switch to nix2container for image building

nix/image/haze.nix

@@ -36,14 +36,24 @@
   dnsmasq,
   frankenphp,
   nushell,
-}: let
+  nix2container,
+  buildEnv,
+}:
+let
   inherit (builtins) toString compareVersions;
-  inherit (lib) readFile getExe concatStringsSep splitString take optionals;
+  inherit (lib)
+    readFile
+    getExe
+    concatStringsSep
+    splitString
+    take
+    optionals
+    ;
 
   version = (fromTOML (readFile ../../Cargo.toml)).package.version;
 
   phpVersion = concatStringsSep "." (take 2 (splitString "." php.version));
-  phpEnv = callPackage ./php.nix {inherit debug php;};
+  phpEnv = callPackage ./php.nix { inherit debug php; };
 
   bootstrap = writers.writeNuBin "bootstrap" (readFile ./bootstrap);
   shadowSetupScript = writeShellApplication {
@@ -51,7 +61,7 @@
     text = dockerTools.shadowSetup;
   };
 
-  tmpDir = runCommand "tmp-dir" {} ''
+  baseDirs = runCommand "tmp-dir" { } ''
     mkdir -p $out/tmp
     mkdir -p $out/var/cache/nginx
     mkdir -p $out/var/log/nginx
@@ -63,9 +73,10 @@
     mkdir -p $out/conf
     mkdir -p $out/var/spool
   '';
-  configs = callPackage ./configs.nix {};
-  scripts = callPackage ./scripts.nix {};
-  phpunitUnwrapped = majorVersion:
+  configs = callPackage ./configs.nix { };
+  scripts = callPackage ./scripts.nix { };
+  phpunitUnwrapped =
+    majorVersion:
     callPackage ./phpunit.nix {
       inherit majorVersion;
       php = phpEnv;
@@ -73,7 +84,7 @@
 
   phpunit = writeShellApplication {
     name = "phpunit";
-    runtimeInputs = [jq];
+    runtimeInputs = [ jq ];
     text = ''
       MAJOR=$(jq -r 'first(.require."phpunit/phpunit" | scan("[[:digit:]]+"))' vendor-bin/phpunit/composer.json)
       case "$MAJOR" in
@@ -97,108 +108,142 @@
     '';
   };
 
-  certificates = runCommand "scripts" {} ''
+  certificates = runCommand "scripts" { } ''
     mkdir -p $out
     cp -r ${../../certificates} $out/certificates
   '';
-  clamav-data = runCommand "scripts" {} ''
+  clamav-data = runCommand "scripts" { } ''
     mkdir -p $out/etc
     mkdir -p $out/var/lib/clamav
     cp ${data/clamav/daily.cvd} $out/var/lib/clamav/daily.cvd
     cp -r ${configs/clamav} $out/etc/clamav
   '';
 
-  baseImage = dockerTools.buildImage {
-    name = "icewind1991/haze-base";
-    tag = phpVersion;
+  basePackages = [
+    dockerTools.caCertificates
+    dockerTools.usrBinEnv
+    bash
+    blackfire
+    nginx
+    coreutils
+    shadow
+    cronie
+    redis
+    gnused
+    procps
+    gnugrep
+    minio-client
+    sudo
+    su
+    which
+    git
+    sqlite-interactive
+    clamav
+    samba
+    wget
+    curl
+    oracle-instantclient
+    vim
+    helix
+    python3Packages.supervisor
+    dnsmasq
+    nushell
+    getent
+    clamav-data
+  ];
 
-    copyToRoot = [
-      dockerTools.caCertificates
-      dockerTools.usrBinEnv
-      bash
-      blackfire
-      nginx
-      coreutils
-      shadow
-      cronie
-      redis
-      gnused
-      procps
-      gnugrep
-      minio-client
-      sudo
-      su
-      which
-      git
-      sqlite-interactive
-      clamav
-      samba
-      wget
-      curl
-      oracle-instantclient
-      vim
-      helix
-      python3Packages.supervisor
-      dnsmasq
-      nushell
-      getent
-    ];
-  };
+  phpPackages = [
+    phpEnv
+    phpEnv.packages.composer
+    phpunit
+  ]
+  ++ optionals ((compareVersions phpVersion "8.2") == 1) [
+    (frankenphp.override {
+      php = php.withExtensions (
+        import ./php-ext.nix {
+          inherit lib php;
+          enableBlackfire = false;
+        }
+      );
+    })
+  ];
 
