I'm trying to build a simple docker image as mentioned here http://lethalman.blogspot.com/2016/04/cheap-docker-images-with-nix_15.html, but it seems there is no network/internet access in the build step. Is this a limitation? Is there a workaround?

{ pkgs ? import <nixpkgs> {} }:

with pkgs;
  entrypoint = writeScript "entrypoint.sh" ''
    set -e
    exec "$@"
dockerTools.buildImage {
  name = "test";
  runAsRoot = ''
    curl google.com

  contents = [ busybox bash curl ];

  config = {
    Cmd = [ "bash" ];
    Entrypoint = [ entrypoint ];
    #ExposedPorts = {
      #"6379/tcp" = {};
    WorkingDir = "/data";
    #Volumes = {
      #"/data" = {};

Curl fails with curl: (6) Could not resolve host: google.com. This also does not work in I use an IP instead (to avoid DNS). Full output:

nix build --no-substitute
builder for '/nix/store/6md5l4lhk4kb5i8b3sp7w3q5v1nd83m2-docker-layer-test.drv' failed with exit code 6; last 10 log lines:
  Writing superblocks and filesystem accounting information: done

  Executing pre-mount steps...
  Adding contents...
  Adding /nix/store/xhwhakb1zcf5wl2a8575gcrnmbbqihm2-busybox-1.30.1...
  Adding /nix/store/rm1hz1lybxangc8sdl7xvzs5dcvigvf7-bash-4.4-p23...
  Adding /nix/store/a7i4hha4gh7fsbw7bfz51l2dkhgvb59a-curl-7.65.3-bin...
  Executing post-mount steps...
  curl: (6) Could not resolve host: google.com
  [    3.476402] reboot: Power down
cannot build derivation '/nix/store/k4dz6c5xv1p430wai75yigmmw8yn9kzy-docker-layer-test.drv': 1 dependencies couldn't be built
cannot build derivation '/nix/store/pk4s3nzdv3kd2gxfqr72bimvvam7h469-docker-image-test.tar.gz.drv': 1 dependencies couldn't be built
[1 built (1 failed)]
error: build of '/nix/store/pk4s3nzdv3kd2gxfqr72bimvvam7h469-docker-image-test.tar.gz.drv' failed
  • As far as I know, network access is not available to build scripts. Instead you have to define what needs to be downloaded (known as sources) so that Nix can download them for you. What are you trying to do with this Docker container? – Emmanuel Rosa May 25 '20 at 11:18
  • Originally wanted to run a PHP related command that installs a PHP library from packagist. There is composor2nix but I also had issues with that. So I suppose this just has some limitations after all. Probably best to just use this to create a base image and run an additional Dockerfile ontop. – Chris Stryczynski May 25 '20 at 11:59
  • There's a hack which allows you to make a derivation that has network access. I've used it to build Java packages with Gradle. Basically, it's an additional derivation that has some additional attributes set, which allow the build script to access the network. Here's an example: github.com/emmanuelrosa/nixpkgs/commit/… In this example, the deps derivation has network access. – Emmanuel Rosa May 25 '20 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.