docker-nixpkgs
docker-nixpkgs copied to clipboard
nix-community
How to run nixpkgs/nix not as root
It's critical for the cases where some directories are mounted, and I definitely don't want to root them. Previously I was able to run dockerized nix-shell with mounted directories as non-root user this way:
https://github.com/coingaming/src/blob/dab692ec0171d4c789bc60c5bbf4ede6b7e43516/btc-lsp/nix/hm-shell-docker.sh#L40-L56
With nixpkgs/nix this is not working because adduser is not in scope.
It would be possible if adduser will be presented in nixpkgs, but at the moment I could not find something similar
https://search.nixos.org/packages?channel=21.11&from=0&size=50&sort=relevance&type=packages&query=adduser
The useradd command is part of the shadow package. I don't know if you can arrange the script with it
+1 on this.
What about pkgs.fakeNss or pkgs.shadowSetup? There are some non-root setups in the examples but it's unclear to me what the best approach would be.
I have an image that can be used as non-root. However it needs the sandbox to be disabled. Code is here: https://github.com/fpletz/docker-nixpkgs/blob/master/images/nix-user/default.nix
Pre-built images available if you want to test: https://github.com/fpletz/docker-nixpkgs/pkgs/container/docker-nixpkgs%2Fnix-user
@fpletz Thanks for the heads up :blush: At least for throwaway CI images it's probably fine to disable nix sandboxing since the entire image already acts as a sandbox. I believe some (toolchain-related) things didn't work without the nix sandbox, but I'll try again. Maybe I'm remembering incorrectly and that was another issue.