We quietly implemented support for a rootless Nix daemon a few months ago, and I have just finished a post describing the challenges in a bit more detail.
Thank you to the Nix Foundation and the Sovereign Tech Agency for funding this project.
41 Likes
I applied code snippet from blog post to my NixOS configuration but I get permission denied errors after reboot and trying to nixos-rebuild build my configuration
warning: creating directory "/root/.cache/nix": Permission denied
error: opening lock file "/nix/store/1xp94zk7f614k0jwc794yvmiwbwmnxmh-xkb-console-keymap.lock": Permission denied
I managed to workaround this with manually setting /nix/store ownership to nix-daemon:nix-daemon but now daemon doesn’t use binary cache to download pre-built binaries.
What am I doing wrong?
1 Like
What are the positives / negatives of rootless vs … not rootless nix daemon?
I’ve been using this for a while on Ubuntu, (although I didn’t go through the read-only mount process for the nix store and the local overlay, since I won’t be giving my users root access) and it’s been great!
One note for Ubuntu users, the OS wants the nix daemon to have an apparmor profile because apparently user namespaces are a huge source of security bugs
1 Like
That’s my mistake, I seemed to have missed something during upstreaming. the Nix daemon isn’t getting a home directory needed for the cache, so you’ll have to make one.
A simple workaround would be:
systemd.tmpfiles.rules = [
"d /nix/var/nix/home 0700 nix-daemon nix-daemon - -"
];
systemd.services.nix-daemon.environment.HOME = "/nix/var/nix/home";
I’ll work on something cleaner and upstream it.
2 Likes