Why does the `nixbld` group have a GID of 30000?

toraritte · September 6, 2023, 3:36pm

Always thought of Nix worker users in nixbld as system users, and so I thought nixbld would have a GID that reflects that (i.e., below 1000). (Not that there is any difference in any way, just curious why this number was chosen.)

On Mac:

$ dscacheutil -q group | grep -A 3 'name: nixbld'

name: nixbld                                                                                                                                                                                                                                                                  
password: *                                                                                                                                                                                                                                                                   
gid: 30000                                                                                                                                                                                                                                                                    
users: _nixbld1 _nixbld2 [..]

On Ubuntu:

$ getent group | grep nixbld

nixbld:x:30000:nixbld1,nixbld2, [..]

abathur · September 6, 2023, 4:53pm

Unless Eelco weighs in or there are preserved discussions from the time, I imagine the closest to an answer is:

github.com

NixOS/nix/blob/fa44e401a8ca5cddc2c5506984f0cd476e0b7d57/doc/manual/installation.xml#L268-L285


      
          <section><title>Setting up the build users</title>
          
          
<para>The <emphasis>build users</emphasis> are the special UIDs under
          which builds are performed.  They should all be members of the
          <emphasis>build users group</emphasis> (usually called
          <literal>nixbld</literal>).  This group should have no other members.
          The build users should not be members of any other group.</para>
          
          
<para>Here is a typical <filename>/etc/group</filename> definition of
          the build users group with 10 build users:
          
          
<programlisting>
          nixbld:!:30000:nixbld1,nixbld2,nixbld3,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9,nixbld10
          </programlisting>
          
          
In this example the <literal>nixbld</literal> group has UID 30000, but
          of course it can be anything that doesn’t collide with an existing
          group.</para>

gytis-ivaskevicius · September 6, 2023, 7:20pm

I think a better question is we still don’t have cgroups isolated builds?

abathur · September 6, 2023, 7:43pm

https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-use-cgroups

https://nixos.org/manual/nix/stable/release-notes/rl-2.12