# \`sudo\` does not work from within vscode-fhs
**URL:** https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227
**Category:** Help
**Created:** [July 23, 2021, 4:32pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227 "2021-07-23T16:32:19Z")
**Posts on this page:** 12
**Page:** 2
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [June 4, 2025, 4:17pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/21 "2025-06-04T16:17:14Z")
> [@Malix](#):
>
> So should we conclude it is impossible to make `.fhs` variants of editors be able to edit root files?
This was already said in the thread twice, but to be absolutely clear, **yes, it’s impossible** to use sudo within \*.fhs for security reasons.
The workarounds were already provided as well.
> [@\`sudo\` does not work from within vscode-fhs](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/5):
>
> It is impossible to use SUID applications from within user namespaces for good reason. Otherwise an unprivileged user could simply bind a crafted /etc/sudoers and become root.
> [@\`sudo\` does not work from within vscode-fhs](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/12):
>
> The answer is pretty clear: All the Linux namespace wrappers (bubblewrap, NixOS user chroot, firejail, etc.) seem to enforce PR\_SET\_NO\_NEW\_PRIVS 5 which means suid binaries cannot be executed. Rightfully so, in my opinion, because suid binaries allow the jailed application to break out and elevate its privileges. I.e., for security reasons, this is not possible. If you want to run a command as root, you have to do it in a terminal not launched by vscode. Alternatively, you could use the vsc…
---
### Author:  [@anon23399578](https://discourse.nixos.org/u/anon23399578)
#### Post date: [June 4, 2025, 5:03pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/22 "2025-06-04T17:03:53Z")
> [@Malix](#):
>
> This is interesting, is it documented somewhere as a best practice?
There’s the [official wiki](https://wiki.nixos.org/wiki/Nixos-rebuild#Specifying_a_different_configuration_location) and the `nixos-rebuild` [manual page](https://www.mankier.com/8/nixos-rebuild#--profile-name) (sorta).
---
### Author:  [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [June 4, 2025, 6:00pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/23 "2025-06-04T18:00:28Z")
> [@Malix](#):
>
> I need VSCode to be able to use its sync mechanism
Non-FHS should support that as well.
For now I assume that you could just change.
---
### Author:  [@Kin](https://discourse.nixos.org/u/Kin)
#### Post date: [November 16, 2025, 8:32pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/24 "2025-11-16T20:32:58Z")
I don’t really understand the reluctance to consider this an actual issue. I’m fairly new to NixOS, but looking at the documentation for buildFHSEnv the goal doesn’t seem to be security or strong isolation but the ability to run applications which don’t natively support NixOS.
[https://ryantm.github.io/nixpkgs/builders/special/fhs-environments/#sec-fhs-environments](https://ryantm.github.io/nixpkgs/builders/special/fhs-environments/#sec-fhs-environments)
> It works similar to containerisation technology such as Docker or FlatPak but provides no security-relevant separation from the host system.
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [November 16, 2025, 8:54pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/25 "2025-11-16T20:54:07Z")
> [@Kin](#):
>
> [buildFHSEnv | nixpkgs](https://ryantm.github.io/nixpkgs/builders/special/fhs-environments/#sec-fhs-environments)
This is not an official documentation site; you should only be looking at docs from [nixos.org](http://nixos.org) or nix.dev - in this case [https://nixos.org/manual/nixpkgs/unstable/#sec-fhs-environments](https://nixos.org/manual/nixpkgs/unstable/#sec-fhs-environments).
Anyway it’s explained more clearly in [buildFHSEnv: binaries with capabilities cannot make use of them · Issue #217119 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/issues/217119#issuecomment-2003921118).
Ultimately you are better off just using the regular vscode. I don’t really understand the copy-pasted desire to use vscode-fhs other than “someone else did so I must too.”
---
### Author:  [@Kin](https://discourse.nixos.org/u/Kin)
#### Post date: [November 16, 2025, 8:59pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/26 "2025-11-16T20:59:19Z")
> This is not an official documentation site; you should only be looking at docs from [nixos.org](http://nixos.org) or nix.dev - in this case [Nixpkgs Reference Manual](https://nixos.org/manual/nixpkgs/unstable/#sec-fhs-environments).
