Repository navigation
fix(nix): allow local networking in the Darwin build sandbox - #22
Merged
Merged
Conversation
The proxy unit tests bind listeners on 127.0.0.1. The Darwin Nix build sandbox refuses that with EPERM unless the derivation opts in, so `nix build` on macOS failed 37 proxy::server tests at src/proxy/server/tests.rs:302. The flag only permits localhost networking; the build stays offline. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
nix build(and any flake consumingpackages.default) fails on macOS since Airlock v2: 37proxy::server::testspanic atsrc/proxy/server/tests.rs:302withOs { code: 1, kind: PermissionDenied, message: "Operation not permitted" }.The tests bind a
TcpListeneron127.0.0.1, and the Darwin Nix build sandbox denies local networking unless the derivation opts in. The macOS CI job runscargo testoutside the Nix sandbox, so it doesn't see this.Fix
Set
__darwinAllowLocalNetworking = true;on the package. It permits localhost networking only — the build still has no internet access — and is the standard nixpkgs idiom for test suites that start a local server. The tests keep running under Nix rather than being skipped, which matters since they cover secret redaction and proxy auth.Verification
nix buildon aarch64-darwin:test result: ok. 882 passed; 0 failed; 4 ignored.Not verified on Linux. The flag is a no-op there (the Linux sandbox already has its own loopback), but the
system_curl_*tests call the systemcurl, which a Linux Nix build doesn't provide unless it's added tonativeCheckInputs— worth confirming those pass or skip cleanly.🤖 Generated with Claude Code