Update a Docker image via a Nix flake input

flake.nix

{
  inputs = {
    # redis:latest
    # We need to specify `page_size=1` as we're otherwise given a random order of previous tags.
    docker-redis = {
      url = "https://registry.hub.docker.com/v2/repositories/library/redis/tags?page_size=1&tag=latest";
      flake = false;
    };
  };
}

horrors.nix

{ inputs, pkgs, ... }:
let
  latestImageTag = { name, input }:
    let
      # The tags API can support multiple results, but we should only have one.
      manifestJSON = builtins.fromJSON (builtins.readFile input.outPath);
      firstResult = builtins.head manifestJSON.results;
      # Our digest is already in form of `sha256:[...]`!
      digest = firstResult.digest;
    in
    # e.g. `redis@sha256:878983f8f5045b28384fc300268cec62bca3b14d5e1a448bec21f28cfcc7bf78`
    "${name}@${digest}";
in
{
  virtualisation.oci-containers.containers = {
    redis = {
      image = latestImageTag {
        name = "redis";
        input = inputs.docker-redis;
      };
      
      # [...]
    };
  };
}