Introduction
Nix is a purely functional package manager. This means that it
treats packages like values in purely functional programming languages
such as Haskell — they are built by functions that don’t have
side-effects, and they never change after they have been built. Nix
stores packages in the Nix store, usually the directory
/nix/store
, where each package has its own unique subdirectory such
as
/nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1/
where b6gvzjyb2pg0…
is a unique identifier for the package that
captures all its dependencies (it’s a cryptographic hash of the
package’s build dependency graph). This enables many powerful
features.
Multiple versions
You can have multiple versions or variants of a package installed at the same time. This is especially important when different applications have dependencies on different versions of the same package — it prevents the “DLL hell”. Because of the hashing scheme, different versions of a package end up in different paths in the Nix store, so they don’t interfere with each other.
An important consequence is that operations like upgrading or uninstalling an application cannot break other applications, since these operations never “destructively” update or delete files that are used by other packages.
Complete dependencies
Nix helps you make sure that package dependency specifications are complete. In general, when you’re making a package for a package management system like RPM, you have to specify for each package what its dependencies are, but there are no guarantees that this specification is complete. If you forget a dependency, then the package will build and work correctly on your machine if you have the dependency installed, but not on the end user's machine if it's not there.
Since Nix on the other hand doesn’t install packages in “global”
locations like /usr/bin
but in package-specific directories, the
risk of incomplete dependencies is greatly reduced. This is because
tools such as compilers don’t search in per-packages directories such
as /nix/store/5lbfaxb722zp…-openssl-0.9.8d/include
, so if a package
builds correctly on your system, this is because you specified the
dependency explicitly. This takes care of the build-time dependencies.
Once a package is built, runtime dependencies are found by scanning
binaries for the hash parts of Nix store paths (such as r8vvq9kq…
).
This sounds risky, but it works extremely well.
Multi-user support
Nix has multi-user support. This means that non-privileged users can
securely install software. Each user can have a different profile,
a set of packages in the Nix store that appear in the user’s PATH
.
If a user installs a package that another user has already installed
previously, the package won’t be built or downloaded a second time.
At the same time, it is not possible for one user to inject a Trojan
horse into a package that might be used by another user.
Atomic upgrades and rollbacks
Since package management operations never overwrite packages in the Nix store but just add new versions in different paths, they are atomic. So during a package upgrade, there is no time window in which the package has some files from the old version and some files from the new version — which would be bad because a program might well crash if it’s started during that period.
And since packages aren’t overwritten, the old versions are still there after an upgrade. This means that you can roll back to the old version:
$ nix-env --upgrade -A nixpkgs.some-package
$ nix-env --rollback
Garbage collection
When you uninstall a package like this…
$ nix-env --uninstall firefox
the package isn’t deleted from the system right away (after all, you might want to do a rollback, or it might be in the profiles of other users). Instead, unused packages can be deleted safely by running the garbage collector:
$ nix-collect-garbage
This deletes all packages that aren’t in use by any user profile or by a currently running program.
Functional package language
Packages are built from Nix expressions, which is a simple functional language. A Nix expression describes everything that goes into a package build task (a “derivation”): other packages, sources, the build script, environment variables for the build script, etc. Nix tries very hard to ensure that Nix expressions are deterministic: building a Nix expression twice should yield the same result.
Because it’s a functional language, it’s easy to support building variants of a package: turn the Nix expression into a function and call it any number of times with the appropriate arguments. Due to the hashing scheme, variants don’t conflict with each other in the Nix store.
Transparent source/binary deployment
Nix expressions generally describe how to build a package from source, so an installation action like
$ nix-env --install -A nixpkgs.firefox
could cause quite a bit of build activity, as not only Firefox but
also all its dependencies (all the way up to the C library and the
compiler) would have to be built, at least if they are not already in the
Nix store. This is a source deployment model. For most users,
building from source is not very pleasant as it takes far too long.
However, Nix can automatically skip building from source and instead
use a binary cache, a web server that provides pre-built
binaries. For instance, when asked to build
/nix/store/b6gvzjyb2pg0…-firefox-33.1
from source, Nix would first
check if the file https://cache.nixos.org/b6gvzjyb2pg0….narinfo
exists, and if so, fetch the pre-built binary referenced from there;
otherwise, it would fall back to building from source.
Nix Packages collection
We provide a large set of Nix expressions containing hundreds of existing Unix packages, the Nix Packages collection (Nixpkgs).
Managing build environments
Nix is extremely useful for developers as it makes it easy to
automatically set up the build environment for a package. Given a Nix
expression that describes the dependencies of your package, the
command nix-shell
will build or download those dependencies if
they’re not already in your Nix store, and then start a Bash shell in
which all necessary environment variables (such as compiler search
paths) are set.
For example, the following command gets all dependencies of the Pan newsreader, as described by its Nix expression:
$ nix-shell '<nixpkgs>' -A pan
You’re then dropped into a shell where you can edit, build and test the package:
[nix-shell]$ unpackPhase
[nix-shell]$ cd pan-*
[nix-shell]$ configurePhase
[nix-shell]$ buildPhase
[nix-shell]$ ./pan/gui/pan
Portability
Nix runs on Linux and macOS.
NixOS
NixOS is a Linux distribution based on Nix. It uses Nix not just for
package management but also to manage the system configuration (e.g.,
to build configuration files in /etc
). This means, among other
things, that it is easy to roll back the entire configuration of the
system to an earlier state. Also, users can install software without
root privileges. For more information and downloads, see the NixOS
homepage.
License
Nix is released under the terms of the GNU LGPLv2.1 or (at your option) any later version.
Quick Start
This chapter is for impatient people who don't like reading documentation. For more in-depth information you are kindly referred to subsequent chapters.
-
Install single-user Nix by running the following:
$ bash <(curl -L https://nixos.org/nix/install)
This will install Nix in
/nix
. The install script will create/nix
usingsudo
, so make sure you have sufficient rights. (For other installation methods, see here.) -
See what installable packages are currently available in the channel:
$ nix-env -qaP nixpkgs.docbook_xml_dtd_43 docbook-xml-4.3 nixpkgs.docbook_xml_dtd_45 docbook-xml-4.5 nixpkgs.firefox firefox-33.0.2 nixpkgs.hello hello-2.9 nixpkgs.libxslt libxslt-1.1.28 …
-
Install some packages from the channel:
$ nix-env -iA nixpkgs.hello
This should download pre-built packages; it should not build them locally (if it does, something went wrong).
-
Test that they work:
$ which hello /home/eelco/.nix-profile/bin/hello $ hello Hello, world!
-
Uninstall a package:
$ nix-env -e hello
-
You can also test a package without installing it:
$ nix-shell -p hello
This builds or downloads GNU Hello and its dependencies, then drops you into a Bash shell where the
hello
command is present, all without affecting your normal environment:[nix-shell:~]$ hello Hello, world! [nix-shell:~]$ exit $ hello hello: command not found
-
To keep up-to-date with the channel, do:
$ nix-channel --update nixpkgs $ nix-env -u '*'
The latter command will upgrade each installed package for which there is a “newer” version (as determined by comparing the version numbers).
-
If you're unhappy with the result of a
nix-env
action (e.g., an upgraded package turned out not to work properly), you can go back:$ nix-env --rollback
-
You should periodically run the Nix garbage collector to get rid of unused packages, since uninstalls or upgrades don't actually delete them:
$ nix-collect-garbage -d
This section describes how to install and configure Nix for first-time use.
Supported Platforms
Nix is currently supported on the following platforms:
-
Linux (i686, x86_64, aarch64).
-
macOS (x86_64, aarch64).
Installing a Binary Distribution
The easiest way to install Nix is to run the following command:
$ sh <(curl -L https://nixos.org/nix/install)
This will run the installer interactively (causing it to explain what it is doing more explicitly), and perform the default "type" of install for your platform:
-
single-user on Linux
-
multi-user on macOS
Notes on read-only filesystem root in macOS 10.15 Catalina +
- It took some time to support this cleanly. You may see posts, examples, and tutorials using obsolete workarounds.
- Supporting it cleanly made macOS installs too complex to qualify as single-user, so this type is no longer supported on macOS.
We recommend the multi-user install if it supports your platform and
you can authenticate with sudo
.
Single User Installation
To explicitly select a single-user installation on your system:
$ sh <(curl -L https://nixos.org/nix/install) --no-daemon
This will perform a single-user installation of Nix, meaning that /nix
is owned by the invoking user. You can run this under your usual user
account or root. The script will invoke sudo
to create /nix
if it doesn’t already exist. If you don’t have sudo
, you should
manually create /nix
first as root, e.g.:
$ mkdir /nix
$ chown alice /nix
The install script will modify the first writable file from amongst
.bash_profile
, .bash_login
and .profile
to source
~/.nix-profile/etc/profile.d/nix.sh
. You can set the
NIX_INSTALLER_NO_MODIFY_PROFILE
environment variable before executing
the install script to disable this behaviour.
You can uninstall Nix simply by running:
$ rm -rf /nix
Multi User Installation
The multi-user Nix installation creates system users, and a system service for the Nix daemon.
Supported Systems
- Linux running systemd, with SELinux disabled
- macOS
You can instruct the installer to perform a multi-user installation on your system:
$ sh <(curl -L https://nixos.org/nix/install) --daemon
The multi-user installation of Nix will create build users between the
user IDs 30001 and 30032, and a group with the group ID 30000. You
can run this under your usual user account or root. The script
will invoke sudo
as needed.
Note
If you need Nix to use a different group ID or user ID set, you will have to download the tarball manually and edit the install script.
The installer will modify /etc/bashrc
, and /etc/zshrc
if they exist.
The installer will first back up these files with a .backup-before-nix
extension. The installer will also create /etc/profile.d/nix.sh
.
Uninstalling
Linux
If you are on Linux with systemd:
-
Remove the Nix daemon service:
sudo systemctl stop nix-daemon.service sudo systemctl disable nix-daemon.socket nix-daemon.service sudo systemctl daemon-reload
-
Remove systemd service files:
sudo rm /etc/systemd/system/nix-daemon.service /etc/systemd/system/nix-daemon.socket
-
The installer script uses systemd-tmpfiles to create the socket directory. You may also want to remove the configuration for that:
sudo rm /etc/tmpfiles.d/nix-daemon.conf
Remove files created by Nix:
sudo rm -rf /nix /etc/nix /etc/profile/nix.sh ~root/.nix-profile ~root/.nix-defexpr ~root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
Remove build users and their group:
for i in $(seq 1 32); do
sudo userdel nixbld$i
done
sudo groupdel nixbld
There may also be references to Nix in
/etc/profile
/etc/bashrc
/etc/zshrc
which you may remove.
macOS
-
Edit
/etc/zshrc
and/etc/bashrc
to remove the lines sourcingnix-daemon.sh
, which should look like this:# Nix if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' fi # End Nix
If these files haven't been altered since installing Nix you can simply put the backups back in place:
sudo mv /etc/zshrc.backup-before-nix /etc/zshrc sudo mv /etc/bashrc.backup-before-nix /etc/bashrc
This will stop shells from sourcing the file and bringing everything you installed using Nix in scope.
-
Stop and remove the Nix daemon services:
sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist sudo launchctl unload /Library/LaunchDaemons/org.nixos.darwin-store.plist sudo rm /Library/LaunchDaemons/org.nixos.darwin-store.plist
This stops the Nix daemon and prevents it from being started next time you boot the system.
-
Remove the
nixbld
group and the_nixbuildN
users:sudo dscl . -delete /Groups/nixbld for u in $(sudo dscl . -list /Users | grep _nixbld); do sudo dscl . -delete /Users/$u; done
This will remove all the build users that no longer serve a purpose.
-
Edit fstab using
sudo vifs
to remove the line mounting the Nix Store volume on/nix
, which looks likeUUID=<uuid> /nix apfs rw,noauto,nobrowse,suid,owners
orLABEL=Nix\040Store /nix apfs rw,nobrowse
. This will prevent automatic mounting of the Nix Store volume. -
Edit
/etc/synthetic.conf
to remove thenix
line. If this is the only line in the file you can remove it entirely,sudo rm /etc/synthetic.conf
. This will prevent the creation of the empty/nix
directory to provide a mountpoint for the Nix Store volume. -
Remove the files Nix added to your system:
sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
This gets rid of any data Nix may have created except for the store which is removed next.
-
Remove the Nix Store volume:
sudo diskutil apfs deleteVolume /nix
This will remove the Nix Store volume and everything that was added to the store.
If the output indicates that the command couldn't remove the volume, you should make sure you don't have an unmounted Nix Store volume. Look for a "Nix Store" volume in the output of the following command:
diskutil list
If you do see a "Nix Store" volume, delete it by re-running the diskutil deleteVolume command, but replace
/nix
with the store volume'sdiskXsY
identifier.
Note
After you complete the steps here, you will still have an empty
/nix
directory. This is an expected sign of a successful uninstall. The empty/nix
directory will disappear the next time you reboot.You do not have to reboot to finish uninstalling Nix. The uninstall is complete. macOS (Catalina+) directly controls root directories and its read-only root will prevent you from manually deleting the empty
/nix
mountpoint.
macOS Installation
We believe we have ironed out how to cleanly support the read-only root on modern macOS. New installs will do this automatically.
This section previously detailed the situation, options, and trade-offs, but it now only outlines what the installer does. You don't need to know this to run the installer, but it may help if you run into trouble:
- create a new APFS volume for your Nix store
- update
/etc/synthetic.conf
to direct macOS to create a "synthetic" empty root directory to mount your volume - specify mount options for the volume in
/etc/fstab
rw
: read-writenoauto
: prevent the system from auto-mounting the volume (so the LaunchDaemon mentioned below can control mounting it, and to avoid masking problems with that mounting service).nobrowse
: prevent the Nix Store volume from showing up on your desktop; also keeps Spotlight from spending resources to index this volume
- if you have FileVault enabled
- generate an encryption password
- put it in your system Keychain
- use it to encrypt the volume
- create a system LaunchDaemon to mount this volume early enough in the boot process to avoid problems loading or restoring any programs that need access to your Nix store
Installing a pinned Nix version from a URL
NixOS.org hosts version-specific installation URLs for all Nix versions
since 1.11.16, at https://releases.nixos.org/nix/nix-version/install
.
These install scripts can be used the same as the main NixOS.org installation script:
$ sh <(curl -L https://nixos.org/nix/install)
In the same directory of the install script are sha256 sums, and gpg signature files.
Installing from a binary tarball
You can also download a binary tarball that contains Nix and all its
dependencies. (This is what the install script at
https://nixos.org/nix/install does automatically.) You should unpack
it somewhere (e.g. in /tmp
), and then run the script named install
inside the binary tarball:
$ cd /tmp
$ tar xfj nix-1.8-x86_64-darwin.tar.bz2
$ cd nix-1.8-x86_64-darwin
$ ./install
If you need to edit the multi-user installation script to use different
group ID or a different user ID range, modify the variables set in the
file named install-multi-user
.
Installing Nix from Source
If no binary package is available or if you want to hack on Nix, you can build Nix from its Git repository.
Prerequisites
-
GNU Autoconf (https://www.gnu.org/software/autoconf/) and the autoconf-archive macro collection (https://www.gnu.org/software/autoconf-archive/). These are needed to run the bootstrap script.
-
GNU Make.
-
Bash Shell. The
./configure
script relies on bashisms, so Bash is required. -
A version of GCC or Clang that supports C++17.
-
pkg-config
to locate dependencies. If your distribution does not provide it, you can get it from http://www.freedesktop.org/wiki/Software/pkg-config. -
The OpenSSL library to calculate cryptographic hashes. If your distribution does not provide it, you can get it from https://www.openssl.org.
-
The
libbrotlienc
andlibbrotlidec
libraries to provide implementation of the Brotli compression algorithm. They are available for download from the official repository https://github.com/google/brotli. -
cURL and its library. If your distribution does not provide it, you can get it from https://curl.haxx.se/.
-
The SQLite embedded database library, version 3.6.19 or higher. If your distribution does not provide it, please install it from http://www.sqlite.org/.
-
The Boehm garbage collector to reduce the evaluator’s memory consumption (optional). To enable it, install
pkgconfig
and the Boehm garbage collector, and pass the flag--enable-gc
toconfigure
. -
The
boost
library of version 1.66.0 or higher. It can be obtained from the official web site https://www.boost.org/. -
The
editline
library of version 1.14.0 or higher. It can be obtained from the its repository https://github.com/troglobit/editline. -
The
libsodium
library for verifying cryptographic signatures of contents fetched from binary caches. It can be obtained from the official web site https://libsodium.org. -
Recent versions of Bison and Flex to build the parser. (This is because Nix needs GLR support in Bison and reentrancy support in Flex.) For Bison, you need version 2.6, which can be obtained from the GNU FTP server. For Flex, you need version 2.5.35, which is available on SourceForge. Slightly older versions may also work, but ancient versions like the ubiquitous 2.5.4a won't.
-
The
libseccomp
is used to provide syscall filtering on Linux. This is an optional dependency and can be disabled passing a--disable-seccomp-sandboxing
option to theconfigure
script (Not recommended unless your system doesn't supportlibseccomp
). To get the library, visit https://github.com/seccomp/libseccomp. -
On 64-bit x86 machines only,
libcpuid
library is used to determine which microarchitecture levels are supported (e.g., as whether to havex86_64-v2-linux
among additional system types). The library is available from its homepage http://libcpuid.sourceforge.net. This is an optional dependency and can be disabled by providing a--disable-cpuid
to theconfigure
script.
Obtaining the Source
The most recent sources of Nix can be obtained from its Git
repository. For example, the following
command will check out the latest revision into a directory called
nix
:
$ git clone https://github.com/NixOS/nix
Likewise, specific releases can be obtained from the tags of the repository.
Building Nix from Source
After cloning Nix's Git repository, issue the following commands:
$ ./bootstrap.sh
$ ./configure options...
$ make
$ make install
Nix requires GNU Make so you may need to invoke gmake
instead.
The installation path can be specified by passing the --prefix=prefix
to configure
. The default installation directory is /usr/local
. You
can change this to any location you like. You must have write permission
to the prefix path.
Nix keeps its store (the place where packages are stored) in
/nix/store
by default. This can be changed using
--with-store-dir=path
.
Warning
It is best not to change the Nix store from its default, since doing so makes it impossible to use pre-built binaries from the standard Nixpkgs channels — that is, all packages will need to be built from source.
Nix keeps state (such as its database and log files) in /nix/var
by
default. This can be changed using --localstatedir=path
.
Using Nix within Docker
To run the latest stable release of Nix with Docker run the following command:
$ docker run -ti nixos/nix
Unable to find image 'nixos/nix:latest' locally
latest: Pulling from nixos/nix
5843afab3874: Pull complete
b52bf13f109c: Pull complete
1e2415612aa3: Pull complete
Digest: sha256:27f6e7f60227e959ee7ece361f75d4844a40e1cc6878b6868fe30140420031ff
Status: Downloaded newer image for nixos/nix:latest
35ca4ada6e96:/# nix --version
nix (Nix) 2.3.12
35ca4ada6e96:/# exit
What is included in Nix's Docker image?
The official Docker image is created using pkgs.dockerTools.buildLayeredImage
(and not with Dockerfile
as it is usual with Docker images). You can still
base your custom Docker image on it as you would do with any other Docker
image.
The Docker image is also not based on any other image and includes minimal set of runtime dependencies that are required to use Nix:
- pkgs.nix
- pkgs.bashInteractive
- pkgs.coreutils-full
- pkgs.gnutar
- pkgs.gzip
- pkgs.gnugrep
- pkgs.which
- pkgs.curl
- pkgs.less
- pkgs.wget
- pkgs.man
- pkgs.cacert.out
- pkgs.findutils
Docker image with the latest development version of Nix
To get the latest image that was built by Hydra run the following command:
$ curl -L https://hydra.nixos.org/job/nix/master/dockerImage.x86_64-linux/latest/download/1 | docker load
$ docker run -ti nix:2.5pre20211105
You can also build a Docker image from source yourself:
$ nix build ./\#hydraJobs.dockerImage.x86_64-linux
$ docker load -i ./result/image.tar.gz
$ docker run -ti nix:2.5pre20211105
Security
Nix has two basic security models. First, it can be used in “single-user mode”, which is similar to what most other package management tools do: there is a single user (typically root) who performs all package management operations. All other users can then use the installed packages, but they cannot perform package management operations themselves.
Alternatively, you can configure Nix in “multi-user mode”. In this model, all users can perform package management operations — for instance, every user can install software without requiring root privileges. Nix ensures that this is secure. For instance, it’s not possible for one user to overwrite a package used by another user with a Trojan horse.
Single-User Mode
In single-user mode, all Nix operations that access the database in
prefix/var/nix/db
or modify the Nix store in prefix/store
must be
performed under the user ID that owns those directories. This is
typically root. (If you install from RPM packages, that’s in fact the
default ownership.) However, on single-user machines, it is often
convenient to chown
those directories to your normal user account so
that you don’t have to su
to root all the time.
Multi-User Mode
To allow a Nix store to be shared safely among multiple users, it is important that users are not able to run builders that modify the Nix store or database in arbitrary ways, or that interfere with builds started by other users. If they could do so, they could install a Trojan horse in some package and compromise the accounts of other users.
To prevent this, the Nix store and database are owned by some privileged
user (usually root
) and builders are executed under special user
accounts (usually named nixbld1
, nixbld2
, etc.). When a unprivileged
user runs a Nix command, actions that operate on the Nix store (such as
builds) are forwarded to a Nix daemon running under the owner of the
Nix store/database that performs the operation.
Note
Multi-user mode has one important limitation: only root and a set of trusted users specified in
nix.conf
can specify arbitrary binary caches. So while unprivileged users may install packages from arbitrary Nix expressions, they may not get pre-built binaries.
Setting up the build users
The build users are the special UIDs under which builds are performed.
They should all be members of the build users group nixbld
. This
group should have no other members. The build users should not be
members of any other group. On Linux, you can create the group and users
as follows:
$ groupadd -r nixbld
$ for n in $(seq 1 10); do useradd -c "Nix build user $n" \
-d /var/empty -g nixbld -G nixbld -M -N -r -s "$(which nologin)" \
nixbld$n; done
This creates 10 build users. There can never be more concurrent builds than the number of build users, so you may want to increase this if you expect to do many builds at the same time.
Running the daemon
The Nix daemon should be started as
follows (as root
):
$ nix-daemon
You’ll want to put that line somewhere in your system’s boot scripts.
To let unprivileged users use the daemon, they should set the
NIX_REMOTE
environment variable to
daemon
. So you should put a line like
export NIX_REMOTE=daemon
into the users’ login scripts.
Restricting access
To limit which users can perform Nix operations, you can use the
permissions on the directory /nix/var/nix/daemon-socket
. For instance,
if you want to restrict the use of Nix to the members of a group called
nix-users
, do
$ chgrp nix-users /nix/var/nix/daemon-socket
$ chmod ug=rwx,o= /nix/var/nix/daemon-socket
This way, users who are not in the nix-users
group cannot connect to
the Unix domain socket /nix/var/nix/daemon-socket/socket
, so they
cannot perform Nix operations.
Environment Variables
To use Nix, some environment variables should be set. In particular,
PATH
should contain the directories prefix/bin
and
~/.nix-profile/bin
. The first directory contains the Nix tools
themselves, while ~/.nix-profile
is a symbolic link to the current
user environment (an automatically generated package consisting of
symlinks to installed packages). The simplest way to set the required
environment variables is to include the file
prefix/etc/profile.d/nix.sh
in your ~/.profile
(or similar), like
this:
source prefix/etc/profile.d/nix.sh
NIX_SSL_CERT_FILE
If you need to specify a custom certificate bundle to account for an
HTTPS-intercepting man in the middle proxy, you must specify the path to
the certificate bundle in the environment variable NIX_SSL_CERT_FILE
.
If you don't specify a NIX_SSL_CERT_FILE
manually, Nix will install
and use its own certificate bundle.
Set the environment variable and install Nix
$ export NIX_SSL_CERT_FILE=/etc/ssl/my-certificate-bundle.crt
$ sh <(curl -L https://nixos.org/nix/install)
In the shell profile and rc files (for example, /etc/bashrc
,
/etc/zshrc
), add the following line:
export NIX_SSL_CERT_FILE=/etc/ssl/my-certificate-bundle.crt
Note
You must not add the export and then do the install, as the Nix installer will detect the presence of Nix configuration, and abort.
NIX_SSL_CERT_FILE
with macOS and the Nix daemon
On macOS you must specify the environment variable for the Nix daemon service, then restart it:
$ sudo launchctl setenv NIX_SSL_CERT_FILE /etc/ssl/my-certificate-bundle.crt
$ sudo launchctl kickstart -k system/org.nixos.nix-daemon
Proxy Environment Variables
The Nix installer has special handling for these proxy-related
environment variables: http_proxy
, https_proxy
, ftp_proxy
,
no_proxy
, HTTP_PROXY
, HTTPS_PROXY
, FTP_PROXY
, NO_PROXY
.
If any of these variables are set when running the Nix installer, then
the installer will create an override file at
/etc/systemd/system/nix-daemon.service.d/override.conf
so nix-daemon
will use them.
Upgrading Nix
Multi-user Nix users on macOS can upgrade Nix by running: sudo -i sh -c 'nix-channel --update && nix-env -iA nixpkgs.nix && launchctl remove org.nixos.nix-daemon && launchctl load /Library/LaunchDaemons/org.nixos.nix-daemon.plist'
Single-user installations of Nix should run this: nix-channel --update; nix-env -iA nixpkgs.nix nixpkgs.cacert
Multi-user Nix users on Linux should run this with sudo: nix-channel --update; nix-env -iA nixpkgs.nix nixpkgs.cacert; systemctl daemon-reload; systemctl restart nix-daemon
This chapter discusses how to do package management with Nix, i.e., how to obtain, install, upgrade, and erase packages. This is the “user’s” perspective of the Nix system — people who want to create packages should consult the chapter on the Nix language.
