# The Nix sandbox is a hidden input
**URL:** https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269
**Category:** Links
**Created:** [July 31, 2026, 8:52pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269 "2026-07-31T20:52:27Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@fzakaria](https://discourse.nixos.org/u/fzakaria)
#### Post date: [July 31, 2026, 8:52pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/1 "2026-07-31T20:52:28Z")
> **[The Nix sandbox is a hidden input](https://fzakaria.com/2026/07/30/the-nix-sandbox-is-a-hidden-input)**
>
> The whole beauty of Nix was that it was incredibly pragmatic to achieve “reproducibility”, which is quite an overloaded term. The default model for Nix is the intensional-model which is input-addressed: the hash of a store path is derived from the...
I learn something new about Nix every day.
---
### Author:  [@colecf](https://discourse.nixos.org/u/colecf)
#### Post date: [August 4, 2026, 4:09pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/2 "2026-08-04T16:09:46Z")
> Is this a bug? 🤔
> This is tough to say. Including the sandbox-paths in the derivation would make Nix completely unusable. Suppose you did fold sandbox-paths into the output hash by having it in the derivation. My busybox is busybox-1.37.0 at one store path; yours is a different version at a different path. The same derivation would then hash to different outputs on our two machines, and binary-cache sharing across would collapse.
I don’t think this is true, or if it is true it would also behave like that for any other dependency from nixpkgs. If you provide a flake producing some derivation, you’ll use that flake’s pinned version of nixpkgs for the derivation’s dependencies, so even if you use a different version of BusyBox in your nixpkgs, everyone will use the same nixpkgs to build this one derivation.
This is why many flakes tell you not to use `inputs..inputs.nixpkgs.follows = "nixpkgs";`, as doing that would cause everyone to use a different BusyBox to compile the dep.
(Hello again Farid 😀 I saw this from lobsters but I don’t have an account there)
---
### Author:  [@fzakaria](https://discourse.nixos.org/u/fzakaria)
#### Post date: [August 4, 2026, 4:28pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/3 "2026-08-04T16:28:47Z")
That part wasn’t clear.
What i meant:
If you allow it to be configurable AND ALSO become an input, then that will modify the hash unecessarily.
The busybox on NixOS is set by the release/commit you are on, so if you tried to install anything outside that commit, you will never get a cache hit.
Also, Hello!
---
### Author:  [@colecf](https://discourse.nixos.org/u/colecf)
#### Post date: [August 4, 2026, 9:59pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/4 "2026-08-04T21:59:30Z")
Ah yeah, that’s true of any CLI flag that causes changes in the inputs to a derivation, so I don’t think it’s that surprising. The flag probably shouldn’t exist though.
---
### Author:  [@fzakaria](https://discourse.nixos.org/u/fzakaria)
#### Post date: [August 4, 2026, 10:03pm UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/5 "2026-08-04T22:03:54Z")
well that’s the point; very few flags do change those… and they usuall have crazy stuff like “impure” in the name not “sandbox” 😛
Having a “pure hermetic” builder and then poking a bunch of holes in it…seems counter productive 🙂
---
### Author:  [@hugosenari](https://discourse.nixos.org/u/hugosenari)
#### Post date: [August 6, 2026, 10:13am UTC](https://discourse.nixos.org/t/the-nix-sandbox-is-a-hidden-input/79269/6 "2026-08-06T10:13:33Z")
Would be a good fit for this feature?
> **[Nix is a lie, and that’s ok](https://fzakaria.com/2026/03/07/nix-is-a-lie-and-that-s-ok)**
>
> When Eelco Dolstra, father of Nix, descended from the mountain tops and enlightened us all, one of the main commandments for Nix was to eschew all uses of the Filesystem Hierarchy Standard (FHS).