2026-10-09
> 2026-10-09: note: Rework 'Add build Typst doc ...'
diff --git a/note/build-typst-doc-in-gitlab-ci-with-guix.md b/note/build-typst-doc-in-gitlab-ci-with-guix.md
index dd0045d..9aa3cea 100644
--- a/note/build-typst-doc-in-gitlab-ci-with-guix.md
+++ b/note/build-typst-doc-in-gitlab-ci-with-guix.md
@@ -7,78 +7,59 @@ keywords: guix docker
rights: CC0 1.0
---
-I am not saying this is right; it just works for me.
+In the Git repo with Typst documents, we have this `manifest.scm`:
+
+```scheme
+(specifications->manifest
+ (list "typst"
+ "typstyle"
+ ; The following we need to build docker image:
+ "bash-minimal" ; bash
+ "git-minimal" ; git
+ "nss-certs" ; git with TLS, I guess
+ "coreutils-minimal" ; mkdir
+ "make" ; make
+ ))
+```
+
+From this file, we can create a Docker image `typst-at-guix`:
-This is `Dockerfile` based on [`jas4711/guix`][]:
+```bash
+docker load < $(guix pack -m manifest.scm -f docker -S /bin=bin --image-tag=typst-at-guix)
+```
-[`jas4711/guix`]: https://hub.docker.com/r/jas4711/guix
+To get Typst packages we use `git` with `--sparse` argument so we cannot
+simply use `git-download` from Guix (yet). And that is sole reason for
+using "intermediate" `Dockerfile`:
```dockerfile
-FROM jas4711/guix
-# see https://hub.docker.com/r/jas4711/guix
-
-# From "How to use in a GitLab pipeline":
-RUN groupadd --gid 0 root
-RUN useradd --uid 0 --gid root --shell /bin/sh --home-dir / --system root
-RUN cp -rL /gnu/store/*profile/etc/* /etc/
-RUN groupadd --system guixbuild
-RUN for i in $(seq -w 1 10); do useradd -g guixbuild -G guixbuild -d /var/empty -s $(command -v nologin) -c "Guix build user $i" --system guixbuilder$i; done
-
-ENV HOME=/
-ENV LANG=C.UTF-8
-RUN guix archive --authorize < /share/guix/ci.guix.gnu.org.pub
-RUN guix archive --authorize < /share/guix/bordeaux.guix.gnu.org.pub
-RUN guix describe
-
-# This worked for me, not saying I am right:
-RUN --security=insecure nohup bash -c 'guix-daemon --build-users-group=guixbuild &' && sleep 2 && guix install typst typstyle
-# - The --security=insecure relates to docker buildx and some kind of permissions.
-# - nohup "runs a command immune to hangups" (from man page).
-# - So we have guix-daemon running in background and wait 2 sec before guix install.
-
-# Get ready to use Guix:
-ENV GUIX_PROFILE="/.guix-profile"
-RUN . "$GUIX_PROFILE/etc/profile"
-
-# Get Typst packages we use:
+FROM typst-at-guix
+
+# Get Typst packages we use -- we need just two, therefore such mummery:
+
WORKDIR /.local/share/
-RUN git clone --sparse --no-checkout --filter=tree:0 --single-branch --branch main https://github.com/typst/packages.git typst
-# - Git sparse no checkout and others are here to speed-up git clone.
+
+# Clone limited history only (without blobs, i.e., files):
+RUN git clone \
+ --sparse --no-checkout --filter=tree:0 \
+ --single-branch --branch main \
+ https://github.com/typst/packages.git typst
WORKDIR /.local/share/typst/
-# Specify what to checkout:
+# Specify only what files to checkout:
RUN git sparse-checkout set \
- packages/preview/diagraph/0.3.7 \
- packages/preview/cheq/0.3.1 \
+ packages/preview/diagraph/0.3.7 \
+ packages/preview/cheq/0.3.1
-# And checkout it:
+# And checkout them:
RUN git checkout
-
-# Entry point that gets Guix ready (source Guix profile):
-COPY ep.sh /
-ENTRYPOINT ["/ep.sh"]
-CMD ["/ep.sh"]
-```
-
-Entry point -- `ep.sh` -- contains just:
-
-```bash
-#!/bin/sh
-. "$GUIX_PROFILE/etc/profile"
-exec "$@"
-```
-
-We need `docker-buildx` and create `insecure-builder`:
-
-```bash
-docker buildx create --name insecure-builder --buildkitd-flags '--allow-insecure-entitlement security.insecure'
```
-Then we build the `Dockerfile` with it:
+Now build docker image from that:
```bash
-docker buildx build --builder=insecure-builder --allow security.insecure --load -t registry.gitlab.com/qeef/foo .
+docker build -t registry.gitlab.com/qeef/foo .
```
Nope, there is no repo `qeef/foo` on GitLab, but the idea is clear,
> 2026-10-08: Improve HEAD^
diff --git a/note/build-typst-doc-in-gitlab-ci-with-guix.md b/note/build-typst-doc-in-gitlab-ci-with-guix.md
index 426345f..dd0045d 100644
--- a/note/build-typst-doc-in-gitlab-ci-with-guix.md
+++ b/note/build-typst-doc-in-gitlab-ci-with-guix.md
@@ -46,12 +46,16 @@ RUN git clone --sparse --no-checkout --filter=tree:0 --single-branch --branch ma
# - Git sparse no checkout and others are here to speed-up git clone.
WORKDIR /.local/share/typst/
-RUN git sparse-checkout set packages/preview/diagraph/0.3.7 packages/preview/cheq/0.3.1
-# - Specify what to checkout...
+
+# Specify what to checkout:
+RUN git sparse-checkout set \
+ packages/preview/diagraph/0.3.7 \
+ packages/preview/cheq/0.3.1 \
+
+# And checkout it:
RUN git checkout
-# - ... and checkout it.
-# Entry point that gets Guix ready (source profile):
+# Entry point that gets Guix ready (source Guix profile):
COPY ep.sh /
ENTRYPOINT ["/ep.sh"]
CMD ["/ep.sh"]