Can nix-ld be used in docker image created with nix2container?

[nxy7]

Hi, I'm trying to create minimal docker image, that can run binaries. I've created repo @ https://github.com/nxy7/tiny and published this image to docker hub (in case anyone wants to test it) as nxyt/tiny:latest. Anyway - it doesn't work and any binary I run results in bash: ./main: cannot execute: required file not found.
As far as I understand binaries expect linker at specific location, so even if ldd my-binary shows that all dependencies are present it still tries to call linker at /lib64/xxx and because there's none, that's why my binaries are failing.

If I got that right, that's the problem that nix-ld is trying to solve, but I cannot really get that to work with nix2container.
What I've tried was adding nix_ld to copyToRoot and adding 'lib' and 'lib64' to 'pathsToLink' and I've also added NIX_LD env variable, but that still doesn't work.

Can nix-ld be used to fix that error, or is it made only for NixOS? Any guidance toward getting that to work would be great :-)

[Mic92]

Should work for containers as well - also you could probably just copy the real thing in if it's just scoped for smaller well scoped projects -> the actual glibc ld.so and set LIBRARY_PATH directly. Using that in copyToRoot might work (untested)?

    nix-ld = let
         libDir = if builtins.elem stdenv.system [ "x86_64-linux" "mips64-linux" "powerpc64le-linux" ]
           then "/lib64"
           else "/lib";

    in pkgs.runCommand "nix-ld" {} ''
      install -D -m755 ${pkgs.nix-ld}/libexec/nix-ld ${libDir}/$(basename ${pkgs.stdenv.cc.bintools.dynamicLinker})
    '';

I am not sure if copyToRoot works well with symlinks, so I used install again which always should work.
Make sure you have a valid file afterwards in /lib64 and that your NIX_LD_LIBRARY_PATH is set for real. Otherwise @nlewo is a better person to ask about nix2container details

[anttiharju]

Thank you both! I was working on producing a container image to be used in GitHub Actions generated from flake.nix and the advice here was exactly what was needed to get the unpatched node binaries that GitHub Actions mounts into the container to work!

More context at anttiharju/vmatch@27e385f