Skip to content

Add nix installation #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bthomee merged 9 commits into from
Feb 6, 2026
Merged

Add nix installation #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e53cb5b
Add nix installation
kuznetsss Feb 5, 2026
51210eb
Sort packages
kuznetsss Feb 5, 2026
6e61e3e
Fix nix sourcing issue
kuznetsss Feb 5, 2026
0b80d06
Fix build
kuznetsss Feb 5, 2026
ac7c935
Fix reviw comments
kuznetsss Feb 5, 2026
0859bea
Check nix after creating env variables
kuznetsss Feb 5, 2026
c832e6e
Update docker/ubuntu/Dockerfile
mathbunnyru Feb 5, 2026
57f45df
Update docker/ubuntu/Dockerfile
mathbunnyru Feb 5, 2026
902dc91
Move nix installation
kuznetsss Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion docker/debian/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ pkgs+=(python3-pip) # Package manager for Python applications.
pkgs+=(unzip) # Dependency for tools requiring unzipping files.
pkgs+=(vim) # Text editor.
pkgs+=(wget) # Required build tool.
pkgs+=(xz-utils) # Required to install nix
apt-get update
apt-get install -y --no-install-recommends "${pkgs[@]}"
apt-get clean
Expand Down Expand Up @@ -96,6 +97,15 @@ ENV RUSTUP_HOME="/opt/rust/.rustup"
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=${RUST_VERSION}
ENV PATH="$CARGO_HOME/bin:$PATH"

# Install nix
RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes

# Add nix to PATH and set NIX environment variables so nix is available in all
# shells including non-interactive shells (e.g., GitHub Actions).
ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
ENV NIX_PROFILES="/nix/var/nix/profiles/default"
ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"

# Print versions.
RUN <<EOF
cmake --version
Expand All @@ -106,6 +116,7 @@ mold --version
python3 --version
rustc --version
cargo --version
nix --version
EOF

# ====================== GCC IMAGE ======================
Expand Down Expand Up @@ -243,8 +254,16 @@ curl --no-progress-meter https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dear
printf "%s\n%s\n" \
"deb [signed-by=/etc/apt/keyrings/llvm.gpg] https://apt.llvm.org/${DEBIAN_VERSION}/ llvm-toolchain-${DEBIAN_VERSION}-${CLANG_VERSION} main" \
| tee /etc/apt/sources.list.d/llvm.list
# As of 2026-02-01, Debian Trixie rejects GPG keys using SHA1 signatures as insecure.
# The LLVM apt repository (apt.llvm.org) GPG key still uses SHA1, causing signature
# verification to fail. We configure apt to allow weak signatures and use
# --allow-unauthenticated for this trusted repository until LLVM updates their signing key.
printf "%s\n" \
"Acquire::AllowInsecureRepositories \"true\";" \
"Acquire::AllowWeakRepositories \"true\";" \
| tee /etc/apt/apt.conf.d/99llvm-allow-weak
apt-get update
apt-get install -t llvm-toolchain-${DEBIAN_VERSION}-${CLANG_VERSION} -y --no-install-recommends \
apt-get install -t llvm-toolchain-${DEBIAN_VERSION}-${CLANG_VERSION} -y --no-install-recommends --allow-unauthenticated \
clang-${CLANG_VERSION} \
libclang-rt-${CLANG_VERSION}-dev \
llvm-${CLANG_VERSION}
Expand Down
12 changes: 12 additions & 0 deletions docker/rhel/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ if [[ "${RHEL_VERSION}" == "8" ]]; then
else
pkgs+=(binutils-gold) # Required build tool.
fi
pkgs+=(curl) # Required to install nix
pkgs+=(file) # Required packaging tool.
pkgs+=(git) # Required build tool.
pkgs+=(gpg) # Dependency for tools requiring signing or encrypting/decrypting.
Expand Down Expand Up @@ -56,6 +57,7 @@ pkgs+=(rpm-build) # Required packaging tool.
pkgs+=(unzip) # Dependency for tools requiring unzipping files.
pkgs+=(vim) # Text editor.
pkgs+=(wget) # Required build tool.
pkgs+=(xz) # Required to install nix
dnf update -y
dnf install -y --allowerasing --setopt=tsflags=nodocs "${pkgs[@]}"
dnf clean -y all
Expand Down Expand Up @@ -107,6 +109,15 @@ ENV RUSTUP_HOME="/opt/rust/.rustup"
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=${RUST_VERSION}
ENV PATH="$CARGO_HOME/bin:$PATH"

# Install nix
RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes

# Add nix to PATH and set NIX environment variables so nix is available in all
# shells including non-interactive shells (e.g., GitHub Actions).
ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
ENV NIX_PROFILES="/nix/var/nix/profiles/default"
ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"

# Print versions.
RUN <<EOF
cmake --version
Expand All @@ -117,6 +128,7 @@ mold --version
python3 --version
rustc --version
cargo --version
nix --version
EOF

# ====================== GCC IMAGE ======================
Expand Down
20 changes: 19 additions & 1 deletion docker/ubuntu/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ pkgs+=(python3-pip) # Package manager for Python applications.
pkgs+=(unzip) # Dependency for tools requiring unzipping files.
pkgs+=(vim) # Text editor.
pkgs+=(wget) # Required build tool.
pkgs+=(xz-utils) # Required to install nix
apt-get update
apt-get install -y --no-install-recommends "${pkgs[@]}"
apt-get clean
Expand Down Expand Up @@ -79,6 +80,15 @@ ENV RUSTUP_HOME="/opt/rust/.rustup"
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=${RUST_VERSION}
ENV PATH="$CARGO_HOME/bin:$PATH"

# Install nix
RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes

# Add nix to PATH and set NIX environment variables so nix is available in all
# shells including non-interactive shells (e.g., GitHub Actions).
ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
ENV NIX_PROFILES="/nix/var/nix/profiles/default"
ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"

# Print versions.
RUN <<EOF
cmake --version
Expand All @@ -89,6 +99,7 @@ mold --version
python3 --version
rustc --version
cargo --version
nix --version
EOF

# ====================== GCC IMAGE ======================
Expand Down Expand Up @@ -209,8 +220,15 @@ ARG UBUNTU_VERSION
# Install Clang. Some build dependencies require GCC to be also available.
ARG CLANG_VERSION
RUN <<EOF
# As of 2026-02-01, newer distros reject GPG keys using SHA1 signatures as insecure.
# Some LLVM/Clang repository GPG keys may still use SHA1. We configure apt to allow
# weak signatures and use --allow-unauthenticated as a workaround for trusted repositories.
printf "%s\n" \
"Acquire::AllowInsecureRepositories \"true\";" \
"Acquire::AllowWeakRepositories \"true\";" \
| tee /etc/apt/apt.conf.d/99llvm-allow-weak
apt-get update
apt-get install -y --no-install-recommends \
apt-get install -y --no-install-recommends --allow-unauthenticated \
clang-${CLANG_VERSION} \
libclang-rt-${CLANG_VERSION}-dev \
llvm-${CLANG_VERSION} \
Expand Down