Is it possible to use __noChroot during nixos-install? It works fine during a rebuild, but not when installing a new system, apparently; the build phase doesn’t seem to have access to external directories at that time.
However, I’m using a nix-shell as well; is it possible that’s interfering with it?
__noChroot wouldn’t work during a nixos-install as instead of using /nix/store, nix uses /mnt/nix/store and chroot is required for builders to use the correct store (/mnt/nix/store).
Got it. Hmm… Is there any possible way to access external directories during nixos-install builds?
It depends on what directories you need access to, however you can set sandbox-paths (nix.conf - Nix 2.34.9 Reference Manual) to allow a builder access to an external directory
sandbox-paths can be specified by passing --option sandbox-paths "/example /another-example" to nixos-install.
That shouldn’t be allowed during a Oh you mean you can enable nixos-rebuild either, so I don’t know how you’ve come to a conclusion that it works fine during a rebuild.__noChroot to do this for nixos-rebuild. Still, it’s extremely unlikely that doing this is a good idea. What are you actually trying to do?
I was using git-agecrypt to manage runtime build secrets, but reencryption was extremely difficult for me there, so I switched to a sort of “builder” user with a global age identity that the nixbld group can access during rebuilds. The identity is then used to decrypt agenix secret files. The identity being global doesn’t really bother me since the files would already be world-readable. I just need them to not be readable in a public repo. They’re not exactly secret, just licensed for a single user.
Got it. Will this work for just files, or do entire directories need to be specified?
It will work for both files (even special files) and directories, however I made a small mistake and you should be using extra-sandbox-paths (adds to sandbox-paths) as that won’t overwrite the entry for /bin/sh.
Perfect. Does this work for rebuilds as well? Because I think I tried it with nh, and it doesn’t seem to work.
I’m not familiar with nh (I still use nixos-rebuild), however specifying extra-sandbox-paths is a privileged operation.
If you’re not running nh as root, it might be worth setting nix.settings.extra-sandbox-paths in your configuration.nix.
Yep. It works. Now I can make the sandbox strict again. Thanks for all the help!