From 4eb97e43610b8602299c60c539067352b4d866ab Mon Sep 17 00:00:00 2001 From: Ivan Malison Date: Sat, 11 Jul 2026 13:54:53 -0700 Subject: [PATCH] nixos: run non-FHS claude-desktop so the integrated terminal can sudo The FHS variant (claudeDesktopFhs) wraps the app in buildFHSEnv -> bubblewrap, which runs in an unprivileged user namespace. That makes host root impossible for the integrated Claude Code terminal (setuid sudo resolves to an unmapped uid). Switch to the non-FHS claude-desktop package, which runs in the host namespace, so sudo / nixos-rebuild work from inside the app. MCP/Cowork features that assume an FHS layout may need nix-ld/envfs as a follow-up. Co-Authored-By: Claude Opus 4.8 --- nixos/code.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/code.nix b/nixos/code.nix index bd90a1c9..9ddf7e47 100644 --- a/nixos/code.nix +++ b/nixos/code.nix @@ -184,7 +184,12 @@ in alejandra ] ++ lib.optionals (config.networking.hostName != "jay-lenovo") [ - claudeDesktopFhs + # Non-FHS variant: runs in the host namespace (no bwrap userns), so the + # integrated Claude Code terminal can use sudo / nixos-rebuild. The FHS + # variant (claudeDesktopFhs) sandboxes everything in an unprivileged user + # namespace, which makes host root impossible. Trade-off: MCP/Cowork + # features that assume an FHS layout may need nix-ld/envfs instead. + claudeDesktop cabal2nix ] ++ (