{"id":13443010,"url":"https://github.com/metacall/guix","last_synced_at":"2026-01-16T07:32:56.819Z","repository":{"id":64614925,"uuid":"209222193","full_name":"metacall/guix","owner":"metacall","description":"Docker image for using Guix in a CI/CD environment.","archived":false,"fork":false,"pushed_at":"2026-01-13T18:00:38.000Z","size":134,"stargazers_count":53,"open_issues_count":4,"forks_count":8,"subscribers_count":2,"default_branch":"master","last_synced_at":"2026-01-13T19:23:49.383Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://metacall.io","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/metacall.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-09-18T05:07:09.000Z","updated_at":"2026-01-13T17:30:27.000Z","dependencies_parsed_at":"2025-12-19T05:06:01.125Z","dependency_job_id":null,"html_url":"https://github.com/metacall/guix","commit_stats":null,"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/metacall/guix","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metacall%2Fguix","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metacall%2Fguix/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metacall%2Fguix/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metacall%2Fguix/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/metacall","download_url":"https://codeload.github.com/metacall/guix/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metacall%2Fguix/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28478047,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T06:30:42.265Z","status":"ssl_error","status_checked_at":"2026-01-16T06:30:16.248Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T03:01:54.759Z","updated_at":"2026-01-16T07:32:56.798Z","avatar_url":"https://github.com/metacall.png","language":"JavaScript","funding_links":[],"categories":["Dockerfile","Misc"],"sub_categories":["Issue tracker"],"readme":"# MetaCall Guix\n\nDocker image for using Guix in a CI/CD environment.\n\n## Design philosophy\n\nThe project is designed in the following way:\n\n  - **Guix runs deamonless**: The container has an entry point that allows you to run commands per instance of the command, the daemon is shutdown for each command or group of commands executed. You can group them by passing a script and executing it or running the image interactively and pass multiple commands.\n\n  - **Versions are fixed**: We provide a fixed channel commit into `https://codeberg.org/guix` repository, if you want to patch the `channels.scm` you can find them on `/root/.config/guix/channels.scm`. By default if you do `guix pull` it will always pull to the same commit and not to the latest.\n\n  - **Incrementally builds and tarballs for all architectures**: In order to avoid CI slowness, we build and cache incrementally our own versions of Guix, snapshots are done periodically to the upstream repository in master branch. They are tagged in the following way: `v20260106` for 6th of January of 2026. The binaries are pushed into releases that later on the CI reuses for building the next version so builds are cached in each iteration.\n\n  - **Default list of substitutes**: In order to improve performance, we provide a long list of substitutes a part from the official servers. You can modify them, check the substitute section for doing so.\n\n  - **Report errors in-place**: If your command fails, we copy all the `*.drv.gz` files into the current directory, we unpack them and then we show the contents. By default the working directory of the image is root `/`, so all contents will be put there in case of error. In addition to this, all commands are always traced and printed to stdout with `set -exuo pipefail`, so it can be easily debugged later on and errors are not silently skipped.\n\nAll these design decisions are taken because we focus only on providing CI/CD environment. If you want to use this as a normal end user, take it carefully. You can still modify those behaviors easily but those assumptions are taken due to nature of CI/CD itself. In the future we may make it more customizable for end users.\n\nThe main objective of this repository is to have a tool for producing ultra portable, reproducible and cross-platform builds for production ready applications that can be installed from a shell script or uncompressing them into root.