diff options
Diffstat (limited to 'nixpkgs/doc/builders/special/fhs-environments.section.md')
| -rw-r--r-- | nixpkgs/doc/builders/special/fhs-environments.section.md | 43 |
1 files changed, 24 insertions, 19 deletions
diff --git a/nixpkgs/doc/builders/special/fhs-environments.section.md b/nixpkgs/doc/builders/special/fhs-environments.section.md index cacad261e28f..5a248e4ead92 100644 --- a/nixpkgs/doc/builders/special/fhs-environments.section.md +++ b/nixpkgs/doc/builders/special/fhs-environments.section.md @@ -1,9 +1,12 @@ -# buildFHSUserEnv {#sec-fhs-environments} +# buildFHSEnv {#sec-fhs-environments} -`buildFHSUserEnv` provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root with bound `/nix/store`, so its footprint in terms of disk space needed is quite small. This allows one to run software which is hard or unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries. It uses Linux namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without root user rights requirement. Accepted arguments are: +`buildFHSEnv` provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root filesystem with the host's `/nix/store`, so its footprint in terms of disk space is quite small. This allows you to run software which is hard or unfeasible to patch for NixOS; 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries for instance. +It uses Linux' namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without requiring elevated privileges. It works similar to containerisation technology such as Docker or FlatPak but provides no security-relevant separation from the host system. + +Accepted arguments are: - `name` - Environment name. + The name of the environment and the wrapper executable. - `targetPkgs` Packages to be installed for the main host's architecture (i.e. x86_64 on x86_64 installations). Along with libraries binaries are also installed. - `multiPkgs` @@ -17,33 +20,35 @@ - `extraInstallCommands` Additional commands to be executed for finalizing the derivation with runner script. - `runScript` - A command that would be executed inside the sandbox and passed all the command line arguments. It defaults to `bash`. + A shell command to be executed inside the sandbox. It defaults to `bash`. Command line arguments passed to the resulting wrapper are appended to this command by default. + This command must be escaped; i.e. `"foo app" --do-stuff --with "some file"`. See `lib.escapeShellArgs`. - `profile` Optional script for `/etc/profile` within the sandbox. -One can create a simple environment using a `shell.nix` like that: +You can create a simple environment using a `shell.nix` like this: ```nix { pkgs ? import <nixpkgs> {} }: -(pkgs.buildFHSUserEnv { +(pkgs.buildFHSEnv { name = "simple-x11-env"; - targetPkgs = pkgs: (with pkgs; - [ udev - alsa-lib - ]) ++ (with pkgs.xorg; - [ libX11 - libXcursor - libXrandr - ]); - multiPkgs = pkgs: (with pkgs; - [ udev - alsa-lib - ]); + targetPkgs = pkgs: (with pkgs; [ + udev + alsa-lib + ]) ++ (with pkgs.xorg; [ + libX11 + libXcursor + libXrandr + ]); + multiPkgs = pkgs: (with pkgs; [ + udev + alsa-lib + ]); runScript = "bash"; }).env ``` -Running `nix-shell` would then drop you into a shell with these libraries and binaries available. You can use this to run closed-source applications which expect FHS structure without hassles: simply change `runScript` to the application path, e.g. `./bin/start.sh` -- relative paths are supported. +Running `nix-shell` on it would drop you into a shell inside an FHS env where those libraries and binaries are available in FHS-compliant paths. Applications that expect an FHS structure (i.e. proprietary binaries) can run inside this environment without modification. +You can build a wrapper by running your binary in `runScript`, e.g. `./bin/start.sh`. Relative paths work as expected. Additionally, the FHS builder links all relocated gsettings-schemas (the glib setup-hook moves them to `share/gsettings-schemas/${name}/glib-2.0/schemas`) to their standard FHS location. This means you don't need to wrap binaries with `wrapGAppsHook`. |