# 创建包含 Python 的 Docker 镜像
guix pack -f docker -o python-image.tar.gz \
  python python-requests python-flask

# 导入到 Docker
docker load < python-image.tar.gz
# 输出：Loaded image: ...

# 运行
docker run --rm -it <image-id> python3 -c "print('Hello from Guix!')"

# 设置默认入口点
guix pack -f docker \
  --entry-point=/bin/python3 \
  -o python-app.tar.gz \
  python python-flask gunicorn

# 运行时直接执行
docker run --rm -it <image-id> -c "print('hello')"

# 指定名称和标签
guix pack -f docker \
  --image-tag="myapp:1.0" \
  -o myapp-1.0.tar.gz \
  python python-flask

# 导入后镜像名为 myapp:1.0
docker load < myapp-1.0.tar.gz
docker images | grep myapp

;; webapp-manifest.scm
(specifications->manifest
  '("python"
    "python-flask"
    "python-gunicorn"
    "python-redis"
    "python-psycopg2"
    "openssl"
    "ca-certificates"
    "tzdata"))

guix pack -f docker \
  --image-tag="webapp:latest" \
  --manifest=webapp-manifest.scm \
  --entry-point=/bin/gunicorn \
  -o webapp.tar.gz

;; manifest.scm — 完整的 Web 应用环境
(use-modules (guix gexp))

(specifications->manifest
  '(;; 运行时
    "python"
    "python-flask"
    "python-gunicorn"
    "python-redis"
    "python-sqlalchemy"
    "python-psycopg2"
    ;; 工具
    "openssl"
    "ca-certificates"
    "tzdata"
    "coreutils"        ; ls, cat 等
    "bash"             ; Shell
    "curl"))            ; 健康检查

(use-modules (gnu packages)
             (gnu packages python)
             (gnu packages python-web)
             (gnu packages databases))

;; 使用 Scheme 表达式精细控制
(packages->manifest
  (list
    ;; Python 运行时
    python-3.11

    ;; Web 框架
    python-flask
    python-gunicorn

    ;; 数据库
    python-sqlalchemy
    python-alembic
    python-psycopg2

    ;; 缓存
    python-redis

    ;; 工具
    openssl
    (specification->package "ca-certificates")))

;; guix-manifest.scm
(specifications->manifest
  '("python"
    "python-flask"
    "python-gunicorn"
    "python-sqlalchemy"
    "python-psycopg2"
    "python-redis"
    "openssl"
    "ca-certificates"))

# 使用 Guix 构建镜像
guix pack -f docker \
  --image-tag="my-flask-app:1.0" \
  --manifest=guix-manifest.scm \
  --entry-point=/bin/gunicorn \
  -o app-image.tar.gz

# 或者使用 Dockerfile 混合模式

# Dockerfile.guix — 使用 Guix 构建的镜像作为基础
FROM guix-pack:latest as builder

# 复制应用代码
COPY app/ /app/
COPY wsgi.py /app/

# 设置工作目录
WORKDIR /app

# 健康检查
HEALTHCHECK --interval=30s --timeout=10s \
  CMD curl -f http://localhost:8000/health || exit 1

# 暴露端口
EXPOSE 8000

# 启动应用
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "4", "wsgi:app"]

;; nginx-manifest.scm
(specifications->manifest
  '("nginx"
    "openssl"))

guix pack -f docker \
  --image-tag="static-site:latest" \
  --manifest=nginx-manifest.scm \
  --entry-point=/bin/nginx \
  -o static-site.tar.gz

FROM static-site:latest

# 复制网站文件
COPY dist/ /var/www/html/

# 使用自定义 nginx 配置
COPY nginx.conf /etc/nginx/nginx.conf

EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]

;; api-gateway-manifest.scm
(specifications->manifest
  '("nginx"
    "openssl"
    "curl"))

;; user-service-manifest.scm
(specifications->manifest
  '("python"
    "python-flask"
    "python-sqlalchemy"
    "python-jwt"))

;; order-service-manifest.scm
(specifications->manifest
  '("python"
    "python-flask"
    "python-redis"
    "python-celery"))

# 构建多个服务镜像
for service in api-gateway user-service order-service; do
  guix pack -f docker \
    --image-tag="${service}:latest" \
    --manifest=${service}-manifest.scm \
    --entry-point=/bin/python3 \
    -o ${service}.tar.gz
done

# 创建可重定位的包
guix pack --relocatable --relocatable-name=myapp \
  -f tarball \
  python python-flask

# 这个包可以在任意位置解压使用
tar xf myapp.tar.gz
./myapp/bin/python3

# SquashFS 是只读压缩文件系统
guix pack -f squashfs \
  --manifest=manifest.scm \
  -o app.squashfs

# 挂载使用
sudo mount app.squashfs /mnt/app
/mnt/app/bin/python3

# 完整的 guix pack 选项
guix pack -f docker \
  --image-tag="myapp:1.0" \
  --manifest=manifest.scm \
  --entry-point=/bin/python3 \
  --max-jobs=4 \
  --no-grafts \
  --save-provenance \
  -o myapp.tar.gz

# docker-compose.yml
version: "3.8"
services:
  web:
    image: my-flask-app:1.0
    build:
      context: .
      dockerfile: Dockerfile.guix
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://user:pass@db:5432/myapp
      - REDIS_URL=redis://redis:6379/0
    depends_on:
      - db
      - redis

  db:
    image: guix-postgres:15
    build:
      context: .
      dockerfile: Dockerfile.postgres.guix
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=myapp
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=pass

  redis:
    image: guix-redis:7
    build:
      context: .
      dockerfile: Dockerfile.redis.guix
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:

#!/bin/bash
# build-images.sh — 构建所有 Guix Docker 镜像

set -e

echo "Building Guix Docker images..."

