From b39622a487e2978bd32c9faf2f651aec1f9815c1 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Tue, 29 Sep 2015 18:21:10 +0200 Subject: rename `chroot` to `sandbox` (fixes #656, close #682) - rename options but leav old names as lower-priority aliases, also "-dirs" -> "-paths" to get closer to the meaning - update docs to reflect the new names (old aliases are not documented), including a new file with release notes - tests need an update after corresponding changes to nixpkgs - __noChroot is left as it is (after discussion on the PR) --- doc/manual/command-ref/conf-file.xml | 44 +++++++++++++++++++----------------- 1 file changed, 23 insertions(+), 21 deletions(-) (limited to 'doc/manual/command-ref/conf-file.xml') diff --git a/doc/manual/command-ref/conf-file.xml b/doc/manual/command-ref/conf-file.xml index c947d19fa0e1..a23223818ea5 100644 --- a/doc/manual/command-ref/conf-file.xml +++ b/doc/manual/command-ref/conf-file.xml @@ -224,16 +224,16 @@ flag, e.g. --option gc-keep-outputs false. - build-use-chroot + build-use-sandbox If set to true, builds will be - performed in a chroot environment, i.e., + performed in a sandboxed environment, i.e., they’re isolated from the normal file system hierarchy and will only see their dependencies in the Nix store, the temporary build directory, private versions of /proc, /dev, /dev/shm and - /dev/pts, and the paths configured with the - build-chroot-dirs + /dev/pts (on Linux), and the paths configured with the + build-sandbox-paths option. This is useful to prevent undeclared dependencies on files in directories such as /usr/bin. In addition, on Linux, builds run in private PID, mount, network, IPC @@ -241,8 +241,8 @@ flag, e.g. --option gc-keep-outputs false. system (except that fixed-output derivations do not run in private network namespace to ensure they can access the network). - Currently, chroots only work on Linux and Mac OS X. The use - of a chroot requires that Nix is run as root (so you should use + Currently, sandboxing only work on Linux and Mac OS X. The use + of a sandbox requires that Nix is run as root (so you should use the “build users” feature to perform the actual builds under different users than root). @@ -250,7 +250,7 @@ flag, e.g. --option gc-keep-outputs false. If this option is set to relaxed, then fixed-output derivations and derivations that have the __noChroot attribute set to - true do not run in chroots. + true do not run in sandboxes. The default is false. @@ -259,17 +259,16 @@ flag, e.g. --option gc-keep-outputs false. - build-chroot-dirs + + build-sandbox-paths - A list of paths bind-mounted into Nix chroot - environments. Contrary to what the name suggests, the specified - paths do not have to be directories; you can bind-mount other - types of files as well. You can use the syntax + A list of paths bind-mounted into Nix sandbox + environments. You can use the syntax target=source - to mount a path in a different location in the chroot; for + to mount a path in a different location in the sandbox; for instance, /bin=/nix-bin will mount the path /nix-bin as /bin inside the - chroot. + sandbox. Depending on how Nix was built, the default value for this option may be empty or provide /bin/sh as a @@ -278,10 +277,11 @@ flag, e.g. --option gc-keep-outputs false. - build-extra-chroot-dirs + + build-extra-sandbox-paths A list of additional paths appended to - . Useful if you want to extend + . Useful if you want to extend its default value. @@ -593,19 +593,21 @@ flag, e.g. --option gc-keep-outputs false. between different versions of the same system to be hard-coded into nix. - The hook is passed the derivation path and, if chroots are enabled, - the chroot directory. It can then modify the chroot and send a series of + The hook is passed the derivation path and, if sandboxes are enabled, + the sandbox directory. It can then modify the sandbox and send a series of commands to modify various settings to stdout. The currently recognized commands are: - extra-chroot-dirs + + extra-sandbox-paths Pass a list of files and directories to be included in the - chroot for this build. One entry per line, terminated by an empty - line. Entries have the same format as build-chroot-dirs. + sandbox for this build. One entry per line, terminated by an empty + line. Entries have the same format as + build-sandbox-paths. -- cgit 1.4.1