colonelpanic/dotfiles
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos: run non-FHS claude-desktop so the integrated terminal can sudo

Browse Source 
The FHS variant (claudeDesktopFhs) wraps the app in buildFHSEnv -> bubblewrap,
which runs in an unprivileged user namespace. That makes host root impossible
for the integrated Claude Code terminal (setuid sudo resolves to an unmapped
uid). Switch to the non-FHS claude-desktop package, which runs in the host
namespace, so sudo / nixos-rebuild work from inside the app. MCP/Cowork
features that assume an FHS layout may need nix-ld/envfs as a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ivan Malison
2026-07-11 13:54:53 -07:00
parent 0592807638
commit 4eb97e4361
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/code.nix
View File

@@ -184,7 +184,12 @@ in
alejandra alejandra
] ]
++ lib.optionals (config.networking.hostName != "jay-lenovo") [ ++ lib.optionals (config.networking.hostName != "jay-lenovo") [
claudeDesktopFhs # Non-FHS variant: runs in the host namespace (no bwrap userns), so the
# integrated Claude Code terminal can use sudo / nixos-rebuild. The FHS
# variant (claudeDesktopFhs) sandboxes everything in an unprivileged user
# namespace, which makes host root impossible. Trade-off: MCP/Cowork
# features that assume an FHS layout may need nix-ld/envfs instead.
claudeDesktop
cabal2nix cabal2nix
] ]
++ ( ++ (