feat: add and install nix as tool

README.md

@@ -18,6 +18,7 @@ Images are published to `ghcr.io/rancher/ci-image/<name>`, each tagged independe
 | `node22` | none | CI image with Node 22 toolchain |
 | `node24` | none | CI image with Node 24 toolchain |
 | `charts` | none | Rancher charts build environment |
+| `nix` | none | Nix environment |
 <!-- END IMAGES TABLE -->
 
 ## Changelog

deps.yaml

@@ -64,6 +64,15 @@ images:
       - ob-charts-tool
       - oras
 
+  - name: nix
+    description: "Nix environment"
+    base: "registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea"
+    packages:
+      - sudo
+      - vim
+    tools:
+      - nix
+
 packages:
   - gettext-runtime
   - ca-certificates
@@ -200,3 +209,15 @@ tools:
     release:
       download_template: "ob-charts-tool_{os}_{arch}"
       checksum_template: "ob-charts-tool_{version|trimprefix:v}_checksums.txt"
+
+  - name: nix
+    source: "https://releases.nixos.org/nix"
+    mode: static
+    version: 2.34.7
+    checksums:
+      linux/amd64: "eafe5042404e818505e28c5ca3d0885f3ec45c31f955489a25bb38258f87560e"
+      linux/arm64: "f1cee64ae7a02330c6421924c28f597c41813f2214ff108622087d8056378b08"
+    release:
+      download_template: "{source}/nix-{version}/nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}.tar.xz"
+      extract: "nix-{version}-{arch|replace:amd64=x86_64|replace:arm64=aarch64}-{os}/"
+      install_to_path: false

