Show HN: Nucleus – A security-hardened, Nix-native container runtime(github.com)

  "use_podman": true

  {
    "name": "projectName",
    "runArgs": ["--name", "projectName"],
    "dockerComposeFile": "docker-compose.yml",
    "service": "devcontainer",
    "features": {
      "ghcr.io/devcontainers/features/nix:1": {
        "packages": "devenv"
      }
    },
    "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
    "onCreateCommand": "nix-env -iA nixpkgs.devenv",
    "postCreateCommand": "git config --global user.name \"${GIT_USER_NAME}\" && git config --global user.email \"${GIT_USER_EMAIL}\" && git config --global --add --bool push.autoSetupRemote true && echo 'eval \"$(devenv hook bash)\"' | tee -a ~/.bashrc"
  
    // If compose isn't needed use the following:
    // "image": "mcr.microsoft.com/devcontainers/base:debian",
    // "containerEnv": {
    //   "GIT_USER_NAME": "${localEnv:GIT_USER_NAME}",
    //   "GIT_USER_EMAIL": "${localEnv:GIT_USER_EMAIL}",
    //   "SSH_AUTH_SOCK": "/run/host-services/ssh-auth.sock",
    // },
    // "mounts": [
    //   "source=${localEnv:XDG_RUNTIME_DIR}/ssh-agent.socket,target=/run/host-services/ssh-auth.sock,type=bind",
    // ],
  }

  name: projectName
  services:
    devcontainer:
      image: mcr.microsoft.com/devcontainers/base:debian
      command: sleep infinity
      userns_mode: keep-id
      environment:
        SSH_AUTH_SOCK: /run/host-services/ssh-auth.sock
        GIT_USER_EMAIL: ${GIT_USER_EMAIL?err}
        GIT_USER_NAME: ${GIT_USER_NAME?err}
        POSTGRES_DB: ${POSTGRES_DB:-projectName}
        POSTGRES_USER: ${POSTGRES_USER:-postgres}
        POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      ports:
        # To connect to postgres running inside the container
        - target: 5432
          published: 5432
          protocol: tcp
          host_ip: 127.0.0.1
          mode: host
      volumes:
        - ${XDG_RUNTIME_DIR}/ssh-agent.socket:/run/host-services/ssh-auth.sock:bind
        - ..:/workspaces/projectName:cached

  { pkgs, config, ... }: {
    env.GREET = "determinism";
  
    enterShell = ''
      echo hello ${config.env.GREET}
    '';
  
    packages = [
      pkgs.nodejs
      pkgs.yarn
    ];
  
    services = {
      postgres = {
        enable = true;
        listen_addresses = "0.0.0.0";
        hbaConf = ''
          # TYPE      DATABASE      USER      ADDRESS       METHOD
            local       all         all                     peer
            host        all         all       127.0.0.1/32  trust
            host        all         all       0.0.0.0/0     md5
        '';
        initialDatabases = [
          {
            name = "postgres";
          }
          {
            name = "projectName";
          }
          {
            name = "projectName_auth";
          }
        ];
        initialScript = ''
          CREATE ROLE postgres SUPERUSER LOGIN PASSWORD 'postgres';
          CREATE ROLE api LOGIN PASSWORD 'api';
          CREATE ROLE auth LOGIN PASSWORD 'auth';
        '';
        settings = {
          wal_level = "logical";
        };
      };
    };
  
    scripts = {
      drizzle.exec = "npx lerna run --scope @projectName/drizzle \"$@\"";
      better-auth.exec = "npx lerna run --scope @projectName/better-auth \"$@\"";
    };
  }

  # ~/.config/containers/containers.conf
  [containers]
  label = false