nix-oci-lock

Status: ALPHA

This generates lockfiles for your virtualisation.oci-containers.containers.

Example

{
  programs.nix-oci-lock = {
    enable = true;
    lockFile = ./oci-lock.json;
  };

  virtualisation.oci-containers.containers = {
    app-db = {
      image = "postgres:latest";
      environment = {
        POSTGRES_USER = "postgres";
        POSTGRES_PASSWORD = "changeme";
        POSTGRES_DB = "app";
      };
      volumes = [ "app-db-data:/var/lib/postgresql" ];
    };
    app-redis.image = "valkey/valkey:latest";
  };
}

Usage

Currently, only flakes are supported. Get started by importing this flake’s NixOS module, e.g.:

{
  inputs.nix-oci-lock.url = "https://git.bartoostveen.nl/bart/nix-oci-lock.git";
  outputs = { nixpkgs, ... }@inputs: {
    nixosConfigurations.foo = nixpkgs.lib.nixosConfiguration {
      modules = [ inputs.nix-oci-lock.nixosModules.default ];
    };
  };
}

See examples for examples.

Roadmap

• Non-flake NixOS configurations
• Substituting password files for OCI login, possibly using sops-nix/agenix
• Signature verification
• Keeping track of timestamps
• Proper tests
• Proper docs
• Proper exit codes
• CI
• CTRL+C handler that writes old lock file

Reference

All docs are available at https://nix-oci-lock.bartoostveen.nl/ (unstable). NixOS options reference is rendered at https://nix-oci-lock.bartoostveen.nl/options.html (unstable).

License

This project is licensed under the GNU General Public License version 3. You can find a copy here.