Welcome to this instance of Nixery, an ad-hoc container image registry that provides packages from the Nix package manager.
You can pull container images from this registry
at nixery.dev by appending any
packages that you need in the URL, separated by slashes.
These usage examples assume that you use Docker, but should not be much different for other OCI-compatible platforms.
Pull an image from this registry, separating each package you want included by a slash:
docker pull nixery.dev/shell/git/htop
This gives you an image with git, htop and an interactively
configured shell. You could run it like this:
docker run -ti nixery.dev/shell/git/htop bash
Each path segment corresponds either to a key in the Nix package set, or a meta-package that automatically expands to several other packages.
Currently there are two meta-packages:
shell, which provides a bash-shell with interactive
configuration and standard tools like coreutils
arm64, which provides ARM64 binaries (must be specified as the first path component)
Below are the Nix build errors for some packages that failed to build recently. If Nixery served you an error, you might be able to find more details about it here.
error: Node.js 20 support was removed given upstream End-of-Life on 2026-04-30
error: postgresql_13 has been removed since it reached its EOL upstream
error: `python` previously pointed to Python 2; use `python3` instead
error: Refusing to evaluate package 'minio-2025-10-15T17-29-55Z' in /nix/store/0m7d5p4262m5bv2jynm6zpcfgkwca855-source/pkgs/by-name/mi/minio/package.nix:69 because it is marked as insecure
Known issues:
- CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
- CVE-2026-41145: Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
- CVE-2026-33322: JWT Algorithm Confusion in OIDC Authentication
- CVE-2026-33419: LDAP login brute-force via user enumeration and missing rate limit
- CVE-2026-34204: SSE Metadata Injection via Replication Headers
- CVE-2026-39414: DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
- minio has been abandoned by upstream and security issues won't be fixed. Users should migrate to alternatives such as Garage, SeaweedFS, or Ceph. S3-compatible clients such as rclone can be used to move data.
You can install it anyway by allowing this package, using the
following methods:
a) To temporarily allow all insecure packages, you can use an environment
variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_INSECURE=1
Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
then pass `--impure` in order to allow use of environment variables.
b) for `nixos-rebuild` you can add ‘minio-2025-10-15T17-29-55Z’ to
`nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
like so:
{
nixpkgs.config.permittedInsecurePackages = [
"minio-2025-10-15T17-29-55Z"
];
}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
‘minio-2025-10-15T17-29-55Z’ to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:
{
permittedInsecurePackages = [
"minio-2025-10-15T17-29-55Z"
];
}
note: trace involved the following derivations:
derivation 'runtime-graph.json'
error: Refusing to evaluate package 'github-copilot-cli-1.0.88' in /nix/store/0m7d5p4262m5bv2jynm6zpcfgkwca855-source/pkgs/by-name/gi/github-copilot-cli/package.nix:94 because it has an unfree license (‘unfree’)
a) To temporarily allow unfree packages, you can use an environment variable
for a single invocation of the nix tools.
$ export NIXPKGS_ALLOW_UNFREE=1
Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
then pass `--impure` in order to allow use of environment variables.
b) For `nixos-rebuild` you can set
{ nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.
Alternatively you can configure a predicate to allow specific packages:
{ nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"github-copilot-cli"
];
}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
{ allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.
note: trace involved the following derivations:
derivation 'runtime-graph.json'
error: `python` previously pointed to Python 2; use `python3` instead
error: some substitutes for the outputs of derivation '/nix/store/xzc63696cldii1pjyc2l9sb1z57iwhhz-symlink-layer-meta.json.drv' failed (usually happens due to networking issues); try '--fallback' to build derivation from source
error: some substitutes for the outputs of derivation '/nix/store/myr9642vqirmqk6a8d76bc8mbpdj7ccr-runtime-graph.json.drv' failed (usually happens due to networking issues); try '--fallback' to build derivation from source
error: Node.js 20 support was removed given upstream End-of-Life on 2026-04-30
The short version is that we use the Nix package manager and an optimised layering strategy.
Check out the Nixery talk from NixCon 2019 for more information.
nixery.dev in production?
While we appreciate the enthusiasm, if you would like to use Nixery in your production
project we recommend setting up a private instance. The public Nixery
at nixery.dev is run on a best-effort basis and we make no guarantees
about availability.
Nixery was written by tazjin, originally at Google. These days Nixery is maintained by TVL.
Nixery would not be possible without the many people that have contributed to Nix and nixpkgs over time, maybe you could become one of them?
Nixery lives in the TVL monorepo. All development happens there and follows the TVL contribution guidelines.
We mirror the source code to Github but do not guarantee that anyone will look at PRs or issues there.