Consider the following Rust app
fn main() -> Result<(), Box<dyn Error>> {
process::Command::new("echo").arg("hello")
.status()?;
}
and container
docker = pkgs.dockerTools.buildImage {
name = "my-app";
tag = "latest";
# everything in this is *copied* to the root of the image
contents = [
self.app
pkgs.glibc
pkgs.coreutils
pkgs.runtimeShellPackage
];
# run unprivileged with the current directory as the root of the image
extraCommands = ''
#!${pkgs.runtimeShell}
mkdir -p /tmp
'';
# Docker settings
config = {
Cmd = [ "app" ];
Volumes = {
"/tmp" = { };
};
};
};
where app is the derivation of the rust app.
nix build -j auto ".#docker" && docker image load -i result;
so far so good. But then!
docker run -it my-app
Fails with
Error: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" }
error: Operation not permitted
Whaaat? docker run -it dots-docker echo hello works just fine! binary works fine out of the container. Executable bit is definitely set.
This could be a docker problem (or rust), but I have a sneaking suspicion it’s a library mapping issue? Something is obviously wrong here, and just wanted to probe for ideas. Let me know if this is enough for replication. Is there something obvious going on? Happy to hear your thoughts.