`bootc` and `ostree native containers` need `--no-start-daemon` option in the ostree plan.

[queeup]

I am trying to build my own Silverblue bootc image and install Nix while building container my self. The problem is while trying to install on container build time, It is complaining about systemd. In silverblue ostree native container, systemd is not active on the image itself.

systemd was not active.

If it will be started later consider, passing `--no-start-daemon`.

To use a `root`-only Nix install, consider passing `--init none`.

As I can see there is no --no-start-daemon & --init none options with ostree install.

Can be reproduced with building this Dockerfile/Containerfile:

ARG FEDORA_VERSION=43

FROM quay.io/fedora-ostree-desktops/silverblue:${FEDORA_VERSION}

RUN curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install ostree --no-confirm

RUN bootc container lint --no-truncate

This containers is booting with fedora bootc images and there is systemd after boot process but on the build stage there is no systemd. Thats the problem. What I was looking for install with "--no-start-daemon" option for ostree. That option is not implemented to ostree yet.

Some info about ostree native containers:

• https://coreos.github.io/rpm-ostree/container/
• https://bootc-dev.github.io/

Related

• ostree mode for install and plan should support --no-start-daemon DeterminateSystems/nix-installer#1506
• ostree planner does not understand --no-start-daemon/$NIX_INSTALLER_START_DAEMON=false  DeterminateSystems/nix-installer#1297

[Mic92]

Can you download the installer build by CI here? https://github.com/NixOS/nix-installer/actions/runs/22659878553?pr=157

search for nix-installer-x86_64-linux under artifacts.

[Mic92]

That's the PR itself: #157

[Mic92]

Added some docs: 8a327ec

[queeup]

I tested it. Because of --init none installer not putting systemd services like nix.mount etc. in the container. I think we need --no-start-daemon. Also can you consider make it bootc spesific installer too? Because I think ostree and bootc need different needs.

Maybe just leave ostree ass it is and put new bootc installer?

If you want to work on it I will give you all information you need to put the installer. Just let me know.

[Mic92]

Okay, give me the expected outcome.

[queeup]

/var or /home is not exist while building bootc container. Also /var created on first boot so we need a different place to persist nix directory (like /usr/lib/nix) then copy to /var on boot with systemd-tmpfiles to /var/lib/nix. Then we can trigger nix.mount and so on.
/etc/tmpfiles.d/nix.conf

# This file is part of the Nix store persistence strategy for immutable/bootc systems.
#
# PURPOSE:
# Since /nix is a mount point for a persistent or volatile /var partition, 
# this configuration ensures that the initial Nix store structure and 
# binaries (pre-installed during image build in /usr/lib/nix) 
# are copied (populated) into /var/lib/nix at the first boot.
#
# HOW IT WORKS:
# 'C' (Copy) recursively copies the contents of the nix directory 
# to the target only if the target is empty.

# Type  Path            Mode  User  Group  Age  Argument
C /var/lib/nix - - - - /usr/lib/nix

We need systemd-sysusers file to tell system about created user.
/etc/sysusers.d/nixbld.conf

