nixpkgs/pkgs/build-support/oci-tools/default.nix

{ lib, writeText, runCommand, writeClosure }:

{
  buildContainer =
    { args
    , mounts ? {}
    , os ? "linux"
    , arch ? "x86_64"
    , readonly ? false
    }:
  let
    sysMounts = {
      "/proc" = {
        type = "proc";
        source = "proc";
      };
      "/dev" = {
        type = "tmpfs";
        source = "tmpfs";
        options = [ "nosuid" "strictatime" "mode=755" "size=65536k" ];
      };
      "/dev/pts" = {
        type = "devpts";
        source = "devpts";
        options = [ "nosuid" "noexec" "newinstance" "ptmxmode=0666" "mode=755" "gid=5" ];
      };
      "/dev/shm" = {
        type = "tmpfs";
        source = "shm";
        options = [ "nosuid" "noexec" "nodev" "mode=1777" "size=65536k" ];
      };
      "/dev/mqueue" = {
        type = "mqueue";
        source = "mqueue";
        options = [ "nosuid" "noexec" "nodev" ];
      };
      "/sys" = {
        type = "sysfs";
        source = "sysfs";
        options = [ "nosuid" "noexec" "nodev" "ro" ];
      };
      "/sys/fs/cgroup" = {
        type = "cgroup";
        source = "cgroup";
        options = [ "nosuid" "noexec" "nodev" "relatime" "ro" ];
      };
    };
    config = writeText "config.json" (builtins.toJSON {
      ociVersion = "1.0.0";
      platform = {
        inherit os arch;
      };

      linux = {
        namespaces = map (type: { inherit type; }) [ "pid" "network" "mount" "ipc" "uts" ];
      };

      root = { path = "rootfs"; inherit readonly; };

      process = {
        inherit args;
        user = { uid = 0; gid = 0; };
        cwd = "/";
      };

      mounts = lib.mapAttrsToList (destination: { type, source, options ? null }: {
        inherit destination type source options;
      }) sysMounts;
    });
  in
    runCommand "join" {} ''
      set -o pipefail
      mkdir -p $out/rootfs/{dev,proc,sys}
      cp ${config} $out/config.json
      xargs tar c < ${writeClosure args} | tar -xC $out/rootfs/
    '';
}