public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nix-daemon: default nix.useSandbox to true.

Browse Source
This commit is contained in:
Andreas Rammhold 2018-07-29 11:01:55 +02:00
parent 6dd7ddd5b8
commit 4f6df27aee
No known key found for this signature in database
GPG Key ID: E432E410B5E48C86
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/doc/manual/release-notes/rl-1809.xml
View File

@ -370,7 +370,9 @@ inherit (pkgs.nixos {
<varname>s6-dns</varname>, <varname>s6-networking</varname>, <varname>s6-dns</varname>, <varname>s6-networking</varname>,
<varname>s6-linux-utils</varname> and <varname>s6-portable-utils</varname> respectively. <varname>s6-linux-utils</varname> and <varname>s6-portable-utils</varname> respectively.
</para> </para>
</listitem> </listitem>
<listitem>
<para>The module option <option>nix.useSandbox</option> is now defaulted to <literal>true</literal>.
</itemizedlist> </itemizedlist>
</section> </section>
</section> </section>

10
nixos/modules/services/misc/nix-daemon.nix
View File

@ -127,16 +127,16 @@ in
useSandbox = mkOption { useSandbox = mkOption {
type = types.either types.bool (types.enum ["relaxed"]); type = types.either types.bool (types.enum ["relaxed"]);
default = false; default = true;
description = " description = "
If set, Nix will perform builds in a sandboxed environment that it If set, Nix will perform builds in a sandboxed environment that it
will set up automatically for each build. This prevents impurities will set up automatically for each build. This prevents impurities
in builds by disallowing access to dependencies outside of the Nix in builds by disallowing access to dependencies outside of the Nix
store by using network and mount namespaces in a chroot environment. store by using network and mount namespaces in a chroot environment.
This isn't enabled by default for possible performance impacts due to This is enabled by default even though it has a possible performance
the initial setup time of a sandbox for each build. It doesn't affect impact due to the initial setup time of a sandbox for each build. It
derivation hashes, so changing this option will not trigger a rebuild doesn't affect derivation hashes, so changing this option will not
of packages. trigger a rebuild of packages.
"; ";
}; };