Basic Package Management
The main command for package management is
nix-env
. You can use it to install,
upgrade, and erase packages, and to query what packages are installed
or are available for installation.
In Nix, different users can have different “views” on the set of
installed applications. That is, there might be lots of applications
present on the system (possibly in many different versions), but users
can have a specific selection of those active — where “active” just
means that it appears in a directory in the user’s PATH
. Such a view
on the set of installed applications is called a user environment,
which is just a directory tree consisting of symlinks to the files of
the active applications.
Components are installed from a set of Nix expressions that tell Nix how to build those packages, including, if necessary, their dependencies. There is a collection of Nix expressions called the Nixpkgs package collection that contains packages ranging from basic development stuff such as GCC and Glibc, to end-user applications like Mozilla Firefox. (Nix is however not tied to the Nixpkgs package collection; you could write your own Nix expressions based on Nixpkgs, or completely new ones.)
You can manually download the latest version of Nixpkgs from https://github.com/NixOS/nixpkgs. However, it’s much more convenient to use the Nixpkgs channel, since it makes it easy to stay up to date with new versions of Nixpkgs. Nixpkgs is automatically added to your list of “subscribed” channels when you install Nix. If this is not the case for some reason, you can add it as follows:
$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
$ nix-channel --update
Note
On NixOS, you’re automatically subscribed to a NixOS channel corresponding to your NixOS major release (e.g. http://nixos.org/channels/nixos-21.11). A NixOS channel is identical to the Nixpkgs channel, except that it contains only Linux binaries and is updated only if a set of regression tests succeed.
You can view the set of available packages in Nixpkgs:
$ nix-env -qaP
nixpkgs.aterm aterm-2.2
nixpkgs.bash bash-3.0
nixpkgs.binutils binutils-2.15
nixpkgs.bison bison-1.875d
nixpkgs.blackdown blackdown-1.4.2
nixpkgs.bzip2 bzip2-1.0.2
…
The flag -q
specifies a query operation, -a
means that you want
to show the “available” (i.e., installable) packages, as opposed to the
installed packages, and -P
prints the attribute paths that can be used
to unambiguously select a package for installation (listed in the first column).
If you downloaded Nixpkgs yourself, or if you checked it out from GitHub,
then you need to pass the path to your Nixpkgs tree using the -f
flag:
$ nix-env -qaPf /path/to/nixpkgs
aterm aterm-2.2
bash bash-3.0
…
where /path/to/nixpkgs is where you’ve unpacked or checked out Nixpkgs.
You can filter the packages by name:
$ nix-env -qaP firefox
nixpkgs.firefox-esr firefox-91.3.0esr
nixpkgs.firefox firefox-94.0.1
and using regular expressions:
$ nix-env -qaP 'firefox.*'
It is also possible to see the status of available packages, i.e., whether they are installed into the user environment and/or present in the system:
$ nix-env -qaPs
…
-PS nixpkgs.bash bash-3.0
--S nixpkgs.binutils binutils-2.15
IPS nixpkgs.bison bison-1.875d
…
The first character (I
) indicates whether the package is installed in
your current user environment. The second (P
) indicates whether it is
present on your system (in which case installing it into your user
environment would be a very quick operation). The last one (S
)
indicates whether there is a so-called substitute for the package,
which is Nix’s mechanism for doing binary deployment. It just means that
Nix knows that it can fetch a pre-built package from somewhere
(typically a network server) instead of building it locally.
You can install a package using nix-env -iA
. For instance,
$ nix-env -iA nixpkgs.subversion
will install the package called subversion
from nixpkgs
channel (which is, of course, the
Subversion version management system).
Note
When you ask Nix to install a package, it will first try to get it in pre-compiled form from a binary cache. By default, Nix will use the binary cache https://cache.nixos.org; it contains binaries for most packages in Nixpkgs. Only if no binary is available in the binary cache, Nix will build the package from source. So if
nix-env -iA nixpkgs.subversion
results in Nix building stuff from source, then either the package is not built for your platform by the Nixpkgs build servers, or your version of Nixpkgs is too old or too new. For instance, if you have a very recent checkout of Nixpkgs, then the Nixpkgs build servers may not have had a chance to build everything and upload the resulting binaries to https://cache.nixos.org. The Nixpkgs channel is only updated after all binaries have been uploaded to the cache, so if you stick to the Nixpkgs channel (rather than using a Git checkout of the Nixpkgs tree), you will get binaries for most packages.
Naturally, packages can also be uninstalled. Unlike when installing, you will
need to use the derivation name (though the version part can be omitted),
instead of the attribute path, as nix-env
does not record which attribute
was used for installing:
$ nix-env -e subversion
Upgrading to a new version is just as easy. If you have a new release of Nix Packages, you can do:
$ nix-env -uA nixpkgs.subversion
This will only upgrade Subversion if there is a “newer” version in the
new set of Nix expressions, as defined by some pretty arbitrary rules
regarding ordering of version numbers (which generally do what you’d
expect of them). To just unconditionally replace Subversion with
whatever version is in the Nix expressions, use -i
instead of -u
;
-i
will remove whatever version is already installed.
You can also upgrade all packages for which there are newer versions:
$ nix-env -u
Sometimes it’s useful to be able to ask what nix-env
would do, without
actually doing it. For instance, to find out what packages would be
upgraded by nix-env -u
, you can do
$ nix-env -u --dry-run
(dry run; not doing anything)
upgrading `libxslt-1.1.0' to `libxslt-1.1.10'
upgrading `graphviz-1.10' to `graphviz-1.12'
upgrading `coreutils-5.0' to `coreutils-5.2.1'
Profiles
Profiles and user environments are Nix’s mechanism for implementing the
ability to allow different users to have different configurations, and
to do atomic upgrades and rollbacks. To understand how they work, it’s
useful to know a bit about how Nix works. In Nix, packages are stored in
unique locations in the Nix store (typically, /nix/store
). For
instance, a particular version of the Subversion package might be stored
in a directory
/nix/store/dpmvp969yhdqs7lm2r1a3gng7pyq6vy4-subversion-1.1.3/
, while
another version might be stored in
/nix/store/5mq2jcn36ldlmh93yj1n8s9c95pj7c5s-subversion-1.1.2
. The long
strings prefixed to the directory names are cryptographic hashes (to be
precise, 160-bit truncations of SHA-256 hashes encoded in a base-32
notation) of all inputs involved in building the package — sources,
dependencies, compiler flags, and so on. So if two packages differ in
any way, they end up in different locations in the file system, so they
don’t interfere with each other. Here is what a part of a typical Nix
store looks like:
Of course, you wouldn’t want to type
$ /nix/store/dpmvp969yhdq...-subversion-1.1.3/bin/svn
every time you want to run Subversion. Of course we could set up the
PATH
environment variable to include the bin
directory of every
package we want to use, but this is not very convenient since changing
PATH
doesn’t take effect for already existing processes. The solution
Nix uses is to create directory trees of symlinks to activated
packages. These are called user environments and they are packages
themselves (though automatically generated by nix-env
), so they too
reside in the Nix store. For instance, in the figure above, the user
environment /nix/store/0c1p5z4kda11...-user-env
contains a symlink to
just Subversion 1.1.2 (arrows in the figure indicate symlinks). This
would be what we would obtain if we had done
$ nix-env -iA nixpkgs.subversion
on a set of Nix expressions that contained Subversion 1.1.2.
This doesn’t in itself solve the problem, of course; you wouldn’t want
to type /nix/store/0c1p5z4kda11...-user-env/bin/svn
either. That’s why
there are symlinks outside of the store that point to the user
environments in the store; for instance, the symlinks default-42-link
and default-43-link
in the example. These are called generations
since every time you perform a nix-env
operation, a new user
environment is generated based on the current one. For instance,
generation 43 was created from generation 42 when we did
$ nix-env -iA nixpkgs.subversion nixpkgs.firefox
on a set of Nix expressions that contained Firefox and a new version of Subversion.
Generations are grouped together into profiles so that different users don’t interfere with each other if they don’t want to. For example:
$ ls -l /nix/var/nix/profiles/
...
lrwxrwxrwx 1 eelco ... default-42-link -> /nix/store/0c1p5z4kda11...-user-env
lrwxrwxrwx 1 eelco ... default-43-link -> /nix/store/3aw2pdyx2jfc...-user-env
lrwxrwxrwx 1 eelco ... default -> default-43-link
This shows a profile called default
. The file default
itself is
actually a symlink that points to the current generation. When we do a
nix-env
operation, a new user environment and generation link are
created based on the current one, and finally the default
symlink is
made to point at the new generation. This last step is atomic on Unix,
which explains how we can do atomic upgrades. (Note that the
building/installing of new packages doesn’t interfere in any way with
old packages, since they are stored in different locations in the Nix
store.)
If you find that you want to undo a nix-env
operation, you can just do
$ nix-env --rollback
which will just make the current generation link point at the previous
link. E.g., default
would be made to point at default-42-link
. You
can also switch to a specific generation:
$ nix-env --switch-generation 43
which in this example would roll forward to generation 43 again. You can also see all available generations:
$ nix-env --list-generations
You generally wouldn’t have /nix/var/nix/profiles/some-profile/bin
in
your PATH
. Rather, there is a symlink ~/.nix-profile
that points to
your current profile. This means that you should put
~/.nix-profile/bin
in your PATH
(and indeed, that’s what the
initialisation script /nix/etc/profile.d/nix.sh
does). This makes it
easier to switch to a different profile. You can do that using the
command nix-env --switch-profile
:
$ nix-env --switch-profile /nix/var/nix/profiles/my-profile
$ nix-env --switch-profile /nix/var/nix/profiles/default
These commands switch to the my-profile
and default profile,
respectively. If the profile doesn’t exist, it will be created
automatically. You should be careful about storing a profile in another
location than the profiles
directory, since otherwise it might not be
used as a root of the garbage collector.
All nix-env
operations work on the profile pointed to by
~/.nix-profile
, but you can override this using the --profile
option
(abbreviation -p
):
$ nix-env -p /nix/var/nix/profiles/other-profile -iA nixpkgs.subversion
This will not change the ~/.nix-profile
symlink.
Garbage Collection
nix-env
operations such as upgrades (-u
) and uninstall (-e
) never
actually delete packages from the system. All they do (as shown above)
is to create a new user environment that no longer contains symlinks to
the “deleted” packages.
Of course, since disk space is not infinite, unused packages should be removed at some point. You can do this by running the Nix garbage collector. It will remove from the Nix store any package not used (directly or indirectly) by any generation of any profile.
Note however that as long as old generations reference a package, it will not be deleted. After all, we wouldn’t be able to do a rollback otherwise. So in order for garbage collection to be effective, you should also delete (some) old generations. Of course, this should only be done if you are certain that you will not need to roll back.
To delete all old (non-current) generations of your current profile:
$ nix-env --delete-generations old
Instead of old
you can also specify a list of generations, e.g.,
$ nix-env --delete-generations 10 11 14
To delete all generations older than a specified number of days (except
the current generation), use the d
suffix. For example,
$ nix-env --delete-generations 14d
deletes all generations older than two weeks.
After removing appropriate old generations you can run the garbage collector as follows:
$ nix-store --gc
The behaviour of the garbage collector is affected by the
keep-derivations
(default: true) and keep-outputs
(default: false)
options in the Nix configuration file. The defaults will ensure that all
derivations that are build-time dependencies of garbage collector roots
will be kept and that all output paths that are runtime dependencies
will be kept as well. All other derivations or paths will be collected.
(This is usually what you want, but while you are developing it may make
sense to keep outputs to ensure that rebuild times are quick.) If you
are feeling uncertain, you can also first view what files would be
deleted:
$ nix-store --gc --print-dead
Likewise, the option --print-live
will show the paths that won’t be
deleted.
There is also a convenient little utility nix-collect-garbage
, which
when invoked with the -d
(--delete-old
) switch deletes all old
generations of all profiles in /nix/var/nix/profiles
. So
$ nix-collect-garbage -d
is a quick and easy way to clean up your system.
Garbage Collector Roots
The roots of the garbage collector are all store paths to which there
are symlinks in the directory prefix/nix/var/nix/gcroots
. For
instance, the following command makes the path
/nix/store/d718ef...-foo
a root of the collector:
$ ln -s /nix/store/d718ef...-foo /nix/var/nix/gcroots/bar
That is, after this command, the garbage collector will not remove
/nix/store/d718ef...-foo
or any of its dependencies.
Subdirectories of prefix/nix/var/nix/gcroots
are also searched for
symlinks. Symlinks to non-store paths are followed and searched for
roots, but symlinks to non-store paths inside the paths reached in
that way are not followed to prevent infinite recursion.
Channels
If you want to stay up to date with a set of packages, it’s not very
convenient to manually download the latest set of Nix expressions for
those packages and upgrade using nix-env
. Fortunately, there’s a
better way: Nix channels.
A Nix channel is just a URL that points to a place that contains a set
of Nix expressions and a manifest. Using the command
nix-channel
you can automatically
stay up to date with whatever is available at that URL.
To see the list of official NixOS channels, visit https://nixos.org/channels.
You can “subscribe” to a channel using nix-channel --add
, e.g.,
$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
subscribes you to a channel that always contains that latest version of
the Nix Packages collection. (Subscribing really just means that the URL
is added to the file ~/.nix-channels
, where it is read by subsequent
calls to nix-channel --update
.) You can “unsubscribe” using nix-channel --remove
:
$ nix-channel --remove nixpkgs
To obtain the latest Nix expressions available in a channel, do
$ nix-channel --update
This downloads and unpacks the Nix expressions in every channel
(downloaded from url/nixexprs.tar.bz2
). It also makes the union of
each channel’s Nix expressions available by default to nix-env
operations (via the symlink ~/.nix-defexpr/channels
). Consequently,
you can then say
$ nix-env -u
to upgrade all packages in your profile to the latest versions available in the subscribed channels.
Sharing Packages Between Machines
Sometimes you want to copy a package from one machine to another. Or, you want to install some packages and you know that another machine already has some or all of those packages or their dependencies. In that case there are mechanisms to quickly copy packages between machines.
Serving a Nix store via HTTP
You can easily share the Nix store of a machine via HTTP. This allows other machines to fetch store paths from that machine to speed up installations. It uses the same binary cache mechanism that Nix usually uses to fetch pre-built binaries from https://cache.nixos.org.
The daemon that handles binary cache requests via HTTP, nix-serve
, is
not part of the Nix distribution, but you can install it from Nixpkgs:
$ nix-env -iA nixpkgs.nix-serve
You can then start the server, listening for HTTP connections on whatever port you like:
$ nix-serve -p 8080
To check whether it works, try the following on the client:
$ curl http://avalon:8080/nix-cache-info
which should print something like:
StoreDir: /nix/store
WantMassQuery: 1
Priority: 30
On the client side, you can tell Nix to use your binary cache using
--option extra-binary-caches
, e.g.:
$ nix-env -iA nixpkgs.firefox --option extra-binary-caches http://avalon:8080/
The option extra-binary-caches
tells Nix to use this binary cache in
addition to your default caches, such as https://cache.nixos.org.
Thus, for any path in the closure of Firefox, Nix will first check if
the path is available on the server avalon
or another binary caches.
If not, it will fall back to building from source.
You can also tell Nix to always use your binary cache by adding a line
to the nix.conf
configuration file like this:
binary-caches = http://avalon:8080/ https://cache.nixos.org/
Copying Closures via SSH
The command nix-copy-closure
copies a Nix store path along with all
its dependencies to or from another machine via the SSH protocol. It
doesn’t copy store paths that are already present on the target machine.
For example, the following command copies Firefox with all its
dependencies:
$ nix-copy-closure --to alice@itchy.example.org $(type -p firefox)
See the manpage for nix-copy-closure
for details.
With nix-store --export
and nix-store --import
you can write the closure of a store
path (that is, the path and all its dependencies) to a file, and then
unpack that file into another Nix store. For example,
$ nix-store --export $(nix-store -qR $(type -p firefox)) > firefox.closure
writes the closure of Firefox to a file. You can then copy this file to another machine and install the closure:
$ nix-store --import < firefox.closure
Any store paths in the closure that are already present in the target store are ignored. It is also possible to pipe the export into another command, e.g. to copy and install a closure directly to/on another machine:
$ nix-store --export $(nix-store -qR $(type -p firefox)) | bzip2 | \
ssh alice@itchy.example.org "bunzip2 | nix-store --import"
However, nix-copy-closure
is generally more efficient because it only
copies paths that are not already present in the target Nix store.
Serving a Nix store via SSH
You can tell Nix to automatically fetch needed binaries from a remote
Nix store via SSH. For example, the following installs Firefox,
automatically fetching any store paths in Firefox’s closure if they are
available on the server avalon
:
$ nix-env -iA nixpkgs.firefox --substituters ssh://alice@avalon
This works similar to the binary cache substituter that Nix usually
uses, only using SSH instead of HTTP: if a store path P
is needed, Nix
will first check if it’s available in the Nix store on avalon
. If not,
it will fall back to using the binary cache substituter, and then to
building from source.
Note
The SSH substituter currently does not allow you to enter an SSH passphrase interactively. Therefore, you should use
ssh-add
to load the decrypted private key intossh-agent
.
You can also copy the closure of some store path, without installing it into your profile, e.g.
$ nix-store -r /nix/store/m85bxg…-firefox-34.0.5 --substituters
ssh://alice@avalon
This is essentially equivalent to doing
$ nix-copy-closure --from alice@avalon
/nix/store/m85bxg…-firefox-34.0.5
You can use SSH’s forced command feature to set up a restricted user
account for SSH substituter access, allowing read-only access to the
local Nix store, but nothing more. For example, add the following lines
to sshd_config
to restrict the user nix-ssh
:
Match User nix-ssh
AllowAgentForwarding no
AllowTcpForwarding no
PermitTTY no
PermitTunnel no
X11Forwarding no
ForceCommand nix-store --serve
Match All
On NixOS, you can accomplish the same by adding the following to your
configuration.nix
:
nix.sshServe.enable = true;
nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];
where the latter line lists the public keys of users that are allowed to connect.
Serving a Nix store via S3
Nix has built-in support for storing and fetching store paths from Amazon S3 and S3-compatible services. This uses the same binary cache mechanism that Nix usually uses to fetch prebuilt binaries from cache.nixos.org.
The following options can be specified as URL parameters to the S3 URL:
-
profile
The name of the AWS configuration profile to use. By default Nix will use thedefault
profile. -
region
The region of the S3 bucket.us–east-1
by default.If your bucket is not in
us–east-1
, you should always explicitly specify the region parameter. -
endpoint
The URL to your S3-compatible service, for when not using Amazon S3. Do not specify this value if you're using Amazon S3.Note
This endpoint must support HTTPS and will use path-based addressing instead of virtual host based addressing.
-
scheme
The scheme used for S3 requests,https
(default) orhttp
. This option allows you to disable HTTPS for binary caches which don't support it.Note
HTTPS should be used if the cache might contain sensitive information.
In this example we will use the bucket named example-nix-cache
.
Anonymous Reads to your S3-compatible binary cache
If your binary cache is publicly accessible and does not require authentication, the simplest and easiest way to use Nix with your S3 compatible binary cache is to use the HTTP URL for that cache.
For AWS S3 the binary cache URL for example bucket will be exactly https://example-nix-cache.s3.amazonaws.com or s3://example-nix-cache. For S3 compatible binary caches, consult that cache's documentation.
Your bucket will need the following bucket policy:
{
"Id": "DirectReads",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDirectReads",
"Action": [
"s3:GetObject",
"s3:GetBucketLocation"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::example-nix-cache",
"arn:aws:s3:::example-nix-cache/*"
],
"Principal": "*"
}
]
}
Authenticated Reads to your S3 binary cache
For AWS S3 the binary cache URL for example bucket will be exactly s3://example-nix-cache.
Nix will use the default credential provider chain for authenticating requests to Amazon S3.
Nix supports authenticated reads from Amazon S3 and S3 compatible binary caches.
Your bucket will need a bucket policy allowing the desired users to
perform the s3:GetObject
and s3:GetBucketLocation
action on all
objects in the bucket. The anonymous policy given
above can be
updated to have a restricted Principal
to support this.
Authenticated Writes to your S3-compatible binary cache
Nix support fully supports writing to Amazon S3 and S3 compatible buckets. The binary cache URL for our example bucket will be s3://example-nix-cache.
Nix will use the default credential provider chain for authenticating requests to Amazon S3.
Your account will need the following IAM policy to upload to the cache:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "UploadToCache",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::example-nix-cache",
"arn:aws:s3:::example-nix-cache/*"
]
}
]
}
Examples
To upload with a specific credential profile for Amazon S3:
$ nix copy nixpkgs.hello \
--to 's3://example-nix-cache?profile=cache-upload®ion=eu-west-2'
To upload to an S3-compatible binary cache:
$ nix copy nixpkgs.hello --to \
's3://example-nix-cache?profile=cache-upload&scheme=https&endpoint=minio.example.com'
Nix Language
The Nix language is
-
domain-specific
It only exists for the Nix package manager: to describe packages and configurations as well as their variants and compositions. It is not intended for general purpose use.
-
declarative
There is no notion of executing sequential steps. Dependencies between operations are established only through data.
-
pure
Values cannot change during computation. Functions always produce the same output if their input does not change.
-
functional
Functions are like any other value. Functions can be assigned to names, taken as arguments, or returned by functions.
-
lazy
Expressions are only evaluated when their value is needed.
-
dynamically typed
Type errors are only detected when expressions are evaluated.
Overview
This is an incomplete overview of language features, by example.
Example | Description |
---|---|
Basic values |
|
|
A string |
|
A multi-line string. Strips common prefixed whitespace. Evaluates to |
|
String interpolation (expands to |
|
Booleans |
|
Null value |
|
An integer |
|
A floating point number |
|
An absolute path |
|
A path relative to the file containing this Nix expression |
|
A home path. Evaluates to the |
|
Search path. Value determined by |
Compound values |
|
|
A set with attributes named |
|
A nested set, equivalent to |
|
A recursive set, equivalent to |
|
Lists with three elements. |
Operators |
|
|
String concatenation |
|
Integer addition |
|
Equality test (evaluates to |
|
Inequality test (evaluates to |
|
Boolean negation |
|
Attribute selection (evaluates to |
|
Attribute selection with default (evaluates to |
|
Merge two sets (attributes in the right-hand set taking precedence) |
Control structures |
|
|
Conditional expression |
|
Assertion check (evaluates to |
|
Variable definition |
|
Add all attributes from the given set to the scope (evaluates to |
Functions (lambdas) |
|
|
A function that expects an integer and returns it increased by 1 |
|
Curried function, equivalent to |
|
A function call (evaluates to 101) |
|
A function bound to a variable and subsequently called by name (evaluates to 103) |
|
A function that expects a set with required attributes |
|
A function that expects a set with required attribute |
|
A function that expects a set with required attributes |
|
A function that expects a set with required attributes |
Built-in functions |
|
|
Load and return Nix expression in given file |
|
Apply a function to every element of a list (evaluates to |
Data Types
Primitives
-
Strings can be written in three ways.
The most common way is to enclose the string between double quotes, e.g.,
"foo bar"
. Strings can span multiple lines. The special characters"
and\
and the character sequence${
must be escaped by prefixing them with a backslash (\
). Newlines, carriage returns and tabs can be written as\n
,\r
and\t
, respectively.You can include the results of other expressions into a string by enclosing them in
${ }
, a feature known as string interpolation.The second way to write string literals is as an indented string, which is enclosed between pairs of double single-quotes, like so:
'' This is the first line. This is the second line. This is the third line. ''
This kind of string literal intelligently strips indentation from the start of each line. To be precise, it strips from each line a number of spaces equal to the minimal indentation of the string as a whole (disregarding the indentation of empty lines). For instance, the first and second line are indented two spaces, while the third line is indented four spaces. Thus, two spaces are stripped from each line, so the resulting string is
"This is the first line.\nThis is the second line.\n This is the third line.\n"
Note that the whitespace and newline following the opening
''
is ignored if there is no non-whitespace text on the initial line.Indented strings support string interpolation.
Since
${
and''
have special meaning in indented strings, you need a way to quote them.$
can be escaped by prefixing it with''
(that is, two single quotes), i.e.,''$
.''
can be escaped by prefixing it with'
, i.e.,'''
.$
removes any special meaning from the following$
. Linefeed, carriage-return and tab characters can be written as''\n
,''\r
,''\t
, and''\
escapes any other character.Indented strings are primarily useful in that they allow multi-line string literals to follow the indentation of the enclosing Nix expression, and that less escaping is typically necessary for strings representing languages such as shell scripts and configuration files because
''
is much less common than"
. Example:stdenv.mkDerivation { ... postInstall = '' mkdir $out/bin $out/etc cp foo $out/bin echo "Hello World" > $out/etc/foo.conf ${if enableBar then "cp bar $out/bin" else ""} ''; ... }
Finally, as a convenience, URIs as defined in appendix B of RFC 2396 can be written as is, without quotes. For instance, the string
"http://example.org/foo.tar.bz2"
can also be written ashttp://example.org/foo.tar.bz2
. -
Numbers, which can be integers (like
123
) or floating point (like123.43
or.27e13
).See arithmetic and comparison operators for semantics.
-
Paths, e.g.,
/bin/sh
or./builder.sh
. A path must contain at least one slash to be recognised as such. For instance,builder.sh
is not a path: it's parsed as an expression that selects the attributesh
from the variablebuilder
. If the file name is relative, i.e., if it does not begin with a slash, it is made absolute at parse time relative to the directory of the Nix expression that contained it. For instance, if a Nix expression in/foo/bar/bla.nix
refers to../xyzzy/fnord.nix
, the absolute path is/foo/xyzzy/fnord.nix
.If the first component of a path is a
~
, it is interpreted as if the rest of the path were relative to the user's home directory. e.g.~/foo
would be equivalent to/home/edolstra/foo
for a user whose home directory is/home/edolstra
.Paths can also be specified between angle brackets, e.g.
