From 2697d34603c9bdf7b6b1728ece7c72efdb4872a4 Mon Sep 17 00:00:00 2001
From: WxNzEMof <143541718+WxNzEMof@users.noreply.github.com>
Date: Mon, 22 Jan 2024 11:49:52 +0000
Subject: [PATCH] streamLayeredImage: Change mode of /nix, /nix/store to 755

The change is insignificant when the owner is root.  However, when it
is not root, this change is needed to allow using Nix (as an
unprivileged user) inside the container.
---
 nixos/tests/docker-tools.nix                      | 2 +-
 pkgs/build-support/docker/stream_layered_image.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index f252eb9ff61e..b819932ca4cc 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -181,7 +181,7 @@ in {
     ):
         docker.succeed(
             "docker load --input='${examples.bashLayeredWithUser}'",
-            "docker run -u somebody --rm ${examples.bashLayeredWithUser.imageName} ${pkgs.bash}/bin/bash -c 'test 555 == $(stat --format=%a /nix) && test 555 == $(stat --format=%a /nix/store)'",
+            "docker run -u somebody --rm ${examples.bashLayeredWithUser.imageName} ${pkgs.bash}/bin/bash -c 'test 755 == $(stat --format=%a /nix) && test 755 == $(stat --format=%a /nix/store)'",
             "docker rmi ${examples.bashLayeredWithUser.imageName}",
         )
 
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
index b7e68fe32285..98ec2358cef9 100644
--- a/pkgs/build-support/docker/stream_layered_image.py
+++ b/pkgs/build-support/docker/stream_layered_image.py
@@ -70,7 +70,7 @@ def archive_paths_to(obj, paths, mtime, uid, gid, uname, gname):
         return ti
 
     def nix_root(ti):
-        ti.mode = 0o0555  # r-xr-xr-x
+        ti.mode = 0o0755  # rwxr-xr-x
         return ti
 
     def dir(path):