2 files changed, 128 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/applications/virtualization/cri-o/default.nix b/nixpkgs/pkgs/applications/virtualization/cri-o/default.nix
new file mode 100644
index 000000000000..05de3c1626df
--- /dev/null
+++ b/nixpkgs/pkgs/applications/virtualization/cri-o/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, btrfs-progs
+, buildGoModule
+, fetchFromGitHub
+, glibc
+, gpgme
+, installShellFiles
+, libapparmor
+, libseccomp
+, libselinux
+, lvm2
+, pkg-config
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "cri-o";
+  version = "1.28.2";
+
+  src = fetchFromGitHub {
+    owner = "cri-o";
+    repo = "cri-o";
+    rev = "v${version}";
+    sha256 = "sha256-g9J66CZOAoco7UmK+xPEE6T5Aes3LWEG3J40LuDcvYo=";
+  };
+  vendorHash = null;
+
+  doCheck = false;
+
+  outputs = [ "out" "man" ];
+  nativeBuildInputs = [ installShellFiles pkg-config ];
+
+  buildInputs = [
+    btrfs-progs
+    gpgme
+    libapparmor
+    libseccomp
+    libselinux
+    lvm2
+  ] ++ lib.optionals (glibc != null) [ glibc glibc.static ];
+
+  BUILDTAGS = "apparmor seccomp selinux containers_image_openpgp containers_image_ostree_stub";
+  buildPhase = ''
+    runHook preBuild
+    make binaries docs BUILDTAGS="$BUILDTAGS"
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 bin/* -t $out/bin
+
+    for shell in bash fish zsh; do
+      installShellCompletion --$shell completions/$shell/*
+    done
+
+    install contrib/cni/*.conflist -Dt $out/etc/cni/net.d
+    install crictl.yaml -Dt $out/etc
+
+    installManPage docs/*.[1-9]
+    runHook postInstall
+  '';
+
+  passthru.tests = { inherit (nixosTests) cri-o; };
+
+  meta = with lib; {
+    homepage = "https://cri-o.io";
+    description = ''
+      Open Container Initiative-based implementation of the
+      Kubernetes Container Runtime Interface
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ] ++ teams.podman.members;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/applications/virtualization/cri-o/wrapper.nix b/nixpkgs/pkgs/applications/virtualization/cri-o/wrapper.nix
new file mode 100644
index 000000000000..c8af1b909c84
--- /dev/null
+++ b/nixpkgs/pkgs/applications/virtualization/cri-o/wrapper.nix
@@ -0,0 +1,52 @@
+{ cri-o-unwrapped
+, runCommand
+, makeWrapper
+, lib
+, extraPackages ? []
+, runc # Default container runtime
+, conntrack-tools
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
+, conmon # Container runtime monitor
+, util-linux # nsenter
+, iptables
+}:
+
+let
+  binPath = lib.makeBinPath ([
+    runc
+    conntrack-tools
+    crun
+    conmon
+    util-linux
+    iptables
+  ] ++ extraPackages);
+
+in runCommand cri-o-unwrapped.name {
+  name = "${cri-o-unwrapped.pname}-wrapper-${cri-o-unwrapped.version}";
+  inherit (cri-o-unwrapped) pname version passthru;
+
+  preferLocalBuild = true;
+
+  meta = builtins.removeAttrs cri-o-unwrapped.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+} ''
+  ln -s ${cri-o-unwrapped.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${cri-o-unwrapped}/etc $out/etc
+  ln -s ${cri-o-unwrapped}/share $out/share
+
+  for p in ${cri-o-unwrapped}/bin/*; do
+    makeWrapper $p $out/bin/''${p##*/} \
+      --prefix PATH : ${binPath}
+  done
+''