+7 -1

spindle/engine/engine.go

··· 497 497 Mode: 0o1777, // world-writeable sticky bit 498 498 }, 499 499 }, 500 500 + { 501 501 + Type: mount.TypeVolume, 502 502 + Source: "etc-nix-" + wid.String(), 503 503 + Target: "/etc/nix", 504 504 + }, 500 505 }, 501 506 ReadonlyRootfs: false, 502 507 CapDrop: []string{"ALL"}, 503 503 - SecurityOpt: []string{"seccomp=unconfined"}, 508 508 + CapAdd: []string{"CAP_DAC_OVERRIDE"}, 509 509 + SecurityOpt: []string{"no-new-privileges"}, 504 510 } 505 511 506 512 return hostConfig

+1

spindle/models/pipeline.go

··· 55 55 swf.addNixProfileToPath() 56 56 setup := &setupSteps{} 57 57 58 58 + setup.addStep(nixConfStep()) 58 59 setup.addStep(cloneStep(*twf, *pl.TriggerMetadata.Repo, cfg.Server.Dev)) 59 60 setup.addStep(checkoutStep(*twf, *pl.TriggerMetadata)) 60 61 setup.addStep(dependencyStep(*twf))

+9

spindle/models/setup_steps.go

··· 8 8 "tangled.sh/tangled.sh/core/api/tangled" 9 9 ) 10 10 11 11 + func nixConfStep() Step { 12 12 + setupCmd := `echo 'extra-experimental-features = nix-command flakes' >> /etc/nix/nix.conf 13 13 + echo 'build-users-group = ' >> /etc/nix/nix.conf` 14 14 + return Step{ 15 15 + Command: setupCmd, 16 16 + Name: "Configure Nix", 17 17 + } 18 18 + } 19 19 + 11 20 // checkoutStep checks out the specified ref in the cloned repository. 12 21 func checkoutStep(twf tangled.Pipeline_Workflow, tr tangled.Pipeline_TriggerMetadata) Step { 13 22 if twf.Clone.Skip {