Minimal ipset docker image

gista-file

{ pkgs ? import <nixpkgs> {}  # you might want to pin it to specific revision
                              # to make it reproducible.
}:

let

    # docs about dockerTools.buildImage are in the manual here:
    # http://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools
  mkDocker = ipset: pks.dockerTools.buildImage {

    # whatever you want to call this image
    name = "ipset";

    # tag is set to <ipset-version>-<nixpkgs-hash> but it can be ofcourse
    # anything
    tag = "${ipset}-${pkgs.lib.nixpkgsVersion}";

    # here we tell that we want to build from "scratch", and only dependencies of
    # contents (defined in the next line) will be added to the docker image.  you
    # will end up with a image that includes only things you need.
    fromImage = null;

    # list of packages you want to include in docker
    contents =
      [ ipset
      # ... more packages
      ];

    # config is used to specify the configuration of the containers that will be
    # started off the built image in Docker. The available options are listed in
    # the Docker Image Specification v1.0.0 .
    # https://github.com/docker/docker/blob/master/image/spec/v1.md#container-runconfig-field-descriptions
    config = {
      Cmd = [ "/bin/ipset" "...." ];
      WorkingDir = "/data";
      Volumes = {
        "/data" = {};
      };
    };
  };

  # function which builds different version of ipset
  mkIpset = version: hash: pkgs.ipset.overrideDerivation (old: {
    name = "ipset-${version}";
    src = pkgs.fetchurl {
      url = "http://ipset.netfilter.org/ipset-${version}.tar.bz2";
      sha256 = hash;
    };
  });

# attribute set (aka dict) of all docker images with different ipset version
# you can build all images with simple doing "nix-build default.nix"
# or building specific image with "nix-buils default.nix -A debian_testing
in {
  latest = mkDocker pkgs.ipset;
  debian_testing = mkDocker (mkIpset "1.1.3" "somehash")
}