I’m thinking of setting up multi user nix on a compute cluster. The advantage would be to have a shared storage where common packages are reused, this is a great advantage compared to conda where every environment duplicates storage and inodes.

However, the packages are installed as root. As such I’m a bit wary of whether a user installing something could have the system run malware as root by installing a package.

What are the safeguards in place and how do I know I can trust them?

  • sudoer777@lemmy.mlEnglish
    1·
    14 hours ago

    However, the packages are installed as root. As such I’m a bit wary of whether a user installing something could have the system run malware as root by installing a package.

    I’m pretty sure the packages are built as unprivileged users in a sandbox, and you can also restrict what users can use certain Nix features.

    The main security flaw with a multi-user Nix system is that everything you build ends up in a world-readable store.