renovate-nix-docker

I like nixos, but it's a bit painful not being able to update applications as I see fit. Why can't I just use docker images on nixos? Well.. I can, but I either have to choose between auto-updating without rollback, or manually pasting hashes. The hash part can be automated, but I want automated PRs which tell me to update my stuff, otherwise it won't be updated. Enter renovate-nix-docker.

How it works

You have a Dockerfile in the following form (example):

FROM --platform=linux/arm64 ghcr.io/jellyfin/jellyfin:10.11.6@sha256:c8501a04517595419748a9fadbcadea777c0b61814c6216c6d68dfe6a2c29ad3 as jellyfin
FROM --platform=linux/arm64 code.forgejo.org/forgejo/runner:12.6.3@sha256:15d782821d1b3ce83022b20d75aec2b14b68e47c629a2dce7c0cd21f85e21180 as forgejo-runner

this file all the info for running the images. And renovate bot understands it (that's why there's the --platform, so that it chooses the correct hash). Nice! One small issue: it doesn't contain the nix hash. And to get the hash you need to download the whole image. Ouch.

To fix that run renovate-nix-docker Dockerfile images.json - it'll download each image, hash it and write it in the json file. Then you can trivially parse it in nix (see example-nix-module.nix) and then you can do something like this:

virtualisation.oci-containers = {
  containers.jellyfin = {
    image = config.isbl.podman-pin.jellyfin.image;
    imageFile = config.isbl.podman-pin.jellyfin.imageFile;
    # note that the naming is a leftover from my previous attempt at this thing...
    # ...
  };
};

and done! I'll probably want to write proper nix flake or something for this, but yeah, that's it.

Important to note: the tool only downloads the image for out-of-date hashes, so you can do stuff like run this in CI on every commit and it won't hurt.

How to install

You can either run the docker image from this repo, or build it yourself.

podman run --rm -it -v $PWD:/data:Z forgejo.isbl.cz/isabella/renovate-nix-docker:latest /data/Dockerfile /data/images.json

If you build it yourself make sure you have skopeo installed.

Local build

You need rust toolchain and rust compiler. Rust preferably via rustup. On fedora you could do something like the following:

sudo dnf install gcc rustup
rustup-init
# reload shell
cargo b

Notice

The idea was being refined over many evenings - over time it was a bash script, node.js script, nix derivation, bash script again (but different) and finally this. This version seems to check all my boxes, so I expect to use it (hence I'm writing readme). That being said: I wrote this specific code over one evening and I didn't even read it after myself. Expect bugs.

Maintenance

Build and push the docker image:

set TAG forgejo.isbl.cz/isabella/renovate-nix-docker:latest
podman manifest create $TAG
podman build --platform linux/arm64,linux/amd64 --manifest $TAG --inherit-labels=false .
podman manifest push $TAG
podman manifest rm $TAG