g nixbld 30000
u nixbld1 30001:30000 "Nix build user 1" /var/empty /sbin/nologin
u nixbld2 30002:30000 "Nix build user 2" /var/empty /sbin/nologin
u nixbld3 30003:30000 "Nix build user 3" /var/empty /sbin/nologin
u nixbld4 30004:30000 "Nix build user 4" /var/empty /sbin/nologin
u nixbld5 30005:30000 "Nix build user 5" /var/empty /sbin/nologin
u nixbld6 30006:30000 "Nix build user 6" /var/empty /sbin/nologin
u nixbld7 30007:30000 "Nix build user 7" /var/empty /sbin/nologin
u nixbld8 30008:30000 "Nix build user 8" /var/empty /sbin/nologin
u nixbld9 30009:30000 "Nix build user 9" /var/empty /sbin/nologin
u nixbld10 30010:30000 "Nix build user 10" /var/empty /sbin/nologin
u nixbld11 30011:30000 "Nix build user 11" /var/empty /sbin/nologin
u nixbld12 30012:30000 "Nix build user 12" /var/empty /sbin/nologin
u nixbld13 30013:30000 "Nix build user 13" /var/empty /sbin/nologin
u nixbld14 30014:30000 "Nix build user 14" /var/empty /sbin/nologin
u nixbld15 30015:30000 "Nix build user 15" /var/empty /sbin/nologin
u nixbld16 30016:30000 "Nix build user 16" /var/empty /sbin/nologin
u nixbld17 30017:30000 "Nix build user 17" /var/empty /sbin/nologin
u nixbld18 30018:30000 "Nix build user 18" /var/empty /sbin/nologin
u nixbld19 30019:30000 "Nix build user 19" /var/empty /sbin/nologin
u nixbld20 30020:30000 "Nix build user 20" /var/empty /sbin/nologin
u nixbld21 30021:30000 "Nix build user 21" /var/empty /sbin/nologin
u nixbld22 30022:30000 "Nix build user 22" /var/empty /sbin/nologin
u nixbld23 30023:30000 "Nix build user 23" /var/empty /sbin/nologin
u nixbld24 30024:30000 "Nix build user 24" /var/empty /sbin/nologin
u nixbld25 30025:30000 "Nix build user 25" /var/empty /sbin/nologin
u nixbld26 30026:30000 "Nix build user 26" /var/empty /sbin/nologin
u nixbld27 30027:30000 "Nix build user 27" /var/empty /sbin/nologin
u nixbld28 30028:30000 "Nix build user 28" /var/empty /sbin/nologin
u nixbld29 30029:30000 "Nix build user 29" /var/empty /sbin/nologin
u nixbld30 30030:30000 "Nix build user 30" /var/empty /sbin/nologin
u nixbld31 30031:30000 "Nix build user 31" /var/empty /sbin/nologin
u nixbld32 30032:30000 "Nix build user 32" /var/empty /sbin/nologin

There is no /root directory on container build. So we don't need to add anything to /root directory like channels or .nix-profile etc. There is a workaround like mkdir -p /var/roothome (because /root is symbolic linked to /var/roothome) before nix-installer then remove that directory but better to not populate anything on /root directory.

Systemd services stays same except we need to bind mount /nix to /var/lib/nix after /etc/tmpfiles.d/nix.conf triggered. So we need to put After=systemd-tmpfiles-setup.service somewhere. I am not sure about where atm.

SELinux stays same I guess.

For now thats it. Probably I forget something but lets see what are you going to say about this infos.

[Mic92]

My plan would be as follows:

• Install to /nix normally (nix needs it)
• Move /nix → /usr/lib/nix at the end (MoveDirectory action)
• First boot: tmpfiles copies /usr/lib/nix → /var/lib/nix, nix-directory.service creates /nix, nix.mount bind-mounts

Does this sounds good?

[queeup]

Sounds good. Lets try that.

One note: I test your latest --no-start-daemon commit and it works but bootc container lint complains about tmpfiles a led outside of the filesystem. Probably because of this line: https://github.com/NixOS/nix-installer/blob/main/src/action/common/configure_init_service.rs#L16

I get this error:

error: Linting: Unexpected runtime error running lint var-tmpfiles: I/O error: a path led outside of the filesystem
Error: building at STEP "RUN bootc container lint --no-truncate": while running runtime: exit status 1

var-tmpfiles: https://github.com/bootc-dev/bootc/blob/main/crates/lib/src/lints.rs#L698

I will investigate.

[queeup]

I have a question: Is there any artifact download shortcut like Determinate installer? For easy to test new commits?

curl -sSfL https://install.determinate.systems/nix/pr/1782 | sh -s -- --help