nixos/systemd-confinment: use /var/empty as chroot mountpoint

bind mounting directories into the nix-store breaks nix commands.
In particular it introduces character devices that are not supported
by nix-store as valid files in the nix store. Use `/var/empty` instead
which is designated for these kind of use cases. We won't create any
files beause of the tmpfs mounted.
This commit is contained in:
Jörg Thalheim 2020-12-31 09:14:28 +01:00
parent cd687af9f4
commit e12188c0f2
No known key found for this signature in database
GPG key ID: B3F5D81B0C6967C4

View file

@ -105,7 +105,7 @@ in {
wantsAPIVFS = lib.mkDefault (config.confinement.mode == "full-apivfs");
in lib.mkIf config.confinement.enable {
serviceConfig = {
RootDirectory = pkgs.runCommand rootName {} "mkdir \"$out\"";
RootDirectory = "/var/empty";
TemporaryFileSystem = "/";
PrivateMounts = lib.mkDefault true;