From 20bb3a1673fe295857b623995812e8346be83072 Mon Sep 17 00:00:00 2001
From: nandi <78769380+codegod100@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:21:32 -0700
Subject: [PATCH] ci-nixbuild: stop leaking nixbuild.net config into global
 nix.conf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

check now failed with 'cannot connect to socket ... Connection
refused' after apk/flatpak had run on the same container instance.
setup_nixbuild() was writing builders/substituters/max-jobs=0 into
/etc/nix/nix.conf (appended) and $HOME/.config/nix/nix.conf
(overwritten) — both disk-persisted, global config files every nix
invocation on this long-lived, shared container reads by default.
Once any run's apk/flatpak step wrote that config, every later,
unrelated run's plain 'nix develop' inherited builders=@... and
started requiring a live nix-daemon connection it never asked for —
then failed once that daemon (started by the earlier run) had died,
leaving a stale socket.

NIX_CONFIG (already exported, already threaded into remote_build via
setup_env) is process-scoped and sufficient for this job's own needs;
remote_build also passes --builders '' and --store explicitly on the
command line. Drop the two global-file writes entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 scripts/ci-nixbuild.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/scripts/ci-nixbuild.sh b/scripts/ci-nixbuild.sh
index 2997392..ddf77ec 100755
--- a/scripts/ci-nixbuild.sh
+++ b/scripts/ci-nixbuild.sh
@@ -231,18 +231,18 @@ setup_nixbuild() {
   } | "${sudo[@]}" tee /etc/nix/sleek-nixbuild.conf >/dev/null
   "${sudo[@]}" chmod 644 /etc/nix/sleek-nixbuild.conf
 
-  if ! "${sudo[@]}" grep -q 'sleek-nixbuild.conf' /etc/nix/nix.conf 2>/dev/null; then
-    echo 'include /etc/nix/sleek-nixbuild.conf' | "${sudo[@]}" tee -a /etc/nix/nix.conf >/dev/null
-  fi
-  if ! "${sudo[@]}" grep -qF "$nixbuild_pubkey" /etc/nix/nix.conf 2>/dev/null; then
-    echo "extra-trusted-public-keys = $nixbuild_pubkey" | "${sudo[@]}" tee -a /etc/nix/nix.conf >/dev/null
-  fi
-  if ! "${sudo[@]}" grep -q 'ssh://nixbuild' /etc/nix/nix.conf 2>/dev/null; then
-    echo 'extra-substituters = ssh://nixbuild?priority=100' | "${sudo[@]}" tee -a /etc/nix/nix.conf >/dev/null
-  fi
-
-  mkdir -p "$HOME/.config/nix"
-  "${sudo[@]}" cp /etc/nix/sleek-nixbuild.conf "$HOME/.config/nix/nix.conf"
+  # Deliberately NOT writing this into /etc/nix/nix.conf or
+  # $HOME/.config/nix/nix.conf: both are global, disk-persisted config files
+  # that every nix invocation on this container reads by default — including
+  # unrelated later runs, since boxci's CF Containers runner is long-lived
+  # and shared. A prior version of this script did write there, and it
+  # leaked `builders = @.../sleek-nixbuild-builders` + `max-jobs = 0` into
+  # every future run on the same instance, breaking plain `nix develop` in
+  # the (unrelated) check step once this ran (it started requiring a live
+  # nix-daemon connection it never asked for, then failed on a stale socket
+  # once the daemon from *this* run had died). NIX_CONFIG below is process-
+  # scoped and gets threaded into remote_build via setup_env — that's all
+  # this job itself needs; nothing should touch the global config files.
   export NIX_CONFIG="include /etc/nix/sleek-nixbuild.conf"
 
   # Persist SSH opts for later remote-build in the same job (via env file).
-- 
2.51.2