Sandboxed tools have no DNS on NixOS hosts: ro-bound /etc config symlinks dangle without /nix #13

New issue

Open

opened 2026-10-21 13:28:52 -04:00 by glen · 0 comments

glen commented

2026-10-21 13:28:52 -04:00

Collaborator

Observed (engine 0.4.1, bee, NixOS 26.05): every networked package run in-sandbox fails name resolution:

railway whoami -> OAuth refresh fails: network error ... dns error: failed to lookup address information: Temporary failure in name resolution
agent-browser install -> Failed to fetch version info ... dns error ... name resolution
in-sandbox bash -c 'cat /etc/resolv.conf' -> No such file or directory (same for /etc/nsswitch.conf)

Same packages are fine on the thinkpad (Fedora atomic host).

Root cause: build_bwrap_args does --ro-bind /etc /etc (host /etc into the sandbox). On NixOS, /etc config files are symlinks into the store (/etc/resolv.conf -> /etc/static/resolv.conf -> /nix/store/...). The sandbox has no /nix mount, so every store-indirected config dangles - resolv.conf, nsswitch.conf, likely CA certs too - and every getaddrinfo fails. On Fedora hosts /etc files are real files, so the bind carries them intact.

Evidence it is the symlink, not networking: bwrap shares the host net ns; a manual bwrap with --ro-bind <resolved-store-path>/resolv.conf /etc/resolv.conf resolves fine.

Fix directions:

After binding /etc, host-side resolve (readlink -f) the handful of config symlinks (resolv.conf, nsswitch.conf, hosts, ssl certs) and bind their store targets in - or copy file contents onto a tmpfs /etc overlay.
Or synthesize a minimal /etc (resolv.conf copied from the host's resolved target, nsswitch files dns) rather than binding host /etc wholesale.

Impact: bubblebox-pkgs CI runs on bees (NixOS) - any smoke check touching the network fails there even when the package is correct (found while packaging railway + agent-browser). Workaround: run networked verification from a Fedora host or seed state host-side.

**Observed (engine 0.4.1, bee, NixOS 26.05):** every networked package run in-sandbox fails name resolution: - `railway whoami` -> OAuth refresh fails: `network error ... dns error: failed to lookup address information: Temporary failure in name resolution` - `agent-browser install` -> `Failed to fetch version info ... dns error ... name resolution` - in-sandbox `bash -c 'cat /etc/resolv.conf'` -> **No such file or directory** (same for /etc/nsswitch.conf) Same packages are fine on the thinkpad (Fedora atomic host). **Root cause:** `build_bwrap_args` does `--ro-bind /etc /etc` (host /etc into the sandbox). On NixOS, /etc config files are symlinks into the store (/etc/resolv.conf -> /etc/static/resolv.conf -> /nix/store/...). The sandbox has no /nix mount, so every store-indirected config dangles - resolv.conf, nsswitch.conf, likely CA certs too - and every getaddrinfo fails. On Fedora hosts /etc files are real files, so the bind carries them intact. **Evidence it is the symlink, not networking:** bwrap shares the host net ns; a manual bwrap with `--ro-bind <resolved-store-path>/resolv.conf /etc/resolv.conf` resolves fine. **Fix directions:** 1. After binding /etc, host-side resolve (readlink -f) the handful of config symlinks (resolv.conf, nsswitch.conf, hosts, ssl certs) and bind their store targets in - or copy file contents onto a tmpfs /etc overlay. 2. Or synthesize a minimal /etc (resolv.conf copied from the host's resolved target, nsswitch `files dns`) rather than binding host /etc wholesale. **Impact:** bubblebox-pkgs CI runs on bees (NixOS) - any smoke check touching the network fails there even when the package is correct (found while packaging railway + agent-browser). Workaround: run networked verification from a Fedora host or seed state host-side.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

chad/bubblebox#13

No description provided.

Rows
Columns