nixos/doc: recommend usage of --use-remote-sudo when switching configurations#342338
nixos/doc: recommend usage of --use-remote-sudo when switching configurations#342338cafkafk merged 2 commits intoNixOS:masterfrom
--use-remote-sudo when switching configurations#342338Conversation
…mote-sudo After a discussion on Matrix, it has become clear that building as root is discouraged, and the (inappropriately named) --use-remote-sudo flag should be enouraged as the de-facto way to selectively escalate to root after a system build has finished. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
There was a problem hiding this comment.
Simply changing it to --use-remote-sudo may be a bit hassle, because it is difficult to explain to users why "remote" sudo appears here when we are obviously switching local machine. I haven't thought of a good solution yet (maybe modifying the flag is one)
There was a problem hiding this comment.
modifying the flag is mildly expensive since it's a breaking change, may be possible to just create another flag that aliases it and name it e.g. --sudo?
I feel like this adding such a flag should be taken up in a separate issue, but I do agree that a slight explanation of the flag name being so odd would be helpful to include in this PR.
There was a problem hiding this comment.
Yeah, I don't think we should expand this PR to changing the flag name.
When we do so in another PR, I'm not exactly sure if --sudo is the best replacement. The script itself should probably use Polkit to match systemd's authentication system, and the flag could be a generic --authenticate-when-needed (but worded more concisely)
Also recommends the usage of sudo's -E flag if --use-remote-sudo cannot be used. This should still be discouraged IMO, as it means Nix may write root-owned files to the user's home directory. Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
f4304a2 to
8bf0396
Compare
cafkafk
left a comment
There was a problem hiding this comment.
I think all issues have been addressed, thanks for improving the docs!
Description of changes
Recommends the usage of
--use-remote-sudoon thechanging-configchapter. This is based on a discussion in Matrix with a new user to discourage building system configurations through the root user, and only escalate when necessary.This has some hastily-made wording changes. Please review the grammar and cohesion of the altered phrases.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = trueAdd a 👍 reaction to pull requests you find important.