From 3acd5cae61da04264077499a24da39141f86dc02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?=
 <kieran.meinhardt@applicative.systems>
Date: Mon, 9 Feb 2026 17:00:31 +0100
Subject: [PATCH] nixos/virtualisation: disallow specialisation in
 nspawn-container

---
 nixos/modules/virtualisation/nspawn-container/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix
index 56bcb13e68bf..c62bcfeb4540 100644
--- a/nixos/modules/virtualisation/nspawn-container/default.nix
+++ b/nixos/modules/virtualisation/nspawn-container/default.nix
@@ -71,6 +71,14 @@ in
     boot.isNspawnContainer = true;
 
     assertions = [
+      {
+        assertion = config.specialisation == { };
+        message = ''
+          Setting 'specialisation' is disallowed for systemd-nspawn container configurations.
+          Activating a specialisation requires creating SUID wrappers (e.g., for 'sudo'),
+          which is prohibited within the Nix build sandbox where the test is run.
+        '';
+      }
       {
         # Check every interface defined in allInterfaces.
         # Containers try to create a bridge "${config.system.name}-${interfaceName}"