OCI & Docker

An unprivileged, distroless OCI container image is built via pkgs.dockerTools.buildLayeredImage in flake.nix and published to ghcr.io/sini/xmsg:

image = pkgs.dockerTools.buildLayeredImage {
  name = "ghcr.io/sini/xmsg";
  tag = "latest";
  contents = [
    pkgs.cacert
    self.packages.${pkgs.system}.default
  ];
  extraCommands = ''
    mkdir -p -m 1777 tmp
    mkdir -p -m 0755 var/lib/xmsg
  '';
  config = {
    User = "10001:10001";
    Entrypoint = [ "${self.packages.${pkgs.system}.default}/bin/xmsg" ];
    Cmd = [ "serve" ];
    WorkingDir = "/var/lib/xmsg";
    Env = [
      "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
    ];
  };
};

Security properties

Non-root execution: Runs as UID/GID 10001:10001.
No shell or utilities: Contains only CA certificates (/etc/ssl/certs/ca-bundle.crt) and the xmsg binary; no /bin/sh or auxiliary tools are present in any layer.
Entrypoint: xmsg with default command serve and working directory /var/lib/xmsg.

Building & verification

# Build the OCI image archive
nix build .#image

# Run the image oracle check (asserts non-root user, xmsg entrypoint, and no /bin/sh in layers)
nix build -L .#checks.x86_64-linux.image

Palettes adapted from Catppuccin (Macchiato) (MIT), Tokyo Night (Apache-2.0), gruvbox (MIT), Catppuccin (Latte) (MIT), Rosé Pine (Dawn) (MIT).