\n\n## How to use it\n\nThis image encapsulates the Guix daemon. You can view the image details and tags in [DockerHub](https://hub.docker.com/r/metacall/guix). For now, Guix does not have a daemonless option, so packaging it into a Docker image has some implications. The Guix daemon needs to fork, and forking a process during build phase is not allowed, so we have to work with it in a different way. There are two options:\n\n1. Running the build with Docker, using the `--privileged` flag and commiting the result on each step. For example, imagine we have the following `Dockerfile`:\n\n   ```docker\n   FROM metacall/guix:latest AS example\n\n   # Copy some dependencies\n   COPY . .\n   ```\n\n   Now we can build the image `metacall/example` with docker run + commit:\n\n   ```sh\n   # Build the base image\n   docker build -t metacall/example -f Dockerfile .\n   # Run a guix pull\n   docker run --privileged --name tmp metacall/example sh -c 'guix pull'\n   # Commit changes\n   docker commit tmp metacall/new-image \u0026\u0026 docker rm -f tmp\n   # Install some package\n   docker run --privileged --name tmp metacall/example sh -c 'guix package -i guile'\n   # Commit changes\n   docker commit tmp metacall/example \u0026\u0026 docker rm -f tmp\n   # Push the final image\n   docker push metacall/example\n   ```\n\n   A complete working example used in production can be found here: https://github.com/metacall/distributable-linux\n\n2. Running the build with BuildKit using the buildx extension for Docker (like how it is done in this repository: https://github.com/metacall/guix/blob/e9a0e791af919ddf74349cdbb11acc325ee1b48b/Dockerfile#L73). BuildKit allows to pass extra arguments to the `RUN` command in the Dockerfile. With the `--security=insecure` flag we can allow Docker to fork while it is building. For supporting insecure builds, you have to use any docker syntax extension that uses `experimental` or `labs` suffix, like `# syntax=docker/dockerfile:1.1-experimental` or `# syntax=docker/dockerfile:1.4-labs`, because this feature is not standardized yet. The previous example can be transformed into this:\n\n   ```docker\n   # syntax=docker/dockerfile:1.4-labs\n\n   FROM metacall/guix:latest AS example\n\n   # Copy some dependencies\n   COPY . .\n\n   # Run guix pull and install dependencies\n   RUN --security=insecure sh -c '/entry-point.sh guix pull' \\\n       \u0026\u0026 sh -c '/entry-point.sh guix package -i guile'\n   ```\n\n   For building this image we need Docker `v19.03` or superior and the buildx plugin:\n\n   ```sh\n   # Install the buildx plugin\n   docker build --platform=local -o . git://github.com/docker/buildx\n   mkdir -p ~/.docker/cli-plugins/\n   mv buildx ~/.docker/cli-plugins/docker-buildx\n   ```\n\n   If you have it already installed, we need to create an insecure builder (this must be run only once):\n\n   ```sh\n   # Create an insecure builder\n   docker buildx create --use --name insecure-builder --buildkitd-flags '--allow-insecure-entitlement security.insecure'\n   ```\n\n   Finally, for building the `Dockerfile` with the already created insecure builder, we have to run this command:\n\n   ```sh\n   # Build and push the image with buildx\n   docker buildx build -t metacall/example -o type=registry --allow security.insecure .\n   ```\n\n## Building the image locally\n\nFor building it, we use `buildx` from Buildkit:\n\n```sh\n# Run the following command the first time only\ndocker buildx create --use --name insecure-builder --buildkitd-flags '--allow-insecure-entitlement security.insecure'\n# Build the Guix image with the following command\ndocker buildx build --load -t metacall/guix --allow security.insecure --build-arg METACALL_GUIX_ARCH=\"x86_64-linux\" .