Images and tags
CI builds Nix's images in .github/workflows/ci-images.yml on every push to main, and on demand.
Image | Contents |
|---|---|
| Core |
| Core's database migrations |
| The collaboration service, and its document migration command |
| The Go worker binary for every role |
| The web app and Caddy |
| The sites build worker and the sites serving process |
|
|
Tags#
Every image is tagged with the full 40-character commit SHA it was built from, and published as ghcr.io/<owner>/nix/<image>:<full-commit-sha>. There is no latest or other moving tag. A deployment names exactly one commit, and the manifest and scripts you run must come from that same commit.
Architectures#
Each image is built natively on an amd64 runner and an arm64 runner, and the two are joined into one multi-architecture manifest. The same tag runs on an x86 server and on an ARM board.
Rebuilding only what changed#
A planning step works out which images' inputs changed in a commit. Only those are rebuilt; the others are re-tagged from the previous build with the new SHA, so every commit still has a complete set.
Building your own#
You do not need to build images to run Nix. If you want to, deploy/compose/build.sh <ref> builds local images from a clean git archive of a commit for use with NIX_IMAGE_REGISTRY=localhost/nix, and deploy/docker/build-and-push.sh builds and pushes all seven to your own registry for Kubernetes. Do not build images on a production host as a routine release step.