<nixpkgs>
. This means that the directories listed in the environment variableNIX_PATH
will be searched for the given file or directory name.When an interpolated string evaluates to a path, the path is first copied into the Nix store and the resulting string is the store path of the newly created store object.
For instance, evaluating
"${./foo.txt}"
will causefoo.txt
in the current directory to be copied into the Nix store and result in the string"/nix/store/<hash>-foo.txt"
.Note that the Nix language assumes that all input files will remain unchanged while evaluating a Nix expression. For example, assume you used a file path in an interpolated string during a
nix repl
session. Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new store path, since Nix might not re-read the file contents.Paths themselves, except those in angle brackets (
< >
), support string interpolation.At least one slash (
/
) must appear before any interpolated expression for the result to be recognized as a path.a.${foo}/b.${bar}
is a syntactically valid division operation../a.${foo}/b.${bar}
is a path. -
Booleans with values
true
andfalse
. -
The null value, denoted as
null
.
List
Lists are formed by enclosing a whitespace-separated list of values between square brackets. For example,
[ 123 ./foo.nix "abc" (f { x = y; }) ]
defines a list of four elements, the last being the result of a call to
the function f
. Note that function calls have to be enclosed in
parentheses. If they had been omitted, e.g.,
[ 123 ./foo.nix "abc" f { x = y; } ]
the result would be a list of five elements, the fourth one being a function and the fifth being a set.
Note that lists are only lazy in values, and they are strict in length.
Attribute Set
An attribute set is a collection of name-value-pairs (called attributes) enclosed in curly brackets ({ }
).
Names and values are separated by an equal sign (=
).
Each value is an arbitrary expression terminated by a semicolon (;
).
Attributes can appear in any order. An attribute name may only occur once.
Example:
{
x = 123;
text = "Hello";
y = f { bla = 456; };
}
This defines a set with attributes named x
, text
, y
.
Attributes can be selected from a set using the .
operator. For
instance,
{ a = "Foo"; b = "Bar"; }.a
evaluates to "Foo"
. It is possible to provide a default value in an
attribute selection using the or
keyword. For example,
{ a = "Foo"; b = "Bar"; }.c or "Xyzzy"
will evaluate to "Xyzzy"
because there is no c
attribute in the set.
You can use arbitrary double-quoted strings as attribute names:
{ "$!@#?" = 123; }."$!@#?"
let bar = "bar";
{ "foo ${bar}" = 123; }."foo ${bar}"
Both will evaluate to 123
.
Attribute names support string interpolation:
let bar = "foo"; in
{ foo = 123; }.${bar}
let bar = "foo"; in
{ ${bar} = 123; }.foo
Both will evaluate to 123
.
In the special case where an attribute name inside of a set declaration
evaluates to null
(which is normally an error, as null
cannot be coerced to
a string), that attribute is simply not added to the set:
{ ${if foo then "bar" else null} = true; }
This will evaluate to {}
if foo
evaluates to false
.
A set that has a __functor
attribute whose value is callable (i.e. is
itself a function or a set with a __functor
attribute whose value is
callable) can be applied as if it were a function, with the set itself
passed in first , e.g.,
let add = { __functor = self: x: x + self.x; };
inc = add // { x = 1; };
in inc 1
evaluates to 2
. This can be used to attach metadata to a function
without the caller needing to treat it specially, or to implement a form
of object-oriented programming, for example.
Language Constructs
Recursive sets
Recursive sets are just normal sets, but the attributes can refer to each other. For example,
rec {
x = y;
y = 123;
}.x
evaluates to 123
. Note that without rec
the binding x = y;
would
refer to the variable y
in the surrounding scope, if one exists, and
would be invalid if no such variable exists. That is, in a normal
(non-recursive) set, attributes are not added to the lexical scope; in a
recursive set, they are.
Recursive sets of course introduce the danger of infinite recursion. For example, the expression
rec {
x = y;
y = x;
}.x
will crash with an infinite recursion encountered
error message.
Let-expressions
A let-expression allows you to define local variables for an expression. For instance,
let
x = "foo";
y = "bar";
in x + y
evaluates to "foobar"
.
Inheriting attributes
When defining a set or in a let-expression it is often convenient to
copy variables from the surrounding lexical scope (e.g., when you want
to propagate attributes). This can be shortened using the inherit
keyword. For instance,
let x = 123; in
{ inherit x;
y = 456;
}
is equivalent to
let x = 123; in
{ x = x;
y = 456;
}
and both evaluate to { x = 123; y = 456; }
. (Note that this works
because x
is added to the lexical scope by the let
construct.) It is
also possible to inherit attributes from another set. For instance, in
this fragment from all-packages.nix
,
graphviz = (import ../tools/graphics/graphviz) {
inherit fetchurl stdenv libpng libjpeg expat x11 yacc;
inherit (xlibs) libXaw;
};
xlibs = {
libX11 = ...;
libXaw = ...;
...
}
libpng = ...;
libjpg = ...;
...
the set used in the function call to the function defined in
../tools/graphics/graphviz
inherits a number of variables from the
surrounding scope (fetchurl
... yacc
), but also inherits libXaw
(the X Athena Widgets) from the xlibs
(X11 client-side libraries) set.
Summarizing the fragment
...
inherit x y z;
inherit (src-set) a b c;
...
is equivalent to
...
x = x; y = y; z = z;
a = src-set.a; b = src-set.b; c = src-set.c;
...
when used while defining local variables in a let-expression or while defining a set.
Functions
Functions have the following form:
pattern: body
The pattern specifies what the argument of the function must look like, and binds variables in the body to (parts of) the argument. There are three kinds of patterns:
-
If a pattern is a single identifier, then the function matches any argument. Example:
let negate = x: !x; concat = x: y: x + y; in if negate true then concat "foo" "bar" else ""
Note that
concat
is a function that takes one argument and returns a function that takes another argument. This allows partial parameterisation (i.e., only filling some of the arguments of a function); e.g.,map (concat "foo") [ "bar" "bla" "abc" ]
evaluates to
[ "foobar" "foobla" "fooabc" ]
. -
A set pattern of the form
{ name1, name2, …, nameN }
matches a set containing the listed attributes, and binds the values of those attributes to variables in the function body. For example, the function{ x, y, z }: z + y + x
can only be called with a set containing exactly the attributes
x
,y
andz
. No other attributes are allowed. If you want to allow additional arguments, you can use an ellipsis (...
):{ x, y, z, ... }: z + y + x
This works on any set that contains at least the three named attributes.
It is possible to provide default values for attributes, in which case they are allowed to be missing. A default value is specified by writing
name ? e
, where e is an arbitrary expression. For example,{ x, y ? "foo", z ? "bar" }: z + y + x
specifies a function that only requires an attribute named
x
, but optionally acceptsy
andz
. -
An
@
-pattern provides a means of referring to the whole value being matched:args@{ x, y, z, ... }: z + y + x + args.a
but can also be written as:
{ x, y, z, ... } @ args: z + y + x + args.a
Here
args
is bound to the entire argument, which is further matched against the pattern{ x, y, z, ... }
.@
-pattern makes mainly sense with an ellipsis(...
) as you can access attribute names asa
, usingargs.a
, which was given as an additional attribute to the function.Warning
The
args@
expression is bound to the argument passed to the function which means that attributes with defaults that aren't explicitly specified in the function call won't cause an evaluation error, but won't exist inargs
.For instance
let function = args@{ a ? 23, ... }: args; in function {}
will evaluate to an empty attribute set.
Note that functions do not have names. If you want to give them a name, you can bind them to an attribute, e.g.,
let concat = { x, y }: x + y;
in concat { x = "foo"; y = "bar"; }
Conditionals
Conditionals look like this:
if e1 then e2 else e3
where e1 is an expression that should evaluate to a Boolean value
(true
or false
).
Assertions
Assertions are generally used to check that certain requirements on or between features and dependencies hold. They look like this:
assert e1; e2
where e1 is an expression that should evaluate to a Boolean value. If
it evaluates to true
, e2 is returned; otherwise expression
evaluation is aborted and a backtrace is printed.
Here is a Nix expression for the Subversion package that shows how assertions can be used:.
{ localServer ? false
, httpServer ? false
, sslSupport ? false
, pythonBindings ? false
, javaSwigBindings ? false
, javahlBindings ? false
, stdenv, fetchurl
, openssl ? null, httpd ? null, db4 ? null, expat, swig ? null, j2sdk ? null
}:
assert localServer -> db4 != null; ①
assert httpServer -> httpd != null && httpd.expat == expat; ②
assert sslSupport -> openssl != null && (httpServer -> httpd.openssl == openssl); ③
assert pythonBindings -> swig != null && swig.pythonSupport;
assert javaSwigBindings -> swig != null && swig.javaSupport;
assert javahlBindings -> j2sdk != null;
stdenv.mkDerivation {
name = "subversion-1.1.1";
...
openssl = if sslSupport then openssl else null; ④
...
}
The points of interest are:
-
This assertion states that if Subversion is to have support for local repositories, then Berkeley DB is needed. So if the Subversion function is called with the
localServer
argument set totrue
but thedb4
argument set tonull
, then the evaluation fails.Note that
->
is the logical implication Boolean operation. -
This is a more subtle condition: if Subversion is built with Apache (
httpServer
) support, then the Expat library (an XML library) used by Subversion should be same as the one used by Apache. This is because in this configuration Subversion code ends up being linked with Apache code, and if the Expat libraries do not match, a build- or runtime link error or incompatibility might occur. -
This assertion says that in order for Subversion to have SSL support (so that it can access
https
URLs), an OpenSSL library must be passed. Additionally, it says that if Apache support is enabled, then Apache's OpenSSL should match Subversion's. (Note that if Apache support is not enabled, we don't care about Apache's OpenSSL.) -
The conditional here is not really related to assertions, but is worth pointing out: it ensures that if SSL support is disabled, then the Subversion derivation is not dependent on OpenSSL, even if a non-
null
value was passed. This prevents an unnecessary rebuild of Subversion if OpenSSL changes.
With-expressions
A with-expression,
with e1; e2
introduces the set e1 into the lexical scope of the expression e2. For instance,
let as = { x = "foo"; y = "bar"; };
in with as; x + y
evaluates to "foobar"
since the with
adds the x
and y
attributes
of as
to the lexical scope in the expression x + y
. The most common
use of with
is in conjunction with the import
function. E.g.,
with (import ./definitions.nix); ...
makes all attributes defined in the file definitions.nix
available as
if they were defined locally in a let
-expression.
The bindings introduced by with
do not shadow bindings introduced by
other means, e.g.
let a = 3; in with { a = 1; }; let a = 4; in with { a = 2; }; ...
establishes the same scope as
let a = 1; in let a = 2; in let a = 3; in let a = 4; in ...
Comments
Comments can be single-line, started with a #
character, or
inline/multi-line, enclosed within /* ... */
.
String interpolation
String interpolation is a language feature where a string, path, or attribute name can contain expressions enclosed in ${ }
(dollar-sign with curly brackets).
Such a string is an interpolated string, and an expression inside is an interpolated expression.
Interpolated expressions must evaluate to one of the following:
- a string
- a path
- a derivation
Examples
String
Rather than writing
"--with-freetype2-library=" + freetype + "/lib"
(where freetype
is a derivation), you can instead write
"--with-freetype2-library=${freetype}/lib"
The latter is automatically translated to the former.
A more complicated example (from the Nix expression for Qt):
configureFlags = "
-system-zlib -system-libpng -system-libjpeg
${if openglSupport then "-dlopen-opengl
-L${mesa}/lib -I${mesa}/include
-L${libXmu}/lib -I${libXmu}/include" else ""}
${if threadSupport then "-thread" else "-no-thread"}
";
Note that Nix expressions and strings can be arbitrarily nested;
in this case the outer string contains various interpolated expressions that themselves contain strings (e.g., "-thread"
), some of which in turn contain interpolated expressions (e.g., ${mesa}
).
Path
Rather than writing
./. + "/" + foo + "-" + bar + ".nix"
or
./. + "/${foo}-${bar}.nix"
you can instead write
./${foo}-${bar}.nix
Attribute name
Attribute names can be created dynamically with string interpolation:
let name = "foo"; in
{
${name} = "bar";
}
{ foo = "bar"; }
Operators
Name | Syntax | Associativity | Precedence |
---|---|---|---|
Attribute selection | attrset . attrpath [ or expr ] | none | 1 |
Function application | func expr | left | 2 |
Arithmetic negation | - number | none | 3 |
Has attribute | attrset ? attrpath | none | 4 |
List concatenation | list ++ list | right | 5 |
Multiplication | number * number | left | 6 |
Division | number / number | left | 6 |
Subtraction | number - number | left | 7 |
Addition | number + number | left | 7 |
String concatenation | string + string | left | 7 |
Path concatenation | path + path | left | 7 |
Path and string concatenation | path + string | left | 7 |
[String and path concatenation] | string + path | left | 7 |
Logical negation (NOT ) | ! bool | none | 8 |
Update | attrset // attrset | right | 9 |
Less than | expr < expr | none | 10 |
Less than or equal to | expr <= expr | none | 10 |
Greater than | expr > expr | none | 10 |
Greater than or equal to | expr >= expr | none | 10 |
Equality | expr == expr | none | 11 |
Inequality | expr != expr | none | 11 |
Logical conjunction (AND ) | bool && bool | left | 12 |
Logical disjunction (OR ) | bool ` | ` bool | |
Logical implication | bool -> bool | none | 14 |
Attribute selection
Select the attribute denoted by attribute path attrpath from attribute set attrset. If the attribute doesn’t exist, return value if provided, otherwise abort evaluation.
An attribute path is a dot-separated list of attribute names. An attribute name can be an identifier or a string.
attrpath = name [
.
name ]... name = identifier | string identifier ~[a-zA-Z_][a-zA-Z0-9_'-]*
Has attribute
attrset
?
attrpath
Test whether attribute set attrset contains the attribute denoted by attrpath. The result is a Boolean value.
Arithmetic
Numbers are type-compatible: Pure integer operations will always return integers, whereas any operation involving at least one floating point number return a floating point number.
See also Comparison and Equality.
The +
operator is overloaded to also work on strings and paths.
String concatenation
string
+
string
Concatenate two strings and merge their string contexts.
Path concatenation
path
+
path
Concatenate two paths. The result is a path.
Path and string concatenation
path + string
Concatenate path with string. The result is a path.
Note
The string must not have a string context that refers to a store path.
String and path concatenation
string + path
Concatenate string with path. The result is a string.
Important
The file or directory at path must exist and is copied to the store. The path appears in the result as the corresponding store path.
Update
attrset1 + attrset2
Update attribute set attrset1 with names and values from attrset2.
The returned attribute set will have of all the attributes in e1 and e2. If an attribute name is present in both, the attribute value from the former is taken.
Comparison
Comparison is
- arithmetic for numbers
- lexicographic for strings and paths
- item-wise lexicographic for lists: elements at the same index in both lists are compared according to their type and skipped if they are equal.
All comparison operators are implemented in terms of <
, and the following equivalencies hold:
comparison | implementation |
---|---|
a <= b | ! ( b < a ) |
a > b | b < a |
a >= b | ! ( a < b ) |
Equality
- Attribute sets and lists are compared recursively, and therefore are fully evaluated.
- Comparison of functions always returns
false
. - Numbers are type-compatible, see arithmetic operators.
- Floating point numbers only differ up to a limited precision.
Logical implication
Equivalent to !
b1 ||
b2.
Derivations
The most important built-in function is derivation
, which is used to
describe a single derivation (a build task). It takes as input a set,
the attributes of which specify the inputs of the build.
-
There must be an attribute named
system
whose value must be a string specifying a Nix system type, such as"i686-linux"
or"x86_64-darwin"
. (To figure out your system type, runnix -vv --version
.) The build can only be performed on a machine and operating system matching the system type. (Nix can automatically forward builds for other platforms by forwarding them to other machines.) -
There must be an attribute named
name
whose value must be a string. This is used as a symbolic name for the package bynix-env
, and it is appended to the output paths of the derivation. -
There must be an attribute named
builder
that identifies the program that is executed to perform the build. It can be either a derivation or a source (a local file reference, e.g.,./builder.sh
). -
Every attribute is passed as an environment variable to the builder. Attribute values are translated to environment variables as follows:
-
Strings and numbers are just passed verbatim.
-
A path (e.g.,
../foo/sources.tar
) causes the referenced file to be copied to the store; its location in the store is put in the environment variable. The idea is that all sources should reside in the Nix store, since all inputs to a derivation should reside in the Nix store. -
A derivation causes that derivation to be built prior to the present derivation; its default output path is put in the environment variable.
-
Lists of the previous types are also allowed. They are simply concatenated, separated by spaces.
-
true
is passed as the string1
,false
andnull
are passed as an empty string.
-
-
The optional attribute
args
specifies command-line arguments to be passed to the builder. It should be a list. -
The optional attribute
outputs
specifies a list of symbolic outputs of the derivation. By default, a derivation produces a single output path, denoted asout
. However, derivations can produce multiple output paths. This is useful because it allows outputs to be downloaded or garbage-collected separately. For instance, imagine a library package that provides a dynamic library, header files, and documentation. A program that links against the library doesn’t need the header files and documentation at runtime, and it doesn’t need the documentation at build time. Thus, the library package could specify:outputs = [ "lib" "headers" "doc" ];
This will cause Nix to pass environment variables
lib
,headers
anddoc
to the builder containing the intended store paths of each output. The builder would typically do something like./configure \ --libdir=$lib/lib \ --includedir=$headers/include \ --docdir=$doc/share/doc
for an Autoconf-style package. You can refer to each output of a derivation by selecting it as an attribute, e.g.
buildInputs = [ pkg.lib pkg.headers ];
The first element of
outputs
determines the default output. Thus, you could also writebuildInputs = [ pkg pkg.headers ];
since
pkg
is equivalent topkg.lib
.
The function mkDerivation
in the Nixpkgs standard environment is a
wrapper around derivation
that adds a default value for system
and
always uses Bash as the builder, to which the supplied builder is passed
as a command-line argument. See the Nixpkgs manual for details.
The builder is executed as follows:
-
A temporary directory is created under the directory specified by
TMPDIR
(default/tmp
) where the build will take place. The current directory is changed to this directory. -
The environment is cleared and set to the derivation attributes, as specified above.
-
In addition, the following variables are set:
-
NIX_BUILD_TOP
contains the path of the temporary directory for this build. -
Also,
TMPDIR
,TEMPDIR
,TMP
,TEMP
are set to point to the temporary directory. This is to prevent the builder from accidentally writing temporary files anywhere else. Doing so might cause interference by other processes. -
PATH
is set to/path-not-set
to prevent shells from initialising it to their built-in default value. -
HOME
is set to/homeless-shelter
to prevent programs from using/etc/passwd
or the like to find the user's home directory, which could cause impurity. Usually, whenHOME
is set, it is used as the location of the home directory, even if it points to a non-existent path. -
NIX_STORE
is set to the path of the top-level Nix store directory (typically,/nix/store
). -
For each output declared in
outputs
, the corresponding environment variable is set to point to the intended path in the Nix store for that output. Each output path is a concatenation of the cryptographic hash of all build inputs, thename
attribute and the output name. (The output name is omitted if it’sout
.)
-
-
If an output path already exists, it is removed. Also, locks are acquired to prevent multiple Nix instances from performing the same build at the same time.
-
A log of the combined standard output and error is written to
/nix/var/log/nix
. -
The builder is executed with the arguments specified by the attribute
args
. If it exits with exit code 0, it is considered to have succeeded. -
The temporary directory is removed (unless the
-K
option was specified). -
If the build was successful, Nix scans each output path for references to input paths by looking for the hash parts of the input paths. Since these are potential runtime dependencies, Nix registers them as dependencies of the output paths.
-
After the build, Nix sets the last-modified timestamp on all files in the build result to 1 (00:00:01 1/1/1970 UTC), sets the group to the default group, and sets the mode of the file to 0444 or 0555 (i.e., read-only, with execute permission enabled if the file was originally executable). Note that possible
setuid
andsetgid
bits are cleared. Setuid and setgid programs are not currently supported by Nix. This is because the Nix archives used in deployment have no concept of ownership information, and because it makes the build result dependent on the user performing the build.
Advanced Attributes
Derivations can declare some infrequently used optional attributes.
-
allowedReferences
The optional attributeallowedReferences
specifies a list of legal references (dependencies) of the output of the builder. For example,allowedReferences = [];
enforces that the output of a derivation cannot have any runtime dependencies on its inputs. To allow an output to have a runtime dependency on itself, use
"out"
as a list item. This is used in NixOS to check that generated files such as initial ramdisks for booting Linux don’t have accidental dependencies on other paths in the Nix store. -
allowedRequisites
This attribute is similar toallowedReferences
, but it specifies the legal requisites of the whole closure, so all the dependencies recursively. For example,allowedRequisites = [ foobar ];
enforces that the output of a derivation cannot have any other runtime dependency than
foobar
, and in addition it enforces thatfoobar
itself doesn't introduce any other dependency itself. -
disallowedReferences
The optional attributedisallowedReferences
specifies a list of illegal references (dependencies) of the output of the builder. For example,disallowedReferences = [ foo ];
enforces that the output of a derivation cannot have a direct runtime dependencies on the derivation
foo
. -
disallowedRequisites
This attribute is similar todisallowedReferences
, but it specifies illegal requisites for the whole closure, so all the dependencies recursively. For example,disallowedRequisites = [ foobar ];
enforces that the output of a derivation cannot have any runtime dependency on
foobar
or any other derivation depending recursively onfoobar
. -
exportReferencesGraph
This attribute allows builders access to the references graph of their inputs. The attribute is a list of inputs in the Nix store whose references graph the builder needs to know. The value of this attribute should be a list of pairs[ name1 path1 name2 path2 ... ]
. The references graph of each pathN will be stored in a text file nameN in the temporary build directory. The text files have the format used bynix-store --register-validity
(with the deriver fields left empty). For example, when the following derivation is built:derivation { ... exportReferencesGraph = [ "libfoo-graph" libfoo ]; };
the references graph of
libfoo
is placed in the filelibfoo-graph
in the temporary build directory.exportReferencesGraph
is useful for builders that want to do something with the closure of a store path. Examples include the builders in NixOS that generate the initial ramdisk for booting Linux (acpio
archive containing the closure of the boot script) and the ISO-9660 image for the installation CD (which is populated with a Nix store containing the closure of a bootable NixOS configuration). -
impureEnvVars
This attribute allows you to specify a list of environment variables that should be passed from the environment of the calling user to the builder. Usually, the environment is cleared completely when the builder is executed, but with this attribute you can allow specific environment variables to be passed unmodified. For example,fetchurl
in Nixpkgs has the lineimpureEnvVars = [ "http_proxy" "https_proxy" ... ];
to make it use the proxy server configuration specified by the user in the environment variables
http_proxy
and friends.This attribute is only allowed in fixed-output derivations (see below), where impurities such as these are okay since (the hash of) the output is known in advance. It is ignored for all other derivations.
Warning
impureEnvVars
implementation takes environment variables from the current builder process. When a daemon is building its environmental variables are used. Without the daemon, the environmental variables come from the environment of thenix-build
. -
outputHash
;outputHashAlgo
;outputHashMode
These attributes declare that the derivation is a so-called fixed-output derivation, which means that a cryptographic hash of the output is already known in advance. When the build of a fixed-output derivation finishes, Nix computes the cryptographic hash of the output and compares it to the hash declared with these attributes. If there is a mismatch, the build fails.The rationale for fixed-output derivations is derivations such as those produced by the
fetchurl
function. This function downloads a file from a given URL. To ensure that the downloaded file has not been modified, the caller must also specify a cryptographic hash of the file. For example,fetchurl { url = "http://ftp.gnu.org/pub/gnu/hello/hello-2.1.1.tar.gz"; sha256 = "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465"; }
It sometimes happens that the URL of the file changes, e.g., because servers are reorganised or no longer available. We then must update the call to
fetchurl
, e.g.,fetchurl { url = "ftp://ftp.nluug.nl/pub/gnu/hello/hello-2.1.1.tar.gz"; sha256 = "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465"; }
If a
fetchurl
derivation was treated like a normal derivation, the output paths of the derivation and all derivations depending on it would change. For instance, if we were to change the URL of the Glibc source distribution in Nixpkgs (a package on which almost all other packages depend) massive rebuilds would be needed. This is unfortunate for a change which we know cannot have a real effect as it propagates upwards through the dependency graph.For fixed-output derivations, on the other hand, the name of the output path only depends on the
outputHash*
andname
attributes, while all other attributes are ignored for the purpose of computing the output path. (Thename
attribute is included because it is part of the path.)As an example, here is the (simplified) Nix expression for
fetchurl
:{ stdenv, curl }: # The curl program is used for downloading. { url, sha256 }: stdenv.mkDerivation { name = baseNameOf (toString url); builder = ./builder.sh; buildInputs = [ curl ]; # This is a fixed-output derivation; the output must be a regular # file with SHA256 hash sha256. outputHashMode = "flat"; outputHashAlgo = "sha256"; outputHash = sha256; inherit url; }
The
outputHashAlgo
attribute specifies the hash algorithm used to compute the hash. It can currently be"sha1"
,"sha256"
or"sha512"
.The
outputHashMode
attribute determines how the hash is computed. It must be one of the following two values:-
"flat"
The output must be a non-executable regular file. If it isn’t, the build fails. The hash is simply computed over the contents of that file (so it’s equal to what Unix commands likesha256sum
orsha1sum
produce).This is the default.
-
"recursive"
The hash is computed over the NAR archive dump of the output (i.e., the result ofnix-store --dump
). In this case, the output can be anything, including a directory tree.
