Permit installation of dev/test dependencies via Nix

buildkitd.go

@@ -74,7 +74,7 @@ func SpawnBuildkitd(req Request, opts *BuildkitdOpts) (*Buildkitd, error) {
 	if os.Getuid() == 0 {
 		cmd = exec.Command("buildkitd", buildkitdFlags...)
 	} else {
-		cmd = exec.Command("rootlesskit", append([]string{"buildkitd"}, buildkitdFlags...)...)
+		cmd = exec.Command("rootlesskit", append([]string{"buildkitd", "--rootless"}, buildkitdFlags...)...)
 	}
 
 	// kill buildkitd on exit

flake.nix

@@ -0,0 +1,39 @@
+# If using a flake-enabled version of Nix (minimum 2.4, with experimental
+# features enabled), ''nix develop'' will spawn an environment in which
+# ''./scripts/test'' will work as intended.
+
+# For older versions of Nix, ''nix-shell'' will invoke this same code via the
+# shell.nix compatibility layer.
+
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/release-21.11";
+    flake-compat.url = "github:edolstra/flake-compat";
+    flake-compat.flake = false;
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+  outputs = { self, nixpkgs, flake-utils, ... }:
+  flake-utils.lib.eachDefaultSystem (system: 
+    let pkgs = import nixpkgs { inherit system; };
+  in rec {
+    devShell = pkgs.mkShell {
+      buildInputs = with pkgs; [
+        buildkit
+        go
+        rootlesskit
+        runc
+      ];
+      shellHook = ''
+        if ! type newuidmap >/dev/null 2>&1; then {
+          echo "WARNING: newuidmap and newgid map are required but not found"
+          echo "         Because these tools require a setuid bit to operate,"
+          echo "         they cannot be installed in a local Nix shell."
+          echo
+        } >&2; fi
+        PS1='[oci-build-task devshell] '"$PS1"
+      '';
+    };
+  });
+}
+
+

scripts/test

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e -u
 

shell.nix

@@ -0,0 +1,10 @@
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).shellNix