dockerfiles/Dockerfile.nix

@@ -0,0 +1,237 @@
+FROM registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea
+
+LABEL org.opencontainers.image.source="https://github.com/rancher/ci-image" \
+      org.opencontainers.image.title="Rancher nix CI image" \
+      org.opencontainers.image.description="Nix environment"
+
+ARG TARGETARCH
+ENV ARCH=$TARGETARCH
+ENV GH_TELEMETRY=false
+ENV DO_NOT_TRACK=true
+ENV PATH="/var/ci-tools/active:${PATH}"
+
+RUN zypper -n refresh && \
+    zypper -n install \
+        gettext-runtime \
+        ca-certificates \
+        docker \
+        gawk \
+        git-core \
+        gzip \
+        jq \
+        make \
+        tar \
+        unzip \
+        zstd \
+        wget \
+        sudo \
+        vim \
+    && \
+    zypper -n clean -a && \
+    rm -rf /var/log/{lastlog,tallylog,zypper.log,zypp/history,YaST2}
+
+# Create runner group (GID 121) and user (UID 1001) early for use in tool installations.
+# /var/ci-tools/ is set up with setgid (2755) so subdirectories inherit the runner group.
+# This allows any user added to the runner group to access tools extracted to /var/ci-tools/.
+RUN groupadd -g 121 runner && \
+    useradd -u 1001 -g 121 -m runner && \
+    mkdir -p /var/ci-tools && \
+    chown root:runner /var/ci-tools && \
+    chmod 2755 /var/ci-tools
+
+# cosign v3.0.6
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74" ;; \
+        arm64) CHECKSUM="bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-arm64" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_DIR}/cosign" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_DIR}/cosign" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    install "${TMP_DIR}/cosign" "/usr/local/bin/cosign" && \
+    rm -rf "${TMP_DIR}"
+
+# gh v2.89.0
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="d0422caade520530e76c1c558da47daebaa8e1203d6b7ff10ad7d6faba3490d8" ;; \
+        arm64) CHECKSUM="9e64a623dfc242990aa5d9b3f507111149c4282f66b68eaad1dc79eeb13b9ce5" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/gh.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_amd64.tar.gz"; EXTRACT="gh_2.89.0_linux_amd64/bin/gh" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_arm64.tar.gz"; EXTRACT="gh_2.89.0_linux_arm64/bin/gh" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/gh" && \
+    rm -rf "${TMP_DIR}"
+
+# helmv3 v3.20.2
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea" ;; \
+        arm64) CHECKSUM="5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/helmv3.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
+        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv3" && \
+    rm -rf "${TMP_DIR}"
+
+# helmv4 v4.1.4
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09" ;; \
+        arm64) CHECKSUM="13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/helmv4.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
+        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv4" && \
+    rm -rf "${TMP_DIR}"
+
+# slsactl v0.1.30
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="7ed4750766c135ddcae788d194d7ff59a57c6debdc722fd1e52c06460218f10a" ;; \
+        arm64) CHECKSUM="bbbe66089135c82526677177c080f5ca4911ad1989712596338c5acdae4bb383" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/slsactl.tar.gz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_amd64.tar.gz"; EXTRACT="slsactl" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_arm64.tar.gz"; EXTRACT="slsactl" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/slsactl" && \
+    rm -rf "${TMP_DIR}"
+
+# yq v4.53.2
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="d56bf5c6819e8e696340c312bd70f849dc1678a7cda9c2ad63eebd906371d56b" ;; \
+        arm64) CHECKSUM="03061b2a50c7a498de2bbb92d7cb078ce433011f085a4994117c2726be4106ea" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export TMP_DIR=$(mktemp -d) && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_amd64" ;; \
+        arm64) DOWNLOAD_URL="https://github.com/mikefarah/yq/releases/download/v4.53.2/yq_linux_arm64" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_DIR}/yq" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_DIR}/yq" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    install "${TMP_DIR}/yq" "/usr/local/bin/yq" && \
+    rm -rf "${TMP_DIR}"
+
+# nix 2.34.7
+
+# Pre-install setup for nix
+# Create unprivileged user for Nix installation
+RUN useradd -m suse && \
+    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
+    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Add suse user to runner group and create /etc/nix directory and configuration
+RUN usermod -a -G runner suse && \
+    sudo mkdir -p /etc/nix && \
+    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
+    sudo chown -R suse:runner /etc/nix && \
+    sudo mkdir -p /nix && \
+    sudo chown -R suse:runner /nix && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local
+
+RUN case "${ARCH}" in \
+        amd64) CHECKSUM="eafe5042404e818505e28c5ca3d0885f3ec45c31f955489a25bb38258f87560e" ;; \
+        arm64) CHECKSUM="f1cee64ae7a02330c6421924c28f597c41813f2214ff108622087d8056378b08" ;; \
+        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
+    esac && \
+    export INSTALL_DIR="/var/ci-tools/nix" && \
+    mkdir -p "${INSTALL_DIR}" && \
+    export TMP_DIR=$(mktemp -d) && \
+    export TMP_FILE="${TMP_DIR}/nix.tar.xz" && \
+    case "${ARCH}" in \
+        amd64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.7/nix-2.34.7-x86_64-linux.tar.xz"; EXTRACT="nix-2.34.7-x86_64-linux/" ;; \
+        arm64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.7/nix-2.34.7-aarch64-linux.tar.xz"; EXTRACT="nix-2.34.7-aarch64-linux/" ;; \
+    esac && \
+    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
+    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
+    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
+    tar xJf "${TMP_FILE}" -C "${TMP_DIR}" && \
+    FULL_EXTRACT_PATH="${TMP_DIR}/${EXTRACT}" && \
+    EXTRACT_DIR=$(dirname "${FULL_EXTRACT_PATH}") && \
+    if [ "${EXTRACT_DIR}" != "${TMP_DIR}" ]; then \
+        cp -a "${FULL_EXTRACT_PATH}" "${INSTALL_DIR}/"; \
+    else \
+        (cd "${FULL_EXTRACT_PATH}" && cp -a . "${INSTALL_DIR}/"); \
+    fi && \
+    rm -rf "${TMP_DIR}"
+
+# Post-install setup for nix
+# Fix ownership and run Nix installer from the extracted archive
+RUN set -e; \
+    sudo chown -R suse:runner /var/ci-tools/nix
+
+# Switch to unprivileged user for installation
+USER suse
+WORKDIR /home/suse
+ENV USER=suse
+
+RUN set -e; \
+    cd /var/ci-tools/nix && \
+    ./install --no-daemon
+
+RUN set -e; \
+    install -d .config/nix/profiles
+
+# Restore root user for remaining Dockerfile operations
+USER root
+ENV USER=root
+
+# Family selectors — copy scripts and set up manifest + active symlinks.
+# /var/ci-tools/active is on PATH ahead of /usr/local/bin; runner can update
+# the active symlink with: ci-select <family> <tool>  or  select-<family> <tool>
+COPY dockerfiles/scripts/select-helm.sh /usr/local/bin/select-helm
+COPY dockerfiles/scripts/ci-select.sh /usr/local/bin/ci-select
+RUN chmod +x /usr/local/bin/select-helm && chmod +x /usr/local/bin/ci-select
+
+
+# Set up CI tool family infrastructure (runner user and group created earlier).
+RUN mkdir -p /var/ci-tools/active \
+    && mkdir -p /usr/local/share/ci-tools/families/helm \
+    && touch /usr/local/share/ci-tools/families/helm/helmv3 \
+    && touch /usr/local/share/ci-tools/families/helm/helmv4 \
+    && ln -sf helmv4 /usr/local/share/ci-tools/families/helm/default \
+    && ln -sf /usr/local/bin/helmv4 /var/ci-tools/active/helm \
+    && chown -R root:runner /var/ci-tools \
+    && chmod 2775 /var/ci-tools/active
+
+# We trust our base image and the repos that are pulled in workflows. Otherwise
+# each workflow that uses our base images would have to add the step below.
+RUN git config --system --add safe.directory '*'

