Figure out real path of nix binary

learnmlcolab · February 14, 2026, 5:30am

Hi, I’m trying to find the real path (without symlink) to the nix binary.

Currently, I’m using the following nix code:

lib.getExe pkgs.nix

This is the result in my system:

/nix/store/wxm9qds5wayqnfryk3mgqikg0v4gm98l-nix-2.31.3/bin/nix

The result from readlink $(which nix) is the same:

/nix/store/wxm9qds5wayqnfryk3mgqikg0v4gm98l-nix-2.31.3/bin/nix

But, in my system, /nix/store/wxm9qds5wayqnfryk3mgqikg0v4gm98l-nix-2.31.3/bin/nix is a symlink to /nix/store/y7m2phpvda41km4m4hqg1p08acvqi44r-nix-2.31.3/bin/nix.

How do I get the /nix/store/y7m2phpvda41km4m4hqg1p08acvqi44r-nix-2.31.3/bin/nix path using nix code?

For context, I need the real path to create OpenSnitch rule, I’m using lib.getExe pkgs.nix but the resulting path is not what OpenSnitch expects.

tejing · February 14, 2026, 9:18am

which nix points to a symlink in a “merged set” of packages made for your PATH, which points into the actual nix package. You’d need to use realpath to follow the chain of symlinks to its actual end.

As for why there’s another layer of symlink, that seems to be because the nix package is built in pieces and then symlinked together into a single store object.

If I’m following the nix packaging correctly, you can find the underlying package with the cli command in it, from inside the nix language, from lib.getExe pkgs.nix.nix-cli.

learnmlcolab · February 14, 2026, 2:18pm

Thanks a lot @tejing, lib.getExe pkgs.nix.nix-cli works.

If I’m following the nix packaging correctly, you can find the underlying package with the cli command in it, from inside the nix language, from lib.getExe pkgs.nix.nix-cli.

Would you mind telling me how you figured this out? I’ve been checking nixpkgs since your reply, but still have no clue how to do it.

waffle8946 · February 14, 2026, 2:51pm

github.com/NixOS/nixpkgs

pkgs/tools/package-management/nix/modular/packaging/everything.nix

6c5e707c6


      
          installPhase =
            let
              devPaths = lib.mapAttrsToList (_k: lib.getDev) finalAttrs.finalPackage.libs;
            in
            ''
              mkdir -p $out $dev/nix-support
          
              # Custom files
              echo $libs >> $dev/nix-support/propagated-build-inputs
              echo ${nix-cli} ${lib.escapeShellArgs devPaths} >> $dev/nix-support/propagated-build-inputs
          
              # Merged outputs
              lndir ${nix-cli} $out

indicates that nix-cli got linked into the package’s contents, and

github.com/NixOS/nixpkgs

pkgs/tools/package-management/nix/modular/packaging/everything.nix

6c5e707c6


      
          passthru = {
            inherit (nix-cli) version;
            inherit nix-cli;

indicates that it’s exposed as an attribute (i.e. .nix-cli would actually work)

If you really wanted to be safe I’d use config.nix.package rather pkgs.nix (assuming you’re using nix).

learnmlcolab · February 15, 2026, 3:17am

Thanks @waffle8946, I think I understand it now.

If you really wanted to be safe I’d use config.nix.package rather pkgs.nix (assuming you’re using nix).

Yeah, I will switch to config.nix.package.nix-cli.