From 9751771c73209b58c89829bf3889473a801a013f Mon Sep 17 00:00:00 2001
From: Jean-Philippe Braun <eon@patapon.info>
Date: Thu, 12 Apr 2018 13:03:56 +0200
Subject: [PATCH] dockerTools.buildImage: add /nix/store with correct
permissions
Fixes #38835.
---
pkgs/build-support/docker/default.nix | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index b8eda3d09673..75e279afdc37 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -497,6 +497,16 @@ rec {
# Record the contents of the tarball with ls_tar.
ls_tar temp/layer.tar >> baseFiles
+ # Append nix/store directory to the layer so that when the layer is loaded in the
+ # image /nix/store has read permissions for non-root users.
+ # nix/store is added only if the layer has /nix/store paths in it.
+ if [ $(wc -l < $layerClosure) -gt 1 ] && [ $(grep -c -e "^/nix/store$" baseFiles) -eq 0 ]; then
+ mkdir -p nix/store
+ chmod -R 555 nix
+ echo "./nix" >> layerFiles
+ echo "./nix/store" >> layerFiles
+ fi
+
# Get the files in the new layer which were *not* present in
# the old layer, and record them as newFiles.
comm <(sort -n baseFiles|uniq) \