nix install on linux can fail with "cloning builder process: Operation not permitted"

[simonmichael]

The nix command for installing hledger, on the download page, can fail with an error like:

cloning builder process: Operation not permitted

since nix requires some kernel permission that GNU/Linux distros may not grant by default (NixOS/nix#2633). The workaround is to run a command similar to:

sudo sysctl kernel.unprivileged_userns_clone=1

before running nix-env.

Is it safe to leave this permission enabled ? https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do thinks not. So maybe you should disable it again after running nix-env:

sudo sysctl kernel.unprivileged_userns_clone=0

This all seems pretty lame, presumably nix will fix eventually.

[peti]

Note NixOS/nix#2633 (comment). Nix needs those privileges to set up the build sandbox. Without sandboxing enabled, those privileges are not required.

[simonmichael]

This problem with our recommended nix install command was noted in 2019. Our current recommendation is

nix-shell -p hledger hledger-ui hledger-web

I'm not sure if it's still affected by this problem.
But I think it's not something the hledger project can tackle, so I'm inclined to close this unless a nix user wants to investigate.

[NobbZ]

nix-shell and the more modern (but experimental) nix shell do have the same requirement.

Usernamespaces are a requirement of the build sandbox. If you enable the sandbox, you have to enable the user name spaces.

Also the way you enable/disable user name spaces does somewhat depend on your distro. The command from the OP is only viable for debian based distros IIRC.

It has to be noted, that most modern distros have their equivalent enabled by default as far as I understand.

I think the problem from the OP is therefore not really a problem anymore today. Like on my Ubuntu 22.05 based distro I didn't have to enable user namespaces explicitely. Also they are a requirement for rootless docker or podman anyway AFAIU, which seem to be the new hype anyway.

[simonmichael]

Thanks @NobbZ. I understand "I think the problem from the OP is therefore not really a problem anymore today." and so am closing this. :)