make-disk-image: allow pre/post format files in vm #778
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Enzime
reviewed
Sep 29, 2024
Mic92
reviewed
Jan 7, 2025
| type = lib.types.attrsOf (lib.types.either lib.types.str lib.types.path); | ||
| description = '' | ||
| Files to copy into the image builder VM before disko is run. | ||
| This is useful to provide secrets like LUKS keys, or other files you need for formatting. |
There was a problem hiding this comment.
Should we not have a disclaimer, that this leaks secrets into the nix store?
For image builder that runs outside of the nix store, we have a parameter that can be used instead.
There was a problem hiding this comment.
A warning that it could leak is probably a good idea.
But the second variant of passing a shell snippet should be usable without leaking secrets into the store? i.e.
preFormatFiles."/tmp/secret" = "cat /my-secret-out-side-nix store > $out" shouldn't leak. $out is just a tempfile here, see prepareFiles above.
phaer
commented
Jan 7, 2025
| example = lib.literalExpression '' | ||
| { | ||
| "/tmp/pre/file" = pkgs.writeText "foo" "bar"; | ||
| "/tmp/pre/script" = "mkdir -p $out/foo; echo bar > $out/foo"; |
There was a problem hiding this comment.
Suggested change
| "/tmp/pre/script" = "mkdir -p $out/foo; echo bar > $out/foo"; | |
| "/tmp/pre/script" = "mkdir -p $out; echo bar > $out/foo"; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
...via
disko.imageBuilder.preFormatFilesanddisko.imageBuilder.postFormatFiles.This enables users to add secrets to their diskoVMs.
diskoImageScriptsdoes include--pre-format-files, butdiskoImagesdidn't supportthe same feature so far - making it harder to pre-generate encrypted disk images or to test such images in a VM.