I’m thinking of setting up multi user nix on a compute cluster. The advantage would be to have a shared storage where common packages are reused, this is a great advantage compared to conda where every environment duplicates storage and inodes.

However, the packages are installed as root. As such I’m a bit wary of whether a user installing something could have the system run malware as root by installing a package.

What are the safeguards in place and how do I know I can trust them?

  • ranzispa@mander.xyzOP
    1·
    18 hours ago

    Thank you for the explanation. Yes, I’m talking about the nix package manager, not about the operating system.

    As far as I understand packages are built by less privileges users, but libraries and binaries are owned by the root user in the nix store.

    https://nix.dev/manual/nix/2.34/installation/multi-user.html

    What I wonder is wheter this could lead to root executing untrusted code. I will have several users installing packages and I can not trust that they will check every package. Thus I’d like to know whether I can trust the system to be resilient without careful attention.