-  phpImage = dockerTools.buildImage {
-    name = "icewind1991/haze-php";
-    tag = phpVersion;
-    fromImage = baseImage;
-
-    copyToRoot =
-      [
-        phpEnv
-        phpEnv.packages.composer
-        phpunit
-      ]
-      ++ optionals ((compareVersions phpVersion "8.2") == 1) [
-        (frankenphp.override {
-          php = php.withExtensions (import ./php-ext.nix {
-            inherit lib php;
-            enableBlackfire = false;
-          });
-        })
-      ];
-  };
+  # https://blog.eigenvalue.net/2023-nix2container-everything-once/
+  foldImageLayers =
+    let
+      mergeToLayer =
+        priorLayers: component:
+        assert builtins.isList priorLayers;
+        assert builtins.isAttrs component;
+        let
+          layer = nix2container.buildLayer (
+            component
+            // {
+              layers = priorLayers;
+            }
+          );
+        in
+        priorLayers ++ [ layer ];
+    in
+    layers: lib.foldl mergeToLayer [ ] layers;
 in
-  dockerTools.buildLayeredImage {
-    name = "icewind1991/haze";
-    tag = phpVersion;
-    maxLayers = 5;
-    fromImage = phpImage;
-    contents = [
-      tmpDir
-      bootstrap
-      configs
-      scripts
-      certificates
-      clamav-data
-      shadowSetupScript
-    ];
-    fakeRootCommands = ''
-      chmod 1777 tmp
-      chmod 1777 var/tmp
-      chmod 1777 var/run
-      chmod 1777 var/log/nginx
-      chmod 1777 var/cache/nginx
-      chmod 1777 var/spool
-      chmod -R 0755 etc/nc
-    '';
-    config = {
-      Cmd = [(getExe bootstrap)];
-      Env = [
-        "EDITOR=hx"
-        "WEBROOT=/var/www/html"
-        "HAZE_IMAGE_VERSION=${toString version}"
-      ];
-      WorkingDir = "/var/www/html";
-      Labels = {
-        "nl.icewind.haze.version" = toString version;
+nix2container.buildImage {
+  name = "icewind1991/haze";
+  tag = phpVersion;
+  layers = foldImageLayers [
+    {
+      copyToRoot = buildEnv {
+        name = "base";
+        paths = basePackages;
+        pathsToLink = [
+          "/bin"
+          "/sbin"
+          "/etc"
+          "/usr"
+          "/conf"
+        ];
       };
+    }
+    {
+      copyToRoot = buildEnv {
+        name = "php";
+        paths = phpPackages;
+        pathsToLink = [ "/bin" ];
+      };
+    }
+    {
+      copyToRoot = [
+        baseDirs
+        bootstrap
+        configs
+        scripts
+        certificates
+        shadowSetupScript
+      ];
+      perms = [
+        {
+          path = baseDirs;
+          regex = "/tmp|var/(tmp|run|log/nginx|cache/nginx|spool)";
+          mode = "0777";
+        }
+        {
+          path = baseDirs;
+          regex = "/etc/nc";
+          mode = "0755";
+        }
+      ];
+    }
+  ];
+  config = {
+    Cmd = [ (getExe bootstrap) ];
+    Env = [
+      "EDITOR=hx"
+      "WEBROOT=/var/www/html"
+      "HAZE_IMAGE_VERSION=${toString version}"
+    ];
+    WorkingDir = "/var/www/html";
+    Labels = {
+      "nl.icewind.haze.version" = toString version;
     };
-  }
+  };
+}