Microbenchmark for the cover letter of the RFC "landlock: Add access rights on created files". It sets up and tears down a Nix-like build sandbox (user, mount, PID, IPC, UTS and network namespaces, pivot_root into a chroot, removing the chroot afterwards) and compares how the input paths are made visible:
mounts: one bind mount per input onto a fresh mountpoint directory (what
Nix does today).
| # This file is automatically @generated by Cargo. | |
| # It is not intended for manual editing. | |
| version = 4 | |
| [[package]] | |
| name = "adler2" | |
| version = "2.0.1" | |
| source = "registry+https://github.com/rust-lang/crates.io-index" | |
| checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" |
Dynamic derivation whose chain closes into a cycle crashes the scheduler: Assertion '!awake.empty()' failed in Worker::run
A derivation can emit a derivation whose inputDrvs carries a dynamicOutputs
entry. If that entry names the derivation that is currently producing it, the
| #!/usr/bin/env nix | |
| #! nix shell nixpkgs#python3 --command python3 | |
| """Every nixpkgs revision the flake ecosystem pins, and which channel it was. | |
| Reads `pins.jsonl` from a checkout of https://github.com/fzakaria/omniflake -- | |
| one row per indexed flake, carrying the nixpkgs its lock file names -- joins it | |
| against every channel bump the nix release archive ever published, and writes | |
| nixpkgs-pins.csv. | |
| git clone https://github.com/fzakaria/omniflake |
A real SQLite, compiled to WebAssembly, running inside Nix evaluation and answering arbitrary SQL against a database it never opens as a file.
# query.nix
builtins.wasm { path = ./sqlite_nix.wasm; } {
db = ./index.db;
sql = "SELECT version, rev FROM versions
| #!/usr/bin/env nix-shell | |
| #! nix-shell -i python3 --pure | |
| #! nix-shell -p "python3.withPackages(ps: with ps; [ plotnine pandas numpy scipy ])" | |
| #! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/72841a4a8761d1aed92ef6169a636872c986c76d.tar.gz | |
| """ | |
| Generate the figures for the "look at your data" post. | |
| Self-contained: the shebang above pins nixpkgs to an exact commit and pulls in | |
| plotnine + friends, so `./latency_charts.py` reproduces every figure on any | |
| machine with Nix installed -- no virtualenv, no pip, no system packages. |
| // SPDX-License-Identifier: GPL-2.0 | |
| /* | |
| * shebang_origin.bpf.c - $ORIGIN-relative shebang (#!) interpreter resolution. | |
| * | |
| * A binfmt_misc_ops handler for scripts whose interpreter line is | |
| * "#!$ORIGIN/...": the interpreter is resolved relative to the directory of | |
| * the script and selected via bpf_binprm_set_interp(). Ordinary scripts are | |
| * declined so binfmt_script handles them. | |
| * | |
| * The whole shebang line is in the prefetched bprm->buf, so no file read is |
| { | |
| description = "Linux Kernel Development Environment"; | |
| inputs = { | |
| nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; | |
| }; | |
| outputs = { | |
| self, | |
| nixpkgs, |
| // SPDX-License-Identifier: GPL-2.0 | |
| /* | |
| * binfmt_misc 'B' (BPF) program: match aarch64 ELF binaries and choose the | |
| * interpreter (qemu-aarch64) dynamically via bpf_binprm_set_interp(). | |
| * | |
| * The program is given the BINPRM_BUF_SIZE file header as context. It inspects | |
| * the ELF header and, on a match, sets the interpreter and returns 1. This | |
| * makes the handler a superset of a traditional magic rule: the program both | |
| * decides the match and computes the interpreter path (it could equally derive | |
| * a path relative to the binary). |
| package main | |
| import ( | |
| "encoding/json" | |
| "fmt" | |
| "os" | |
| "os/exec" | |
| "strings" | |
| ) |