files + action: |- + #!/bin/sh + set -eux + + TARGET="x86_64" + [ "$(uname -m)" = "aarch64" ] && TARGET="arm64" + + update-grub + grub-install --uefi-secure-boot --target="${TARGET}-efi" --no-nvram --removable + update-grub + sed -i "s#root=[^ ]*#root=${DISTROBUILDER_ROOT_UUID}#g" /boot/grub/grub.cfg + types: + - vm + + mappings: + architecture_map: debian