From 347e16346da2ac9ba1094fc0d5eaea5acb039a1b Mon Sep 17 00:00:00 2001 From: rzuasti Date: Thu, 18 Jun 2026 09:35:58 -0400 Subject: [PATCH] Document skopeo --insecure-policy for the Fly push on NixOS NixOS ships no default containers policy.json, so skopeo copy aborts with a trust-policy error. Add --insecure-policy to the documented push command and gitignore the result-fly build symlink. Co-Authored-By: Claude Opus 4.8 --- .gitignore | 1 + deploy/fly/README.md | 5 ++++- deploy/fly/fly.toml | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 11de1d9..6c52dd0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ /target /backend/target /result +/result-fly oott.db oott.db-wal oott.db-shm diff --git a/deploy/fly/README.md b/deploy/fly/README.md index 68d1d92..2d8e7e2 100644 --- a/deploy/fly/README.md +++ b/deploy/fly/README.md @@ -44,7 +44,10 @@ nix build .#flyImage -o result-fly # Push the image straight from the Nix store archive to Fly's registry. # No Docker daemon involved; skopeo authenticates with a short-lived Fly token. -skopeo copy --dest-creds "x:$(fly auth token)" \ +# --insecure-policy skips skopeo's trust-policy check: on NixOS there is no +# default /etc/containers/policy.json, and we are pushing our own freshly built +# image, so there is nothing to verify. +skopeo copy --insecure-policy --dest-creds "x:$(fly auth token)" \ docker-archive:result-fly \ docker://registry.fly.io/oott-test:latest ``` diff --git a/deploy/fly/fly.toml b/deploy/fly/fly.toml index e49da74..4b3d960 100644 --- a/deploy/fly/fly.toml +++ b/deploy/fly/fly.toml @@ -8,7 +8,7 @@ # See deploy/fly/README.md for the full deploy procedure. app = "oott-test" # change to your chosen Fly app name -primary_region = "yyz" # change to a region near you / the reviewers +primary_region = "yyz" # change to a region near you / the reviewersu # The image is built with Nix and pushed to the Fly registry (see README), # so there is no [build] section: deploy with `fly deploy --image ...`.