mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-07-07 13:25:11 +02:00
Ryan Yin
0fe12bef5a
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap. Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net. Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
23 lines
799 B
Nix
23 lines
799 B
Nix
{
|
|
lib,
|
|
outputs,
|
|
}:
|
|
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
|
|
name:
|
|
let
|
|
settings = outputs.nixosConfigurations.${name}.config.nix.settings;
|
|
effectiveSystemFeatures =
|
|
(settings.system-features or [ ]) ++ (settings.extra-system-features or [ ]);
|
|
in
|
|
{
|
|
autoAllocateUids = settings.auto-allocate-uids or false;
|
|
hasUidRange = builtins.elem "uid-range" effectiveSystemFeatures;
|
|
hasAutoAllocateUidsFeature = builtins.elem "auto-allocate-uids" (
|
|
settings.experimental-features or [ ]
|
|
);
|
|
hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
|
|
hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
|
|
hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
|
|
}
|
|
)
|