The
outputHash
attribute, finally, must be a string containing the hash in either hexadecimal or base-32 notation. (See thenix-hash
command for information about converting to and from base-32 notation.) -
-
__contentAddressed
If this experimental attribute is set to true, then the derivation outputs will be stored in a content-addressed location rather than the traditional input-addressed one. This only has an effect if theca-derivation
experimental feature is enabled.Setting this attribute also requires setting
outputHashMode
andoutputHashAlgo
like for fixed-output derivations (see above). -
passAsFile
A list of names of attributes that should be passed via files rather than environment variables. For example, if you havepassAsFile = ["big"]; big = "a very long string";
then when the builder runs, the environment variable
bigPath
will contain the absolute path to a temporary file containinga very long string
. That is, for any attribute x listed inpassAsFile
, Nix will pass an environment variablexPath
holding the path of the file containing the value of attribute x. This is useful when you need to pass large strings to a builder, since most operating systems impose a limit on the size of the environment (typically, a few hundred kilobyte). -
preferLocalBuild
If this attribute is set totrue
and distributed building is enabled, then, if possible, the derivation will be built locally instead of forwarded to a remote machine. This is appropriate for trivial builders where the cost of doing a download or remote build would exceed the cost of building locally. -
allowSubstitutes
If this attribute is set tofalse
, then Nix will always build this derivation; it will not try to substitute its outputs. This is useful for very trivial derivations (such aswriteText
in Nixpkgs) that are cheaper to build than to substitute from a binary cache.Note
You need to have a builder configured which satisfies the derivation’s
system
attribute, since the derivation cannot be substituted. Thus it is usually a good idea to alignsystem
withbuiltins.currentSystem
when settingallowSubstitutes
tofalse
. For most trivial derivations this should be the case.
Built-in Constants
Here are the constants built into the Nix expression evaluator:
-
builtins
The setbuiltins
contains all the built-in functions and values. You can usebuiltins
to test for the availability of features in the Nix installation, e.g.,if builtins ? getEnv then builtins.getEnv "PATH" else ""
This allows a Nix expression to fall back gracefully on older Nix installations that don’t have the desired built-in function.
-
builtins.currentSystem
The built-in valuecurrentSystem
evaluates to the Nix platform identifier for the Nix installation on which the expression is being evaluated, such as"i686-linux"
or"x86_64-darwin"
.
Built-in Functions
This section lists the functions built into the Nix expression
evaluator. (The built-in function derivation
is discussed above.)
Some built-ins, such as derivation
, are always in scope of every Nix
expression; you can just access them right away. But to prevent
polluting the namespace too much, most built-ins are not in
scope. Instead, you can access them through the builtins
built-in
value, which is a set that contains all built-in functions and values.
For instance, derivation
is also available as builtins.derivation
.
derivation attrs
;builtins.derivation attrs
derivation is described in its own section.
-
abort s
-
Abort Nix expression evaluation and print the error message s.
-
add e1 e2
-
Return the sum of the numbers e1 and e2.
-
all pred list
-
Return
true
if the function pred returnstrue
for all elements of list, andfalse
otherwise. -
any pred list
-
Return
true
if the function pred returnstrue
for at least one element of list, andfalse
otherwise. -
attrNames set
-
Return the names of the attributes in the set set in an alphabetically sorted list. For instance,
builtins.attrNames { y = 1; x = "foo"; }
evaluates to[ "x" "y" ]
. -
attrValues set
-
Return the values of the attributes in the set set in the order corresponding to the sorted attribute names.
-
baseNameOf s
-
Return the base name of the string s, that is, everything following the final slash in the string. This is similar to the GNU
basename
command. -
bitAnd e1 e2
-
Return the bitwise AND of the integers e1 and e2.
-
bitOr e1 e2
-
Return the bitwise OR of the integers e1 and e2.
-
bitXor e1 e2
-
Return the bitwise XOR of the integers e1 and e2.
-
break v
-
In debug mode (enabled using
--debugger
), pause Nix expression evaluation and enter the REPL. Otherwise, return the argumentv
. -
catAttrs attr list
-
Collect each attribute named attr from a list of attribute sets. Attrsets that don't contain the named attribute are ignored. For example,
builtins.catAttrs "a" [{a = 1;} {b = 0;} {a = 2;}]
evaluates to
[1 2]
. -
ceil double
-
Converts an IEEE-754 double-precision floating-point number (double) to the next higher integer.
If the datatype is neither an integer nor a "float", an evaluation error will be thrown.
-
compareVersions s1 s2
-
Compare two strings representing versions and return
-1
if version s1 is older than version s2,0
if they are the same, and1
if s1 is newer than s2. The version comparison algorithm is the same as the one used bynix-env -u
. -
concatLists lists
-
Concatenate a list of lists into a single list.
-
concatMap f list
-
This function is equivalent to
builtins.concatLists (map f list)
but is more efficient. -
concatStringsSep separator list
-
Concatenate a list of strings with a separator between each element, e.g.
concatStringsSep "/" ["usr" "local" "bin"] == "usr/local/bin"
. -
deepSeq e1 e2
-
This is like
seq e1 e2
, except that e1 is evaluated deeply: if it’s a list or set, its elements or attributes are also evaluated recursively. -
dirOf s
-
Return the directory part of the string s, that is, everything before the final slash in the string. This is similar to the GNU
dirname
command. -
div e1 e2
-
Return the quotient of the numbers e1 and e2.
-
elem x xs
-
Return
true
if a value equal to x occurs in the list xs, andfalse
otherwise. -
elemAt xs n
-
Return element n from the list xs. Elements are counted starting from 0. A fatal error occurs if the index is out of bounds.
-
fetchClosure args
-
Fetch a Nix store closure from a binary cache, rewriting it into content-addressed form. For example,
builtins.fetchClosure { fromStore = "https://cache.nixos.org"; fromPath = /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1; toPath = /nix/store/ldbhlwhh39wha58rm61bkiiwm6j7211j-git-2.33.1; }
fetches
/nix/store/r2jd...
from the specified binary cache, and rewrites it into the content-addressed store path/nix/store/ldbh...
.If
fromPath
is already content-addressed, or if you are allowing impure evaluation (--impure
), thentoPath
may be omitted.To find out the correct value for
toPath
given afromPath
, you can usenix store make-content-addressed
:# nix store make-content-addressed --from https://cache.nixos.org /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1 rewrote '/nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1' to '/nix/store/ldbhlwhh39wha58rm61bkiiwm6j7211j-git-2.33.1'
This function is similar to
builtins.storePath
in that it allows you to use a previously built store path in a Nix expression. However, it is more reproducible because it requires specifying a binary cache from which the path can be fetched. Also, requiring a content-addressed final store path avoids the need for users to configure binary cache public keys.This function is only available if you enable the experimental feature
fetch-closure
. -
fetchGit args
-
Fetch a path from git. args can be a URL, in which case the HEAD of the repo at that URL is fetched. Otherwise, it can be an attribute with the following attributes (all except
url
optional):-
url
The URL of the repo. -
name
The name of the directory the repo should be exported to in the store. Defaults to the basename of the URL. -
rev
The git revision to fetch. Defaults to the tip ofref
. -
ref
The git ref to look for the requested revision under. This is often a branch or tag name. Defaults toHEAD
.By default, the
ref
value is prefixed withrefs/heads/
. As of Nix 2.3.0 Nix will not prefixrefs/heads/
ifref
starts withrefs/
. -
submodules
A Boolean parameter that specifies whether submodules should be checked out. Defaults tofalse
. -
shallow
A Boolean parameter that specifies whether fetching a shallow clone is allowed. Defaults tofalse
. -
allRefs
Whether to fetch all refs of the repository. With this argument being true, it's possible to load arev
from anyref
(by default onlyrev
s from the specifiedref
are supported).
Here are some examples of how to use
fetchGit
.-
To fetch a private repository over SSH:
builtins.fetchGit { url = "git@github.com:my-secret/repository.git"; ref = "master"; rev = "adab8b916a45068c044658c4158d81878f9ed1c3"; }
-
To fetch an arbitrary reference:
builtins.fetchGit { url = "https://github.com/NixOS/nix.git"; ref = "refs/heads/0.5-release"; }
-
If the revision you're looking for is in the default branch of the git repository you don't strictly need to specify the branch name in the
ref
attribute.However, if the revision you're looking for is in a future branch for the non-default branch you will need to specify the the
ref
attribute as well.builtins.fetchGit { url = "https://github.com/nixos/nix.git"; rev = "841fcbd04755c7a2865c51c1e2d3b045976b7452"; ref = "1.11-maintenance"; }
Note
It is nice to always specify the branch which a revision belongs to. Without the branch being specified, the fetcher might fail if the default branch changes. Additionally, it can be confusing to try a commit from a non-default branch and see the fetch fail. If the branch is specified the fault is much more obvious.
-
If the revision you're looking for is in the default branch of the git repository you may omit the
ref
attribute.builtins.fetchGit { url = "https://github.com/nixos/nix.git"; rev = "841fcbd04755c7a2865c51c1e2d3b045976b7452"; }
-
To fetch a specific tag:
builtins.fetchGit { url = "https://github.com/nixos/nix.git"; ref = "refs/tags/1.9"; }
-
To fetch the latest version of a remote branch:
builtins.fetchGit { url = "ssh://git@github.com/nixos/nix.git"; ref = "master"; }
Note
Nix will refetch the branch in accordance with the option
tarball-ttl
.Note
This behavior is disabled in Pure evaluation mode.
-
-
fetchTarball args
-
Download the specified URL, unpack it and return the path of the unpacked tree. The file must be a tape archive (
.tar
) compressed withgzip
,bzip2
orxz
. The top-level path component of the files in the tarball is removed, so it is best if the tarball contains a single directory at top level. The typical use of the function is to obtain external Nix expression dependencies, such as a particular version of Nixpkgs, e.g.with import (fetchTarball https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz) {}; stdenv.mkDerivation { … }
The fetched tarball is cached for a certain amount of time (1 hour by default) in
~/.cache/nix/tarballs/
. You can change the cache timeout either on the command line with--tarball-ttl
number-of-seconds or in the Nix configuration file by adding the linetarball-ttl =
number-of-seconds.Note that when obtaining the hash with
nix-prefetch-url
the option--unpack
is required.This function can also verify the contents against a hash. In that case, the function takes a set instead of a URL. The set requires the attribute
url
and the attributesha256
, e.g.with import (fetchTarball { url = "https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz"; sha256 = "1jppksrfvbk5ypiqdz4cddxdl8z6zyzdb2srq8fcffr327ld5jj2"; }) {}; stdenv.mkDerivation { … }
This function is not available if restricted evaluation mode is enabled.
-
fetchurl url
-
Download the specified URL and return the path of the downloaded file. This function is not available if restricted evaluation mode is enabled.
-
filter f list
-
Return a list consisting of the elements of list for which the function f returns
true
. -
filterSource e1 e2
-
Warning
filterSource
should not be used to filter store paths. SincefilterSource
uses the name of the input directory while naming the output directory, doing so will produce a directory name in the form of<hash2>-<hash>-<name>
, where<hash>-<name>
is the name of the input directory. Since<hash>
depends on the unfiltered directory, the name of the output directory will indirectly depend on files that are filtered out by the function. This will trigger a rebuild even when a filtered out file is changed. Usebuiltins.path
instead, which allows specifying the name of the output directory.This function allows you to copy sources into the Nix store while filtering certain files. For instance, suppose that you want to use the directory
source-dir
as an input to a Nix expression, e.g.stdenv.mkDerivation { ... src = ./source-dir; }
However, if
source-dir
is a Subversion working copy, then all those annoying.svn
subdirectories will also be copied to the store. Worse, the contents of those directories may change a lot, causing lots of spurious rebuilds. WithfilterSource
you can filter out the.svn
directories:src = builtins.filterSource (path: type: type != "directory" || baseNameOf path != ".svn") ./source-dir;
Thus, the first argument e1 must be a predicate function that is called for each regular file, directory or symlink in the source tree e2. If the function returns
true
, the file is copied to the Nix store, otherwise it is omitted. The function is called with two arguments. The first is the full path of the file. The second is a string that identifies the type of the file, which is either"regular"
,"directory"
,"symlink"
or"unknown"
(for other kinds of files such as device nodes or fifos — but note that those cannot be copied to the Nix store, so if the predicate returnstrue
for them, the copy will fail). If you exclude a directory, the entire corresponding subtree of e2 will be excluded. -
floor double
-
Converts an IEEE-754 double-precision floating-point number (double) to the next lower integer.
If the datatype is neither an integer nor a "float", an evaluation error will be thrown.
-
foldl' op nul list
-
Reduce a list by applying a binary operator, from left to right, e.g.
foldl' op nul [x0 x1 x2 ...] = op (op (op nul x0) x1) x2) ...
. The operator is applied strictly, i.e., its arguments are evaluated first. For example,foldl' (x: y: x + y) 0 [1 2 3]
evaluates to 6. -
fromJSON e
-
Convert a JSON string to a Nix value. For example,
builtins.fromJSON ''{"x": [1, 2, 3], "y": null}''
returns the value
{ x = [ 1 2 3 ]; y = null; }
. -
functionArgs f
-
Return a set containing the names of the formal arguments expected by the function f. The value of each attribute is a Boolean denoting whether the corresponding argument has a default value. For instance,
functionArgs ({ x, y ? 123}: ...) = { x = false; y = true; }
."Formal argument" here refers to the attributes pattern-matched by the function. Plain lambdas are not included, e.g.
functionArgs (x: ...) = { }
. -
genList generator length
-
Generate list of size length, with each element i equal to the value returned by generator
i
. For example,builtins.genList (x: x * x) 5
returns the list
[ 0 1 4 9 16 ]
. -
genericClosure attrset
-
Take an attrset with values named
startSet
andoperator
in order to return a list of attrsets by starting with thestartSet
, recursively applying theoperator
function to each element. The attrsets in thestartSet
and produced by theoperator
must each contain value namedkey
which are comparable to each other. The result is produced by repeatedly calling the operator for each element encountered with a unique key, terminating when no new elements are produced. For example,builtins.genericClosure { startSet = [ {key = 5;} ]; operator = item: [{ key = if (item.key / 2 ) * 2 == item.key then item.key / 2 else 3 * item.key + 1; }]; }
evaluates to
[ { key = 5; } { key = 16; } { key = 8; } { key = 4; } { key = 2; } { key = 1; } ]
-
getAttr s set
-
getAttr
returns the attribute named s from set. Evaluation aborts if the attribute doesn’t exist. This is a dynamic version of the.
operator, since s is an expression rather than an identifier. -
getEnv s
-
getEnv
returns the value of the environment variable s, or an empty string if the variable doesn’t exist. This function should be used with care, as it can introduce all sorts of nasty environment dependencies in your Nix expression.getEnv
is used in Nix Packages to locate the file~/.nixpkgs/config.nix
, which contains user-local settings for Nix Packages. (That is, it does agetEnv "HOME"
to locate the user’s home directory.) -
getFlake args
-
Fetch a flake from a flake reference, and return its output attributes and some metadata. For example:
(builtins.getFlake "nix/55bc52401966fbffa525c574c14f67b00bc4fb3a").packages.x86_64-linux.nix
Unless impure evaluation is allowed (
--impure
), the flake reference must be "locked", e.g. contain a Git revision or content hash. An example of an unlocked usage is:(builtins.getFlake "github:edolstra/dwarffs").rev
This function is only available if you enable the experimental feature
flakes
. -
groupBy f list
-
Groups elements of list together by the string returned from the function f called on each element. It returns an attribute set where each attribute value contains the elements of list that are mapped to the same corresponding attribute name returned by f.
For example,
builtins.groupBy (builtins.substring 0 1) ["foo" "bar" "baz"]
evaluates to
{ b = [ "bar" "baz" ]; f = [ "foo" ]; }
-
hasAttr s set
-
hasAttr
returnstrue
if set has an attribute named s, andfalse
otherwise. This is a dynamic version of the?
operator, since s is an expression rather than an identifier. -
hashFile type p
-
Return a base-16 representation of the cryptographic hash of the file at path p. The hash algorithm specified by type must be one of
"md5"
,"sha1"
,"sha256"
or"sha512"
. -
hashString type s
-
Return a base-16 representation of the cryptographic hash of string s. The hash algorithm specified by type must be one of
"md5"
,"sha1"
,"sha256"
or"sha512"
. -
head list
-
Return the first element of a list; abort evaluation if the argument isn’t a list or is an empty list. You can test whether a list is empty by comparing it with
[]
. -
import path
-
Load, parse and return the Nix expression in the file path. If path is a directory, the file
default.nix
in that directory is loaded. Evaluation aborts if the file doesn’t exist or contains an incorrect Nix expression.import
implements Nix’s module system: you can put any Nix expression (such as a set or a function) in a separate file, and use it from Nix expressions in other files.Note
Unlike some languages,
import
is a regular function in Nix. Paths using the angle bracket syntax (e.g.,import
<foo>) are normal path values.A Nix expression loaded by
import
must not contain any free variables (identifiers that are not defined in the Nix expression itself and are not built-in). Therefore, it cannot refer to variables that are in scope at the call site. For instance, if you have a calling expressionrec { x = 123; y = import ./foo.nix; }
then the following
foo.nix
will give an error:x + 456
since
x
is not in scope infoo.nix
. If you wantx
to be available infoo.nix
, you should pass it as a function argument:rec { x = 123; y = import ./foo.nix x; }
and
x: x + 456
(The function argument doesn’t have to be called
x
infoo.nix
; any name would work.) -
intersectAttrs e1 e2
-
Return a set consisting of the attributes in the set e2 which have the same name as some attribute in e1.
Performs in O(n log m) where n is the size of the smaller set and m the larger set's size.
-
isAttrs e
-
Return
true
if e evaluates to a set, andfalse
otherwise. -
isBool e
-
Return
true
if e evaluates to a bool, andfalse
otherwise. -
isFloat e
-
Return
true
if e evaluates to a float, andfalse
otherwise. -
isFunction e
-
Return
true
if e evaluates to a function, andfalse
otherwise. -
isInt e
-
Return
true
if e evaluates to an integer, andfalse
otherwise. -
isList e
-
Return
true
if e evaluates to a list, andfalse
otherwise. -
isNull e
-
Return
true
if e evaluates tonull
, andfalse
otherwise.Warning
This function is deprecated; just write
e == null
instead. -
isPath e
-
Return
true
if e evaluates to a path, andfalse
otherwise. -
isString e
-
Return
true
if e evaluates to a string, andfalse
otherwise. -
length e
-
Return the length of the list e.
-
lessThan e1 e2
-
Return
true
if the number e1 is less than the number e2, andfalse
otherwise. Evaluation aborts if either e1 or e2 does not evaluate to a number. -
listToAttrs e
-
Construct a set from a list specifying the names and values of each attribute. Each element of the list should be a set consisting of a string-valued attribute
name
specifying the name of the attribute, and an attributevalue
specifying its value.In case of duplicate occurrences of the same name, the first takes precedence.
Example:
builtins.listToAttrs [ { name = "foo"; value = 123; } { name = "bar"; value = 456; } { name = "bar"; value = 420; } ]
evaluates to
{ foo = 123; bar = 456; }
-
map f list
-
Apply the function f to each element in the list list. For example,
map (x: "foo" + x) [ "bar" "bla" "abc" ]
evaluates to
[ "foobar" "foobla" "fooabc" ]
. -
mapAttrs f attrset
-
Apply function f to every element of attrset. For example,
builtins.mapAttrs (name: value: value * 10) { a = 1; b = 2; }
evaluates to
{ a = 10; b = 20; }
. -
match regex str
-
Returns a list if the extended POSIX regular expression regex matches str precisely, otherwise returns
null
. Each item in the list is a regex group.builtins.match "ab" "abc"
Evaluates to
null
.builtins.match "abc" "abc"
Evaluates to
[ ]
.builtins.match "a(b)(c)" "abc"
Evaluates to
[ "b" "c" ]
.builtins.match "[[:space:]]+([[:upper:]]+)[[:space:]]+" " FOO "
Evaluates to
[ "FOO" ]
. -
mul e1 e2
-
Return the product of the numbers e1 and e2.
-
parseDrvName s
-
Split the string s into a package name and version. The package name is everything up to but not including the first dash not followed by a letter, and the version is everything following that dash. The result is returned in a set
{ name, version }
. Thus,builtins.parseDrvName "nix-0.12pre12876"
returns{ name = "nix"; version = "0.12pre12876"; }
. -
partition pred list
-
Given a predicate function pred, this function returns an attrset containing a list named
right
, containing the elements in list for which pred returnedtrue
, and a list namedwrong
, containing the elements for which it returnedfalse
. For example,builtins.partition (x: x > 10) [1 23 9 3 42]
evaluates to
{ right = [ 23 42 ]; wrong = [ 1 9 3 ]; }
-
path args
-
An enrichment of the built-in path type, based on the attributes present in args. All are optional except
path
:-
path
The underlying path. -
name
The name of the path when added to the store. This can used to reference paths that have nix-illegal characters in their names, like@
. -
filter
A function of the type expected bybuiltins.filterSource
, with the same semantics. -
recursive
Whenfalse
, whenpath
is added to the store it is with a flat hash, rather than a hash of the NAR serialization of the file. Thus,path
must refer to a regular file, not a directory. This allows similar behavior tofetchurl
. Defaults totrue
. -
sha256
When provided, this is the expected hash of the file at the path. Evaluation will fail if the hash is incorrect, and providing a hash allowsbuiltins.path
to be used even when thepure-eval
nix config option is on.
-
-
pathExists path
-
Return
true
if the path path exists at evaluation time, andfalse
otherwise. -
placeholder output
-
Return a placeholder string for the specified output that will be substituted by the corresponding output path at build time. Typical outputs would be
"out"
,"bin"
or"dev"
. -
readDir path
-
Return the contents of the directory path as a set mapping directory entries to the corresponding file type. For instance, if directory
A
contains a regular fileB
and another directoryC
, thenbuiltins.readDir ./A
will return the set{ B = "regular"; C = "directory"; }
The possible values for the file type are
"regular"
,"directory"
,"symlink"
and"unknown"
. -
readFile path
-
Return the contents of the file path as a string.
-
removeAttrs set list
-
Remove the attributes listed in list from set. The attributes don’t have to exist in set. For instance,
removeAttrs { x = 1; y = 2; z = 3; } [ "a" "x" "z" ]
evaluates to
{ y = 2; }
. -
replaceStrings from to s
-
Given string s, replace every occurrence of the strings in from with the corresponding string in to. For example,
builtins.replaceStrings ["oo" "a"] ["a" "i"] "foobar"
evaluates to
"fabir"
. -
seq e1 e2
-
Evaluate e1, then evaluate and return e2. This ensures that a computation is strict in the value of e1.
-
sort comparator list
-
Return list in sorted order. It repeatedly calls the function comparator with two elements. The comparator should return
true
if the first element is less than the second, andfalse
otherwise. For example,builtins.sort builtins.lessThan [ 483 249 526 147 42 77 ]
produces the list
[ 42 77 147 249 483 526 ]
.This is a stable sort: it preserves the relative order of elements deemed equal by the comparator.
-
split regex str
-
Returns a list composed of non matched strings interleaved with the lists of the extended POSIX regular expression regex matches of str. Each item in the lists of matched sequences is a regex group.
builtins.split "(a)b" "abc"
Evaluates to
[ "" [ "a" ] "c" ]
.builtins.split "([ac])" "abc"
Evaluates to
[ "" [ "a" ] "b" [ "c" ] "" ]
.builtins.split "(a)|(c)" "abc"
Evaluates to
[ "" [ "a" null ] "b" [ null "c" ] "" ]
.builtins.split "([[:upper:]]+)" " FOO "
Evaluates to
[ " " [ "FOO" ] " " ]
. -
splitVersion s
-
Split a string representing a version into its components, by the same version splitting logic underlying the version comparison in
nix-env -u
. -
storePath path
-
This function allows you to define a dependency on an already existing store path. For example, the derivation attribute
src = builtins.storePath /nix/store/f1d18v1y…-source
causes the derivation to depend on the specified path, which must exist or be substitutable. Note that this differs from a plain path (e.g.src = /nix/store/f1d18v1y…-source
) in that the latter causes the path to be copied again to the Nix store, resulting in a new path (e.g./nix/store/ld01dnzc…-source-source
).This function is not available in pure evaluation mode.
-
stringLength e
-
Return the length of the string e. If e is not a string, evaluation is aborted.
-
sub e1 e2
-
Return the difference between the numbers e1 and e2.
-
substring start len s
-
Return the substring of s from character position start (zero-based) up to but not including start + len. If start is greater than the length of the string, an empty string is returned, and if start + len lies beyond the end of the string, only the substring up to the end of the string is returned. start must be non-negative. For example,
builtins.substring 0 3 "nixos"
evaluates to
"nix"
. -
tail list
-
Return the second to last elements of a list; abort evaluation if the argument isn’t a list or is an empty list.
Warning
This function should generally be avoided since it's inefficient: unlike Haskell's
tail
, it takes O(n) time, so recursing over a list by repeatedly callingtail
takes O(n^2) time. -
throw s
-
Throw an error message s. This usually aborts Nix expression evaluation, but in
nix-env -qa
and other commands that try to evaluate a set of derivations to get information about those derivations, a derivation that throws an error is silently skipped (which is not the case forabort
). -
toFile name s
-
Store the string s in a file in the Nix store and return its path. The file has suffix name. This file can be used as an input to derivations. One application is to write builders “inline”. For instance, the following Nix expression combines the Nix expression for GNU Hello and its build script into one file:
{ stdenv, fetchurl, perl }: stdenv.mkDerivation { name = "hello-2.1.1"; builder = builtins.toFile "builder.sh" " source $stdenv/setup PATH=$perl/bin:$PATH tar xvfz $src cd hello-* ./configure --prefix=$out make make install "; src = fetchurl { url = "http://ftp.nluug.nl/pub/gnu/hello/hello-2.1.1.tar.gz"; sha256 = "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465"; }; inherit perl; }
It is even possible for one file to refer to another, e.g.,
builder = let configFile = builtins.toFile "foo.conf" " # This is some dummy configuration file. ... "; in builtins.toFile "builder.sh" " source $stdenv/setup ... cp ${configFile} $out/etc/foo.conf ";
Note that
${configFile}
is a string interpolation, so the result of the expressionconfigFile
(i.e., a path like/nix/store/m7p7jfny445k...-foo.conf
) will be spliced into the resulting string.It is however not allowed to have files mutually referring to each other, like so:
let foo = builtins.toFile "foo" "...${bar}..."; bar = builtins.toFile "bar" "...${foo}..."; in foo
This is not allowed because it would cause a cyclic dependency in the computation of the cryptographic hashes for
foo
andbar
.It is also not possible to reference the result of a derivation. If you are using Nixpkgs, the
writeTextFile
function is able to do that. -
toJSON e
-
Return a string containing a JSON representation of e. Strings, integers, floats, booleans, nulls and lists are mapped to their JSON equivalents. Sets (except derivations) are represented as objects. Derivations are translated to a JSON string containing the derivation’s output path. Paths are copied to the store and represented as a JSON string of the resulting store path.
