nixos/virtualisation: disallow specialisation in nspawn-container

2026-03-03 16:32:01 +01:00
parent af0238c70e
commit 3acd5cae61
1 changed files with 8 additions and 0 deletions
@@ -71,6 +71,14 @@ in
    boot.isNspawnContainer = true;

    assertions = [
+      {
+        assertion = config.specialisation == { };
+        message = ''
+          Setting 'specialisation' is disallowed for systemd-nspawn container configurations.
+          Activating a specialisation requires creating SUID wrappers (e.g., for 'sudo'),
+          which is prohibited within the Nix build sandbox where the test is run.
+        '';
+      }
      {
        # Check every interface defined in allInterfaces.
        # Containers try to create a bridge "${config.system.name}-${interfaceName}"