build(devcontainer): install Nix and bake the development shell in - #52
Open
Joibel wants to merge 1 commit into
Open
build(devcontainer): install Nix and bake the development shell in#52Joibel wants to merge 1 commit into
Joibel wants to merge 1 commit into
Conversation
Joibel
force-pushed
the
tb-ufbi.5-pr5
branch
2 times, most recently
from
July 30, 2026 12:30
6bd4e33 to
e3b0bc9
Compare
The dev container described the toolchain a second time: the Go, Node and Python dev container features, apt's protoc and clang-format, a kubectl pinned to the minimum tested Kubernetes version, and `make tilt` at create time. flake.nix already describes all of that. Replace the lot with Nix, and run `nix develop` during the image build so the store ships warm. Entering the shell in the container evaluates the same flake.nix, flake.lock and go.mod the build copied in, so it resolves to a derivation that is already realised — 2.3s, no downloads, no network. Interactive shells enter it from .bashrc, and pre-build.sh runs inside it from postCreateCommand; that script now only creates the cluster, since nothing needs installing. Nix is installed single-user and owned by `vscode`, because a container has no init system to run the multi-user daemon under. That also rules out the build sandbox, hence `sandbox = false`: with the Cachix cache and the warm store, nothing is expected to build in there anyway. The guard around the .bashrc line is a variable of our own rather than IN_NIX_SHELL, which looks like the obvious choice but is not yet exported at the point `nix develop` sources ~/.bashrc — recursing until the container runs out of processes. The Dev Container workflow rebuilds on flake.nix, flake.lock and go.mod instead of hack/k8s-versions.sh, which the image no longer reads, and sets Nix up for itself: the `devcontainer` CLI that `make devcontainer-build` runs now comes from the shell rather than from an npm install target that no longer exists. The Nix workflow grows an aarch64-linux job. The dev container image is built for arm64 as well, and without that half of the cache the QEMU build compiles every pinned tool from source. Two things get worse. The image is much bigger — 7.4GB against the 2.5GB it replaces — because a Nix store holding a whole toolchain costs more than the distro packages it replaces. And kubectl is nixpkgs' rather than the minimum tested version, which is what everyone developing outside the container has been using all along. Verified by building the image and the dev container CLI's version of it with the docker-in-docker feature on top: an interactive shell lands in the development shell with go, tilt, kubectl and make from the store and docker, git, sudo and curl still on PATH behind them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UfBK3mQcTNEBEGpXu4hzCY Signed-off-by: Alan Clucas <alan@clucas.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Based on PR #47
Chain of upstream PRs as of 2026-07-30
PR build(nix): one tools-only flake at the repo root #46:
nix-stack-base←tb-ufbi.1-pr1PR ci(nix): build the development shell into the Cachix cache #47:
tb-ufbi.1-pr1←tb-ufbi.2-pr2tb-ufbi.2-pr2←tb-ufbi.5-pr5Fixes #TODO
Motivation
Modifications
Verification
Documentation
AI
🤖 Generated with Claude Code
https://claude.ai/code/session_01H871PuNyYPzjmpUhXCRXGA