docker-nixuser: Instructions file for Codex

Development Guide

NOTE: Keep it updated with the most useful non-trivial dev info. Keep it minimal.

CI Publishing (CRITICAL)

The publish job runs on v* tag push (push: tags: ['v*']), not on push to master. Push to master only runs build (test, no ghcr.io push). To publish:

git tag vX.Y.Z && git push origin vX.Y.Z

Note: Uses push: tags trigger, not create event — git push --tags triggers it reliably. The tag triggers both build and publish jobs. The publish job builds amd64 + arm64, pushes platform-specific images, then creates multi-arch manifests (version + latest).

Multi-Platform CI Builds

The CI workflow builds Docker images for:

• linux/amd64 (x86_64)
• linux/arm64 (aarch64) — built via Nix --system aarch64-linux with QEMU emulation

Multi-platform images use Docker manifests. Platform-specific images are tagged as:

• ghcr.io/grigio/docker-nixuser:TAG-amd64
• ghcr.io/grigio/docker-nixuser:TAG-arm64

Arm64 builds use docker/setup-qemu-action for QEMU binfmt registration, allowing Nix to cross-build for aarch64-linux on amd64 runners via nix build .#default --system aarch64-linux.

Arm64 testing in CI uses docker run --platform linux/arm64 (relies on QEMU binfmt from docker/setup-qemu-action for transparent emulation).

Flake Auto-Update

The flake-update-check.yml workflow runs weekly (Sunday 2 AM UTC) and:

1. Checks if flake.lock is up to date
2. Updates GitHub status check
3. Automatically creates a pull request if updates are available

Docker Image

The project creates a Docker image with Nix package manager running as non-root user nixuser.

Build

nix --extra-experimental-features 'nix-command flakes' build .#default

Load Image

docker load < result

Run Container

docker run -it nix-nixuser:latest

Test Nix Installation

docker run --rm nix-nixuser:latest sh -c 'whoami && nix profile add nixpkgs#hello && hello'

Expected output:

nixuser
Hello, world!