feat: add and install nix as tool

README.md

@@ -18,6 +18,7 @@ Images are published to `ghcr.io/rancher/ci-image/<name>`, each tagged independe
 | `node22` | none | CI image with Node 22 toolchain |
 | `node24` | none | CI image with Node 24 toolchain |
 | `charts` | none | Rancher charts build environment |
+| `nix` | none | Nix environment |
 <!-- END IMAGES TABLE -->
 
 ## Changelog

deps.yaml

@@ -64,6 +64,16 @@ images:
       - ob-charts-tool
       - oras
 
+  - name: nix
+    description: "Nix environment"
+    base: "registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea"
+    packages:
+      - sudo
+      - vim
+    tools:
+      - nix
+      - goreleaser
+
 packages:
   - gettext-runtime
   - ca-certificates
@@ -191,3 +201,15 @@ tools:
     release:
       download_template: "ob-charts-tool_{os}_{arch}"
       checksum_template: "ob-charts-tool_{version|trimprefix:v}_checksums.txt"
+
+  - name: nix
+    source: "https://releases.nixos.org/nix"
+    mode: static
+    version: 2.34.5
+    checksums:
+      linux/amd64: "0a0462692a10ff1eb8a608f713f38d1f25a208ad55963a9c00b239da398de5a1"
+      linux/arm64: "771e4b6f719243b9481f19eaedfbbbacc2f4a0282d6e043df4f33bb449ea3c57"
+    release:
+      download_template: "{source}/nix-{version}/nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}.tar.xz"
+      extract: "nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}/install"
+      install_to_path: false

