I’m thinking of setting up multi user nix on a compute cluster. The advantage would be to have a shared storage where common packages are reused, this is a great advantage compared to conda where every environment duplicates storage and inodes.
However, the packages are installed as root. As such I’m a bit wary of whether a user installing something could have the system run malware as root by installing a package.
What are the safeguards in place and how do I know I can trust them?
Thank you for the clear explanation. This is good enough for me I guess then. What I am most afraid is not really a colleague building a malicious package on purpose, but rather them installing something which is then run as root and gets access to the whole system. I understand packages are built by unprivileged users, but in the end they are owned by root.
What I wonder is whether in the way it is possible that something is run as root without someone specifically deciding it should be.