-
toPath s
-
DEPRECATED. Use
/. + "/path"
to convert a string into an absolute path. For relative paths, use./. + "/path"
. -
toString e
-
Convert the expression e to a string. e can be:
-
A string (in which case the string is returned unmodified).
-
A path (e.g.,
toString /foo/bar
yields"/foo/bar"
. -
A set containing
{ __toString = self: ...; }
or{ outPath = ...; }
. -
An integer.
-
A list, in which case the string representations of its elements are joined with spaces.
-
A Boolean (
false
yields""
,true
yields"1"
). -
null
, which yields the empty string.
-
-
toXML e
-
Return a string containing an XML representation of e. The main application for
toXML
is to communicate information with the builder in a more structured format than plain environment variables.Here is an example where this is the case:
{ stdenv, fetchurl, libxslt, jira, uberwiki }: stdenv.mkDerivation (rec { name = "web-server"; buildInputs = [ libxslt ]; builder = builtins.toFile "builder.sh" " source $stdenv/setup mkdir $out echo "$servlets" | xsltproc ${stylesheet} - > $out/server-conf.xml ① "; stylesheet = builtins.toFile "stylesheet.xsl" ② "<?xml version='1.0' encoding='UTF-8'?> <xsl:stylesheet xmlns:xsl='http://www.w3.org/1999/XSL/Transform' version='1.0'> <xsl:template match='/'> <Configure> <xsl:for-each select='/expr/list/attrs'> <Call name='addWebApplication'> <Arg><xsl:value-of select=\"attr[@name = 'path']/string/@value\" /></Arg> <Arg><xsl:value-of select=\"attr[@name = 'war']/path/@value\" /></Arg> </Call> </xsl:for-each> </Configure> </xsl:template> </xsl:stylesheet> "; servlets = builtins.toXML [ ③ { path = "/bugtracker"; war = jira + "/lib/atlassian-jira.war"; } { path = "/wiki"; war = uberwiki + "/uberwiki.war"; } ]; })
The builder is supposed to generate the configuration file for a Jetty servlet container. A servlet container contains a number of servlets (
*.war
files) each exported under a specific URI prefix. So the servlet configuration is a list of sets containing thepath
andwar
of the servlet (①). This kind of information is difficult to communicate with the normal method of passing information through an environment variable, which just concatenates everything together into a string (which might just work in this case, but wouldn’t work if fields are optional or contain lists themselves). Instead the Nix expression is converted to an XML representation withtoXML
, which is unambiguous and can easily be processed with the appropriate tools. For instance, in the example an XSLT stylesheet (at point ②) is applied to it (at point ①) to generate the XML configuration file for the Jetty server. The XML representation produced at point ③ bytoXML
is as follows:<?xml version='1.0' encoding='utf-8'?> <expr> <list> <attrs> <attr name="path"> <string value="/bugtracker" /> </attr> <attr name="war"> <path value="/nix/store/d1jh9pasa7k2...-jira/lib/atlassian-jira.war" /> </attr> </attrs> <attrs> <attr name="path"> <string value="/wiki" /> </attr> <attr name="war"> <path value="/nix/store/y6423b1yi4sx...-uberwiki/uberwiki.war" /> </attr> </attrs> </list> </expr>
Note that we used the
toFile
built-in to write the builder and the stylesheet “inline” in the Nix expression. The path of the stylesheet is spliced into the builder using the syntaxxsltproc ${stylesheet}
. -
trace e1 e2
-
Evaluate e1 and print its abstract syntax representation on standard error. Then return e2. This function is useful for debugging.
-
traceVerbose e1 e2
-
Evaluate e1 and print its abstract syntax representation on standard error if
--trace-verbose
is enabled. Then return e2. This function is useful for debugging. -
tryEval e
-
Try to shallowly evaluate e. Return a set containing the attributes
success
(true
if e evaluated successfully,false
if an error was thrown) andvalue
, equalling e if successful andfalse
otherwise.tryEval
will only prevent errors created bythrow
orassert
from being thrown. ErrorstryEval
will not catch are for example those created byabort
and type errors generated by builtins. Also note that this doesn't evaluate e deeply, solet e = { x = throw ""; }; in (builtins.tryEval e).success
will betrue
. Usingbuiltins.deepSeq
one can get the expected result:let e = { x = throw ""; }; in (builtins.tryEval (builtins.deepSeq e e)).success
will befalse
. -
typeOf e
-
Return a string representing the type of the value e, namely
"int"
,"bool"
,"string"
,"path"
,"null"
,"set"
,"list"
,"lambda"
or"float"
. -
zipAttrsWith f list
-
Transpose a list of attribute sets into an attribute set of lists, then apply
mapAttrs
.f
receives two arguments: the attribute name and a non-empty list of all values encountered for that attribute name.The result is an attribute set where the attribute names are the union of the attribute names in each element of
list
. The attribute values are the return values off
.builtins.zipAttrsWith (name: values: { inherit name values; }) [ { a = "x"; } { a = "y"; b = "z"; } ]
evaluates to
{ a = { name = "a"; values = [ "x" "y" ]; }; b = { name = "b"; values = [ "z" ]; }; }
Remote Builds
Nix supports remote builds, where a local Nix installation can forward
Nix builds to other machines. This allows multiple builds to be
performed in parallel and allows Nix to perform multi-platform builds in
a semi-transparent way. For instance, if you perform a build for a
x86_64-darwin
on an i686-linux
machine, Nix can automatically
forward the build to a x86_64-darwin
machine, if available.
To forward a build to a remote machine, it’s required that the remote machine is accessible via SSH and that it has Nix installed. You can test whether connecting to the remote Nix instance works, e.g.
$ nix store ping --store ssh://mac
will try to connect to the machine named mac
. It is possible to
specify an SSH identity file as part of the remote store URI, e.g.
$ nix store ping --store ssh://mac?ssh-key=/home/alice/my-key
Since builds should be non-interactive, the key should not have a
passphrase. Alternatively, you can load identities ahead of time into
ssh-agent
or gpg-agent
.
If you get the error
bash: nix-store: command not found
error: cannot connect to 'mac'
then you need to ensure that the PATH
of non-interactive login shells
contains Nix.
Warning
If you are building via the Nix daemon, it is the Nix daemon user account (that is,
root
) that should have SSH access to the remote machine. If you can’t or don’t want to configureroot
to be able to access to remote machine, you can use a private Nix store instead by passing e.g.--store ~/my-nix
.
The list of remote machines can be specified on the command line or in
the Nix configuration file. The former is convenient for testing. For
example, the following command allows you to build a derivation for
x86_64-darwin
on a Linux machine:
$ uname
Linux
$ nix build --impure \
--expr '(with import <nixpkgs> { system = "x86_64-darwin"; }; runCommand "foo" {} "uname > $out")' \
--builders 'ssh://mac x86_64-darwin'
[1/0/1 built, 0.0 MiB DL] building foo on ssh://mac
$ cat ./result
Darwin
It is possible to specify multiple builders separated by a semicolon or a newline, e.g.
--builders 'ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd'
Each machine specification consists of the following elements, separated
by spaces. Only the first element is required. To leave a field at its
default, set it to -
.
-
The URI of the remote store in the format
ssh://[username@]hostname
, e.g.ssh://nix@mac
orssh://mac
. For backward compatibility,ssh://
may be omitted. The hostname may be an alias defined in your~/.ssh/config
. -
A comma-separated list of Nix platform type identifiers, such as
x86_64-darwin
. It is possible for a machine to support multiple platform types, e.g.,i686-linux,x86_64-linux
. If omitted, this defaults to the local platform type. -
The SSH identity file to be used to log in to the remote machine. If omitted, SSH will use its regular identities.
-
The maximum number of builds that Nix will execute in parallel on the machine. Typically this should be equal to the number of CPU cores. For instance, the machine
itchy
in the example will execute up to 8 builds in parallel. -
The “speed factor”, indicating the relative speed of the machine. If there are multiple machines of the right type, Nix will prefer the fastest, taking load into account.
-
A comma-separated list of supported features. If a derivation has the
requiredSystemFeatures
attribute, then Nix will only perform the derivation on a machine that has the specified features. For instance, the attributerequiredSystemFeatures = [ "kvm" ];
will cause the build to be performed on a machine that has the
kvm
feature. -
A comma-separated list of mandatory features. A machine will only be used to build a derivation if all of the machine’s mandatory features appear in the derivation’s
requiredSystemFeatures
attribute. -
The (base64-encoded) public host key of the remote machine. If omitted, SSH will use its regular known-hosts file. Specifically, the field is calculated via
base64 -w0 /etc/ssh/ssh_host_ed25519_key.pub
.
For example, the machine specification
nix@scratchy.labs.cs.uu.nl i686-linux /home/nix/.ssh/id_scratchy_auto 8 1 kvm
nix@itchy.labs.cs.uu.nl i686-linux /home/nix/.ssh/id_scratchy_auto 8 2
nix@poochie.labs.cs.uu.nl i686-linux /home/nix/.ssh/id_scratchy_auto 1 2 kvm benchmark
specifies several machines that can perform i686-linux
builds.
However, poochie
will only do builds that have the attribute
requiredSystemFeatures = [ "benchmark" ];
or
requiredSystemFeatures = [ "benchmark" "kvm" ];
itchy
cannot do builds that require kvm
, but scratchy
does support
such builds. For regular builds, itchy
will be preferred over
scratchy
because it has a higher speed factor.
Remote builders can also be configured in nix.conf
, e.g.
builders = ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd
Finally, remote builders can be configured in a separate configuration
file included in builders
via the syntax @file
. For example,
builders = @/etc/nix/machines
causes the list of machines in /etc/nix/machines
to be included. (This
is the default.)
If you want the builders to use caches, you likely want to set the
option builders-use-substitutes
in your local nix.conf
.
To build only on remote builders and disable building on the local
machine, you can use the option --max-jobs 0
.
Tuning Cores and Jobs
Nix has two relevant settings with regards to how your CPU cores will
be utilized: cores
and max-jobs
. This chapter will talk about what
they are, how they interact, and their configuration trade-offs.
-
max-jobs
Dictates how many separate derivations will be built at the same time. If you set this to zero, the local machine will do no builds. Nix will still substitute from binary caches, and build remotely if remote builders are configured. -
cores
Suggests how many cores each derivation should use. Similar tomake -j
.
The cores
setting determines the value of
NIX_BUILD_CORES
. NIX_BUILD_CORES
is equal to cores
, unless
cores
equals 0
, in which case NIX_BUILD_CORES
will be the total
number of cores in the system.
The maximum number of consumed cores is a simple multiplication,
max-jobs
* NIX_BUILD_CORES
.
The balance on how to set these two independent variables depends upon each builder's workload and hardware. Here are a few example scenarios on a machine with 24 cores:
max-jobs | cores | NIX_BUILD_CORES | Maximum Processes | Result |
---|---|---|---|---|
1 | 24 | 24 | 24 | One derivation will be built at a time, each one can use 24 cores. Undersold if a job can’t use 24 cores. |
4 | 6 | 6 | 24 | Four derivations will be built at once, each given access to six cores. |
12 | 6 | 6 | 72 | 12 derivations will be built at once, each given access to six cores. This configuration is over-sold. If all 12 derivations being built simultaneously try to use all six cores, the machine's performance will be degraded due to extensive context switching between the 12 builds. |
24 | 1 | 1 | 24 | 24 derivations can build at the same time, each using a single core. Never oversold, but derivations which require many cores will be very slow to compile. |
24 | 0 | 24 | 576 | 24 derivations can build at the same time, each using all the available cores of the machine. Very likely to be oversold, and very likely to suffer context switches. |
It is up to the derivations' build script to respect host's requested
cores-per-build by following the value of the NIX_BUILD_CORES
environment variable.
Verifying Build Reproducibility
You can use Nix's diff-hook
setting to compare build results. Note
that this hook is only executed if the results differ; it is not used
for determining if the results are the same.
For purposes of demonstration, we'll use the following Nix file,
deterministic.nix
for testing:
let
inherit (import <nixpkgs> {}) runCommand;
in {
stable = runCommand "stable" {} ''
touch $out
'';
unstable = runCommand "unstable" {} ''
echo $RANDOM > $out
'';
}
Additionally, nix.conf
contains:
diff-hook = /etc/nix/my-diff-hook
run-diff-hook = true
where /etc/nix/my-diff-hook
is an executable file containing:
#!/bin/sh
exec >&2
echo "For derivation $3:"
/run/current-system/sw/bin/diff -r "$1" "$2"
The diff hook is executed by the same user and group who ran the build. However, the diff hook does not have write access to the store path just built.
Spot-Checking Build Determinism
Verify a path which already exists in the Nix store by passing --check
to the build command.
If the build passes and is deterministic, Nix will exit with a status code of 0:
$ nix-build ./deterministic.nix -A stable
this derivation will be built:
/nix/store/z98fasz2jqy9gs0xbvdj939p27jwda38-stable.drv
building '/nix/store/z98fasz2jqy9gs0xbvdj939p27jwda38-stable.drv'...
/nix/store/yyxlzw3vqaas7wfp04g0b1xg51f2czgq-stable
$ nix-build ./deterministic.nix -A stable --check
checking outputs of '/nix/store/z98fasz2jqy9gs0xbvdj939p27jwda38-stable.drv'...
/nix/store/yyxlzw3vqaas7wfp04g0b1xg51f2czgq-stable
If the build is not deterministic, Nix will exit with a status code of 1:
$ nix-build ./deterministic.nix -A unstable
this derivation will be built:
/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv
building '/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv'...
/nix/store/krpqk0l9ib0ibi1d2w52z293zw455cap-unstable
$ nix-build ./deterministic.nix -A unstable --check
checking outputs of '/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv'...
error: derivation '/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv' may
not be deterministic: output '/nix/store/krpqk0l9ib0ibi1d2w52z293zw455cap-unstable' differs
In the Nix daemon's log, we will now see:
For derivation /nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv:
1c1
< 8108
---
> 30204
Using --check
with --keep-failed
will cause Nix to keep the second
build's output in a special, .check
path:
$ nix-build ./deterministic.nix -A unstable --check --keep-failed
checking outputs of '/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv'...
note: keeping build directory '/tmp/nix-build-unstable.drv-0'
error: derivation '/nix/store/cgl13lbj1w368r5z8gywipl1ifli7dhk-unstable.drv' may
not be deterministic: output '/nix/store/krpqk0l9ib0ibi1d2w52z293zw455cap-unstable' differs
from '/nix/store/krpqk0l9ib0ibi1d2w52z293zw455cap-unstable.check'
In particular, notice the
/nix/store/krpqk0l9ib0ibi1d2w52z293zw455cap-unstable.check
output. Nix
has copied the build results to that directory where you can examine it.
Check paths are not protected against garbage collection, and this path will be deleted on the next garbage collection.
The path is guaranteed to be alive for the duration of the
diff-hook
's execution, but may be deleted any time after.If the comparison is performed as part of automated tooling, please use the diff-hook or author your tooling to handle the case where the build was not deterministic and also a check path does not exist.
--check
is only usable if the derivation has been built on the system
already. If the derivation has not been built Nix will fail with the
error:
error: some outputs of '/nix/store/hzi1h60z2qf0nb85iwnpvrai3j2w7rr6-unstable.drv'
are not valid, so checking is not possible
Run the build without --check
, and then try with --check
again.
Using the post-build-hook
Implementation Caveats
Here we use the post-build hook to upload to a binary cache. This is a simple and working example, but it is not suitable for all use cases.
The post build hook program runs after each executed build, and blocks the build loop. The build loop exits if the hook program fails.
Concretely, this implementation will make Nix slow or unusable when the internet is slow or unreliable.
A more advanced implementation might pass the store paths to a user-supplied daemon or queue for processing the store paths outside of the build loop.
Prerequisites
This tutorial assumes you have configured an S3-compatible binary
cache, and that the root
user's default AWS profile can upload to the bucket.
Set up a Signing Key
Use nix-store --generate-binary-cache-key
to create our public and
private signing keys. We will sign paths with the private key, and
distribute the public key for verifying the authenticity of the paths.
# nix-store --generate-binary-cache-key example-nix-cache-1 /etc/nix/key.private /etc/nix/key.public
# cat /etc/nix/key.public
example-nix-cache-1:1/cKDz3QCCOmwcztD2eV6Coggp6rqc9DGjWv7C0G+rM=
Then update nix.conf
on any machine that will access the cache.
Add the cache URL to substituters
and the public key to trusted-public-keys
:
substituters = https://cache.nixos.org/ s3://example-nix-cache
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= example-nix-cache-1:1/cKDz3QCCOmwcztD2eV6Coggp6rqc9DGjWv7C0G+rM=
Machines that build for the cache must sign derivations using the private key.
On those machines, add the path to the key file to the secret-key-files
field in their nix.conf
:
secret-key-files = /etc/nix/key.private
We will restart the Nix daemon in a later step.
Implementing the build hook
Write the following script to /etc/nix/upload-to-cache.sh
:
#!/bin/sh
set -eu
set -f # disable globbing
export IFS=' '
echo "Uploading paths" $OUT_PATHS
exec nix copy --to "s3://example-nix-cache" $OUT_PATHS
Note
The
$OUT_PATHS
variable is a space-separated list of Nix store paths. In this case, we expect and want the shell to perform word splitting to make each output path its own argument tonix store sign
. Nix guarantees the paths will not contain any spaces, however a store path might contain glob characters. Theset -f
disables globbing in the shell.
Then make sure the hook program is executable by the root
user:
# chmod +x /etc/nix/upload-to-cache.sh
Updating Nix Configuration
Edit /etc/nix/nix.conf
to run our hook, by adding the following
configuration snippet at the end:
post-build-hook = /etc/nix/upload-to-cache.sh
Then, restart the nix-daemon
.
Testing
Build any derivation, for example:
$ nix-build -E '(import <nixpkgs> {}).writeText "example" (builtins.toString builtins.currentTime)'
this derivation will be built:
/nix/store/s4pnfbkalzy5qz57qs6yybna8wylkig6-example.drv
building '/nix/store/s4pnfbkalzy5qz57qs6yybna8wylkig6-example.drv'...
running post-build-hook '/home/grahamc/projects/github.com/NixOS/nix/post-hook.sh'...
post-build-hook: Signing paths /nix/store/ibcyipq5gf91838ldx40mjsp0b8w9n18-example
post-build-hook: Uploading paths /nix/store/ibcyipq5gf91838ldx40mjsp0b8w9n18-example
/nix/store/ibcyipq5gf91838ldx40mjsp0b8w9n18-example
Then delete the path from the store, and try substituting it from the binary cache:
$ rm ./result
$ nix-store --delete /nix/store/ibcyipq5gf91838ldx40mjsp0b8w9n18-example
Now, copy the path back from the cache:
$ nix-store --realise /nix/store/ibcyipq5gf91838ldx40mjsp0b8w9n18-example
copying path '/nix/store/m8bmqwrch6l3h8s0k3d673xpmipcdpsa-example from 's3://example-nix-cache'...
warning: you did not specify '--add-root'; the result might be removed by the garbage collector
/nix/store/m8bmqwrch6l3h8s0k3d673xpmipcdpsa-example
Conclusion
We now have a Nix installation configured to automatically sign and upload every local build to a remote binary cache.
Before deploying this to production, be sure to consider the implementation caveats.
This section lists commands and options that you can use when you work with Nix.
Common Options
Most Nix commands accept the following command-line options:
-
--help
Prints out a summary of the command syntax and exits. -
--version
Prints out the Nix version number on standard output and exits. -
--verbose
/-v
Increases the level of verbosity of diagnostic messages printed on standard error. For each Nix operation, the information printed on standard output is well-defined; any diagnostic information is printed on standard error, never on standard output.This option may be specified repeatedly. Currently, the following verbosity levels exist:
-
0
“Errors only”: only print messages explaining why the Nix invocation failed. -
1
“Informational”: print useful messages about what Nix is doing. This is the default. -
2
“Talkative”: print more informational messages. -
3
“Chatty”: print even more informational messages. -
4
“Debug”: print debug information. -
5
“Vomit”: print vast amounts of debug information.
-
-
--quiet
Decreases the level of verbosity of diagnostic messages printed on standard error. This is the inverse option to-v
/--verbose
.This option may be specified repeatedly. See the previous verbosity levels list.
-
--log-format
format
This option can be used to change the output of the log format, with format being one of:-
raw
This is the raw format, as outputted by nix-build. -
internal-json
Outputs the logs in a structured manner.Warning
While the schema itself is relatively stable, the format of the error-messages (namely of the
msg
-field) can change between releases. -
bar
Only display a progress bar during the builds. -
bar-with-logs
Display the raw logs, with the progress bar at the bottom.
-
-
--no-build-output
/-Q
By default, output written by builders to standard output and standard error is echoed to the Nix command's standard error. This option suppresses this behaviour. Note that the builder's standard output and error are always written to a log file inprefix/nix/var/log/nix
. -
--max-jobs
/-j
number
Sets the maximum number of build jobs that Nix will perform in parallel to the specified number. Specifyauto
to use the number of CPUs in the system. The default is specified by themax-jobs
configuration setting, which itself defaults to1
. A higher value is useful on SMP systems or to exploit I/O latency.Setting it to
0
disallows building on the local machine, which is useful when you want builds to happen only on remote builders. -
--cores
Sets the value of theNIX_BUILD_CORES
environment variable in the invocation of builders. Builders can use this variable at their discretion to control the maximum amount of parallelism. For instance, in Nixpkgs, if the derivation attributeenableParallelBuilding
is set totrue
, the builder passes the-jN
flag to GNU Make. It defaults to the value of thecores
configuration setting, if set, or1
otherwise. The value0
means that the builder should use all available CPU cores in the system. -
--max-silent-time
Sets the maximum number of seconds that a builder can go without producing any data on standard output or standard error. The default is specified by themax-silent-time
configuration setting.0
means no time-out. -
--timeout
Sets the maximum number of seconds that a builder can run. The default is specified by thetimeout
configuration setting.0
means no timeout. -
--keep-going
/-k
Keep going in case of failed builds, to the greatest extent possible. That is, if building an input of some derivation fails, Nix will still build the other inputs, but not the derivation itself. Without this option, Nix stops if any build fails (except for builds of substitutes), possibly killing builds in progress (in case of parallel or distributed builds). -
--keep-failed
/-K
Specifies that in case of a build failure, the temporary directory (usually in/tmp
) in which the build takes place should not be deleted. The path of the build directory is printed as an informational message. -
--fallback
Whenever Nix attempts to build a derivation for which substitutes are known for each output path, but realising the output paths through the substitutes fails, fall back on building the derivation.The most common scenario in which this is useful is when we have registered substitutes in order to perform binary distribution from, say, a network repository. If the repository is down, the realisation of the derivation will fail. When this option is specified, Nix will build the derivation instead. Thus, installation from binaries falls back on installation from source. This option is not the default since it is generally not desirable for a transient failure in obtaining the substitutes to lead to a full build from source (with the related consumption of resources).
-
--readonly-mode
When this option is used, no attempt is made to open the Nix database. Most Nix operations do need database access, so those operations will fail. -
--arg
name value
This option is accepted bynix-env
,nix-instantiate
,nix-shell
andnix-build
. When evaluating Nix expressions, the expression evaluator will automatically try to call functions that it encounters. It can automatically call functions for which every argument has a default value (e.g.,{ argName ? defaultValue }: ...
). With--arg
, you can also call functions that have arguments without a default value (or override a default value). That is, if the evaluator encounters a function with an argument named name, it will call it with value value.For instance, the top-level
default.nix
in Nixpkgs is actually a function:{ # The system (e.g., `i686-linux') for which to build the packages. system ? builtins.currentSystem ... }: ...
So if you call this Nix expression (e.g., when you do
nix-env -iA pkgname
), the function will be called automatically using the valuebuiltins.currentSystem
for thesystem
argument. You can override this using--arg
, e.g.,nix-env -iA pkgname --arg system \"i686-freebsd\"
. (Note that since the argument is a Nix string literal, you have to escape the quotes.) -
--argstr
name value
This option is like--arg
, only the value is not a Nix expression but a string. So instead of--arg system "i686-linux"
(the outer quotes are to keep the shell happy) you can say--argstr system i686-linux
. -
--attr
/-A
attrPath
Select an attribute from the top-level Nix expression being evaluated. (nix-env
,nix-instantiate
,nix-build
andnix-shell
only.) The attribute path attrPath is a sequence of attribute names separated by dots. For instance, given a top-level Nix expression e, the attribute pathxorg.xorgserver
would cause the expressione.xorg.xorgserver
to be used. Seenix-env --install
for some concrete examples.In addition to attribute names, you can also specify array indices. For instance, the attribute path
foo.3.bar
selects thebar
attribute of the fourth element of the array in thefoo
attribute of the top-level expression. -
--expr
/-E
Interpret the command line arguments as a list of Nix expressions to be parsed and evaluated, rather than as a list of file names of Nix expressions. (nix-instantiate
,nix-build
andnix-shell
only.)For
nix-shell
, this option is commonly used to give you a shell in which you can build the packages returned by the expression. If you want to get a shell which contain the built packages ready for use, give your expression to thenix-shell -p
convenience flag instead. -
-I
path
Add a path to the Nix expression search path. This option may be given multiple times. See theNIX_PATH
environment variable for information on the semantics of the Nix search path. Paths added through-I
take precedence overNIX_PATH
. -
--option
name value
Set the Nix configuration option name to value. This overrides settings in the Nix configuration file (see nix.conf5). -
--repair
Fix corrupted or missing store paths by redownloading or rebuilding them. Note that this is slow because it requires computing a cryptographic hash of the contents of every path in the closure of the build. Also note the warning undernix-store --repair-path
.
