From c3db10a1014b29608d84ced21032ec5a5e80f191 Mon Sep 17 00:00:00 2001
From: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Date: Thu, 12 Dec 2024 11:53:13 +0100
Subject: [PATCH] packages/nixos: make interpreter-less

This removes Perl and Python dependencies from our NixOS images. These are used throughout scripts for user generation and setup of volatile directories at boot (like `/etc`). However, this functionality can also be implemented without those interpreters, allowing us to remove them from the system closure. This saves around 168MB in image size.
---
 packages/nixos/kata.nix   |  6 +-----
 packages/nixos/system.nix | 33 ++++++++++++++++++++++++++++++++-
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/packages/nixos/kata.nix b/packages/nixos/kata.nix
index fa85326bff..753db39634 100644
--- a/packages/nixos/kata.nix
+++ b/packages/nixos/kata.nix
@@ -87,12 +87,8 @@ in
     };
 
     networking.resolvconf.enable = false;
-    systemd.tmpfiles.settings."10-etc-resolvconf"."/etc/resolv.conf".f = {
-      group = "root";
-      mode = "0755";
-      user = "root";
-    };
 
+    environment.etc."resolv.conf".text = "dummy file, to be bind-mounted by the Kata agent when writing network configuration";
     environment.etc."kata-opa/default-policy.rego".source = "${pkgs.kata-runtime.src}/src/kata-opa/allow-set-policy.rego";
   };
 }
diff --git a/packages/nixos/system.nix b/packages/nixos/system.nix
index a6efc880bf..5e2015e749 100644
--- a/packages/nixos/system.nix
+++ b/packages/nixos/system.nix
@@ -63,7 +63,6 @@
         })
         [
           "/var"
-          "/etc"
           "/bin"
           "/usr/bin"
           "/tmp"
@@ -78,6 +77,38 @@
   # Images are immutable, so no need to include Nix.
   nix.enable = false;
 
+  # Interpreter-less activation bits, tailored to our needs:
+  # Source: https://github.com/NixOS/nixpkgs/blob/a4741ea333f97cca0680d1eb485907f0e4a0eb3a/nixos/modules/profiles/perlless.nix
+  # We do not include the upstream module as-is, as we don't need sophisticated user generation, for example.
+
+  # Remove perl from activation
+  system.etc.overlay = {
+    enable = true;
+    mutable = false;
+  };
+
+  # simple replacement for update-users-groups.pl
+  systemd.sysusers.enable = true;
+
+  # Random perl remnants
+  system.disableInstallerTools = true;
+  programs.less.lessopen = null;
+  programs.command-not-found.enable = false;
+  boot.enableContainers = false;
+  environment.defaultPackages = [ ];
+  documentation.enable = false;
+
+  # Check that the system does not contain a Nix store path that contains the
+  # string "perl" or "python".
+  system.forbiddenDependenciesRegexes =
+    [
+      "perl"
+    ]
+    ++ lib.optionals (!config.contrast.debug.enable) [
+      # Some of the debug packages need Python.
+      "python"
+    ];
+
   nixpkgs.hostPlatform.system = "x86_64-linux";
   system.switch.enable = false;
   system.stateVersion = "24.05";