nix: fix permission denied on /nix/var/nix/db/big-lock#14568
Merged
JamieMagee merged 1 commit intomainfrom Mar 28, 2026
Merged
Conversation
The /nix tree was copied from nixos/nix with root ownership, but the container runs as the dependabot user. nix flake update needs to write to /nix/store and /nix/var, so it failed with "Permission denied" on the SQLite lock file. Add --chown=dependabot:dependabot to the COPY so the whole store is owned by the running user, matching the single-user Nix model.
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes Nix single-user operation inside the Dependabot Nix updater image by ensuring /nix is writable by the runtime dependabot user, preventing nix flake update from failing on the Nix DB lock file.
Changes:
- Update the multi-stage
COPYof/nixfromnixos/nixto use--chown=dependabot:dependabot, making the Nix store and DB writable in the final image.
kbukum1
approved these changes
Mar 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
The nix container image copies
/nixfromnixos/nixwith root ownership, but the updater runs as thedependabotuser. Whennix flake updatetries to write to the Nix store and SQLite database, it fails with:Found while adding nix smoke tests: dependabot/smoke-tests#445 (failed run)
Anything you want to highlight for special attention from reviewers?
The fix is
--chown=dependabot:dependaboton theCOPY --from=nixline. This gives thedependabotuser ownership of the entire/nixtree at copy time, which is how single-user Nix is supposed to work -- the running user owns/nix. No extra Docker layer needed compared to a separateRUN chown -R.How will you know you've accomplished your goal?
Built the image locally and verified:
/nix/var/nix/db/big-lockand/nix/storeare owned bydependabotnix --versionruns without errornix flake updateagainst a test flake completes and produces aflake.lockThe smoke test in dependabot/smoke-tests#445 should pass once this lands.
Checklist