Common Environment Variables
Most Nix commands interpret the following environment variables:
-
IN_NIX_SHELL
Indicator that tells if the current environment was set up bynix-shell
. It can have the valuespure
orimpure
. -
NIX_PATH
A colon-separated list of directories used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<path>
), e.g./home/eelco/Dev:/etc/nixos
. It can be extended using the-I
option. -
NIX_IGNORE_SYMLINK_STORE
Normally, the Nix store directory (typically/nix/store
) is not allowed to contain any symlink components. This is to prevent “impure” builds. Builders sometimes “canonicalise” paths by resolving all symlink components. Thus, builds on different machines (with/nix/store
resolving to different locations) could yield different results. This is generally not a problem, except when builds are deployed to machines where/nix/store
resolves differently. If you are sure that you’re not going to do that, you can setNIX_IGNORE_SYMLINK_STORE
to1
.Note that if you’re symlinking the Nix store so that you can put it on another file system than the root file system, on Linux you’re better off using
bind
mount points, e.g.,$ mkdir /nix $ mount -o bind /mnt/otherdisk/nix /nix
Consult the mount 8 manual page for details.
-
NIX_STORE_DIR
Overrides the location of the Nix store (defaultprefix/store
). -
NIX_DATA_DIR
Overrides the location of the Nix static data directory (defaultprefix/share
). -
NIX_LOG_DIR
Overrides the location of the Nix log directory (defaultprefix/var/log/nix
). -
NIX_STATE_DIR
Overrides the location of the Nix state directory (defaultprefix/var/nix
). -
NIX_CONF_DIR
Overrides the location of the system Nix configuration directory (defaultprefix/etc/nix
). -
NIX_CONFIG
Applies settings from Nix configuration from the environment. The content is treated as if it was read from a Nix configuration file. Settings are separated by the newline character. -
NIX_USER_CONF_FILES
Overrides the location of the user Nix configuration files to load from (defaults to the XDG spec locations). The variable is treated as a list separated by the:
token. -
TMPDIR
Use the specified directory to store temporary files. In particular, this includes temporary build directories; these can take up substantial amounts of disk space. The default is/tmp
. -
NIX_REMOTE
This variable should be set todaemon
if you want to use the Nix daemon to execute Nix operations. This is necessary in multi-user Nix installations. If the Nix daemon's Unix socket is at some non-standard path, this variable should be set tounix://path/to/socket
. Otherwise, it should be left unset. -
NIX_SHOW_STATS
If set to1
, Nix will print some evaluation statistics, such as the number of values allocated. -
NIX_COUNT_CALLS
If set to1
, Nix will print how often functions were called during Nix expression evaluation. This is useful for profiling your Nix expressions. -
GC_INITIAL_HEAP_SIZE
If Nix has been configured to use the Boehm garbage collector, this variable sets the initial size of the heap in bytes. It defaults to 384 MiB. Setting it to a low value reduces memory consumption, but will increase runtime due to the overhead of garbage collection.
Main Commands
This section lists commands and options that you can use when you work with Nix.
Name
nix-env
- manipulate or query Nix user environments
Synopsis
nix-env
[--option
name value]
[--arg
name value]
[--argstr
name value]
[{--file
| -f
} path]
[{--profile
| -p
} *path(]
[--system-filter
system]
[--dry-run
]
operation [options…] [arguments…]
Description
The command nix-env
is used to manipulate Nix user environments. User
environments are sets of software packages available to a user at some
point in time. In other words, they are a synthesised view of the
programs available in the Nix store. There may be many user
environments: different users can have different environments, and
individual users can switch between different environments.
nix-env
takes exactly one operation flag which indicates the
subcommand to be performed. These are documented below.
Selectors
Several commands, such as nix-env -q
and nix-env -i
, take a list of
arguments that specify the packages on which to operate. These are
extended regular expressions that must match the entire name of the
package. (For details on regular expressions, see regex(7).) The match is
case-sensitive. The regular expression can optionally be followed by a
dash and a version number; if omitted, any version of the package will
match. Here are some examples:
-
firefox
Matches the package namefirefox
and any version. -
firefox-32.0
Matches the package namefirefox
and version32.0
. -
gtk\\+
Matches the package namegtk+
. The+
character must be escaped using a backslash to prevent it from being interpreted as a quantifier, and the backslash must be escaped in turn with another backslash to ensure that the shell passes it on. -
.\*
Matches any package name. This is the default for most commands. -
'.*zip.*'
Matches any package name containing the stringzip
. Note the dots:'*zip*'
does not work, because in a regular expression, the character*
is interpreted as a quantifier. -
'.*(firefox|chromium).*'
Matches any package name containing the stringsfirefox
orchromium
.
Common options
This section lists the options that are common to all operations. These options are allowed for every subcommand, though they may not always have an effect.
-
--file
/-f
path
Specifies the Nix expression (designated below as the active Nix expression) used by the--install
,--upgrade
, and--query --available
operations to obtain derivations. The default is~/.nix-defexpr
.If the argument starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must include a single top-level directory containing at least a file nameddefault.nix
. -
--profile
/-p
path
Specifies the profile to be used by those operations that operate on a profile (designated below as the active profile). A profile is a sequence of user environments called generations, one of which is the current generation. -
--dry-run
For the--install
,--upgrade
,--uninstall
,--switch-generation
,--delete-generations
and--rollback
operations, this flag will causenix-env
to print what would be done if this flag had not been specified, without actually doing it.--dry-run
also prints out which paths will be substituted (i.e., downloaded) and which paths will be built from source (because no substitute is available). -
--system-filter
system
By default, operations such as--query --available
show derivations matching any platform. This option allows you to use derivations for the specified platform system.
Files
-
~/.nix-defexpr
The source for the default Nix expressions used by the--install
,--upgrade
, and--query --available
operations to obtain derivations. The--file
option may be used to override this default.If
~/.nix-defexpr
is a file, it is loaded as a Nix expression. If the expression is a set, it is used as the default Nix expression. If the expression is a function, an empty set is passed as argument and the return value is used as the default Nix expression.If
~/.nix-defexpr
is a directory containing adefault.nix
file, that file is loaded as in the above paragraph.If
~/.nix-defexpr
is a directory without adefault.nix
file, then its contents (both files and subdirectories) are loaded as Nix expressions. The expressions are combined into a single set, each expression under an attribute with the same name as the original file or subdirectory.For example, if
~/.nix-defexpr
contains two files,foo.nix
andbar.nix
, then the default Nix expression will essentially be{ foo = import ~/.nix-defexpr/foo.nix; bar = import ~/.nix-defexpr/bar.nix; }
The file
manifest.nix
is always ignored. Subdirectories without adefault.nix
file are traversed recursively in search of more Nix expressions, but the names of these intermediate directories are not added to the attribute paths of the default Nix expression.The command
nix-channel
places symlinks to the downloaded Nix expressions from each subscribed channel in this directory. -
~/.nix-profile
A symbolic link to the user's current profile. By default, this symlink points toprefix/var/nix/profiles/default
. ThePATH
environment variable should include~/.nix-profile/bin
for the user environment to be visible to the user.
Operation --install
Synopsis
nix-env
{--install
| -i
} args…
[{--prebuilt-only
| -b
}]
[{--attr
| -A
}]
[--from-expression
] [-E
]
[--from-profile
path]
[--preserve-installed
| -P
]
[--remove-all
| -r
]
Description
The install operation creates a new user environment, based on the current generation of the active profile, to which a set of store paths described by args is added. The arguments args map to store paths in a number of possible ways:
-
By default, args is a set of derivation names denoting derivations in the active Nix expression. These are realised, and the resulting output paths are installed. Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option
--preserve-installed
is specified.If there are multiple derivations matching a name in args that have the same name (e.g.,
gcc-3.3.6
andgcc-4.1.1
), then the derivation with the highest priority is used. A derivation can define a priority by declaring themeta.priority
attribute. This attribute should be a number, with a higher value denoting a lower priority. The default priority is0
.If there are multiple matching derivations with the same priority, then the derivation with the highest version will be installed.
You can force the installation of multiple derivations with the same name by being specific about the versions. For instance,
nix-env -i gcc-3.3.6 gcc-4.1.1
will install both version of GCC (and will probably cause a user environment conflict!). -
If
--attr
(-A
) is specified, the arguments are attribute paths that select attributes from the top-level Nix expression. This is faster than using derivation names and unambiguous. To find out the attribute paths of available packages, usenix-env -qaP
. -
If
--from-profile
path is given, args is a set of names denoting installed store paths in the profile path. This is an easy way to copy user environment elements from one profile to another. -
If
--from-expression
is given, args are Nix functions that are called with the active Nix expression as their single argument. The derivations returned by those function calls are installed. This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name. -
If args are store derivations, then these are realised, and the resulting output paths are installed.
-
If args are store paths that are not store derivations, then these are realised and installed.
-
By default all outputs are installed for each derivation. That can be reduced by setting
meta.outputsToInstall
.
Flags
-
--prebuilt-only
/-b
Use only derivations for which a substitute is registered, i.e., there is a pre-built binary available that can be downloaded in lieu of building the derivation. Thus, no packages will be built from source. -
--preserve-installed
;-P
Do not remove derivations with a name matching one of the derivations being installed. Usually, trying to have two versions of the same package installed in the same generation of a profile will lead to an error in building the generation, due to file name clashes between the two versions. However, this is not the case for all packages. -
--remove-all
;-r
Remove all previously installed packages first. This is equivalent to runningnix-env -e '.*'
first, except that everything happens in a single transaction.
Examples
To install a package using a specific attribute path from the active Nix expression:
$ nix-env -iA gcc40mips
installing `gcc-4.0.2'
$ nix-env -iA xorg.xorgserver
installing `xorg-server-1.2.0'
To install a specific version of gcc
using the derivation name:
$ nix-env --install gcc-3.3.2
installing `gcc-3.3.2'
uninstalling `gcc-3.1'
Using attribute path for selecting a package is preferred, as it is much faster and there will not be multiple matches.
Note the previously installed version is removed, since
--preserve-installed
was not specified.
To install an arbitrary version:
$ nix-env --install gcc
installing `gcc-3.3.2'
To install all derivations in the Nix expression foo.nix
:
$ nix-env -f ~/foo.nix -i '.*'
To copy the store path with symbolic name gcc
from another profile:
$ nix-env -i --from-profile /nix/var/nix/profiles/foo gcc
To install a specific store derivation (typically created by
nix-instantiate
):
$ nix-env -i /nix/store/fibjb1bfbpm5mrsxc4mh2d8n37sxh91i-gcc-3.4.3.drv
To install a specific output path:
$ nix-env -i /nix/store/y3cgx0xj1p4iv9x0pnnmdhr8iyg741vk-gcc-3.4.3
To install from a Nix expression specified on the command-line:
$ nix-env -f ./foo.nix -i -E \
'f: (f {system = "i686-linux";}).subversionWithJava'
I.e., this evaluates to (f: (f {system = "i686-linux";}).subversionWithJava) (import ./foo.nix)
, thus selecting
the subversionWithJava
attribute from the set returned by calling the
function defined in ./foo.nix
.
A dry-run tells you which paths will be downloaded or built from source:
$ nix-env -f '<nixpkgs>' -iA hello --dry-run
(dry run; not doing anything)
installing ‘hello-2.10’
this path will be fetched (0.04 MiB download, 0.19 MiB unpacked):
/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10
...
To install Firefox from the latest revision in the Nixpkgs/NixOS 14.12 channel:
$ nix-env -f https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz -iA firefox
Operation --upgrade
Synopsis
nix-env
{--upgrade
| -u
} args
[--lt
| --leq
| --eq
| --always
]
[{--prebuilt-only
| -b
}]
[{--attr
| -A
}]
[--from-expression
] [-E
]
[--from-profile
path]
[--preserve-installed
| -P
]
Description
The upgrade operation creates a new user environment, based on the current generation of the active profile, in which all store paths are replaced for which there are newer versions in the set of paths described by args. Paths for which there are no newer versions are left untouched; this is not an error. It is also not an error if an element of args matches no installed derivations.
For a description of how args is mapped to a set of store paths, see
--install
. If args describes multiple
store paths with the same symbolic name, only the one with the highest
version is installed.
Flags
-
--lt
Only upgrade a derivation to newer versions. This is the default. -
--leq
In addition to upgrading to newer versions, also “upgrade” to derivations that have the same version. Version are not a unique identification of a derivation, so there may be many derivations that have the same version. This flag may be useful to force “synchronisation” between the installed and available derivations. -
--eq
Only “upgrade” to derivations that have the same version. This may not seem very useful, but it actually is, e.g., when there is a new release of Nixpkgs and you want to replace installed applications with the same versions built against newer dependencies (to reduce the number of dependencies floating around on your system). -
--always
In addition to upgrading to newer versions, also “upgrade” to derivations that have the same or a lower version. I.e., derivations may actually be downgraded depending on what is available in the active Nix expression.
For the other flags, see --install
.
Examples
$ nix-env --upgrade -A nixpkgs.gcc
upgrading `gcc-3.3.1' to `gcc-3.4'
When there are no updates available, nothing will happen:
$ nix-env --upgrade -A nixpkgs.pan
Using -A
is preferred when possible, as it is faster and unambiguous but
it is also possible to upgrade to a specific version by matching the derivation name:
$ nix-env -u gcc-3.3.2 --always
upgrading `gcc-3.4' to `gcc-3.3.2'
To try to upgrade everything (matching packages based on the part of the derivation name without version):
$ nix-env -u
upgrading `hello-2.1.2' to `hello-2.1.3'
upgrading `mozilla-1.2' to `mozilla-1.4'
Versions
The upgrade operation determines whether a derivation y
is an upgrade
of a derivation x
by looking at their respective name
attributes.
The names (e.g., gcc-3.3.1
are split into two parts: the package name
(gcc
), and the version (3.3.1
). The version part starts after the
first dash not followed by a letter. y
is considered an upgrade of x
if their package names match, and the version of y
is higher than that
of x
.
The versions are compared by splitting them into contiguous components
of numbers and letters. E.g., 3.3.1pre5
is split into [3, 3, 1, "pre", 5]
. These lists are then compared lexicographically (from left
to right). Corresponding components a
and b
are compared as follows.
If they are both numbers, integer comparison is used. If a
is an empty
string and b
is a number, a
is considered less than b
. The special
string component pre
(for pre-release) is considered to be less than
other components. String components are considered less than number
components. Otherwise, they are compared lexicographically (i.e., using
case-sensitive string comparison).
This is illustrated by the following examples:
1.0 < 2.3
2.1 < 2.3
2.3 = 2.3
2.5 > 2.3
3.1 > 2.3
2.3.1 > 2.3
2.3.1 > 2.3a
2.3pre1 < 2.3
2.3pre3 < 2.3pre12
2.3a < 2.3c
2.3pre1 < 2.3c
2.3pre1 < 2.3q
Operation --uninstall
Synopsis
nix-env
{--uninstall
| -e
} drvnames…
Description
The uninstall operation creates a new user environment, based on the current generation of the active profile, from which the store paths designated by the symbolic names drvnames are removed.
Examples
$ nix-env --uninstall gcc
$ nix-env -e '.*' (remove everything)
Operation --set
Synopsis
nix-env
--set
drvname
Description
The --set
operation modifies the current generation of a profile so
that it contains exactly the specified derivation, and nothing else.
Examples
The following updates a profile such that its current generation will contain just Firefox:
$ nix-env -p /nix/var/nix/profiles/browser --set firefox
Operation --set-flag
Synopsis
nix-env
--set-flag
name value drvnames
Description
The --set-flag
operation allows meta attributes of installed packages
to be modified. There are several attributes that can be usefully
modified, because they affect the behaviour of nix-env
or the user
environment build script:
-
priority
can be changed to resolve filename clashes. The user environment build script uses themeta.priority
attribute of derivations to resolve filename collisions between packages. Lower priority values denote a higher priority. For instance, the GCC wrapper package and the Binutils package in Nixpkgs both have a filebin/ld
, so previously if you tried to install both you would get a collision. Now, on the other hand, the GCC wrapper declares a higher priority than Binutils, so the former’sbin/ld
is symlinked in the user environment. -
keep
can be set totrue
to prevent the package from being upgraded or replaced. This is useful if you want to hang on to an older version of a package. -
active
can be set tofalse
to “disable” the package. That is, no symlinks will be generated to the files of the package, but it remains part of the profile (so it won’t be garbage-collected). It can be set back totrue
to re-enable the package.
Examples
To prevent the currently installed Firefox from being upgraded:
$ nix-env --set-flag keep true firefox
After this, nix-env -u
will ignore Firefox.
To disable the currently installed Firefox, then install a new Firefox while the old remains part of the profile:
$ nix-env -q
firefox-2.0.0.9 (the current one)
$ nix-env --preserve-installed -i firefox-2.0.0.11
installing `firefox-2.0.0.11'
building path(s) `/nix/store/myy0y59q3ig70dgq37jqwg1j0rsapzsl-user-environment'
collision between `/nix/store/...-firefox-2.0.0.11/bin/firefox'
and `/nix/store/...-firefox-2.0.0.9/bin/firefox'.
(i.e., can’t have two active at the same time)
$ nix-env --set-flag active false firefox
setting flag on `firefox-2.0.0.9'
$ nix-env --preserve-installed -i firefox-2.0.0.11
installing `firefox-2.0.0.11'
$ nix-env -q
firefox-2.0.0.11 (the enabled one)
firefox-2.0.0.9 (the disabled one)
To make files from binutils
take precedence over files from gcc
:
$ nix-env --set-flag priority 5 binutils
$ nix-env --set-flag priority 10 gcc
Operation --query
Synopsis
nix-env
{--query
| -q
} names…
[--installed
| --available
| -a
]
[{--status
| -s
}]
[{--attr-path
| -P
}]
[--no-name
]
[{--compare-versions
| -c
}]
[--system
]
[--drv-path
]
[--out-path
]
[--description
]
[--meta
]
[--xml
]
[--json
]
[{--prebuilt-only
| -b
}]
[{--attr
| -A
} attribute-path]
Description
The query operation displays information about either the store paths
that are installed in the current generation of the active profile
(--installed
), or the derivations that are available for installation
in the active Nix expression (--available
). It only prints information
about derivations whose symbolic name matches one of names.
The derivations are sorted by their name
attributes.
Source selection
The following flags specify the set of things on which the query operates.
-
--installed
The query operates on the store paths that are installed in the current generation of the active profile. This is the default. -
--available
;-a
The query operates on the derivations that are available in the active Nix expression.
Queries
The following flags specify what information to display about the
selected derivations. Multiple flags may be specified, in which case the
information is shown in the order given here. Note that the name of the
derivation is shown unless --no-name
is specified.
-
--xml
Print the result in an XML representation suitable for automatic processing by other tools. The root element is calleditems
, which contains aitem
element for each available or installed derivation. The fields discussed below are all stored in attributes of theitem
elements. -
--json
Print the result in a JSON representation suitable for automatic processing by other tools. -
--prebuilt-only
/-b
Show only derivations for which a substitute is registered, i.e., there is a pre-built binary available that can be downloaded in lieu of building the derivation. Thus, this shows all packages that probably can be installed quickly. -
--status
;-s
Print the status of the derivation. The status consists of three characters. The first isI
or-
, indicating whether the derivation is currently installed in the current generation of the active profile. This is by definition the case for--installed
, but not for--available
. The second isP
or-
, indicating whether the derivation is present on the system. This indicates whether installation of an available derivation will require the derivation to be built. The third isS
or-
, indicating whether a substitute is available for the derivation. -
--attr-path
;-P
Print the attribute path of the derivation, which can be used to unambiguously select it using the--attr
option available in commands that install derivations likenix-env --install
. This option only works together with--available
-
--no-name
Suppress printing of thename
attribute of each derivation. -
--compare-versions
/-c
Compare installed versions to available versions, or vice versa (if--available
is given). This is useful for quickly seeing whether upgrades for installed packages are available in a Nix expression. A column is added with the following meaning:-
<
version
A newer version of the package is available or installed. -
=
version
At most the same version of the package is available or installed. -
>
version
Only older versions of the package are available or installed. -
- ?
No version of the package is available or installed.
-
-
--system
Print thesystem
attribute of the derivation. -
--drv-path
Print the path of the store derivation. -
--out-path
Print the output path of the derivation. -
--description
Print a short (one-line) description of the derivation, if available. The description is taken from themeta.description
attribute of the derivation. -
--meta
Print all of the meta-attributes of the derivation. This option is only available with--xml
or--json
.
Examples
To show installed packages:
$ nix-env -q
bison-1.875c
docbook-xml-4.2
firefox-1.0.4
MPlayer-1.0pre7
ORBit2-2.8.3
…
To show available packages:
$ nix-env -qa
firefox-1.0.7
GConf-2.4.0.1
MPlayer-1.0pre7
ORBit2-2.8.3
…
To show the status of available packages:
$ nix-env -qas
-P- firefox-1.0.7 (not installed but present)
--S GConf-2.4.0.1 (not present, but there is a substitute for fast installation)
--S MPlayer-1.0pre3 (i.e., this is not the installed MPlayer, even though the version is the same!)
IP- ORBit2-2.8.3 (installed and by definition present)
…
To show available packages in the Nix expression foo.nix
:
$ nix-env -f ./foo.nix -qa
foo-1.2.3
To compare installed versions to what’s available:
$ nix-env -qc
...
acrobat-reader-7.0 - ? (package is not available at all)
autoconf-2.59 = 2.59 (same version)
firefox-1.0.4 < 1.0.7 (a more recent version is available)
...
To show all packages with “zip
” in the name:
$ nix-env -qa '.*zip.*'
bzip2-1.0.6
gzip-1.6
zip-3.0
…
To show all packages with “firefox
” or “chromium
” in the name:
$ nix-env -qa '.*(firefox|chromium).*'
chromium-37.0.2062.94
chromium-beta-38.0.2125.24
firefox-32.0.3
firefox-with-plugins-13.0.1
…
To show all packages in the latest revision of the Nixpkgs repository:
$ nix-env -f https://github.com/NixOS/nixpkgs/archive/master.tar.gz -qa
Operation --switch-profile
Synopsis
nix-env
{--switch-profile
| -S
} path
Description
This operation makes path the current profile for the user. That is,
the symlink ~/.nix-profile
is made to point to path.
Examples
$ nix-env -S ~/my-profile
Operation --list-generations
Synopsis
nix-env
--list-generations
Description
This operation print a list of all the currently existing generations
for the active profile. These may be switched to using the
--switch-generation
operation. It also prints the creation date of the
generation, and indicates the current generation.
Examples
$ nix-env --list-generations
95 2004-02-06 11:48:24
96 2004-02-06 11:49:01
97 2004-02-06 16:22:45
98 2004-02-06 16:24:33 (current)
Operation --delete-generations
Synopsis
nix-env
--delete-generations
generations
Description
This operation deletes the specified generations of the current profile.
The generations can be a list of generation numbers, the special value
old
to delete all non-current generations, a value such as 30d
to
delete all generations older than the specified number of days (except
for the generation that was active at that point in time), or a value
such as +5
to keep the last 5
generations ignoring any newer than
current, e.g., if 30
is the current generation +5
will delete
generation 25
and all older generations. Periodically deleting old
generations is important to make garbage collection effective.
Examples
$ nix-env --delete-generations 3 4 8
$ nix-env --delete-generations +5
$ nix-env --delete-generations 30d
$ nix-env -p other_profile --delete-generations old
Operation --switch-generation
Synopsis
nix-env
{--switch-generation
| -G
} generation
Description
This operation makes generation number generation the current
generation of the active profile. That is, if the profile
is the path
to the active profile, then the symlink profile
is made to point to
profile-generation-link
, which is in turn a symlink to the actual user
environment in the Nix store.
Switching will fail if the specified generation does not exist.
Examples
$ nix-env -G 42
switching from generation 50 to 42
Operation --rollback
Synopsis
nix-env
--rollback
Description
This operation switches to the “previous” generation of the active
profile, that is, the highest numbered generation lower than the current
generation, if it exists. It is just a convenience wrapper around
--list-generations
and --switch-generation
.
Examples
$ nix-env --rollback
switching from generation 92 to 91
$ nix-env --rollback
error: no generation older than the current (91) exists
Environment variables
NIX_PROFILE
Location of the Nix profile. Defaults to the target of the symlink~/.nix-profile
, if it exists, or/nix/var/nix/profiles/default
otherwise.
Name
nix-build
- build a Nix expression
Synopsis
nix-build
[paths…]
[--arg
name value]
[--argstr
name value]
[{--attr
| -A
} attrPath]
[--no-out-link
]
[--dry-run
]
[{--out-link
| -o
} outlink]
Disambiguation
This man page describes the command nix-build
, which is distinct from nix build
. For documentation on the latter, run nix build --help
or see man nix3-build
.
Description
The nix-build
command builds the derivations described by the Nix
expressions in paths. If the build succeeds, it places a symlink to
the result in the current directory. The symlink is called result
. If
there are multiple Nix expressions, or the Nix expressions evaluate to
multiple derivations, multiple sequentially numbered symlinks are
created (result
, result-2
, and so on).
If no paths are specified, then nix-build
will use default.nix
in
the current directory, if it exists.
