starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-08 05:45:08 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(nix): preserve default sandbox shell

Browse Source 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
This commit is contained in:
Ryan Yin
2026-07-06 22:02:00 +08:00
parent 049390581e
commit 0fe12bef5a
5 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nixos/base/nix.nix
+9 -1
View File
@@ -31,7 +31,15 @@
"auto-allocate-uids"
"cgroups"
];
sandbox-paths = [ "/dev/net" ];
# Use extra-sandbox-paths instead of sandbox-paths here. The plain
# sandbox-paths setting replaces Nix's compiled sandbox defaults, including
# the sandbox shell that provides /bin/sh for builders with legacy shebangs.
# extra-sandbox-paths keeps those defaults and only adds the paths we need.
# After deploying, verify the effective daemon config with:
# nix config show | grep sandbox-paths
extra-sandbox-paths = [
"/dev/net"
];
};
nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.