Want to create an interactive transcript for this episode?
Podcast: Chaos Computer Club - recent events feed
Episode: DerivationBuilder, extracting Nix's sandboxing logic for library use (nixcon2025)
Description: The most subtle part of Nix's store layer is the exact logic used to sandbox derivations. Mess up the daemon protocol, Local Store SQLite usage, drv file parsing, or other such things, and things should blow up immediately. Fail Fast helps a lot! Mess up the sandboxing logic, however, and you might not notice for a while until you try to build just the right sort of derivation.
For most of Nix's history, the sandboxing logic has been embedded within the build scheduling logic (which builds or downloades dependencies) thus entangling it with hefty other machinery that makes all sorts...