core/pkgs/build-support/oci-tools/default.nix

{
  lib,
  writeText,
  runCommand,
  writeClosure,
}:

{
  buildContainer =
    {
      args,
      mounts ? { },
      os ? "linux",
      arch ? "x86_64",
      readonly ? false,
    }:
    let
      sysMounts = {
        "/proc" = {
          type = "proc";
          source = "proc";
        };
        "/dev" = {
          type = "tmpfs";
          source = "tmpfs";
          options = [
            "nosuid"
            "strictatime"
            "mode=755"
            "size=65536k"
          ];
        };
        "/dev/pts" = {
          type = "devpts";
          source = "devpts";
          options = [
            "nosuid"
            "noexec"
            "newinstance"
            "ptmxmode=0666"
            "mode=755"
            "gid=5"
          ];
        };
        "/dev/shm" = {
          type = "tmpfs";
          source = "shm";
          options = [
            "nosuid"
            "noexec"
            "nodev"
            "mode=1777"
            "size=65536k"
          ];
        };
        "/dev/mqueue" = {
          type = "mqueue";
          source = "mqueue";
          options = [
            "nosuid"
            "noexec"
            "nodev"
          ];
        };
        "/sys" = {
          type = "sysfs";
          source = "sysfs";
          options = [
            "nosuid"
            "noexec"
            "nodev"
            "ro"
          ];
        };
        "/sys/fs/cgroup" = {
          type = "cgroup";
          source = "cgroup";
          options = [
            "nosuid"
            "noexec"
            "nodev"
            "relatime"
            "ro"
          ];
        };
      };
      config = writeText "config.json" (
        builtins.toJSON {
          ociVersion = "1.0.0";
          platform = {
            inherit os arch;
          };

          linux = {
            namespaces = map (type: { inherit type; }) [
              "pid"
              "network"
              "mount"
              "ipc"
              "uts"
            ];
          };

          root = {
            path = "rootfs";
            inherit readonly;
          };

          process = {
            inherit args;
            user = {
              uid = 0;
              gid = 0;
            };
            cwd = "/";
          };

          mounts = lib.mapAttrsToList (
            destination:
            {
              type,
              source,
              options ? null,
            }:
            {
              inherit
                destination
                type
                source
                options
                ;
            }
          ) sysMounts;
        }
      );
    in
    runCommand "join" { } ''
      set -o pipefail
      mkdir -p $out/rootfs/{dev,proc,sys}
      cp ${config} $out/config.json
      xargs tar c < ${writeClosure args} | tar -xC $out/rootfs/
    '';
}