refactor(docker): respect image settings, use vals, customizable registry protocol by yajo · Pull Request #128 · hall/kubenix

yajo · 2026-03-02T13:11:04Z

refactor(docker): respect image settings, use vals, customizable registry protocol

This is a bunch of fixes together to cover a single use case, the one expressed in the included test: multiple images pushed to different destinations with a single script.

Image registry, name and tag can use vals, just like the rest of Kubenix, to expand dynamic or secret references on run time.

BREAKING CHANGE: docker.copyScript now puts a binary inside $out/bin/kubenix-push-images. The benefit is that now you can just nix run .#kubenix.config.docker.copyScript, which is more ergonomic.

BREAKING CHANGE: Registry definitions, which were never a URL, are no longer set in a url option. Instead of using docker.registry.url and docker.images.*.registry options are now consolidated into [docker.registry|docker.images.*.registry].registry.{protocol,host}, which behave as you'd expect.

BREAKING CHANGE: docker.copyScript push images to docker.images.*.uri instead of a handmade combination of the imageName and imageTag passthru attributes of the docker.images.*.image derivation.

@moduon MT-1075

…stry protocol This is a bunch of fixes together to cover a single use case, the one expressed in the included test: multiple images pushed to different destinations with a single script. Image registry, name and tag can use `vals`, just like the rest of Kubenix, to expand dynamic or secret references on run time. BREAKING CHANGE: `docker.copyScript` now puts a binary inside `$out/bin/kubenix-push-images`. The benefit is that now you can just `nix run .#kubenix.config.docker.copyScript`, which is more ergonomic. BREAKING CHANGE: Registry definitions, which were never a URL, are no longer set in a `url` option. Instead of using `docker.registry.url` and `docker.images.*.registry` options are now consolidated into `[docker.registry|docker.images.*.registry].registry.{protocol,host}`, which behave as you'd expect. BREAKING CHANGE: `docker.copyScript` push images to `docker.images.*.uri` instead of a handmade combination of the `imageName` and `imageTag` passthru attributes of the `docker.images.*.image` derivation. @moduon MT-1075

adrian-gierakowski

BREAKING CHANGE: docker.copyScript now puts a binary inside $out/bin/kubenix-push-images. The benefit is that now you can just nix run .#kubenix.config.docker.copyScript, which is more ergonomic.

What did it do previously?

Can we avoid the other breaking changes?

adrian-gierakowski · 2026-03-14T08:03:41Z

+      runtimeInputs = [
+        pkgs.gzip
+        pkgs.skopeo
+        pkgs.vals


Can we hide the use of vals behind a flag? I personally don't use them and would prefer not to be force to download this dep

I do use vals to be able to generate a URI that:

Can be generated in pure nix.

Can be escaped in Bash.

Can be filled at runtime automatically.

My use case is a docker image pushed with a variable name that depends on the pipeline I'm running to push it. Example: docker.io/img:pipeline-1234

If you have another suggestion to get that, I can change it. But if the concern is just disk space, keep in mind you already have vals if you use kubenix for k8s:

kubenix/pkgs/kubenix.nix

Line 30 in 4b46e69

runtimeInputs = [ vals kubectl ];

So you won't be saving any disk space by removing vals, unless you don't use kubenix for k8s.

unless you don't use kubenix for k8s

Yeah, I don't use kubenix to deploy, I render manifests into a repo and use agrocd to deploy. Would appreciate if you could add a flag which could be used to disable vals, thanks!

adrian-gierakowski · 2026-03-14T08:05:42Z

-    registryUrl = mkOption {
-      description = "Docker registry url";
+    registryHost = mkOption {
+      description = "Docker registry host";


Can we keep url for backwards compat. Make it optional, and use it with default protocol ("docker://") when set?

please document this in change-log, thanks!

yajo

BREAKING CHANGE: docker.copyScript now puts a binary inside $out/bin/kubenix-push-images. The benefit is that now you can just nix run .#kubenix.config.docker.copyScript, which is more ergonomic.

What did it do previously?

Before:

nix build .#kubenix.config.docker.copyScript && ./result

After:

nix run .#kubenix.config.docker.copyScript

Which is equivalent to:

nix build .#kubenix.config.docker.copyScript && ./result/bin/kubenix-push-images

Can we avoid the other breaking changes?

It's a bit difficult because the feature was broken before. Even if you set the image and tag in kubenix, those would be ignored when pushing, and instead the imageName and imageTag attrs of the package were used.

yajo · 2026-03-16T10:12:35Z

+      runtimeInputs = [
+        pkgs.gzip
+        pkgs.skopeo
+        pkgs.vals


I do use vals to be able to generate a URI that:

Can be generated in pure nix.

Can be escaped in Bash.

Can be filled at runtime automatically.

