You missed the crucial point: > So you need non-admin users to be able to use it too The build daemon and the user are used for privilege separation. The sepa

You missed the crucial point: > So you need non-admin users to be able to use it too The build daemon and the user are used for privilege separation. The separation goes both ways. Users can't write directly to /nix/store and Nix can't write outside of /nix/store during build. If anything, it's there to make things less invasive. It's nothing like the Docker daemon, which is a proxy for root. Additionally, the daemon doesn't do anything unless users request that a package be built.