starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-10 06:32:42 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(nix): preserve default sandbox shell

Browse Source 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
This commit is contained in:
Ryan Yin
2026-07-06 22:02:00 +08:00
parent 049390581e
commit 0fe12bef5a
5 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nixos/base/nix.nix
+9 -1
View File
@@ -31,7 +31,15 @@
"auto-allocate-uids" "auto-allocate-uids"
"cgroups" "cgroups"
]; ];
sandbox-paths = [ "/dev/net" ]; # Use extra-sandbox-paths instead of sandbox-paths here. The plain
# sandbox-paths setting replaces Nix's compiled sandbox defaults, including
# the sandbox shell that provides /bin/sh for builders with legacy shebangs.
# extra-sandbox-paths keeps those defaults and only adds the paths we need.
# After deploying, verify the effective daemon config with:
# nix config show | grep sandbox-paths
extra-sandbox-paths = [
"/dev/net"
];
}; };
nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead. nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
outputs/aarch64-linux/tests/nix-system-features/expected.nix
+2 -1
View File
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
hasUidRange = true; hasUidRange = true;
hasAutoAllocateUidsFeature = true; hasAutoAllocateUidsFeature = true;
hasCgroupsFeature = true; hasCgroupsFeature = true;
hasDevNetSandboxPath = true; hasNoExplicitSandboxPaths = true;
hasDevNetExtraSandboxPath = true;
}) })
outputs/aarch64-linux/tests/nix-system-features/expr.nix
+2 -1
View File
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
settings.experimental-features or [ ] settings.experimental-features or [ ]
); );
hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]); hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]); hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
} }
) )
outputs/x86_64-linux/tests/nix-system-features/expected.nix
+2 -1
View File
@@ -7,5 +7,6 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
hasUidRange = true; hasUidRange = true;
hasAutoAllocateUidsFeature = true; hasAutoAllocateUidsFeature = true;
hasCgroupsFeature = true; hasCgroupsFeature = true;
hasDevNetSandboxPath = true; hasNoExplicitSandboxPaths = true;
hasDevNetExtraSandboxPath = true;
}) })
outputs/x86_64-linux/tests/nix-system-features/expr.nix
+2 -1
View File
@@ -16,6 +16,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
settings.experimental-features or [ ] settings.experimental-features or [ ]
); );
hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]); hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
hasDevNetSandboxPath = builtins.elem "/dev/net" (settings.sandbox-paths or [ ]); hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
} }
) )