Allow untrusted user to specify using subset of builders

[dtzWill]

Untrusted users can't add new builders, but it seems reasonable to allow specifying fewers builders used -- most commonly I find I want to say "build this locally" using something like --option builders "" but this doesn't work. So I end up sometimes invoking as root just to force a local build.

Offhand I can't come up with a good example of why this is useful (to motivate such a change), but I can say I find myself running into this at least a few times a week. I think it's usually some combination of knowledge about the size of inputs vs network transfer time vs "compute power needed"-- for example many unfree packages have "sources" 100's of mb that it's silly to scp to a beefy builder from my home uplink ... just to perform an extraction and copy to $out. But there are other examples too :).

(I thought there was an issue for this already, but can't find it. Apologies if duplicate.)

[grahamc]

There is an option on the drv to prefer local builds. Have you tried that? Graham

…

On Jul 4, 2018, at 11:00 AM, Will Dietz ***@***.***> wrote: Untrusted users can't add new builders, but it seems reasonable to allow specifying fewers builders used -- most commonly I find I want to say "build this locally" using something like --option builders "" but this doesn't work. So I end up sometimes invoking as root just to force a local build. Offhand I can't come up with a good example of why this is useful (to motivate such a change), but I can say I find myself running into this at least a few times a week. I think it's usually some combination of knowledge about the size of inputs vs network transfer time vs "compute power needed"-- for example many unfree packages have "sources" 100's of mb that it's silly to scp to a beefy builder from my home uplink ... just to perform an extraction and copy to $out. But there are other examples too :). (I thought there was an issue for this already, but can't find it. Apologies if duplicate.) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[dtzWill]

Yes, certainly. It works for things that always should be built locally-- and perhaps the example I gave is such a case. It still seems useful to be able to opt-out of performing distributed builds without requiring being a "trusted" user. More generally it seems the builders to use could safely be a subset of allowed builders, but for my use cases I think simply "--force-local" would do the trick.

[stale]

I marked this as stale due to inactivity. → More info

[stale]

I closed this issue due to inactivity. → More info

[DerRockWolf]

Not sure if this is just a weird quirk of my setup, but I currently have:

❯ sudo nix config show | grep builders
builders = @/etc/nix/machines

❯ nix config show | grep builders
builders =

❯ cat /etc/nix/machines
ssh://eu.nixbuild.net x86_64-linux,aarch64-linux - 100 1 benchmark,big-parallel - -

I "achieved" this with:
NixOS:

nix.distributedBuilds = true;
nix.buildMachines = ...

Home-Manager:

nix.settings.builders = null;

When executing nix build with -j0 as my normal user, it fails, as expected.
When executing nix build with -j0 as root, it builds using the remote builder, as expected.
When executing nix build with -j0 and --builders "@/etc/nix/machines" as my normal user, it builds using the remote builder.

The last case is unexpected and feels like a bug, especially because nix still prints this warning:

warning: ignoring the client-specified setting 'builders', because it is a restricted setting and you are not a trusted user

But then continues to run the build regardless.

---

If it's expected, I'm also happy with it, but then we should fix/remove the warning for this particular case and properly document this behavior.

I'm running on nix (Nix) 2.31.3

---

Edit: It seem to be completely irrelevant what I provide to the --builders flag. I can just do nix build installables... -j0 --builders 'foo' and it will fallback to what is specified in /etc/nix/machines...