3 ms·
This is actually the opposite, by default, impurities like environment variables can still be used, as well as binaries, or other things ! A small example : `
by Reventlov 4y ago
This is actually the opposite, by default, impurities like environment variables can still be used, as well as binaries, or other things !
A small example :
```
[remy@typhoon:~/Blog]$ cat flake.nix
{
inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11"; };
outputs = { self, nixpkgs }:
let pkgs = nixpkgs.legacyPackages.x86_64-linux;
in
{
devShell.x86_64-linux =
with pkgs;
pkgs.mkShell {
buildInputs = [
python3Packages.pelican
python3Packages.markdown
];
};
};
}
[remy@typhoon:~/Blog]$ export HELLO="WORLD"
[remy@typhoon:~/Blog]$ nix develop
warning: Git tree '/home/remy/Blog' is dirty
[remy@typhoon:~/Blog]$ echo $HELLO
WORLD
```
And, because flakes are not stable, you need to enable them with e.g. `--experimental-features 'nix-command flakes'`. And by default, you can still access outside binaries, like let's say ls ! Which is why, to have real hermetic builds, in Guix for example, it's advised to run in containers and so on.
- rgoulter 4y ago> by default, impurities like environment variables can still be used In a `nix develop` shell? Ah, sure. -- I don't think the new nix commands have the same functionality that `nix-shell --pure` had. But, in nix expressions used, in order to use environment variables (or to fetch from URLs without using a known sha256), the `--impure` flag needs to be passed.
- abathur 4y agoI haven't used it, but afaict the --ignore-environment flag is intended for roughly the same usecase. https://github.com/NixOS/nix/issues/4359#issuecomment-907768110 https://github.com/NixOS/nix/issues/4359#issuecomment-907768... notes some differences.
- abathur 4y agoA dev shell is designed to allow the outside environment to be accessible (so you've got access to tools you'd want to invoke while working that aren't strictly project dependencies).
- nalllar 4y agoThe dev shell inherits environment, but the builds don't. Having a dev shell inherit none of your environment is possible but an inconvenient default, you can do this with `--ignore-environment`. `nix build .#somePackage` is pure by default, as is `nix flake check` I believe `nix shell` also inherits environment by default for the same reason. People expect to be able to run the packages they installed system wide after entering a shell.