My use case is a docker image pushed with a variable name that depends on the pipeline I'm running to push it. Example: docker.io/img:pipeline-1234

If you have another suggestion to get that, I can change it. But if the concern is just disk space, keep in mind you already have vals if you use kubenix for k8s:

kubenix/pkgs/kubenix.nix

Line 30 in 4b46e69

runtimeInputs = [ vals kubectl ];

So you won't be saving any disk space by removing vals, unless you don't use kubenix for k8s.

adrian-gierakowski · 2026-03-21T07:32:48Z

BREAKING CHANGE: docker.copyScript now puts a binary inside $out/bin/kubenix-push-images. The benefit is that now you can just nix run .#kubenix.config.docker.copyScript, which is more ergonomic.

What did it do previously?

Before:
nix build .#kubenix.config.docker.copyScript && ./result
After:
nix run .#kubenix.config.docker.copyScript
Which is equivalent to:
nix build .#kubenix.config.docker.copyScript && ./result/bin/kubenix-push-images
Can we avoid the other breaking changes?

It's a bit difficult because the feature was broken before. Even if you set the image and tag in kubenix, those would be ignored when pushing, and instead the imageName and imageTag attrs of the package were used.

thanks, makes sense
could you please create an entry in the change log with migration instructions, assuming people used to rely on imageName and imageTag attrs of the package? We could even include a module which people could import to automatically set image and tag in kubenix from imageName and imageTag attrs of the package. Thanks!

adrian-gierakowski · 2026-03-21T07:29:10Z

+      runtimeInputs = [
+        pkgs.gzip
+        pkgs.skopeo
+        pkgs.vals


unless you don't use kubenix for k8s

Yeah, I don't use kubenix to deploy, I render manifests into a repo and use agrocd to deploy. Would appreciate if you could add a flag which could be used to disable vals, thanks!

Summary of changes: 1. **CHANGELOG.md** - Added migration instructions for breaking changes 2. **modules/docker-image-from-package.nix** - Migration module that: - Maps `docker.registry.url` to `docker.registry.host` 3. **modules/docker.nix** - Added `useVals` and `copyScriptArgs` options 4. **lib/docker/default.nix** - Added `useVals` parameter to conditionally skip `vals` expansion, and added SC2046 to excluded shell checks 5. **tests/docker/image-from-package.nix** - Test for the migration module 6. **flake.nix** - Added the new test to the checks

yajo · 2026-03-26T11:21:03Z

Please check now.

adrian-gierakowski · 2026-03-26T15:23:00Z

Thanks @yajo!

yajo force-pushed the fix-images-push branch 5 times, most recently from 56e5b83 to aa9b5d6 Compare March 4, 2026 11:01

yajo force-pushed the fix-images-push branch from aa9b5d6 to 15725c3 Compare March 6, 2026 07:43

adrian-gierakowski reviewed Mar 14, 2026

View reviewed changes

yajo commented Mar 16, 2026

View reviewed changes

adrian-gierakowski requested changes Mar 21, 2026

View reviewed changes

yajo force-pushed the fix-images-push branch from bb33dc9 to f68f573 Compare March 26, 2026 11:20

adrian-gierakowski approved these changes Mar 26, 2026

View reviewed changes

adrian-gierakowski merged commit c402968 into hall:main Mar 26, 2026
1 check passed

yajo deleted the fix-images-push branch March 27, 2026 07:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(docker): respect image settings, use vals, customizable registry protocol#128

refactor(docker): respect image settings, use vals, customizable registry protocol#128
adrian-gierakowski merged 2 commits into
hall:mainfrom
moduon:fix-images-push

yajo commented Mar 2, 2026 •

edited

Loading

Uh oh!

adrian-gierakowski left a comment

Uh oh!

adrian-gierakowski Mar 14, 2026

Uh oh!

yajo Mar 16, 2026

Uh oh!

adrian-gierakowski Mar 21, 2026

Uh oh!

adrian-gierakowski Mar 14, 2026

Uh oh!

adrian-gierakowski Mar 21, 2026

Uh oh!

yajo left a comment

Uh oh!

yajo Mar 16, 2026

Uh oh!

adrian-gierakowski commented Mar 21, 2026

Uh oh!

adrian-gierakowski Mar 21, 2026

Uh oh!

yajo commented Mar 26, 2026

Uh oh!

Uh oh!

adrian-gierakowski commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

yajo commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adrian-gierakowski left a comment

Choose a reason for hiding this comment

Uh oh!

adrian-gierakowski Mar 14, 2026

Choose a reason for hiding this comment

Uh oh!

yajo Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-gierakowski Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-gierakowski Mar 14, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-gierakowski Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo left a comment

Choose a reason for hiding this comment

Uh oh!

yajo Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-gierakowski commented Mar 21, 2026

Uh oh!

adrian-gierakowski Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

yajo commented Mar 26, 2026

Uh oh!

Uh oh!

adrian-gierakowski commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yajo commented Mar 2, 2026 •

edited

Loading