oci_run_and_commit(
    name="nginx_with_conf_from_internet",
    base=":base_nginx",
    commands=[
        "curl https://github.com/my-cool-nginx-conf -o /etc/nginx/nginx.conf",
        "echo 'using my cool conf'"
    ],
    visibility=["//visibility:public"],
    entrypoint=["nginx"],
)

load(":run.bzl", "container_run_and_commit_layer")
load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push", "oci_load")

def oci_run_and_commit(name, base, commands, **kwargs):
    ############################## step 1 ######################################################
    load_name = "{name}_base_load".format(name=name)
    # load the docker image, with a deterministic image name
    # note that invoking the target multiple times from different workspaces in the same machine is not concurrency safe
    oci_load(
        name = load_name,
        image = base,
        repo_tags = ["{load_name}:latest".format(load_name=load_name)],
    )
    # this provides a single tar for the image from the previous oci_load 
    # which can be easily loaded using `docker load` inside our implementation
    # reference: https://github.com/bazel-contrib/rules_oci/blob/main/docs/load.md#build-outputs
    tar_name = "{name}_base_tar".format(name=name)
    native.filegroup(
        name = tar_name,
        srcs = [":{load_name}".format(load_name=load_name)],
        output_group = "tarball",
    )


    ############################## step 2 ######################################################
    # load the docker tar `image`
    # run `commands`
    # commit the image
    # extract the last layer from the committed image (our layer)
    # set that layer as the build result
    commit_layer_name = "{name}_commit_layer".format(name=name)
    container_run_and_commit_layer(
        name = commit_layer_name,
        image = ":{tar_name}".format(tar_name=tar_name),
        commands = commands,
    )


    ############################## step 3 ######################################################
    # use the layer from the container_run_and_commit_layer as additional tars
    # done on top of the passed base image
    if "tars" in kwargs:
      fail("passing `tars` to kwargs is not valid, use other oci_image options")
    oci_image(
        name = name,
        base = base,
        tars = [":{commit_layer_name}".format(commit_layer_name=commit_layer_name)],
        **kwargs,
    )

# extract_image_id.py
import sys
import json
import tarfile


def get_id(tar_path):
    tar = tarfile.open(tar_path, mode="r")
    manifest_file_handle = tar.extractfile("manifest.json")
    if manifest_file_handle is None:
        raise
    manifest = json.load(manifest_file_handle)
    return manifest[0]["Config"].split("/")[-1]

if __name__ == "__main__":
    print(get_id(sys.argv[1]))

# extract_last_layer.py
import shutil
import sys
import json
import tarfile


def extract_last_layer(tar_path, dest_path):
    """Extracts the last layer of a docker image from its tarball.
    Args:
    tar_path: str path to the tarball
    dest_path: str path to the destination file
    """
    tar = tarfile.open(tar_path, mode="r")
    manifest_file_handle = tar.extractfile("manifest.json")
    if manifest_file_handle is None:
        raise
    manifest = json.load(manifest_file_handle)
    last_layer = manifest[0]["Layers"][-1]
    print("copying {} to {}".format(last_layer, dest_path))
    fp = tar.extractfile(last_layer)
    if fp is None:
        raise
    with open(dest_path, "wb") as f:
        shutil.copyfileobj(fp, f)

if __name__ == "__main__":
  extract_last_layer(sys.argv[1], sys.argv[2])

def _commit_layer_impl(ctx):
    # name of the target
    name = ctx.attr.name
    # base image file location
    image = ctx.file.image
    commands = ctx.attr.commands

    # location where we save the extracted layer
    output_layer_tar = ctx.outputs.layer


    # Generate a shell script to execute the run statement and extract the layer
    script = ctx.actions.declare_file(name + ".build")
    ctx.actions.expand_template(
        template = ctx.file._run_tpl,
        output = script,
        substitutions = {
            # join the commands in a single command
            "%{commands}": "'{0}'".format(" && ".join(command_list)),
            # pass extract_id.py path
            "%{image_id_extractor_path}": ctx.executable._extract_image_id.path,
            # pass extract_last_layer.py path
            "%{image_last_layer_extractor_path}": ctx.executable._last_layer_extractor_tool.path,
            # base image tar path
            "%{image_tar}": image.path,
            # layer tar destination path
            "%{output_layer_tar}": output_layer_tar.path,
        },
        is_executable = True,
    )


    # now `script` contains our shell script, with all helpers and variables injected
    # run it now
    ctx.actions.run(
        outputs = [output_layer_tar],
        inputs = [image],
        executable = script,
        mnemonic = "RunAndCommitLayer",
        tools = [
            ctx.executable._extract_image_id,
            ctx.executable._last_layer_extractor_tool
        ],
        # this is needed to find the system installed docker
        use_default_shell_env = True,
    )

    return [
        DefaultInfo(files = depset([output_layer_tar])),
    ]

container_run_and_commit_layer = rule(
    attrs = {
        "commands": attr.string_list(
            doc = "A list of commands to run (sequentially) in the container.",
            mandatory = True,
            allow_empty = False,
        ),
        "image": attr.label(
            doc = "The image to run the commands in.",
            mandatory = True,
            allow_single_file = True,
            cfg = "target",
        ),
        "_extract_image_id": attr.label(
            default = Label("//tools/container_run/utils:extract_image_id"),
            cfg = "exec",
            executable = True,
            allow_files = True,
        ),
        "_last_layer_extractor_tool": attr.label(
            default = Label("//tools/container_run/utils:extract_last_layer"),
            cfg = "exec",
            executable = True,
            allow_files = True,
        ),
        "_run_tpl": attr.label(
            default = Label("//tools/container_run/utils:commit_layer.sh.tpl"),
            allow_single_file = True,
        ),
    },
    doc = ("This rule runs a set of commands in a given image, waits" +
           "for the commands to finish, and then commits the" +
           "container state to a new layer."),
    executable = False,
    implementation = _commit_layer_impl,
)