Make it easy to create docker images with Nix

[tobim]

This can be used with

nix run .#stream-image | docker load

It reuses the regular static binary output so it won't rebuild VAST if the static binary is already available.

According to docker image ls the resulting image weighs 117 Mb,
significantly lighter than the Debian based image which is ~330 Mb.

[dominiklohmann]

This is not a drop-in replacement for the existing tenzir/vast image, right?

[dit7ya]

Tried testing it with

➜ nix run github:tenzir/vast/topic/flake-docker-image#stream-image | docker load

but

➜ docker run -dt --name=vast --rm tenzir/vast start
f2d5f2f1ece9b652cd6b5c8d52c31319b2dcc764deaec28a6e3fd89525bb548f
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "start": executable file not found in $PATH: unknown.

Probably due to NixOS/nixpkgs#99760

Edit: See suggestion below.

[tobim]

This is not a drop-in replacement for the existing tenzir/vast image, right?

With the config changes I just added there are only 3 remaining differences:

1. The container doesn't have any applications besides VAST, so no bash, coreutils, etc. This is not a problem because you should use nsenter for inspection / debugging anyways.
2. We use the static binary to build this container, so injecting additional plugins via bind-mount is not possible. (I don't think anybody does this yet).
3. When built remotely aka nix run github:tenzir/vast#stream-image Nix will use the archived version of the sources, meaning it will only have the fallback version number. We can add support for our versioning theme with nix run git+https://github.com/tenzir/vast#stream-image, but not the former.

[GTrunSec]

if you want to drop the existing tenzir/vast image, I would recommend using the nix2container as an image builder instead. smaller granularity -> example？ also tested with the podman.

[dit7ya]

I tested nix2container for this PR locally, the size was not smaller, but the build time was faster though.

[dominiklohmann]

I don't think we want to drop the regular image, as that supports mounting in additional plugins. This one doesn't. I'm still all for calling this vast-slim.

[dominiklohmann]

From my point of view this is all good to go. @tobim, please take a look through the changes I've made before merging.

The change request was implemented