[ojsef39]

Changes

The nix wrapper now only defaults NIX_STORE_DIR, NIX_DATA_DIR, NIX_LOG_DIR, NIX_STATE_DIR and NIX_CONF_DIR to the containerbase cache when they aren't already set (${NIX_STORE_DIR:-<cache>/store} etc.), as suggested in #7339.

Context

Binary caches only serve paths under /nix/store, because the store prefix is part of every store path's hash. A nix whose store lives below the cache can't substitute anything, so anything that has to realise a store path builds it from source, starting with the whole stdenv bootstrap:

warning: binary cache 'https://cache.nixos.org' is for Nix stores with prefix '/nix/store', not '/tmp/containerbase/cache/nix/store'

nix flake update, which is what Renovate's nix manager runs today, doesn't hit this. Anything that builds or fetches through nix does. My use case is a Renovate fork that computes fixed-output hashes after a version bump, which is the nix-update manager linked in #7339. I've thought about upstreaming that manager, but I don't think it's stable enough yet to propose. This change lets the fork run on the stock base image in the meantime, and makes it possible for anyone else who needs nix to actually build or fetch through it.

Until #7446 an image could sed tools/v2/nix.sh to work around this. The wrapper is now generated by the CLI at install time, and the exports come after the tool env.sh, so there is no way left to override them from the image.

Please select one of the following:

• This closes an existing Issue, Closes: Move Nix tool store dir #7339
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes). -> Opus 5.5
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Use of AI in replying to PR comments

Who answers review comments:

• @username will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

Summary by CodeRabbit

• Improvements
  • Nix setup now preserves existing values for the store, data, log, state, and configuration directories. If a value is unset or empty, the corresponding containerbase cache directory is used by default.
  • Nix documentation now explains that these directories default below the containerbase cache and that a writable /nix can be used for binary-cache substitution.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: containerbase/base
• Branch: main
• File: .coderabbit.yaml
• Commit: 823b9cc
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 95f2bf26-f0b7-40d4-8575-fbe3362383c2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The Nix link command preserves existing Nix directory values and uses cache paths as fallbacks. Docker tests check Nix store behavior with default and preset directories.

Changes: Nix store directory handling

Layer / File(s)	Summary
Preserve Nix directory environment values src/cli/tools/nix.ts, src/cli/tools/nix.spec.ts	The link command uses existing values for all five Nix directory variables and falls back to cache paths when values are unset or empty. Documentation and test expectations describe this behavior.
Verify Nix store paths in Docker test/nix/Dockerfile	Docker tests check that the store path is not /nix/store without preset directories and is /nix/store when store, state, and log directories are set. The final image copies the test stage marker.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature · Severity of issue fixed: Medium

Merge Risk: Minimal · previous review 88747

Preset Nix directory values are retained, while unset values keep the cache-based defaults. The reviewed tests cover the generated exports and preset store selection; no actionable merge risk is evident.

Security architecture risk: Low · up to 985ad

The change preserves configured Nix directories without visibly granting additional privileges. Risk depends on who supplies those settings and owns the selected directories; production caller identities and shared-directory isolation remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The immediate exposure is Nix processes using regenerated wrappers and the store, state, data, log, and configuration paths selected by their environment. Impact on other jobs or assets depends on runtime identity and shared filesystem permissions; tenant and production deployment scope are not established.

Security Findings and Attack Paths

• inferred — Environment values gain reachability to Nix directory configuration, but the inspected path does not establish command injection or privilege escalation. Nix supplies fixed shell assignment templates, whose expanded environment contents are not recursively parsed as commands. Exploitation of a privileged caller accepting lower-trust settings remains unproven because production invocation evidence is unavailable.

Trust Boundaries and Controls

• observed — The generated wrapper invokes initialization and Nix directly, without a privilege-switching command. The preset-path fixture uses a non-root identity and explicitly provisions ownership, providing counterevidence to authority acquisition in that tested arrangement.

Hardening Proposals

• proposed — For deployments adopting external Nix directories, define directory ownership, sharing, and recovery policy explicitly, and avoid allowing lower-trust jobs to select configuration or state paths used by a more privileged identity.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preserving preset Nix store and state directory values.
Linked Issues check		Issue #7339 requires a usable canonical /nix/store path or an equivalent local-store configuration. NixInstallService.link now preserves preset NIX_STORE_DIR and related Nix directory variables,…
Out of Scope Changes check		The changes cover Nix directory export behavior, its unit test, and Nix integration coverage for preset and default store paths. The wrapper documentation describes the binary-cache use case. These ch…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: containerbase/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 818877b5-d49c-4334-bcad-d9fb29a19cf8

📥 Commits

Reviewing files that changed from the base of the PR and between 985ad34 and 88747dd.

📒 Files selected for processing: 1

• src/cli/tools/nix.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[qodo-code-review]

Code Review by Qodo

📎 Requirement gaps (1)

1. Default Nix builds miss binary caches 📎 Requirement gap

Description

NixInstallService.link defaults NIX_STORE_DIR to the container cache instead of presenting the
store at /nix/store. When callers do not predefine NIX_STORE_DIR, Nix resolves
builtins.storeDir below the cache, so binary-cached dependencies cannot be substituted and builds
fall back to source.

Code

src/cli/tools/nix.ts[R60-63]

+        `NIX_STORE_DIR=\${NIX_STORE_DIR:-${cache}/store}`,
+        `NIX_DATA_DIR=\${NIX_DATA_DIR:-${cache}/data}`,
+        `NIX_LOG_DIR=\${NIX_LOG_DIR:-${cache}/log}`,
+        `NIX_STATE_DIR=\${NIX_STATE_DIR:-${cache}/state}`,

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The wrapper still defaults `NIX_STORE_DIR` to the container cache, and the added smoke test confirms that the default store is not `/nix/store`. This prevents Nix from using binary caches unless every caller preconfigures the environment.

## Fix Focus Areas
- src/cli/tools/nix.ts[60-64]
- test/nix/Dockerfile[95-97]

## Recommended Fix
Make the default Nix store available at canonical `/nix/store`, either by using `/nix/store` directly when writable or by implementing a local-store/chroot mapping that presents the cache-backed store as `/nix/store`. Retain environment-variable overrides for images that provide their own writable Nix directories, and update the smoke tests to verify cached-store compatibility by default.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