dockerfiles/Dockerfile.nix

@@ -0,0 +1,235 @@
+FROM registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea
+
+LABEL org.opencontainers.image.source="https://github.com/rancher/ci-image" \
+      org.opencontainers.image.title="Rancher nix CI image" \
+      org.opencontainers.image.description="Nix environment"
+
+ARG TARGETARCH
+ENV ARCH=$TARGETARCH
+ENV GH_TELEMETRY=false
+ENV DO_NOT_TRACK=true
+ENV PATH="/var/ci-tools/active:${PATH}"
+
+RUN zypper -n refresh && \
+    zypper -n install \
+        gettext-runtime \
+        ca-certificates \
+        docker \
+        gawk \
+        git-core \
+        gzip \
+        jq \
+        make \
+        tar \
+        unzip \
+        zstd \
+        wget \
+        sudo \
+        vim \
+    && \
+    zypper -n clean -a && \
+    rm -rf /var/log/{lastlog,tallylog,zypper.log,zypp/history,YaST2}
+
+# Create runner group (GID 121) and user (UID 1001) early for use in tool installations.
+# /var/ci-tools/ is set up with setgid (2755) so subdirectories inherit the runner group.
+# This allows any user added to the runner group to access tools extracted to /var/ci-tools/.
+RUN groupadd -g 121 runner && \
+    useradd -u 1001 -g 121 -m runner && \
+    mkdir -p /var/ci-tools && \
+    chown root:runner /var/ci-tools && \
+    chmod 2755 /var/ci-tools
+
+# cosign v3.0.6
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74" ;; \
+        arm64) CHECKSUM="bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-arm64" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_DIR}/cosign" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_DIR}/cosign" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    install "${TMP_DIR}/cosign" "/usr/local/bin/cosign" && \
+    rm -rf "${TMP_DIR}"
+
+# gh v2.89.0
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="d0422caade520530e76c1c558da47daebaa8e1203d6b7ff10ad7d6faba3490d8" ;; \
+        arm64) CHECKSUM="9e64a623dfc242990aa5d9b3f507111149c4282f66b68eaad1dc79eeb13b9ce5" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/gh.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_amd64.tar.gz"; EXTRACT="gh_2.89.0_linux_amd64/bin/gh" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_arm64.tar.gz"; EXTRACT="gh_2.89.0_linux_arm64/bin/gh" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/gh" && \
+    rm -rf "${TMP_DIR}"
+
+# helmv3 v3.20.2
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea" ;; \
+        arm64) CHECKSUM="5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/helmv3.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
+        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv3" && \
+    rm -rf "${TMP_DIR}"
+
+# helmv4 v4.1.4
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09" ;; \
+        arm64) CHECKSUM="13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/helmv4.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
+        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv4" && \
+    rm -rf "${TMP_DIR}"
+
+# slsactl v0.1.30
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="7ed4750766c135ddcae788d194d7ff59a57c6debdc722fd1e52c06460218f10a" ;; \
+        arm64) CHECKSUM="bbbe66089135c82526677177c080f5ca4911ad1989712596338c5acdae4bb383" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/slsactl.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_amd64.tar.gz"; EXTRACT="slsactl" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_arm64.tar.gz"; EXTRACT="slsactl" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/slsactl" && \
+    rm -rf "${TMP_DIR}"
+
+# nix 2.34.5
+
+# Pre-install setup for nix
+# Create unprivileged user for Nix installation
+RUN useradd -m suse && \
+    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
+    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Add suse user to runner group and create /etc/nix directory and configuration
+RUN usermod -a -G runner suse && \
+    sudo mkdir -p /etc/nix && \
+    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
+    sudo chown -R suse:runner /etc/nix && \
+    sudo mkdir -p /nix && \
+    sudo chown -R suse:runner /nix && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local
+
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="0a0462692a10ff1eb8a608f713f38d1f25a208ad55963a9c00b239da398de5a1" ;; \
+        arm64) CHECKSUM="771e4b6f719243b9481f19eaedfbbbacc2f4a0282d6e043df4f33bb449ea3c57" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export INSTALL_DIR="/var/ci-tools/nix" && \
+    mkdir -p "${INSTALL_DIR}" && \
+    export TMP_FILE="${INSTALL_DIR}/nix.tar.xz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.5/nix-2.34.5-x86_64-linux.tar.xz"; EXTRACT="nix-2.34.5-x86_64-linux/install" ;; \
+        arm64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.5/nix-2.34.5-aarch64-linux.tar.xz"; EXTRACT="nix-2.34.5-aarch64-linux/install" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${INSTALL_DIR}/checksum.sha256" && \
+    sha256sum -c "${INSTALL_DIR}/checksum.sha256" && \
+    cd "${INSTALL_DIR}" && \
+    tar xf "${TMP_FILE}" && \
+    chmod -R a+rX . && \
+    rm "${TMP_FILE}" "${INSTALL_DIR}/checksum.sha256"
+
+# Post-install setup for nix
+# Fix ownership and run Nix installer from the extracted archive
+RUN set -e; \
+    sudo chown -R suse:runner /var/ci-tools/nix
+
+# Switch to unprivileged user for installation
+USER suse
+WORKDIR /home/suse
+ENV USER=suse
+
+RUN set -e; \
+    case "${ARCH}" in \
+        amd64) extract="nix-2.34.5-x86_64-linux/install" ;; \
+        arm64) extract="nix-2.34.5-aarch64-linux/install" ;; \
+        *) echo "unsupported architecture: ${ARCH}" >&2; exit 1 ;; \
+    esac; \
+    cd /var/ci-tools/nix && \
+    ./${extract} --no-daemon
+
+# Restore root user for remaining Dockerfile operations
+USER root
+ENV USER=root
+
+# goreleaser v2.15.2
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="0ebdbf0353aba566b969dde746cc4e4806f96c27aa2f3971b229a9df7611fedc" ;; \
+        arm64) CHECKSUM="5db66761a98f6693161e49e1a95d28d2673a892ba60cb4a5e16736cafd41c4c9" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/goreleaser.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/goreleaser/goreleaser/releases/download/v2.15.2/goreleaser_Linux_x86_64.tar.gz"; EXTRACT="goreleaser" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/goreleaser/goreleaser/releases/download/v2.15.2/goreleaser_Linux_arm64.tar.gz"; EXTRACT="goreleaser" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/goreleaser" && \
+    rm -rf "${TMP_DIR}"
+
+# Family selectors — copy scripts and set up manifest + active symlinks.
+# /var/ci-tools/active is on PATH ahead of /usr/local/bin; runner can update
+# the active symlink with: ci-select <family> <tool>  or  select-<family> <tool>
+COPY dockerfiles/scripts/select-helm.sh /usr/local/bin/select-helm
+COPY dockerfiles/scripts/ci-select.sh /usr/local/bin/ci-select
+RUN chmod +x /usr/local/bin/select-helm && chmod +x /usr/local/bin/ci-select
+
+
+# Set up CI tool family infrastructure (runner user and group created earlier).
+RUN mkdir -p /var/ci-tools/active \
+    && mkdir -p /usr/local/share/ci-tools/families/helm \
+    && touch /usr/local/share/ci-tools/families/helm/helmv3 \
+    && touch /usr/local/share/ci-tools/families/helm/helmv4 \
+    && ln -sf helmv4 /usr/local/share/ci-tools/families/helm/default \
+    && ln -sf /usr/local/bin/helmv4 /var/ci-tools/active/helm \
+    && chown -R root:runner /var/ci-tools \
+    && chmod 2775 /var/ci-tools/active
+
+# We trust our base image and the repos that are pulled in workflows. Otherwise
+# each workflow that uses our base images would have to add the step below.
+RUN git config --system --add safe.directory '*'

