dockertools: fix buildLayeredImage nix-store permissions

[johanot]

Motivation for this change

Fix bug in dockerTools.buildLayeredImage that causes non-root containers to be not runnable.

Pardon my python, but I was unsure how - in the prettiest way - to hook into the existing logic around /nix/store dir-creation.

example docker error message:

docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"/nix/store/3avafdzgh694z5m3rgw2vvlgsfz2gmkl-coredns-1.6.6/bin/coredns\": stat /nix/store/3avafdzgh694z5m3rgw2vvlgsfz2gmkl-coredns-1.6.6/bin/coredns: permission denied": unknown.

The cause of the error is that /nix and /nix/store has wrong permissions inside the final image, i.e.:

bash-4.4# ls -dl /nix/store/
drw-r--r-- 32 root root 34 Jan  1  1970 /nix/store/

The top-level directories lack world execute permissions, which, is ok as long we run the image as root, but fails when the image is run as an unprivileged user.

Steps to reproduce

1. cherry-pick 4fc255e from my branch onto master
2. docker load <$(nix-build . -A dockerTools.examples.bashLayeredWithUser)
3. docker run --rm -it -u somebody bash-layered-with-user /bin/echo "it works"

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

cc @LnL7 @utdemir

[utdemir]

Thank you for the change!

A similar PR was submitted a few days ago too: #93811, but we were waiting for a test. Since this one has also tests, @adrian-gierakowski do you mind if we continue from this PR? The changes are almost identical save the name of the function and this one has a test case.

[adrian-gierakowski]

@utdemir sounds good to me

[utdemir]

The tests have passed on my system, I think this PR is good to merge.

[roberth]

Just one little detail: "priviliged" refers to containers that run with extra capabilities that could harm the host.
Otherwise looks good. Thank you for adding a test case!

[johanot]

@roberth Valid point! I applied your suggestion just now using the fancy github feature. :) I'll squash those extra commits into my test-commit in a sec.

[srhb]

@ofborg test docker-tools

[srhb]

Ofborg is happy too! Thanks :)