\n```\n\n## Running the image\n\nFor running the image interactively from command line:\n\n```sh\ndocker run --rm --privileged -it metacall/guix\n```\n\nThis will give you a prompt where you can write guix commands and execute them directly:\n\n```sh\nguix pull\n```\n\nIf you prefer to have a bash prompt instead, do this:\n\n```sh\ndocker run --rm --privileged --entrypoint bash -it metacall/guix\n```\n\nThen execute guix commands like this:\n\n```sh\n/entry-point.sh guix pull\n```\n\n## Building and running for other architectures\n\nFor building you need to follow the following table:\n\n| Docker Platform (--platform) | Guix Architecture String |\n| ---------------------------- | ------------------------ |\n| linux/amd64                  | x86_64-linux             |\n| linux/386                    | i686-linux               |\n| linux/arm/v7                 | armhf-linux              |\n| linux/arm64/v8               | aarch64-linux            |\n| linux/ppc64le                | powerpc64le-linux        |\n| linux/riscv64                | riscv64-linux            |\n\nYou will need the following for building and runnig:\n\n```sh\n# Required for building:\ndocker run --privileged --rm tonistiigi/binfmt --install all\n# Required for running:\ndocker run --rm --privileged multiarch/qemu-user-static --reset -p yes\n```\n\nNow you can build for some architecture, `linux/386` for example:\n\n```sh\n# Build the Guix image with the following command\ndocker buildx build --load -t metacall/guix --platform linux/386 --allow security.insecure --build-arg METACALL_GUIX_ARCH=\"i686-linux\" .\n```\n\n## Adding substitute servers\n\nAdd all your substitutes public keys in the [substitutes](./substitutes) folder, they must end with `.pub` extension.\nLater on add the URL of your substitute server in `SUBSTITUTE_URLS` list on [scripts/entry-point.sh](./scripts/entry-point.sh).\n\n## Troubleshooting\n\nIn case of an error of any kind.\n\n### Disk issues with `armhf-linux` / `linux/arm/v7`\n\nWhen doing `guix pull`, you will get the following error:\n\n```sh\nguix pull: error: Git error: could not read directory '/root/.cache/guix/checkouts/lmgz3ewobtxzz4rsyp72z7woeuxeghzyukvmmnxlwpobu76yyi5a/.git/refs': Value too large for defined data type\n```\n\nThis happens because there is a mismatch in inodes between 32 and 64-bits. The only way to workaround this is to use `tmpfs` for storing the checkouts of Guix, or any other alternative volume that supports 64-bit inodes, for example binding the volume into the host if you are running a 64-bit host. We do this at build time with the following instruction:\n\n```docker\nRUN --security=insecure --mount=type=tmpfs,target=/root/.cache/guix \\\n\tsh -c '/entry-point.sh guix pull'\n```\n\nSimilarly, for doing it at runtime:\n```sh\ndocker run --privileged --platform linux/arm/v7 -it \\\n\t--mount type=tmpfs,target=/root/.cache/guix \\\n\tmetacall/guix guix pull\n```\n\nIf you want to keep the cache of the `guix pull` command (normally stored in `XDG_CACHE_HOME` environment variable, by default set to `$HOME/.cache`), you can use this method:\n\n```docker\nRUN --security=insecure --mount=type=tmpfs,target=/tmp/.cache \\\n\t\u0026\u0026 mkdir -p /tmp/.cache /root/.cache \\\n\t\u0026\u0026 export XDG_CACHE_HOME=/tmp/.cache \\\n\t\u0026\u0026 sh -c '/entry-point.sh guix pull' \\\n\t\u0026\u0026 cp -a /tmp/.cache/. /root/.cache/\n```\n\nThis will store the cache in the default folder, speeding up next pulls.\n\n### Granting entitlement\n\nIf you get the following error:\n\n```sh\nerror: failed to solve: granting entitlement security.insecure is not allowed by build daemon configuration\n```\n\nRun:\n\n```sh\n# This will select the insecure-builder previously created if it got unselected for some reason\ndocker buildx use insecure-builder\n```\n\n### Running a docker image in another platform fails\n\nIf you get the following error:\n\n```sh\ndocker run --rm --privileged --platform linux/arm/v7 --entrypoint bash -it metacall/guix\nstandard_init_linux.go:228: exec user process caused: exec format error\n```\n\nRun this first:\n\n```sh\ndocker run --rm --privileged multiarch/qemu-user-static --reset -p yes\n```\n\n## Use cases\n\n[`MetaCall Guix GCC Example`](https://github.com/metacall/guix-gcc-example): This repository demonstrates how to use MetaCall Guix Docker Image for building portable self contained packages, in this case GCC@2.95. The idea of this repository is to make a Proof of Concept for Blink Virtual Machine by using GCC and possibly try to do the same with MetaCall in the near future.\n\n[`MetaCall Linux Distributable`](https://github.com/metacall/distributable-linux): This repository provides a self-contained and portrable version of MetaCall Core for Linux.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmetacall%2Fguix","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmetacall%2Fguix","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmetacall%2Fguix/lists"}