If an element of paths starts with http://
or https://
, it is
interpreted as the URL of a tarball that will be downloaded and unpacked
to a temporary location. The tarball must include a single top-level
directory containing at least a file named default.nix
.
nix-build
is essentially a wrapper around
nix-instantiate
(to translate a high-level Nix
expression to a low-level store derivation) and nix-store --realise
(to build the store
derivation).
Warning
The result of the build is automatically registered as a root of the Nix garbage collector. This root disappears automatically when the
result
symlink is deleted or renamed. So don’t rename the symlink.
Options
All options not listed here are passed to nix-store --realise
, except for --arg
and --attr
/ -A
which are passed to
nix-instantiate
.
-
Do not create a symlink to the output path. Note that as a result the output does not become a root of the garbage collector, and so might be deleted by
nix-store --gc
. -
Show what store paths would be built or downloaded.
-
--out-link
/-o
outlinkChange the name of the symlink to the output path created from
result
to outlink.
The following common options are supported:
Examples
$ nix-build '<nixpkgs>' -A firefox
store derivation is /nix/store/qybprl8sz2lc...-firefox-1.5.0.7.drv
/nix/store/d18hyl92g30l...-firefox-1.5.0.7
$ ls -l result
lrwxrwxrwx ... result -> /nix/store/d18hyl92g30l...-firefox-1.5.0.7
$ ls ./result/bin/
firefox firefox-config
If a derivation has multiple outputs, nix-build
will build the default
(first) output. You can also build all outputs:
$ nix-build '<nixpkgs>' -A openssl.all
This will create a symlink for each output named result-outputname
.
The suffix is omitted if the output name is out
. So if openssl
has
outputs out
, bin
and man
, nix-build
will create symlinks
result
, result-bin
and result-man
. It’s also possible to build a
specific output:
$ nix-build '<nixpkgs>' -A openssl.man
This will create a symlink result-man
.
Build a Nix expression given on the command line:
$ nix-build -E 'with import <nixpkgs> { }; runCommand "foo" { } "echo bar > $out"'
$ cat ./result
bar
Build the GNU Hello package from the latest revision of the master branch of Nixpkgs:
$ nix-build https://github.com/NixOS/nixpkgs/archive/master.tar.gz -A hello
Name
nix-shell
- start an interactive shell based on a Nix expression
Synopsis
nix-shell
[--arg
name value]
[--argstr
name value]
[{--attr
| -A
} attrPath]
[--command
cmd]
[--run
cmd]
[--exclude
regexp]
[--pure
]
[--keep
name]
{{--packages
| -p
} {packages | expressions} … | [path]}
Disambiguation
This man page describes the command nix-shell
, which is distinct from nix shell
. For documentation on the latter, run nix shell --help
or see man nix3-shell
.
Description
The command nix-shell
will build the dependencies of the specified
derivation, but not the derivation itself. It will then start an
interactive shell in which all environment variables defined by the
derivation path have been set to their corresponding values, and the
script $stdenv/setup
has been sourced. This is useful for reproducing
the environment of a derivation for development.
If path is not given, nix-shell
defaults to shell.nix
if it
exists, and default.nix
otherwise.
If path starts with http://
or https://
, it is interpreted as the
URL of a tarball that will be downloaded and unpacked to a temporary
location. The tarball must include a single top-level directory
containing at least a file named default.nix
.
If the derivation defines the variable shellHook
, it will be run
after $stdenv/setup
has been sourced. Since this hook is not executed
by regular Nix builds, it allows you to perform initialisation specific
to nix-shell
. For example, the derivation attribute
shellHook =
''
echo "Hello shell"
export SOME_API_TOKEN="$(cat ~/.config/some-app/api-token)"
'';
will cause nix-shell
to print Hello shell
and set the SOME_API_TOKEN
environment variable to a user-configured value.
Options
All options not listed here are passed to nix-store --realise
, except for --arg
and --attr
/ -A
which are passed to
nix-instantiate
.
-
--command
cmd
In the environment of the derivation, run the shell command cmd. This command is executed in an interactive shell. (Use--run
to use a non-interactive shell instead.) However, a call toexit
is implicitly added to the command, so the shell will exit after running the command. To prevent this, addreturn
at the end; e.g.--command "echo Hello; return"
will printHello
and then drop you into the interactive shell. This can be useful for doing any additional initialisation. -
--run
cmd
Like--command
, but executes the command in a non-interactive shell. This means (among other things) that if you hit Ctrl-C while the command is running, the shell exits. -
--exclude
regexp
Do not build any dependencies whose store path matches the regular expression regexp. This option may be specified multiple times. -
--pure
If this flag is specified, the environment is almost entirely cleared before the interactive shell is started, so you get an environment that more closely corresponds to the “real” Nix build. A few variables, in particularHOME
,USER
andDISPLAY
, are retained. -
--packages
/-p
packages…
Set up an environment in which the specified packages are present. The command line arguments are interpreted as attribute names inside the Nix Packages collection. Thus,nix-shell -p libjpeg openjdk
will start a shell in which the packages denoted by the attribute nameslibjpeg
andopenjdk
are present. -
-i
interpreter
The chained script interpreter to be invoked bynix-shell
. Only applicable in#!
-scripts (described below). -
--keep
name
When a--pure
shell is started, keep the listed environment variables.
The following common options are supported:
Environment variables
NIX_BUILD_SHELL
Shell used to start the interactive environment. Defaults to thebash
found in<nixpkgs>
, falling back to thebash
found inPATH
if not found.
Examples
To build the dependencies of the package Pan, and start an interactive shell in which to build it:
$ nix-shell '<nixpkgs>' -A pan
[nix-shell]$ eval ${unpackPhase:-unpackPhase}
[nix-shell]$ cd pan-*
[nix-shell]$ eval ${configurePhase:-configurePhase}
[nix-shell]$ eval ${buildPhase:-buildPhase}
[nix-shell]$ ./pan/gui/pan
The reason we use form eval ${configurePhase:-configurePhase}
here is because
those packages that override these phases do so by exporting the overridden
values in the environment variable of the same name.
Here bash is being told to either evaluate the contents of 'configurePhase',
if it exists as a variable, otherwise evaluate the configurePhase function.
To clear the environment first, and do some additional automatic initialisation of the interactive shell:
$ nix-shell '<nixpkgs>' -A pan --pure \
--command 'export NIX_DEBUG=1; export NIX_CORES=8; return'
Nix expressions can also be given on the command line using the -E
and
-p
flags. For instance, the following starts a shell containing the
packages sqlite
and libX11
:
$ nix-shell -E 'with import <nixpkgs> { }; runCommand "dummy" { buildInputs = [ sqlite xorg.libX11 ]; } ""'
A shorter way to do the same is:
$ nix-shell -p sqlite xorg.libX11
[nix-shell]$ echo $NIX_LDFLAGS
… -L/nix/store/j1zg5v…-sqlite-3.8.0.2/lib -L/nix/store/0gmcz9…-libX11-1.6.1/lib …
Note that -p
accepts multiple full nix expressions that are valid in
the buildInputs = [ ... ]
shown above, not only package names. So the
following is also legal:
$ nix-shell -p sqlite 'git.override { withManual = false; }'
The -p
flag looks up Nixpkgs in the Nix search path. You can override
it by passing -I
or setting NIX_PATH
. For example, the following
gives you a shell containing the Pan package from a specific revision of
Nixpkgs:
$ nix-shell -p pan -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/8a3eea054838b55aca962c3fbde9c83c102b8bf2.tar.gz
[nix-shell:~]$ pan --version
Pan 0.139
Use as a #!
-interpreter
You can use nix-shell
as a script interpreter to allow scripts written
in arbitrary languages to obtain their own dependencies via Nix. This is
done by starting the script with the following lines:
#! /usr/bin/env nix-shell
#! nix-shell -i real-interpreter -p packages
where real-interpreter is the “real” script interpreter that will be
invoked by nix-shell
after it has obtained the dependencies and
initialised the environment, and packages are the attribute names of
the dependencies in Nixpkgs.
The lines starting with #! nix-shell
specify nix-shell
options (see
above). Note that you cannot write #! /usr/bin/env nix-shell -i ...
because many operating systems only allow one argument in #!
lines.
For example, here is a Python script that depends on Python and the
prettytable
package:
#! /usr/bin/env nix-shell
#! nix-shell -i python -p python pythonPackages.prettytable
import prettytable
# Print a simple table.
t = prettytable.PrettyTable(["N", "N^2"])
for n in range(1, 10): t.add_row([n, n * n])
print t
Similarly, the following is a Perl script that specifies that it
requires Perl and the HTML::TokeParser::Simple
and LWP
packages:
#! /usr/bin/env nix-shell
#! nix-shell -i perl -p perl perlPackages.HTMLTokeParserSimple perlPackages.LWP
use HTML::TokeParser::Simple;
# Fetch nixos.org and print all hrefs.
my $p = HTML::TokeParser::Simple->new(url => 'http://nixos.org/');
while (my $token = $p->get_tag("a")) {
my $href = $token->get_attr("href");
print "$href\n" if $href;
}
Sometimes you need to pass a simple Nix expression to customize a package like Terraform:
#! /usr/bin/env nix-shell
#! nix-shell -i bash -p "terraform.withPlugins (plugins: [ plugins.openstack ])"
terraform apply
Note
You must use double quotes (
"
) when passing a simple Nix expression in a nix-shell shebang.
Finally, using the merging of multiple nix-shell shebangs the following Haskell script uses a specific branch of Nixpkgs/NixOS (the 20.03 stable branch):
#! /usr/bin/env nix-shell
#! nix-shell -i runghc -p "haskellPackages.ghcWithPackages (ps: [ps.download-curl ps.tagsoup])"
#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixos-20.03.tar.gz
import Network.Curl.Download
import Text.HTML.TagSoup
import Data.Either
import Data.ByteString.Char8 (unpack)
-- Fetch nixos.org and print all hrefs.
main = do
resp <- openURI "https://nixos.org/"
let tags = filter (isTagOpenName "a") $ parseTags $ unpack $ fromRight undefined resp
let tags' = map (fromAttrib "href") tags
mapM_ putStrLn $ filter (/= "") tags'
If you want to be even more precise, you can specify a specific revision of Nixpkgs:
#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/0672315759b3e15e2121365f067c1c8c56bb4722.tar.gz
The examples above all used -p
to get dependencies from Nixpkgs. You
can also use a Nix expression to build your own dependencies. For
example, the Python example could have been written as:
#! /usr/bin/env nix-shell
#! nix-shell deps.nix -i python
where the file deps.nix
in the same directory as the #!
-script
contains:
with import <nixpkgs> {};
runCommand "dummy" { buildInputs = [ python pythonPackages.prettytable ]; } ""
Name
nix-store
- manipulate or query the Nix store
Synopsis
nix-store
operation [options…] [arguments…]
[--option
name value]
[--add-root
path]
Description
The command nix-store
performs primitive operations on the Nix store.
You generally do not need to run this command manually.
nix-store
takes exactly one operation flag which indicates the
subcommand to be performed. These are documented below.
Common options
This section lists the options that are common to all operations. These options are allowed for every subcommand, though they may not always have an effect.
-
--add-root
pathCauses the result of a realisation (
--realise
and--force-realise
) to be registered as a root of the garbage collector. path will be created as a symlink to the resulting store path. In addition, a uniquely named symlink to path will be created in/nix/var/nix/gcroots/auto/
. For instance,$ nix-store --add-root /home/eelco/bla/result -r ... $ ls -l /nix/var/nix/gcroots/auto lrwxrwxrwx 1 ... 2005-03-13 21:10 dn54lcypm8f8... -> /home/eelco/bla/result $ ls -l /home/eelco/bla/result lrwxrwxrwx 1 ... 2005-03-13 21:10 /home/eelco/bla/result -> /nix/store/1r11343n6qd4...-f-spot-0.0.10
Thus, when
/home/eelco/bla/result
is removed, the GC root in theauto
directory becomes a dangling symlink and will be ignored by the collector.Warning
Note that it is not possible to move or rename GC roots, since the symlink in the
auto
directory will still point to the old location.If there are multiple results, then multiple symlinks will be created by sequentially numbering symlinks beyond the first one (e.g.,
foo
,foo-2
,foo-3
, and so on).
Operation --realise
Synopsis
nix-store
{--realise
| -r
} paths… [--dry-run
]
Description
The operation --realise
essentially “builds” the specified store
paths. Realisation is a somewhat overloaded term:
-
If the store path is a derivation, realisation ensures that the output paths of the derivation are valid (i.e., the output path and its closure exist in the file system). This can be done in several ways. First, it is possible that the outputs are already valid, in which case we are done immediately. Otherwise, there may be substitutes that produce the outputs (e.g., by downloading them). Finally, the outputs can be produced by running the build task described by the derivation.
-
If the store path is not a derivation, realisation ensures that the specified path is valid (i.e., it and its closure exist in the file system). If the path is already valid, we are done immediately. Otherwise, the path and any missing paths in its closure may be produced through substitutes. If there are no (successful) substitutes, realisation fails.
The output path of each derivation is printed on standard output. (For non-derivations argument, the argument itself is printed.)
The following flags are available:
-
--dry-run
Print on standard error a description of what packages would be built or downloaded, without actually performing the operation. -
--ignore-unknown
If a non-derivation path does not have a substitute, then silently ignore it. -
--check
This option allows you to check whether a derivation is deterministic. It rebuilds the specified derivation and checks whether the result is bitwise-identical with the existing outputs, printing an error if that’s not the case. The outputs of the specified derivation must already exist. When used with-K
, if an output path is not identical to the corresponding output from the previous build, the new output path is left in/nix/store/name.check.
Special exit codes:
-
100
Generic build failure, the builder process returned with a non-zero exit code. -
101
Build timeout, the build was aborted because it did not complete within the specifiedtimeout
. -
102
Hash mismatch, the build output was rejected because it does not match theoutputHash
attribute of the derivation. -
104
Not deterministic, the build succeeded in check mode but the resulting output is not binary reproducible.
With the --keep-going
flag it's possible for multiple failures to
occur, in this case the 1xx status codes are or combined using binary
or.
1100100
^^^^
|||`- timeout
||`-- output hash mismatch
|`--- build failure
`---- not deterministic
Examples
This operation is typically used to build store derivations produced by
nix-instantiate
:
$ nix-store -r $(nix-instantiate ./test.nix)
/nix/store/31axcgrlbfsxzmfff1gyj1bf62hvkby2-aterm-2.3.1
This is essentially what nix-build
does.
To test whether a previously-built derivation is deterministic:
$ nix-build '<nixpkgs>' -A hello --check -K
Use --read-log
to show the stderr and stdout of a build:
$ nix-store --read-log $(nix-instantiate ./test.nix)
Operation --serve
Synopsis
nix-store
--serve
[--write
]
Description
The operation --serve
provides access to the Nix store over stdin and
stdout, and is intended to be used as a means of providing Nix store
access to a restricted ssh user.
The following flags are available:
--write
Allow the connected client to request the realization of derivations. In effect, this can be used to make the host act as a remote builder.
Examples
To turn a host into a build server, the authorized_keys
file can be
used to provide build access to a given SSH public key:
$ cat <<EOF >>/root/.ssh/authorized_keys
command="nice -n20 nix-store --serve --write" ssh-rsa AAAAB3NzaC1yc2EAAAA...
EOF
Operation --gc
Synopsis
nix-store
--gc
[--print-roots
| --print-live
| --print-dead
] [--max-freed
bytes]
Description
Without additional flags, the operation --gc
performs a garbage
collection on the Nix store. That is, all paths in the Nix store not
reachable via file system references from a set of “roots”, are deleted.
The following suboperations may be specified:
-
--print-roots
This operation prints on standard output the set of roots used by the garbage collector. -
--print-live
This operation prints on standard output the set of “live” store paths, which are all the store paths reachable from the roots. Live paths should never be deleted, since that would break consistency — it would become possible that applications are installed that reference things that are no longer present in the store. -
--print-dead
This operation prints out on standard output the set of “dead” store paths, which is just the opposite of the set of live paths: any path in the store that is not live (with respect to the roots) is dead.
By default, all unreachable paths are deleted. The following options control what gets deleted and in what order:
--max-freed
bytes
Keep deleting paths until at least bytes bytes have been deleted, then stop. The argument bytes can be followed by the multiplicative suffixK
,M
,G
orT
, denoting KiB, MiB, GiB or TiB units.
The behaviour of the collector is also influenced by the
keep-outputs
and keep-derivations
settings in the Nix
configuration file.
By default, the collector prints the total number of freed bytes when it
finishes (or when it is interrupted). With --print-dead
, it prints the
number of bytes that would be freed.
Examples
To delete all unreachable paths, just do:
$ nix-store --gc
deleting `/nix/store/kq82idx6g0nyzsp2s14gfsc38npai7lf-cairo-1.0.4.tar.gz.drv'
...
8825586 bytes freed (8.42 MiB)
To delete at least 100 MiBs of unreachable paths:
$ nix-store --gc --max-freed $((100 * 1024 * 1024))
Operation --delete
Synopsis
nix-store
--delete
[--ignore-liveness
] paths…
Description
The operation --delete
deletes the store paths paths from the Nix
store, but only if it is safe to do so; that is, when the path is not
reachable from a root of the garbage collector. This means that you can
only delete paths that would also be deleted by nix-store --gc
. Thus,
--delete
is a more targeted version of --gc
.
With the option --ignore-liveness
, reachability from the roots is
ignored. However, the path still won’t be deleted if there are other
paths in the store that refer to it (i.e., depend on it).
Example
$ nix-store --delete /nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4
0 bytes freed (0.00 MiB)
error: cannot delete path `/nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4' since it is still alive
Operation --query
Synopsis
nix-store
{--query
| -q
}
{--outputs
| --requisites
| -R
| --references
|
--referrers
| --referrers-closure
| --deriver
| -d
|
--graph
| --tree
| --binding
name | -b
name | --hash
|
--size
| --roots
}
[--use-output
] [-u
] [--force-realise
] [-f
]
paths…
Description
The operation --query
displays various bits of information about the
store paths . The queries are described below. At most one query can be
specified. The default query is --outputs
.
The paths paths may also be symlinks from outside of the Nix store, to the Nix store. In that case, the query is applied to the target of the symlink.
Common query options
-
--use-output
;-u
For each argument to the query that is a store derivation, apply the query to the output path of the derivation instead. -
--force-realise
;-f
Realise each argument to the query first (seenix-store --realise
).
Queries
-
--outputs
Prints out the output paths of the store derivations paths. These are the paths that will be produced when the derivation is built. -
--requisites
;-R
Prints out the closure of the store path paths.This query has one option:
--include-outputs
Also include the existing output paths of store derivations, and their closures.
This query can be used to implement various kinds of deployment. A source deployment is obtained by distributing the closure of a store derivation. A binary deployment is obtained by distributing the closure of an output path. A cache deployment (combined source/binary deployment, including binaries of build-time-only dependencies) is obtained by distributing the closure of a store derivation and specifying the option
--include-outputs
. -
--references
Prints the set of references of the store paths paths, that is, their immediate dependencies. (For all dependencies, use--requisites
.) -
--referrers
Prints the set of referrers of the store paths paths, that is, the store paths currently existing in the Nix store that refer to one of paths. Note that contrary to the references, the set of referrers is not constant; it can change as store paths are added or removed. -
--referrers-closure
Prints the closure of the set of store paths paths under the referrers relation; that is, all store paths that directly or indirectly refer to one of paths. These are all the path currently in the Nix store that are dependent on paths. -
--deriver
;-d
Prints the deriver of the store paths paths. If the path has no deriver (e.g., if it is a source file), or if the deriver is not known (e.g., in the case of a binary-only deployment), the stringunknown-deriver
is printed. -
--graph
Prints the references graph of the store paths paths in the format of thedot
tool of AT&T's Graphviz package. This can be used to visualise dependency graphs. To obtain a build-time dependency graph, apply this to a store derivation. To obtain a runtime dependency graph, apply it to an output path. -
--tree
Prints the references graph of the store paths paths as a nested ASCII tree. References are ordered by descending closure size; this tends to flatten the tree, making it more readable. The query only recurses into a store path when it is first encountered; this prevents a blowup of the tree representation of the graph. -
--graphml
Prints the references graph of the store paths paths in the GraphML file format. This can be used to visualise dependency graphs. To obtain a build-time dependency graph, apply this to a store derivation. To obtain a runtime dependency graph, apply it to an output path. -
--binding
name;-b
name
Prints the value of the attribute name (i.e., environment variable) of the store derivations paths. It is an error for a derivation to not have the specified attribute. -
--hash
Prints the SHA-256 hash of the contents of the store paths paths (that is, the hash of the output ofnix-store --dump
on the given paths). Since the hash is stored in the Nix database, this is a fast operation. -
--size
Prints the size in bytes of the contents of the store paths paths — to be precise, the size of the output ofnix-store --dump
on the given paths. Note that the actual disk space required by the store paths may be higher, especially on filesystems with large cluster sizes. -
--roots
Prints the garbage collector roots that point, directly or indirectly, at the store paths paths.
Examples
Print the closure (runtime dependencies) of the svn
program in the
current user environment:
$ nix-store -qR $(which svn)
/nix/store/5mbglq5ldqld8sj57273aljwkfvj22mc-subversion-1.1.4
/nix/store/9lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4
...
Print the build-time dependencies of svn
:
$ nix-store -qR $(nix-store -qd $(which svn))
/nix/store/02iizgn86m42q905rddvg4ja975bk2i4-grep-2.5.1.tar.bz2.drv
/nix/store/07a2bzxmzwz5hp58nf03pahrv2ygwgs3-gcc-wrapper.sh
/nix/store/0ma7c9wsbaxahwwl04gbw3fcd806ski4-glibc-2.3.4.drv
... lots of other paths ...
The difference with the previous example is that we ask the closure of
the derivation (-qd
), not the closure of the output path that contains
svn
.
Show the build-time dependencies as a tree:
$ nix-store -q --tree $(nix-store -qd $(which svn))
/nix/store/7i5082kfb6yjbqdbiwdhhza0am2xvh6c-subversion-1.1.4.drv
+---/nix/store/d8afh10z72n8l1cr5w42366abiblgn54-builder.sh
+---/nix/store/fmzxmpjx2lh849ph0l36snfj9zdibw67-bash-3.0.drv
| +---/nix/store/570hmhmx3v57605cqg9yfvvyh0nnb8k8-bash
| +---/nix/store/p3srsbd8dx44v2pg6nbnszab5mcwx03v-builder.sh
...
Show all paths that depend on the same OpenSSL library as svn
:
$ nix-store -q --referrers $(nix-store -q --binding openssl $(nix-store -qd $(which svn)))
/nix/store/23ny9l9wixx21632y2wi4p585qhva1q8-sylpheed-1.0.0
/nix/store/5mbglq5ldqld8sj57273aljwkfvj22mc-subversion-1.1.4
/nix/store/dpmvp969yhdqs7lm2r1a3gng7pyq6vy4-subversion-1.1.3
/nix/store/l51240xqsgg8a7yrbqdx1rfzyv6l26fx-lynx-2.8.5
Show all paths that directly or indirectly depend on the Glibc (C
library) used by svn
:
$ nix-store -q --referrers-closure $(ldd $(which svn) | grep /libc.so | awk '{print $3}')
/nix/store/034a6h4vpz9kds5r6kzb9lhh81mscw43-libgnomeprintui-2.8.2
/nix/store/15l3yi0d45prm7a82pcrknxdh6nzmxza-gawk-3.1.4
...
Note that ldd
is a command that prints out the dynamic libraries used
by an ELF executable.
Make a picture of the runtime dependency graph of the current user environment:
$ nix-store -q --graph ~/.nix-profile | dot -Tps > graph.ps
$ gv graph.ps
Show every garbage collector root that points to a store path that
depends on svn
:
$ nix-store -q --roots $(which svn)
/nix/var/nix/profiles/default-81-link
/nix/var/nix/profiles/default-82-link
/nix/var/nix/profiles/per-user/eelco/profile-97-link
Operation --add
Synopsis
nix-store
--add
paths…
Description
The operation --add
adds the specified paths to the Nix store. It
prints the resulting paths in the Nix store on standard output.
Example
$ nix-store --add ./foo.c
/nix/store/m7lrha58ph6rcnv109yzx1nk1cj7k7zf-foo.c
Operation --add-fixed
Synopsis
nix-store
--add-fixed
[--recursive
] algorithm paths…
Description
The operation --add-fixed
adds the specified paths to the Nix store.
Unlike --add
paths are registered using the specified hashing
algorithm, resulting in the same output path as a fixed-output
derivation. This can be used for sources that are not available from a
public url or broke since the download expression was written.
This operation has the following options:
--recursive
Use recursive instead of flat hashing mode, used when adding directories to the store.
Example
$ nix-store --add-fixed sha256 ./hello-2.10.tar.gz
/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
Operation --verify
Synopsis
nix-store
--verify
[--check-contents
] [--repair
]
Description
The operation --verify
verifies the internal consistency of the Nix
database, and the consistency between the Nix database and the Nix
store. Any inconsistencies encountered are automatically repaired.
Inconsistencies are generally the result of the Nix store or database
being modified by non-Nix tools, or of bugs in Nix itself.
This operation has the following options:
-
--check-contents
Checks that the contents of every valid store path has not been altered by computing a SHA-256 hash of the contents and comparing it with the hash stored in the Nix database at build time. Paths that have been modified are printed out. For large stores,--check-contents
is obviously quite slow. -
--repair
If any valid path is missing from the store, or (if--check-contents
is given) the contents of a valid path has been modified, then try to repair the path by redownloading it. Seenix-store --repair-path
for details.
Operation --verify-path
Synopsis
nix-store
--verify-path
paths…
Description
The operation --verify-path
compares the contents of the given store
paths to their cryptographic hashes stored in Nix’s database. For every
changed path, it prints a warning message. The exit status is 0 if no
path has changed, and 1 otherwise.