hooks/nix-post.tmpl

@@ -0,0 +1,19 @@
+# Fix ownership and run Nix installer from the extracted archive
+RUN set -e; \
+    sudo chown -R suse:runner /var/ci-tools/nix
+
+# Switch to unprivileged user for installation
+USER suse
+WORKDIR /home/suse
+ENV USER=suse
+
+RUN set -e; \
+    cd /var/ci-tools/nix && \
+    ./install --no-daemon
+
+RUN set -e; \
+    install -d .config/nix/profiles
+
+# Restore root user for remaining Dockerfile operations
+USER root
+ENV USER=root

hooks/nix-pre.tmpl

@@ -0,0 +1,14 @@
+# Create unprivileged user for Nix installation
+RUN useradd -m suse && \
+    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
+    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Add suse user to runner group and create /etc/nix directory and configuration
+RUN usermod -a -G runner suse && \
+    sudo mkdir -p /etc/nix && \
+    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
+    sudo chown -R suse:runner /etc/nix && \
+    sudo mkdir -p /nix && \
+    sudo chown -R suse:runner /nix && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
+    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local

images-lock.yaml

@@ -10,6 +10,7 @@ images:
     - node22
     - node24
     - charts
+    - nix
 packages:
     - gettext-runtime
     - ca-certificates
@@ -32,12 +33,21 @@ tools:
     govulncheck: v1.2.0
     helmv3: v3.20.2
     helmv4: v4.1.4
+    nix: 2.34.7
     ob-charts-tool: v0.5.0
     oras: v1.3.1
     slsactl: v0.1.30
     yq: v4.53.2
 selectors:
     - helm
+hooks:
+    nix:
+        pre:
+            name: nix-pre.tmpl
+            checksum: 523b5a96366cae6a5ebe5f64d7df43b3
+        post:
+            name: nix-post.tmpl
+            checksum: 3cc315f4364a4bdc66ae08273ab09270
 configs:
     charts:
         base: registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea
@@ -112,6 +122,25 @@ configs:
             helm: helmv4
         go_version: 1.26.2
         description: CI image with Go 1.26 toolchain
+    nix:
+        base: registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea
+        platforms:
+            - linux/amd64
+            - linux/arm64
+        packages:
+            - sudo
+            - vim
+        tools:
+            - cosign
+            - gh
+            - helmv3
+            - helmv4
+            - nix
+            - slsactl
+            - yq
+        family_selectors:
+            helm: helmv4
+        description: Nix environment
     node22:
         base: registry.suse.com/bci/nodejs:22.22.2@sha256:b81c6b8ffd79f8007c621b6ad21d8aa195fb3c6c8024ac6a04923227d9a18a81
         platforms:

internal/dockerfile/tmpl/dockerfile.tmpl

@@ -45,4 +45,4 @@ RUN {{.SelectorSetupCmd}}
 
 {{if .HasAnyOfPackages "git" "git-core"}}# We trust our base image and the repos that are pulled in workflows. Otherwise
 # each workflow that uses our base images would have to add the step below.
-RUN git config --system --add safe.directory '*'{{end}}
+RUN git config --system --add safe.directory '*'{{end}}