fix(nix): put /run/wrappers on the container unit PATH #229

Merged

dominik.polakovics merged 1 commit from lab/20260725-1303 into main

2026-07-25 15:33:51 +02:00

dominik.polakovics commented

2026-07-25 14:38:16 +02:00

Owner

Closes #228

Container preflight refused every containerized spawn:

container preflight failed: podman: podman version: exit status 125: Error: command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH (install podman >= 4)

Root cause: rootless podman execs setuid newuidmap/newgidmap during user-namespace setup (before even dispatching version). On NixOS those exist only as security wrappers in /run/wrappers/bin — the nix store forbids setuid bits, so no package can provide them — and the lab unit PATH is built exclusively from store paths, so podman could not find them. The host was otherwise correctly provisioned (subuid/subgid ranges present, podman 5.8.2 installed); the "install podman >= 4" hint was a red herring. Verified on the affected host: PATH=/run/wrappers/bin:$PATH podman version succeeds where the bare unit PATH fails.

Changes:

nix/module.nix: add "/run/wrappers" to the container-gated path list (makeBinPath appends /bin), with a comment explaining why it is load-bearing.
flake.nix nixos-module check: /run/wrappers/bin must land on the default and container-enabled unit PATH lines, and must NOT leak onto a container-disabled unit — verified red (check fails against the old module) then green.

🤖 Generated with Claude Code

Closes #228 Container preflight refused every containerized spawn: container preflight failed: podman: podman version: exit status 125: Error: command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH (install podman >= 4) Root cause: rootless podman execs setuid `newuidmap`/`newgidmap` during user-namespace setup (before even dispatching `version`). On NixOS those exist only as security wrappers in `/run/wrappers/bin` — the nix store forbids setuid bits, so no package can provide them — and the lab unit PATH is built exclusively from store paths, so podman could not find them. The host was otherwise correctly provisioned (subuid/subgid ranges present, podman 5.8.2 installed); the "install podman >= 4" hint was a red herring. Verified on the affected host: `PATH=/run/wrappers/bin:$PATH podman version` succeeds where the bare unit PATH fails. Changes: - `nix/module.nix`: add `"/run/wrappers"` to the container-gated `path` list (makeBinPath appends `/bin`), with a comment explaining why it is load-bearing. - `flake.nix` nixos-module check: `/run/wrappers/bin` must land on the default and container-enabled unit PATH lines, and must NOT leak onto a container-disabled unit — verified red (check fails against the old module) then green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-07-25 14:38:16 +02:00

fix(nix): put /run/wrappers on the container unit PATH (issue #228 )

ci / native (pull_request) Successful in 9m15s

Details

ci-nix / flake-check (pull_request) Successful in 20m16s

Details

ee8ea7f850

Container preflight refused spawns with podman exiting 125: rootless
setup execs setuid newuidmap/newgidmap to map the subordinate ID range,
and on NixOS those exist only as security wrappers under
/run/wrappers/bin — the nix store forbids setuid bits, so no package can
carry them and the wrapper dir must be on the unit PATH itself
(makeBinPath appends /bin). Confirmed on the affected host:
PATH=/run/wrappers/bin:$PATH podman version succeeds where the bare unit
PATH fails.

The nixos-module check now pins /run/wrappers/bin onto the default and
container-enabled unit PATH lines and keeps it off a container-disabled
unit, alongside the existing podman/passt greps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics merged commit 9d7b89f792 into main

2026-07-25 15:33:51 +02:00

dominik.polakovics deleted branch lab/20260725-1303

2026-07-25 15:33:51 +02:00

dominik.polakovics referenced this pull request from a commit

2026-07-25 15:33:52 +02:00

Merge pull request 'fix(nix): put /run/wrappers on the container unit PATH' (#229) from lab/20260725-1303 into main