images-lock.yaml

@@ -10,6 +10,7 @@ images:
     - node22
     - node24
     - charts
+    - nix
 packages:
     - gettext-runtime
     - ca-certificates
@@ -32,6 +33,7 @@ tools:
     govulncheck: v1.2.0
     helmv3: v3.20.2
     helmv4: v4.1.4
+    nix: 2.34.5
     ob-charts-tool: v0.5.0
     oras: v1.3.1
     slsactl: v0.1.30
@@ -108,6 +110,25 @@ configs:
             helm: helmv4
         go_version: 1.26.2
         description: CI image with Go 1.26 toolchain
+    nix:
+        base: registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea
+        platforms:
+            - linux/amd64
+            - linux/arm64
+        packages:
+            - sudo
+            - vim
+        tools:
+            - cosign
+            - gh
+            - goreleaser
+            - helmv3
+            - helmv4
+            - nix
+            - slsactl
+        family_selectors:
+            helm: helmv4
+        description: Nix environment
     node22:
         base: registry.suse.com/bci/nodejs:22.22.2@sha256:b81c6b8ffd79f8007c621b6ad21d8aa195fb3c6c8024ac6a04923227d9a18a81
         platforms:

internal/dockerfile/install.go

@@ -45,3 +45,9 @@ func isGzipBinaryURL(url string) bool {
 	u := urlExt(url)
 	return strings.HasSuffix(u, ".gz") && !strings.HasSuffix(u, ".tar.gz")
 }
+
+// isScriptURL reports whether url is an installation script.
+func isScriptURL(url string) bool {
+	u := urlExt(url)
+	return strings.HasSuffix(u, ".sh") || strings.HasSuffix(u, "/install")
+}

internal/dockerfile/tmpl/nix-post.tmpl

@@ -0,0 +1,21 @@
+# Fix ownership and run Nix installer from the extracted archive
+RUN set -e; \
+    sudo chown -R suse:runner /var/ci-tools/nix
+
+# Switch to unprivileged user for installation
+USER suse
+WORKDIR /home/suse
+ENV USER=suse
+
+RUN set -e; \
+    case "${ARCH}" in \
+        amd64) extract="nix-2.34.5-x86_64-linux/install" ;; \
+        arm64) extract="nix-2.34.5-aarch64-linux/install" ;; \
+        *) echo "unsupported architecture: ${ARCH}" >&2; exit 1 ;; \
+    esac; \
+    cd /var/ci-tools/nix && \
+    ./${extract} --no-daemon
+
+# Restore root user for remaining Dockerfile operations
+USER root
+ENV USER=root

internal/dockerfile/tmpl/nix-pre.tmpl

@@ -0,0 +1,14 @@
+# Create unprivileged user for Nix installation
+RUN useradd -m suse && \
+    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
+    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Add suse user to runner group and create /etc/nix directory and configuration
+RUN usermod -a -G runner suse && \
+    sudo mkdir -p /etc/nix && \
+    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
+    sudo chown -R suse:runner /etc/nix && \
+    sudo mkdir -p /nix && \
+    sudo chown -R suse:runner /nix && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local