pkgs.dockerTools.mergeImages

The following is the current implementation of this function.

mergeImages =
    images:
    runCommand "merge-docker-images"
      {
        inherit images;
        nativeBuildInputs =
          [
            file
            jq
          ]
          ++ compressors.none.nativeInputs
          ++ compressors.gz.nativeInputs
          ++ compressors.zstd.nativeInputs;
      }
      ''
        mkdir image inputs
        # Extract images
        repos=()
        manifests=()
        last_image_mime="application/gzip"
        for item in $images; do
          name=$(basename $item)
          mkdir inputs/$name

          last_image_mime=$(file --mime-type -b $item)
          case $last_image_mime in
            "application/x-tar") ${compressors.none.decompress};;
            "application/zstd") ${compressors.zstd.decompress};;
            "application/gzip") ${compressors.gz.decompress};;
            *) echo "error: unexpected layer type $last_image_mime" >&2; exit 1;;
          esac < $item | tar -xC inputs/$name

          if [ -f inputs/$name/repositories ]; then
            repos+=(inputs/$name/repositories)
          fi
          if [ -f inputs/$name/manifest.json ]; then
            manifests+=(inputs/$name/manifest.json)
          fi
        done
        # Copy all layers from input images to output image directory
        cp -R --update=none inputs/*/* image/
        # Merge repositories objects and manifests
        jq -s add "''${repos[@]}" > repositories
        jq -s add "''${manifests[@]}" > manifest.json
        # Replace output image repositories and manifest with merged versions
        mv repositories image/repositories
        mv manifest.json image/manifest.json
        # Create tarball and gzip
        tar -C image --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --xform s:'^./':: -c . | (
          case $last_image_mime in
            "application/x-tar") ${compressors.none.compress};;
            "application/zstd") ${compressors.zstd.compress};;
            "application/gzip") ${compressors.gz.compress};;
            # `*)` not needed; already checked.
          esac
        ) > $out
      '';