Bazel inside the nix sandbox (experiment)

randomizedcoder · March 23, 2026, 2:04am

G’day,

I’ve been trying to build Redpanda ( the fast Kafka server ), which is tricky cos it has bazel.

Anyway, I’ve managed to get it working, including with the bazel caching. This is a bit nasty, because it’s putting the bazel cache into the sandbox, so it’s not 100% “pure” anymore. Not recommended in general, but maybe that’s ok for some people who want the speed of bazel and need to rebuild multiple times.

The good news is nix builds much smaller OCI containers than the real redpanda ones.

Anyway, I spoke with a few people at PlanetNix about this idea, so I thought people might be interested to see. … I need to find another large project that has bazel, so I can see if this solution is generic enough.

github.com/randomizedcoder/redpanda

nix/README.md

205fd7769

# Building Redpanda with Nix

## Quick Start

### Prerequisites

- Nix with flakes enabled (`experimental-features = nix-command flakes` in
  `/etc/nix/nix.conf` or `~/.config/nix/nix.conf`)
- ~20 GB disk for the first build

### Minimal Build (no nix.conf changes)

This works out of the box with just Nix flakes enabled:

```bash
nix build .#redpanda --print-build-logs
result/bin/redpanda --version
```

Each build compiles from scratch (~30 min) because the Bazel action cache

This file has been truncated. show original

github.com/randomizedcoder/redpanda

nix/nix-bazel-module-precacher-design.md

205fd7769

# Design: Nix-Managed Bazel Module Precacher (v2)

## Context

Building Redpanda via `nix build` requires running Bazel inside Nix's sandbox, where
there is no network access. The previous approach used a Fixed-Output Derivation (FOD)
to run `bazel fetch` with network access, downloading ~470 archives. This was fragile:
the FOD hash is all-or-nothing (any MODULE.bazel change invalidates everything).

This document describes the **implemented** replacement: per-archive Nix `fetchurl`
derivations assembled into a linkFarm that serves as Bazel's repository cache.

## The Core Problem

Bazel modules need three things to work in Nix's sandbox:
1. **Downloaded** — no network in sandbox
2. **Nixified** — ELF binaries need patched interpreters/rpath, scripts need
   Nix-compatible shebangs, some modules need custom patches
3. **Provided to Bazel** — in a format Bazel recognizes

This file has been truncated. show original

Thanks,

Dave