From b39622a487e2978bd32c9faf2f651aec1f9815c1 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Tue, 29 Sep 2015 18:21:10 +0200 Subject: rename `chroot` to `sandbox` (fixes #656, close #682) - rename options but leav old names as lower-priority aliases, also "-dirs" -> "-paths" to get closer to the meaning - update docs to reflect the new names (old aliases are not documented), including a new file with release notes - tests need an update after corresponding changes to nixpkgs - __noChroot is left as it is (after discussion on the PR) --- doc/manual/command-ref/conf-file.xml | 44 ++++++++++++++++-------------- doc/manual/release-notes/release-notes.xml | 1 + doc/manual/release-notes/rl-1.11.xml | 23 ++++++++++++++++ 3 files changed, 47 insertions(+), 21 deletions(-) create mode 100644 doc/manual/release-notes/rl-1.11.xml (limited to 'doc/manual') diff --git a/doc/manual/command-ref/conf-file.xml b/doc/manual/command-ref/conf-file.xml index c947d19fa0e1..a23223818ea5 100644 --- a/doc/manual/command-ref/conf-file.xml +++ b/doc/manual/command-ref/conf-file.xml @@ -224,16 +224,16 @@ flag, e.g. --option gc-keep-outputs false. - build-use-chroot + build-use-sandbox If set to true, builds will be - performed in a chroot environment, i.e., + performed in a sandboxed environment, i.e., they’re isolated from the normal file system hierarchy and will only see their dependencies in the Nix store, the temporary build directory, private versions of /proc, /dev, /dev/shm and - /dev/pts, and the paths configured with the - build-chroot-dirs + /dev/pts (on Linux), and the paths configured with the + build-sandbox-paths option. This is useful to prevent undeclared dependencies on files in directories such as /usr/bin. In addition, on Linux, builds run in private PID, mount, network, IPC @@ -241,8 +241,8 @@ flag, e.g. --option gc-keep-outputs false. system (except that fixed-output derivations do not run in private network namespace to ensure they can access the network). - Currently, chroots only work on Linux and Mac OS X. The use - of a chroot requires that Nix is run as root (so you should use + Currently, sandboxing only work on Linux and Mac OS X. The use + of a sandbox requires that Nix is run as root (so you should use the “build users” feature to perform the actual builds under different users than root). @@ -250,7 +250,7 @@ flag, e.g. --option gc-keep-outputs false. If this option is set to relaxed, then fixed-output derivations and derivations that have the __noChroot attribute set to - true do not run in chroots. + true do not run in sandboxes. The default is false. @@ -259,17 +259,16 @@ flag, e.g. --option gc-keep-outputs false. - build-chroot-dirs + + build-sandbox-paths - A list of paths bind-mounted into Nix chroot - environments. Contrary to what the name suggests, the specified - paths do not have to be directories; you can bind-mount other - types of files as well. You can use the syntax + A list of paths bind-mounted into Nix sandbox + environments. You can use the syntax target=source - to mount a path in a different location in the chroot; for + to mount a path in a different location in the sandbox; for instance, /bin=/nix-bin will mount the path /nix-bin as /bin inside the - chroot. + sandbox. Depending on how Nix was built, the default value for this option may be empty or provide /bin/sh as a @@ -278,10 +277,11 @@ flag, e.g. --option gc-keep-outputs false. - build-extra-chroot-dirs + + build-extra-sandbox-paths A list of additional paths appended to - . Useful if you want to extend + . Useful if you want to extend its default value. @@ -593,19 +593,21 @@ flag, e.g. --option gc-keep-outputs false. between different versions of the same system to be hard-coded into nix. - The hook is passed the derivation path and, if chroots are enabled, - the chroot directory. It can then modify the chroot and send a series of + The hook is passed the derivation path and, if sandboxes are enabled, + the sandbox directory. It can then modify the sandbox and send a series of commands to modify various settings to stdout. The currently recognized commands are: - extra-chroot-dirs + + extra-sandbox-paths Pass a list of files and directories to be included in the - chroot for this build. One entry per line, terminated by an empty - line. Entries have the same format as build-chroot-dirs. + sandbox for this build. One entry per line, terminated by an empty + line. Entries have the same format as + build-sandbox-paths. diff --git a/doc/manual/release-notes/release-notes.xml b/doc/manual/release-notes/release-notes.xml index 4ea57c99c3a4..0aa3e8717aa1 100644 --- a/doc/manual/release-notes/release-notes.xml +++ b/doc/manual/release-notes/release-notes.xml @@ -12,6 +12,7 @@ --> + diff --git a/doc/manual/release-notes/rl-1.11.xml b/doc/manual/release-notes/rl-1.11.xml new file mode 100644 index 000000000000..aa9a3e101835 --- /dev/null +++ b/doc/manual/release-notes/rl-1.11.xml @@ -0,0 +1,23 @@ +
+ +Release 1.11 (TODO: date, 2015) + +TODO: This is primarily a bug fix release. It also has a number of new +features: + + + + All "chroot"-containing strings got renamed to "sandbox". + In particular, some nix options got renamed, but the old names + are still accepted as lower-priority aliases. + + + + +This release has contributions from TODO. + +
-- cgit 1.4.1