# 构建 Web 应用镜像
echo "Building web app..."
guix pack -f docker \
  --image-tag="my-flask-app:1.0" \
  --manifest=webapp-manifest.scm \
  --entry-point=/bin/gunicorn \
  -o webapp.tar.gz

# 构建 PostgreSQL 镜像
echo "Building PostgreSQL..."
guix pack -f docker \
  --image-tag="guix-postgres:15" \
  --manifest=postgres-manifest.scm \
  --entry-point=/bin/postgres \
  -o postgres.tar.gz

# 构建 Redis 镜像
echo "Building Redis..."
guix pack -f docker \
  --image-tag="guix-redis:7" \
  --manifest=redis-manifest.scm \
  --entry-point=/bin/redis-server \
  -o redis.tar.gz

# 导入所有镜像
echo "Loading images..."
docker load < webapp.tar.gz
docker load < postgres.tar.gz
docker load < redis.tar.gz

echo "Done! All images loaded."
docker images | grep guix

# .gitlab-ci.yml
stages:
  - build
  - test
  - deploy

variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

build-image:
  stage: build
  image: guix
  script:
    - guix pull
    - guix pack -f docker
        --image-tag="$IMAGE_TAG"
        --manifest=manifest.scm
        --entry-point=/bin/python3
        -o app.tar.gz
    - docker load < app.tar.gz
    - docker push $IMAGE_TAG
  artifacts:
    paths:
      - app.tar.gz

test-image:
  stage: test
  image: docker:latest
  services:
    - docker:dind
  script:
    - docker load < app.tar.gz
    - docker run --rm $IMAGE_TAG python3 -m pytest /app/tests/

deploy:
  stage: deploy
  only:
    - main
  script:
    - docker load < app.tar.gz
    - docker tag $IMAGE_TAG $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:latest

# .github/workflows/docker.yml
name: Build Docker Image
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Guix
        run: |
          wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
          chmod +x guix-install.sh
          sudo ./guix-install.sh
          guix pull

      - name: Build Docker Image
        run: |
          guix pack -f docker \
            --image-tag="myapp:${{ github.sha }}" \
            --manifest=manifest.scm \
            -o app.tar.gz

      - name: Load and Tag
        run: |
          docker load < app.tar.gz
          docker tag myapp:${{ github.sha }} ghcr.io/${{ github.repository }}:latest
          docker tag myapp:${{ github.sha }} ghcr.io/${{ github.repository }}:${{ github.sha }}

      - name: Push to Registry
        if: github.event_name == 'push'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push ghcr.io/${{ github.repository }}:latest
          docker push ghcr.io/${{ github.repository }}:${{ github.sha }}

;; 精简 manifest
(specifications->manifest
  '("python:minimal"        ; 最小 Python
    "python-flask"
    "ca-certificates"))

;; 运行时最小集
(define %runtime-packages
  (specifications->packages
    '("python:minimal"
      "ca-certificates"
      "tzdata")))

;; 开发工具（不在最终镜像中）
(define %dev-packages
  (specifications->packages
    '("gcc-toolchain"
      "python-pytest"
      "python-mypy")))

# 验证镜像内容
guix pack -f docker --save-provenance ...

# 镜像中会包含 /gnu/store 中所有包的定义
# 可以审计每个包的构建来源

FROM guix-app:latest

# 创建应用用户
RUN groupadd -r appuser && useradd -r -g appuser appuser

# 设置目录权限
RUN mkdir -p /app/data && chown -R appuser:appuser /app

# 切换到非 root 用户
USER appuser

CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

;; system-container.scm
(use-modules (gnu)
             (gnu system linux-container))

(operating-system
  (host-name "guix-container")
  (timezone "Asia/Shanghai")
  (locale "zh_CN.utf8")
  (bootloader (bootloader-configuration
                (bootloader grub-bootloader)
                (targets '("/dev/null"))))
  (file-systems
    (cons* (file-system
              (device "tmpfs")
              (mount-point "/")
              (type "tmpfs"))
            %base-file-systems))
  (packages (list python nginx))
  (services
    (cons* (service nginx-service-type
              (nginx-configuration
                (server-blocks
                  (list (nginx-server-configuration
                          (server-name '("localhost"))
                          (listen '("80"))
                          (root "/var/www/html"))))))
            %base-services)))

# 构建系统容器
guix system container system-container.scm