nixos/image: systemd-repart based GPT image builder by nikstur · Pull Request #245250 · NixOS/nixpkgs

nikstur · 2023-07-24T22:22:58Z

Description of changes

Add a new module to build images via systemd-repart. This module exposes a shallow wrapper around systemd-repart that can be used to assemble appliance images by populating the Efi System Partition (ESP) yourself.

The eventual ambitions for this image builder are much larger though:

Have the ability to install all supported boot loaders (by assembling the ESP beforehand and simply copying the contents into the image)
Expose the builder as a snippet, to optionally build disk images just-in-time (so they are not stored in the Nix store and thus not cached)
Replace make-disk-image.nix for all GPT/UEFI use cases (including as the default image creator for qemu-vm.nix)

Generally, this module wants to remain a shallow wrapper around systemd-repart and all additional funcitonality should be implemented outside of this module (e.g. populating an ESP) and then just copy into the image via the provided mechanisms.

I'm not sure where the docs should go. I feel they are too early in the manual. Also these are not really reference material, so I'm not sure if they even belong in the manual. Maybe nix.dev is a better place?

Things done

nixos/modules/image/gpt.nix

nixos/tests/appliance-gpt-image.nix

RaitoBezarius

Very good! My biggest beef is the namespacing. :)

arianvp

I think it would be better to have a derivation that takes a bootspec as input and outputs repart definitions as output instead of having a DSL at the nix expression Level for setting partition contents.

This will also make it easier to have this as a standalone script that builds images outside of the nix store and makes the builder usable outside of NixOS

arianvp · 2023-07-25T09:28:52Z

Would be nice to add or document that you can run

      ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration

From closureInfo

To get a working NixOS (non appliance) image if nix binary is in the target image

Like here:

https://github.com/arianvp/server-optimised-nixos/blob/9e3de35bb5885c22695b953976466aa3c15ac8cc/modules/base.nix#L39

nixos/modules/image/gpt.nix

nixos/modules/image/amend-repart-definitions.py

Add a re-usable function that converts an attrset to a directory containing systemd definition files.

nikstur · 2023-07-26T22:07:19Z

takes a bootspec as input and outputs repart definitions as output instead of having a DSL at the nix expression Level for setting partition contents.

The bootspec does not contain all the information necessary to build an image. Additionally, if we statically assemble an image, and not rely on the generation mechanism, bootspec doesn't really benefit us. We can just use the normal templating mechanisms Nix provides. The issue bootspec really addresses (at least to me) is that it has all the information in place for a bootloader installer that cannot rely on normal templating in Nix.

makes the builder usable outside of NixOS

Outside NixOS, you should probably just use systemd-repart directly or use mkosi wich also uses systemd-repart under the hood.

To get a working NixOS (non appliance) image if nix binary is in the target image

I want to address this outside of this PR. This PR really just adds the NixOS primitives to create an image with systemd-repart. I believe this is also a more elegant approach. make-disk-image.nix for example suffers from a lot of complexity because it tries to do everything at once without many abstractions in between.

The way I envision to eventually create a fully working Nix image (that also supports generations and can be used by qemu-vm.nix) is by creating all the necessary pieces in separate derivations (or at least outside the image builder itself) and just copy the resulting files to the right spots inside the image via the primitives exposed in image.repart. So we would for example have an ESP builder that can assemble the directory tree for an entire ESP (with generations) and then just tell system-repart to copy this tree into the ESP. Registration of the closure is then done via a systemd service in userspace.

nikstur · 2023-07-26T22:09:19Z

@ofborg test systemd-sysupdate systemd-repart.basic appliance-repart-image

nikstur marked this pull request as ready for review July 24, 2023 22:23

nikstur requested a review from a team as a code owner July 24, 2023 22:23

nikstur requested a review from RaitoBezarius July 24, 2023 22:23

nikstur assigned arianvp Jul 24, 2023

RaitoBezarius requested review from Lassulus and Mic92 July 24, 2023 22:24