diff --git a/flake-rust-docker/README.md b/flake-rust-docker/README.md
new file mode 100644
index 0000000..52de89c
--- /dev/null
+++ b/flake-rust-docker/README.md
@@ -0,0 +1,25 @@
+# flake-rust-docker
+
+## Building
+
+```sh
+> nix build .#packages.x86_64-linux.dockerImage
+> podman load < result
+> podman run -ti localhost/hello-world:latest
+Hello, world!
+```
+
+## Developing
+
+```sh
+> nix develop
+$ gunzip --stdout result > /tmp/image.tar && dive docker-archive:///tmp/image.tar
+... this will open dive
+
+$ sudo $(which dockerd)
+$ sudo chown -R 1000:1000 /var/run/docker.sock
+$ docker load < result
+Loaded image: hello-world:latest
+$ docker run -ti hello-world:latest
+Hello, world!
+```
diff --git a/flake-rust-docker/flake.lock b/flake-rust-docker/flake.lock
new file mode 100644
index 0000000..6466cf4
--- /dev/null
+++ b/flake-rust-docker/flake.lock
@@ -0,0 +1,106 @@
+{
+  "nodes": {
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1710819233,
+        "narHash": "sha256-YJsu2BVgUl2qRo0t2ksu5rK4yD59Mudd6BUXGwpC0DE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "fc610a825db14bd8fdc5c7f57450422ae6ff4e7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1710631334,
+        "narHash": "sha256-rL5LSYd85kplL5othxK5lmAtjyMOBg390sGBTb3LRMM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c75037bbf9093a2acb617804ee46320d6d1fea5a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1710814282,
+        "narHash": "sha256-nWaKhMQackiO0M8504HSx/E7I76C2r0/g4wqZf4hp24=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "8c72f33c23c8e537dd59088c4560222c43eedaca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake-rust-docker/flake.nix b/flake-rust-docker/flake.nix
new file mode 100644
index 0000000..e4cb2d9
--- /dev/null
+++ b/flake-rust-docker/flake.nix
@@ -0,0 +1,72 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+    };
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+      };
+    };
+    crane = {
+      url = "github:ipetkov/crane";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+  };
+  outputs = { self, nixpkgs, flake-utils, rust-overlay, crane }:
+    flake-utils.lib.eachDefaultSystem
+      (system:
+        let
+          overlays = [ (import rust-overlay) ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          rustToolchain = pkgs.pkgsBuildHost.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+          # this is how we can tell crane to use our toolchain!
+          craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
+          # cf. https://crane.dev/API.html#libcleancargosource
+          src = craneLib.cleanCargoSource ./hello-world;
+          # as before
+          nativeBuildInputs = with pkgs; [ rustToolchain pkg-config ];
+          buildInputs = with pkgs; [ openssl sqlite ];
+          # because we'll use it for both `cargoArtifacts` and `bin`
+          commonArgs = {
+            inherit src buildInputs nativeBuildInputs;
+          };
+          cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+          # remember, `set1 // set2` does a shallow merge:
+          bin = craneLib.buildPackage (commonArgs // {
+            inherit cargoArtifacts;
+          });
+          dockerImage = pkgs.dockerTools.buildImage {
+            name = "hello-world";
+            tag = "latest";
+            copyToRoot = [ bin ];
+            config = {
+              Cmd = [ "${bin}/bin/hello-world" ];
+            };
+          };
+        in
+        with pkgs;
+        {
+          packages =
+            {
+              # that way we can build `bin` specifically,
+              # but it's also the default.
+              inherit bin dockerImage;
+              default = bin;
+            };
+          devShells.default = mkShell {
+            # instead of passing `buildInputs` / `nativeBuildInputs`,
+            # we refer to an existing derivation here
+            inputsFrom = [ bin ];
+            buildInputs = with pkgs; [ dive docker shadow ];
+          };
+        }
+      );
+}
\ No newline at end of file
diff --git a/flake-rust-docker/hello-world/Cargo.lock b/flake-rust-docker/hello-world/Cargo.lock
new file mode 100644
index 0000000..e7cecae
--- /dev/null
+++ b/flake-rust-docker/hello-world/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "hello-world"
+version = "0.1.0"
diff --git a/flake-rust-docker/hello-world/Cargo.toml b/flake-rust-docker/hello-world/Cargo.toml
new file mode 100644
index 0000000..4b9c151
--- /dev/null
+++ b/flake-rust-docker/hello-world/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "hello-world"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
diff --git a/flake-rust-docker/hello-world/src/main.rs b/flake-rust-docker/hello-world/src/main.rs
new file mode 100644
index 0000000..e7a11a9
--- /dev/null
+++ b/flake-rust-docker/hello-world/src/main.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}
diff --git a/flake-rust-docker/rust-toolchain.toml b/flake-rust-docker/rust-toolchain.toml
new file mode 100644
index 0000000..e651b46
--- /dev/null
+++ b/flake-rust-docker/rust-toolchain.toml
@@ -0,0 +1,5 @@
+[toolchain]
+channel = "nightly-2024-03-17"
+components = [ "rustfmt", "rustc-dev" ]
+targets = [ "x86_64-unknown-linux-gnu" ]
+profile = "minimal"