starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-07 21:35:17 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(nix): preserve default sandbox shell

Browse Source 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
This commit is contained in:
Ryan Yin
2026-07-06 22:02:00 +08:00
parent 049390581e
commit 0fe12bef5a
5 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
outputs/aarch64-linux/tests/nix-system-features/expr.nix
+2 -1
View File
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
settings.experimental-features or [ ]
);
hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]);
hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
}
)