From 1ccfe2eb2692b700f1dacd0256bd719cfa2bb22a Mon Sep 17 00:00:00 2001 From: Jared Baur Date: Fri, 21 Nov 2025 15:43:24 -0800 Subject: [PATCH] buildFHSEnvBubblewrap: do not use read-only bind on /nix Using a read-only bind mount on /nix for bubblewrap FHS environments means that the build products of buildFHSEnvBubblewrap cannot write to anywhere in /nix (notably /nix/var/nix/*, which is not a read-only directory in any deployment I've seen). Since /nix/store is in most cases already read-only on the host system (thanks to `boot.nixStoreMountOpts` defaulting to options that make it read-only), there is no need to enforce that property on the bubblewrap side as well. --- pkgs/build-support/build-fhsenv-bubblewrap/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix index e69e990d3f29..214656bbb955 100644 --- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix +++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix @@ -288,7 +288,7 @@ let ${optionalString unshareUts "--unshare-uts"} ${optionalString unshareCgroup "--unshare-cgroup"} ${optionalString dieWithParent "--die-with-parent"} - --ro-bind /nix /nix + --bind /nix /nix ${optionalString privateTmp "--tmpfs /tmp"} # Our glibc will look for the cache in its own path in `/nix/store`. # As such, we need a cache to exist there, because pressure-vessel