{
  description = "docker base images";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = {
    self,
    nixpkgs,
    flake-utils,
  }:
    flake-utils.lib.eachDefaultSystem
    (system: let
      pkgs = import nixpkgs {inherit system;};
      pkgsStatic = pkgs.pkgsStatic;
      lib = pkgs.lib;
    in {
      packages = {
        hello = pkgs.dockerTools.buildImage {
          name = "hello-docker";
          config = {
            Cmd = ["${pkgs.hello}/bin/hello"];
          };
        };
        flakes-action = pkgs.dockerTools.buildImageWithNixDb {
          name = "flakes-action";
          contents = with pkgs; [
            ./root
            bash
            cacert
            coreutils
            curl
            gawk
            gitFull
            git-lfs
            gnused
            gnutar
            gzip
            nixFlakes
            nodejs
            openssh
            sudo
            wget
            xz
            zstd
            (pkgs.writeTextFile {
              name = "nix.conf";
              destination = "/etc/nix/nix.conf";
              text = ''
                accept-flake-config = true
                experimental-features = nix-command flakes
              '';
            })
          ];

          extraCommands = ''
            # for /usr/bin/env
            mkdir usr
            ln -s ../bin usr/bin

            # make sure /tmp exists
            mkdir -m 1777 tmp

            # need a HOME
            mkdir -vp root
          '';
          config = {
            Cmd = ["/bin/bash"];
            Env = [
              "LANG=en_GB.UTF-8"
              "ENV=/etc/profile.d/nix.sh"
              "BASH_ENV=/etc/profile.d/nix.sh"
              "NIX_BUILD_SHELL=/bin/bash"
              "NIX_PATH=nixpkgs=${./fake_nixpkgs}"
              "PAGER=cat"
              "PATH=/usr/bin:/bin"
              "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
              "USER=root"
            ];
          };
        };
      };

      devShells = {
        default = pkgs.mkShell {
          buildInputs = with pkgs; [
            git-lfs
          ];
        };
      };
    });
}