Remove restricted eval mode

[edolstra]

This feature was added to ensure that Hydra jobs don't access files they're not supposed to touch. However, it would be a lot easier and more secure to just have hydra-eval-jobset run hydra-eval-jobs in a mount namespace containing only the input directories.

The allowed-uris option should be kept though, since that cannot be easily enforced via sandboxing.

[FRidh]

in a mount namespace containing only the input directories

Will paths obtained with fetchTarball and fetchGit also be added recursively to the mount namespace as they become available?

[domenkozar]

Point: this will limit CIs to always only evaluate on linux, which may or may not be desired.

[stale]

I marked this as stale due to inactivity. → More info

[stale]

I closed this issue due to inactivity. → More info

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/what-is-restricted-evaluation-mode-in-nix/26578/1