libstore: use pasta for FODs if available#15959
Open
lisanna-dettwyler wants to merge 1 commit into
Open
Conversation
This allows using a userspace program, pasta, to handle comms between the build sandbox, and the outside world; allowing for full isolation including the network namespace, closing the "fixed-output derivation talks to the host over an abstract domain socket" hole for good. Co-authored-by: Puck Meerburg <puck@puckipedia.com> Co-authored-by: eldritch horrors <pennae@lix.systems> Co-authored-by: Jörg Thalheim <joerg@thalheim.io> Signed-off-by: Lisanna Dettwyler <lisanna.dettwyler@gmail.com>
github-actions
Bot
added
the
with-tests
ysndr
reviewed
Jun 10, 2026
ysndr
left a comment
ysndr
left a comment
Member
There was a problem hiding this comment.
Been curious and left some thoughts.
| nsInSandbox += fmt("nameserver %s\n", PASTA_HOST_IPV6); | ||
| } | ||
| return std::regex_replace(fromHost, lineRegex, "") + nsInSandbox; | ||
| } |
Member
There was a problem hiding this comment.
this appears unused?
https://github.com/NixOS/nix/pull/15959/changes#diff-51cde72b51cf1ba7c7759e7e43654bed525b3db1d382ec9f41ecabd1add6a76aR657 calls pasta::rewriteResolvConf nothing calls this method.
| "--quiet", | ||
| "--config-net", | ||
| "--gateway", PASTA_HOST_IPV4, | ||
| "--address", PASTA_CHILD_IPV4, "--netmask", PASTA_IPV4_NETMASK, |
Member
There was a problem hiding this comment.
maybe?
Suggested change
| "--address", PASTA_CHILD_IPV4, "--netmask", PASTA_IPV4_NETMASK, | |
| "--address", PASTA_CHILD_IPV4, | |
| "--netmask", PASTA_IPV4_NETMASK, |
|
|
||
| AutoCloseFD userns; | ||
| if (usingUserNamespace) { | ||
| userns = AutoCloseFD(open(fmt("/proc/%i/ns/user", pid).c_str(), O_RDONLY | O_CLOEXEC)); |
Member
There was a problem hiding this comment.
question: if this ought to be stdout, why doesnt this need to be opened writable?
Comment on lines
+62
to
+68
| /** | ||
| * Kill the pasta process. | ||
| * | ||
| * @param pastaPid The pasta process to kill | ||
| * @throws Error if pasta exits with unexpected status | ||
| */ | ||
| void killPasta(Pid & pastaPid); |
Comment on lines
+45
to
+50
| /** | ||
| * Wait for pasta to set up the network interface. | ||
| * | ||
| * @throws Error if the interface doesn't appear within the timeout period | ||
| */ | ||
| void waitForPastaInterface(); |
Comment on lines
147
to
+153
| // Output = error code + "standard out" output stream | ||
| std::pair<int, std::string> runProgram(RunOptions && options); | ||
|
|
||
| void runProgram2(const RunOptions & options); | ||
|
|
||
| Pid startProgram(const RunOptions & options, std::shared_ptr<Pipe> out); | ||
|
|
Member
There was a problem hiding this comment.
Question: Is it generally considered trivial what these do internally?
specifically startProgram also seems to gain error cases for dup'ing and handling CAPs.
|
|
||
| // we do the capability dance like this to avoid a dependency | ||
| // on libcap, which has a rather large build closure and many | ||
| // more features that we need for now. maybe some other time. |
Member
There was a problem hiding this comment.
Suggested change
| // more features that we need for now. maybe some other time. | |
| // more features than we need for now. maybe some other time. |
Comment on lines
+122
to
+126
| PASTA_COUNT_BEFORE=$(pgrep -c pasta || echo 0) | ||
| NIX_CONFIG="pasta-path = $PASTA_PATH | ||
| sandbox-paths = $NIX_SANDBOX_PATHS" \ | ||
| nix-build pasta-cleanup-test.nix --no-out-link | ||
| PASTA_COUNT_AFTER=$(pgrep -c pasta || echo 0) |
Member
There was a problem hiding this comment.
is this potentially flaky on a machine using pasta, outside of this test process?
I imagine more so once this PR lands and FODs are built with pasta in the background.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
This allows using a userspace program, pasta, to handle comms between the build sandbox, and the outside world; allowing for full isolation including the network namespace, closing the "fixed-output derivation talks to the host over an abstract domain socket" hole for good.
Context
Prior branch: https://github.com/NixOS/nix/tree/pasta-old
Lix implementation: https://git.lix.systems/lix-project/lix/commit/a959290f4
Add 👍 to pull requests you find important.
The Nix maintainer team uses a GitHub project board to schedule and track reviews.