Add new VM test with unprivileged daemon user#15054
Merged
Merged
Conversation
artemist
force-pushed
the
unprivileged-test
branch
from
8aea5e2 to
4ad4c87
Compare
Contributor
|
afnix has this btw https://git.afnix.fr/afnix/infra/src/commit/dcd9d041c8a9c885b65d02ec60d3316ebe2dfe39/services/build-nix-daemon/default.nix for CI. So it is possible to run with a bind-mounted store |
Member
Author
|
They aren't using |
github-actions
Bot
added
the
store
Ericson2314
reviewed
Jan 23, 2026
Ericson2314
reviewed
Jan 23, 2026
artemist
force-pushed
the
unprivileged-test
branch
3 times, most recently
from
8934329 to
d08969e
Compare
Mic92
reviewed
Jan 23, 2026
When running nix as an unprivileged user it may not be able to write to all paths in the nix store. Ignore deletion failures to fix tests that run `nix-collect-garbage` in this configuration. Co-Authored-By: John Ericson <John.Ericson@Obsidian.Systems>
All current NixOS functional VM tests have a daemon as root with the tests running as different unprivileged users. The new `functional_unprivileged-daemon` test runs the daemon and the nix functional tests as separate unprivileged users. Users may want to run an unprivileged daemon on non-NixOS systems where the administrator does not fully trust nix, but multiple users want to use nix for their own purposes. It could also be useful in concert with an overlay-mount store, where the nix daemon cannot modify the derivations used by the system, and thus a nix vulnerability would not lead to root code execution.
artemist
force-pushed
the
unprivileged-test
branch
from
d08969e to
94907eb
Compare
Mic92
approved these changes
Jan 23, 2026
auto-merge was automatically disabled
January 23, 2026 19:08
Head branch was pushed to by a user without write access
artemist
force-pushed
the
unprivileged-test
branch
from
23bc21c to
18176d2
Compare
brittonr
pushed a commit
to brittonr/nix
that referenced
this pull request
Apr 1, 2026
Add new VM test with unprivileged daemon user
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
All current NixOS functional VM tests have a daemon as root with the tests running as different unprivileged users. Users may want to run an unprivileged daemon on non-NixOS systems where the administrator does not fully trust nix, but multiple users want to use nix for their own purposes. It could also be useful in concert with an overlay-mount store, where the nix daemon cannot modify the derivations used by the system, and thus a nix vulnerability would not lead to root code execution.
Context
The new
functional_unprivileged-daemontest runs the daemon and the nix functional tests as separate unprivileged users.This relies on a read/write nix store. It may be possible to configure systemd to run the unprivileged nix in its own private mount namespace with a read/write store while the store is read-only to those outside it, but that will require more experimentation.
In order to fix garbage collection in the unprivileged test, this PR changes failure in garbage collection deletion from an error to a warning. Garbage collection is not a core part of nix evaluation, so I believe this is a reasonable change.
Add 👍 to pull requests you find important.
The Nix maintainer team uses a GitHub project board to schedule and track reviews.