nixos-containers: init package

[ericbmerritt]

Motivation for this change

Things done

• Tested using sandboxing
  (nix.useChroot on NixOS,
  or option build-use-chroot in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • OS X
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

This moves nixos-containers into its own package so that it can be
relied upon by other packages/systems. This should make development
using dynamic containers much easier.

---

This change is

[mention-bot]

@ericbmerritt, thanks for your PR! By analyzing the annotation information on this pull request, we identified @edolstra, @matthiasbeyer and @aszlig to be potential reviewers

[copumpkin]

Sorry, can you elaborate on what else might use this? I'm not opposed to it but I'm not seeing the use case.

[ericbmerritt]

@copumpkin Our use case is that we standup systems to do testing in various contexts. In one of those contexts, (first pass integration testing) we stand up the system as a set of containers on build host. The testing system is running as an algorithmic user. Unfortunately, to use containers that user needs passwordless sudo rights to run nixos-container. It gives me the heebie-jeebies to grant sudo to that kind of user in any fashion. To limit our risk, only to that very specific nixos-container command. With nixos-containers as its own package this is fairly trivial to do in the configuration.nix of the build host.

That is the primary driver for this. Essentially, being able to treat the nixos-container command as I do any other command in nix. The other side of that is that I have functionality that calls 'nixos-container'. Leaving that as an implicit dependency rather than placing it in the dependency list so nix can manage the relationship seems off.

[aszlig]

The let nixos-container = ... in nixos-container is redundant here, also instead of pulling in pkgs as a whole I'd refer to the dependencies explicitly in the expressions input attributes, like:

{ substituteAll, perl, perlPackages, shadow, utillinux }:

substituteAll {
  ...
}

Also, lib isn't used either.

Another thing that is missing is the callPackage from all-packages.nix.

[ericbmerritt]

@aszlig updated in response to your comments.

[aszlig]

Thanks :-) However, the function signature still doesn't say something like: { substituteAll, perl, perlPackages, shadow, utillinux }: and pulls out the whole pkgs attrset instead of stating dependencies explicitly, see http://nixos.org/nixpkgs/manual/#sec-syntax (Functions should list their expected arguments as precisely as possible. ...).

[ericbmerritt]

Good call. I will make the changes.

[matthiasbeyer]

I'm not sure why I'm pinged by the bot. I will now unsubscribe from this PR as I don't think I'm qualified enough to review this.

---

Edit: Feel free to ping me again if you think I should review this.

[fpletz]

This broke travis tests: https://travis-ci.org/NixOS/nixpkgs/jobs/145759096

Fixed with 6bcf194.