I don’t know what point you are trying to make, the text is exactly the same. I just quoted the docs that someone else did in this thread.
> Ultimately you are better off just using the regular vscode. I don’t really understand the copy-pasted desire to use vscode-fhs other than “someone else did so I must too.”
The reasoning being entire workflows aren’t supported by it. What is the point of using an application when most of its capability won’t work without an ever increasing number of overrides and configuration hacks. We already have tools and workflows for working with/in vscode, and if Nix can’t support then its on Nix.
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [November 16, 2025, 9:02pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/27 "2025-11-16T21:02:17Z")
> [@Kin](#):
>
> I don’t know what point you are trying to make, the text is exactly the same.
The point is to stick to using official manuals instead of 2-year outdated sites.
> [@Kin](#):
>
> The reasoning being entire workflows aren’t supported by it. What is the point of using an application when most of its capability won’t work without an ever increasing number of overrides and configuration hacks.
If you need to run `sudo` and insist on using `vscode-fhs`, run it outside the fhs. We’re not going to fork the kernel and open a security hole just for this edge case. It’s that simple.
> [@hmenke](#):
>
> All the Linux namespace wrappers (bubblewrap, NixOS user chroot, firejail, etc.) seem to enforce [`PR_SET_NO_NEW_PRIVS`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) which means suid binaries cannot be executed.
btw, `buildFHSEnv` is also a hack, so is the entirety of nix and NixOS, it’s just a matter of taste, maintainability, and security as to which hacks are tolerable.
---
### Author:  [@Kin](https://discourse.nixos.org/u/Kin)
#### Post date: [November 16, 2025, 9:16pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/28 "2025-11-16T21:16:58Z")
It sounds like less a matter of taste and more-so inflexibility and platform incompetence. I don’t see the point of reproducibility when whole standard workflows aren’t supported. No one’s asking anyone to fork the kernel or introduce security vulnerabilities, just to simply treat this an actual issue and not “you’re doing it wrong”. I think this really shows the downsides of Nix, the Nix community, and I’m realizing its not the developer friendly OS I expected.
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [November 16, 2025, 9:30pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/29 "2025-11-16T21:30:47Z")
It’s a kernel limitation, as mentioned in the link I posted earlier and the quote I mentioned. I think it’s well-explained how you are basically asking for a security hole, and standard-for-you != standard. Though if you have a better solution to propose do so, it’s open source after all. But if you are just asking for everyone else to drop things and work on your problem for free, I think you will find limited success with that approach in _any_ open-source community, especially after hurling insults 🙂
---
### Author:  [@Malix](https://discourse.nixos.org/u/Malix)
#### Post date: [November 17, 2025, 12:16pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/30 "2025-11-17T12:16:26Z")
> [@NobbZ](#):
>
> Non-FHS should support that as well.
It doesn’t for extensions
> [@waffle8946](#):
>
> Ultimately you are better off just using the regular vscode. I don’t really understand the copy-pasted desire to use vscode-fhs other than “someone else did so I must too.”
Using and syncing extensions using VSCode alone and without nixification
Some environment wouldn’t work with nix (including VSCode web)
* * *
However, I understand the security implications of making sudo work from within a sandboxed `.fhs` package and the tradeoff using `.fhs` implies
---
### Author:  [@Michael-C-Buckley](https://discourse.nixos.org/u/Michael-C-Buckley)
#### Post date: [November 17, 2025, 2:00pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/31 "2025-11-17T14:00:15Z")
I use sync and assumed I needed the fhs edition. I swapped yesterday and the extensions were there, working on non-fhs one. I added a new one while on my windows work laptop. I’ll boot my personal up in a bit to check the changes.
---
### Author:  [@Malix](https://discourse.nixos.org/u/Malix)
#### Post date: [November 17, 2025, 3:26pm UTC](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227/32 "2025-11-17T15:26:30Z")
I also have been told that extensions wouldn’t work without `.fhs` but I just tested and indeed, the non-fhs version also was able to install and sync extensions too
Then, I do not know any benefit of `vscode.fhs` compared to `vscode`
[Previous page](https://discourse.nixos.org/t/sudo-does-not-work-from-within-vscode-fhs/14227.md?page=1)