Example
To verify the integrity of the svn
command and all its dependencies:
$ nix-store --verify-path $(nix-store -qR $(which svn))
Operation --repair-path
Synopsis
nix-store
--repair-path
paths…
Description
The operation --repair-path
attempts to “repair” the specified paths
by redownloading them using the available substituters. If no
substitutes are available, then repair is not possible.
Warning
During repair, there is a very small time window during which the old path (if it exists) is moved out of the way and replaced with the new path. If repair is interrupted in between, then the system may be left in a broken state (e.g., if the path contains a critical system component like the GNU C Library).
Example
$ nix-store --verify-path /nix/store/dj7a81wsm1ijwwpkks3725661h3263p5-glibc-2.13
path `/nix/store/dj7a81wsm1ijwwpkks3725661h3263p5-glibc-2.13' was modified!
expected hash `2db57715ae90b7e31ff1f2ecb8c12ec1cc43da920efcbe3b22763f36a1861588',
got `481c5aa5483ebc97c20457bb8bca24deea56550d3985cda0027f67fe54b808e4'
$ nix-store --repair-path /nix/store/dj7a81wsm1ijwwpkks3725661h3263p5-glibc-2.13
fetching path `/nix/store/d7a81wsm1ijwwpkks3725661h3263p5-glibc-2.13'...
…
Operation --dump
Synopsis
nix-store
--dump
path
Description
The operation --dump
produces a NAR (Nix ARchive) file containing the
contents of the file system tree rooted at path. The archive is
written to standard output.
A NAR archive is like a TAR or Zip archive, but it contains only the information that Nix considers important. For instance, timestamps are elided because all files in the Nix store have their timestamp set to 0 anyway. Likewise, all permissions are left out except for the execute bit, because all files in the Nix store have 444 or 555 permission.
Also, a NAR archive is canonical, meaning that “equal” paths always
produce the same NAR archive. For instance, directory entries are
always sorted so that the actual on-disk order doesn’t influence the
result. This means that the cryptographic hash of a NAR dump of a
path is usable as a fingerprint of the contents of the path. Indeed,
the hashes of store paths stored in Nix’s database (see nix-store -q --hash
) are SHA-256 hashes of the NAR dump of each store path.
NAR archives support filenames of unlimited length and 64-bit file sizes. They can contain regular files, directories, and symbolic links, but not other types of files (such as device nodes).
A Nix archive can be unpacked using nix-store --restore
.
Operation --restore
Synopsis
nix-store
--restore
path
Description
The operation --restore
unpacks a NAR archive to path, which must
not already exist. The archive is read from standard input.
Operation --export
Synopsis
nix-store
--export
paths…
Description
The operation --export
writes a serialisation of the specified store
paths to standard output in a format that can be imported into another
Nix store with nix-store --import
. This is like nix-store --dump
, except that the NAR archive produced by that command doesn’t
contain the necessary meta-information to allow it to be imported into
another Nix store (namely, the set of references of the path).
This command does not produce a closure of the specified paths, so if a store path references other store paths that are missing in the target Nix store, the import will fail. To copy a whole closure, do something like:
$ nix-store --export $(nix-store -qR paths) > out
To import the whole closure again, run:
$ nix-store --import < out
Operation --import
Synopsis
nix-store
--import
Description
The operation --import
reads a serialisation of a set of store paths
produced by nix-store --export
from standard input and adds those
store paths to the Nix store. Paths that already exist in the Nix store
are ignored. If a path refers to another path that doesn’t exist in the
Nix store, the import fails.
Operation --optimise
Synopsis
nix-store
--optimise
Description
The operation --optimise
reduces Nix store disk space usage by finding
identical files in the store and hard-linking them to each other. It
typically reduces the size of the store by something like 25-35%. Only
regular files and symlinks are hard-linked in this manner. Files are
considered identical when they have the same NAR archive serialisation:
that is, regular files must have the same contents and permission
(executable or non-executable), and symlinks must have the same
contents.
After completion, or when the command is interrupted, a report on the achieved savings is printed on standard error.
Use -vv
or -vvv
to get some progress indication.
Example
$ nix-store --optimise
hashing files in `/nix/store/qhqx7l2f1kmwihc9bnxs7rc159hsxnf3-gcc-4.1.1'
...
541838819 bytes (516.74 MiB) freed by hard-linking 54143 files;
there are 114486 files with equal contents out of 215894 files in total
Operation --read-log
Synopsis
nix-store
{--read-log
| -l
} paths…
Description
The operation --read-log
prints the build log of the specified store
paths on standard output. The build log is whatever the builder of a
derivation wrote to standard output and standard error. If a store path
is not a derivation, the deriver of the store path is used.
Build logs are kept in /nix/var/log/nix/drvs
. However, there is no
guarantee that a build log is available for any particular store path.
For instance, if the path was downloaded as a pre-built binary through a
substitute, then the log is unavailable.
Example
$ nix-store -l $(which ktorrent)
building /nix/store/dhc73pvzpnzxhdgpimsd9sw39di66ph1-ktorrent-2.2.1
unpacking sources
unpacking source archive /nix/store/p8n1jpqs27mgkjw07pb5269717nzf5f8-ktorrent-2.2.1.tar.gz
ktorrent-2.2.1/
ktorrent-2.2.1/NEWS
...
Operation --dump-db
Synopsis
nix-store
--dump-db
[paths…]
Description
The operation --dump-db
writes a dump of the Nix database to standard
output. It can be loaded into an empty Nix store using --load-db
. This
is useful for making backups and when migrating to different database
schemas.
By default, --dump-db
will dump the entire Nix database. When one or
more store paths is passed, only the subset of the Nix database for
those store paths is dumped. As with --export
, the user is responsible
for passing all the store paths for a closure. See --export
for an
example.
Operation --load-db
Synopsis
nix-store
--load-db
Description
The operation --load-db
reads a dump of the Nix database created by
--dump-db
from standard input and loads it into the Nix database.
Operation --print-env
Synopsis
nix-store
--print-env
drvpath
Description
The operation --print-env
prints out the environment of a derivation
in a format that can be evaluated by a shell. The command line arguments
of the builder are placed in the variable _args
.
Example
$ nix-store --print-env $(nix-instantiate '<nixpkgs>' -A firefox)
…
export src; src='/nix/store/plpj7qrwcz94z2psh6fchsi7s8yihc7k-firefox-12.0.source.tar.bz2'
export stdenv; stdenv='/nix/store/7c8asx3yfrg5dg1gzhzyq2236zfgibnn-stdenv'
export system; system='x86_64-linux'
export _args; _args='-e /nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25c-default-builder.sh'
Operation --generate-binary-cache-key
Synopsis
nix-store
--generate-binary-cache-key
key-name secret-key-file public-key-file
Description
This command generates an Ed25519 key pair that can be used to create a signed binary cache. It takes three mandatory parameters:
-
A key name, such as
cache.example.org-1
, that is used to look up keys on the client when it verifies signatures. It can be anything, but it’s suggested to use the host name of your cache (e.g.cache.example.org
) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key). -
The file name where the secret key is to be stored.
-
The file name where the public key is to be stored.
Utilities
This section lists utilities that you can use when you work with Nix.
Name
nix-channel
- manage Nix channels
Synopsis
nix-channel
{--add
url [name] | --remove
name | --list
| --update
[names…] | --rollback
[generation] }
Description
A Nix channel is a mechanism that allows you to automatically stay up-to-date with a set of pre-built Nix expressions. A Nix channel is just a URL that points to a place containing a set of Nix expressions.
To see the list of official NixOS channels, visit https://nixos.org/channels.
This command has the following operations:
-
--add
url [name]
Adds a channel named name with URL url to the list of subscribed channels. If name is omitted, it defaults to the last component of url, with the suffixes-stable
or-unstable
removed. -
--remove
name
Removes the channel named name from the list of subscribed channels. -
--list
Prints the names and URLs of all subscribed channels on standard output. -
--update
[names…]
Downloads the Nix expressions of all subscribed channels (or only those included in names if specified) and makes them the default fornix-env
operations (by symlinking them from the directory~/.nix-defexpr
). -
--rollback
[generation]
Reverts the previous call tonix-channel --update
. Optionally, you can specify a specific channel generation number to restore.
Note that --add
does not automatically perform an update.
The list of subscribed channels is stored in ~/.nix-channels
.
Examples
To subscribe to the Nixpkgs channel and install the GNU Hello package:
$ nix-channel --add https://nixos.org/channels/nixpkgs-unstable
$ nix-channel --update
$ nix-env -iA nixpkgs.hello
You can revert channel updates using --rollback
:
$ nix-instantiate --eval -E '(import <nixpkgs> {}).lib.version'
"14.04.527.0e935f1"
$ nix-channel --rollback
switching from generation 483 to 482
$ nix-instantiate --eval -E '(import <nixpkgs> {}).lib.version'
"14.04.526.dbadfad"
Files
-
/nix/var/nix/profiles/per-user/username/channels
nix-channel
uses anix-env
profile to keep track of previous versions of the subscribed channels. Every time you runnix-channel --update
, a new channel generation (that is, a symlink to the channel Nix expressions in the Nix store) is created. This enablesnix-channel --rollback
to revert to previous versions. -
~/.nix-defexpr/channels
This is a symlink to/nix/var/nix/profiles/per-user/username/channels
. It ensures thatnix-env
can find your channels. In a multi-user installation, you may also have~/.nix-defexpr/channels_root
, which links to the channels of the root user.
Channel format
A channel URL should point to a directory containing the following files:
nixexprs.tar.xz
A tarball containing Nix expressions and files referenced by them (such as build scripts and patches). At the top level, the tarball should contain a single directory. That directory must contain a filedefault.nix
that serves as the channel’s “entry point”.
Name
nix-collect-garbage
- delete unreachable store paths
Synopsis
nix-collect-garbage
[--delete-old
] [-d
] [--delete-older-than
period] [--max-freed
bytes] [--dry-run
]
Description
The command nix-collect-garbage
is mostly an alias of nix-store --gc
, that is, it deletes all
unreachable paths in the Nix store to clean up your system. However,
it provides two additional options: -d
(--delete-old
), which
deletes all old generations of all profiles in /nix/var/nix/profiles
by invoking nix-env --delete-generations old
on all profiles (of
course, this makes rollbacks to previous configurations impossible);
and --delete-older-than
period, where period is a value such as
30d
, which deletes all generations older than the specified number
of days in all profiles in /nix/var/nix/profiles
(except for the
generations that were active at that point in time).
Example
To delete from the Nix store everything that is not used by the current generations of each profile, do
$ nix-collect-garbage -d
Name
nix-copy-closure
- copy a closure to or from a remote machine via SSH
Synopsis
nix-copy-closure
[--to
| --from
]
[--gzip
]
[--include-outputs
]
[--use-substitutes
| -s
]
[-v
]
user@machine paths
Description
nix-copy-closure
gives you an easy and efficient way to exchange
software between machines. Given one or more Nix store paths on the
local machine, nix-copy-closure
computes the closure of those paths
(i.e. all their dependencies in the Nix store), and copies all paths
in the closure to the remote machine via the ssh
(Secure Shell)
command. With the --from
option, the direction is reversed: the
closure of paths on a remote machine is copied to the Nix store on
the local machine.
This command is efficient because it only sends the store paths that are missing on the target machine.
Since nix-copy-closure
calls ssh
, you may be asked to type in the
appropriate password or passphrase. In fact, you may be asked twice
because nix-copy-closure
currently connects twice to the remote
machine, first to get the set of paths missing on the target machine,
and second to send the dump of those paths. When using public key
authentication, you can avoid typing the passphrase with ssh-agent
.
Options
-
--to
Copy the closure of paths from the local Nix store to the Nix store on machine. This is the default. -
--from
Copy the closure of paths from the Nix store on machine to the local Nix store. -
--gzip
Enable compression of the SSH connection. -
--include-outputs
Also copy the outputs of store derivations included in the closure. -
--use-substitutes
/-s
Attempt to download missing paths on the target machine using Nix’s substitute mechanism. Any paths that cannot be substituted on the target are still copied normally from the source. This is useful, for instance, if the connection between the source and target machine is slow, but the connection between the target machine andnixos.org
(the default binary cache server) is fast. -
-v
Show verbose output.
Environment variables
NIX_SSHOPTS
Additional options to be passed tossh
on the command line.
Examples
Copy Firefox with all its dependencies to a remote machine:
$ nix-copy-closure --to alice@itchy.labs $(type -tP firefox)
Copy Subversion from a remote machine and then install it into a user environment:
$ nix-copy-closure --from alice@itchy.labs \
/nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
$ nix-env -i /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
Name
nix-daemon
- Nix multi-user support daemon
Synopsis
nix-daemon
Description
The Nix daemon is necessary in multi-user Nix installations. It runs build tasks and other operations on the Nix store on behalf of unprivileged users.
Name
nix-hash
- compute the cryptographic hash of a path
Synopsis
nix-hash
[--flat
] [--base32
] [--truncate
] [--type
hashAlgo] path…
nix-hash
--to-base16
hash…
nix-hash
--to-base32
hash…
Description
The command nix-hash
computes the cryptographic hash of the contents
of each path and prints it on standard output. By default, it computes
an MD5 hash, but other hash algorithms are available as well. The hash
is printed in hexadecimal. To generate the same hash as
nix-prefetch-url
you have to specify multiple arguments, see below for
an example.
The hash is computed over a serialisation of each path: a dump of
the file system tree rooted at the path. This allows directories and
symlinks to be hashed as well as regular files. The dump is in the
NAR format produced by nix-store --dump
. Thus, nix-hash path
yields the same cryptographic hash as nix-store --dump path | md5sum
.
Options
-
--flat
Print the cryptographic hash of the contents of each regular file path. That is, do not compute the hash over the dump of path. The result is identical to that produced by the GNU commandsmd5sum
andsha1sum
. -
--base32
Print the hash in a base-32 representation rather than hexadecimal. This base-32 representation is more compact and can be used in Nix expressions (such as in calls tofetchurl
). -
--truncate
Truncate hashes longer than 160 bits (such as SHA-256) to 160 bits. -
--type
hashAlgo
Use the specified cryptographic hash algorithm, which can be one ofmd5
,sha1
,sha256
, andsha512
. -
--to-base16
Don’t hash anything, but convert the base-32 hash representation hash to hexadecimal. -
--to-base32
Don’t hash anything, but convert the hexadecimal hash representation hash to base-32.
Examples
Computing the same hash as nix-prefetch-url
:
$ nix-prefetch-url file://<(echo test)
1lkgqb6fclns49861dwk9rzb6xnfkxbpws74mxnx01z9qyv1pjpj
$ nix-hash --type sha256 --flat --base32 <(echo test)
1lkgqb6fclns49861dwk9rzb6xnfkxbpws74mxnx01z9qyv1pjpj
Computing hashes:
$ mkdir test
$ echo "hello" > test/world
$ nix-hash test/ (MD5 hash; default)
8179d3caeff1869b5ba1744e5a245c04
$ nix-store --dump test/ | md5sum (for comparison)
8179d3caeff1869b5ba1744e5a245c04 -
$ nix-hash --type sha1 test/
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
$ nix-hash --type sha1 --base32 test/
nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
$ nix-hash --type sha256 --flat test/
error: reading file `test/': Is a directory
$ nix-hash --type sha256 --flat test/world
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
Converting between hexadecimal and base-32:
$ nix-hash --type sha1 --to-base32 e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
$ nix-hash --type sha1 --to-base16 nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
Name
nix-instantiate
- instantiate store derivations from Nix expressions
Synopsis
nix-instantiate
[--parse
| --eval
[--strict
] [--json
] [--xml
] ]
[--read-write-mode
]
[--arg
name value]
[{--attr
| -A
} attrPath]
[--add-root
path]
[--expr
| -E
]
files…
nix-instantiate
--find-file
files…
Description
The command nix-instantiate
produces store derivations from (high-level) Nix expressions.
It evaluates the Nix expressions in each of files (which defaults to
./default.nix). Each top-level expression should evaluate to a
derivation, a list of derivations, or a set of derivations. The paths
of the resulting store derivations are printed on standard output.
If files is the character -
, then a Nix expression will be read from
standard input.
Options
-
--add-root
path
See the corresponding option innix-store
. -
--parse
Just parse the input files, and print their abstract syntax trees on standard output in ATerm format. -
--eval
Just parse and evaluate the input files, and print the resulting values on standard output. No instantiation of store derivations takes place. -
--find-file
Look up the given files in Nix’s search path (as specified by theNIX_PATH
environment variable). If found, print the corresponding absolute paths on standard output. For instance, ifNIX_PATH
isnixpkgs=/home/alice/nixpkgs
, thennix-instantiate --find-file nixpkgs/default.nix
will print/home/alice/nixpkgs/default.nix
. -
--strict
When used with--eval
, recursively evaluate list elements and attributes. Normally, such sub-expressions are left unevaluated (since the Nix language is lazy).Warning
This option can cause non-termination, because lazy data structures can be infinitely large.
-
--json
When used with--eval
, print the resulting value as an JSON representation of the abstract syntax tree rather than as an ATerm. -
--xml
When used with--eval
, print the resulting value as an XML representation of the abstract syntax tree rather than as an ATerm. The schema is the same as that used by thetoXML
built-in. -
--read-write-mode
When used with--eval
, perform evaluation in read/write mode so nix language features that require it will still work (at the cost of needing to do instantiation of every evaluated derivation). If this option is not enabled, there may be uninstantiated store paths in the final output.
Examples
Instantiate store derivations from a Nix expression, and build them using nix-store
:
$ nix-instantiate test.nix (instantiate)
/nix/store/cigxbmvy6dzix98dxxh9b6shg7ar5bvs-perl-BerkeleyDB-0.26.drv
$ nix-store -r $(nix-instantiate test.nix) (build)
...
/nix/store/qhqk4n8ci095g3sdp93x7rgwyh9rdvgk-perl-BerkeleyDB-0.26 (output path)
$ ls -l /nix/store/qhqk4n8ci095g3sdp93x7rgwyh9rdvgk-perl-BerkeleyDB-0.26
dr-xr-xr-x 2 eelco users 4096 1970-01-01 01:00 lib
...
You can also give a Nix expression on the command line:
$ nix-instantiate -E 'with import <nixpkgs> { }; hello'
/nix/store/j8s4zyv75a724q38cb0r87rlczaiag4y-hello-2.8.drv
This is equivalent to:
$ nix-instantiate '<nixpkgs>' -A hello
Parsing and evaluating Nix expressions:
$ nix-instantiate --parse -E '1 + 2'
1 + 2
$ nix-instantiate --eval -E '1 + 2'
3
$ nix-instantiate --eval --xml -E '1 + 2'
<?xml version='1.0' encoding='utf-8'?>
<expr>
<int value="3" />
</expr>
The difference between non-strict and strict evaluation:
$ nix-instantiate --eval --xml -E 'rec { x = "foo"; y = x; }'
...
<attr name="x">
<string value="foo" />
</attr>
<attr name="y">
<unevaluated />
</attr>
...
Note that y
is left unevaluated (the XML representation doesn’t
attempt to show non-normal forms).
$ nix-instantiate --eval --xml --strict -E 'rec { x = "foo"; y = x; }'
...
<attr name="x">
<string value="foo" />
</attr>
<attr name="y">
<string value="foo" />
</attr>
...
Name
nix-prefetch-url
- copy a file from a URL into the store and print its hash
Synopsis
nix-prefetch-url
url [hash]
[--type
hashAlgo]
[--print-path
]
[--unpack
]
[--name
name]
Description
The command nix-prefetch-url
downloads the file referenced by the URL
url, prints its cryptographic hash, and copies it into the Nix store.
The file name in the store is hash-baseName
, where baseName is
everything following the final slash in url.
This command is just a convenience for Nix expression writers. Often a
Nix expression fetches some source distribution from the network using
the fetchurl
expression contained in Nixpkgs. However, fetchurl
requires a cryptographic hash. If you don't know the hash, you would
have to download the file first, and then fetchurl
would download it
again when you build your Nix expression. Since fetchurl
uses the same
name for the downloaded file as nix-prefetch-url
, the redundant
download can be avoided.
If hash is specified, then a download is not performed if the Nix store already contains a file with the same hash and base name. Otherwise, the file is downloaded, and an error is signaled if the actual hash of the file does not match the specified hash.
This command prints the hash on standard output. Additionally, if the
option --print-path
is used, the path of the downloaded file in the
Nix store is also printed.
Options
-
--type
hashAlgo
Use the specified cryptographic hash algorithm, which can be one ofmd5
,sha1
,sha256
, andsha512
. -
--print-path
Print the store path of the downloaded file on standard output. -
--unpack
Unpack the archive (which must be a tarball or zip file) and add the result to the Nix store. The resulting hash can be used with functions such as Nixpkgs’sfetchzip
orfetchFromGitHub
. -
--executable
Set the executable bit on the downloaded file. -
--name
name
Override the name of the file in the Nix store. By default, this ishash-basename
, where basename is the last component of url. Overriding the name is necessary when basename contains characters that are not allowed in Nix store paths.
Examples
$ nix-prefetch-url ftp://ftp.gnu.org/pub/gnu/hello/hello-2.10.tar.gz
0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i
$ nix-prefetch-url --print-path mirror://gnu/hello/hello-2.10.tar.gz
0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i
/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
$ nix-prefetch-url --unpack --print-path https://github.com/NixOS/patchelf/archive/0.8.tar.gz
079agjlv0hrv7fxnx9ngipx14gyncbkllxrp9cccnh3a50fxcmy7
/nix/store/19zrmhm3m40xxaw81c8cqm6aljgrnwj2-0.8.tar.gz
Experimental Commands
This section lists experimental commands.
Warning
These commands may be removed in the future, or their syntax may change in incompatible ways.
Warning
This program is experimental and its interface is subject to change.
Name
nix
- a tool for reproducible and declarative configuration management
Synopsis
nix
[option...] subcommand
where subcommand is one of the following:
Main commands:
nix build
- build a derivation or fetch a store pathnix develop
- run a bash shell that provides the build environment of a derivationnix flake
- manage Nix flakesnix help
- show help aboutnix
or a particular subcommandnix profile
- manage Nix profilesnix repl
- start an interactive environment for evaluating Nix expressionsnix run
- run a Nix applicationnix search
- search for packagesnix shell
- run a shell in which the specified packages are available
Infrequently used commands:
nix bundle
- bundle an application so that it works outside of the Nix storenix copy
- copy paths between Nix storesnix edit
- open the Nix expression of a Nix package in $EDITORnix eval
- evaluate a Nix expressionnix fmt
- reformat your code in the standard stylenix log
- show the build log of the specified packages or paths, if availablenix path-info
- query information about store pathsnix registry
- manage the flake registrynix why-depends
- show why a package has another package in its closure
Utility/scripting commands:
nix daemon
- daemon to perform store operations on behalf of non-root clientsnix describe-stores
- show registered store types and their available optionsnix hash
- compute and convert cryptographic hashesnix key
- generate and convert Nix signing keysnix nar
- create or inspect NAR filesnix print-dev-env
- print shell code that can be sourced by bash to reproduce the build environment of a derivationnix realisation
- manipulate a Nix realisationnix show-config
- show the Nix configurationnix show-derivation
- show the contents of a store derivationnix store
- manipulate a Nix store
Commands for upgrading or troubleshooting your Nix installation:
nix doctor
- check your system for potential problems and print a PASS or FAIL for each checknix upgrade-nix
- upgrade Nix to the stable version declared in Nixpkgs
Examples
-
Create a new flake:
# nix flake new hello # cd hello
-
Build the flake in the current directory:
# nix build # ./result/bin/hello Hello, world!
-
Run the flake in the current directory:
# nix run Hello, world!
-
Start a development shell for hacking on this flake:
# nix develop # unpackPhase # cd hello-* # configurePhase # buildPhase # ./hello Hello, world! # installPhase # ../outputs/out/bin/hello Hello, world!
Description
Nix is a tool for building software, configurations and other artifacts in a reproducible and declarative way. For more information, see the Nix homepage or the Nix manual.
Installables
Many nix
subcommands operate on one or more installables. These are
command line arguments that represent something that can be built in
the Nix store. Here are the recognised types of installables:
-
Flake output attributes:
nixpkgs#hello
These have the form flakeref[
#
attrpath], where flakeref is a flake reference and attrpath is an optional attribute path. For more information on flakes, see thenix flake
manual page. Flake references are most commonly a flake identifier in the flake registry (e.g.nixpkgs
), or a raw path (e.g./path/to/my-flake
or.
or../foo
), or a full URL (e.g.github:nixos/nixpkgs
orpath:.
)When the flake reference is a raw path (a path without any URL scheme), it is interpreted as a
path:
orgit+file:
url in the following way:-
If the path is within a Git repository, then the url will be of the form
git+file://[GIT_REPO_ROOT]?dir=[RELATIVE_FLAKE_DIR_PATH]
whereGIT_REPO_ROOT
is the path to the root of the git repository, andRELATIVE_FLAKE_DIR_PATH
is the path (relative to the directory root) of the closest parent of the given path that contains aflake.nix
within the git repository. If no such directory exists, then Nix will error-out.Note that the search will only include files indexed by git. In particular, files which are matched by
.gitignore
or have never beengit add
-ed will not be available in the flake. If this is undesirable, specifypath:<directory>
explicitly;For example, if
/foo/bar
is a git repository with the following structure:. └── baz ├── blah │ └── file.txt └── flake.nix
Then
/foo/bar/baz/blah
will resolve togit+file:///foo/bar?dir=baz
-
If the supplied path is not a git repository, then the url will have the form
path:FLAKE_DIR_PATH
whereFLAKE_DIR_PATH
is the closest parent of the supplied path that contains aflake.nix
file (within the same file-system). If no such directory exists, then Nix will error-out.For example, if
/foo/bar/flake.nix
exists, then/foo/bar/baz/
will resolve topath:/foo/bar
If attrpath is omitted, Nix tries some default values; for most subcommands, the default is
packages.
system.default
(e.g.packages.x86_64-linux.default
), but some subcommands have other defaults. If attrpath is specified, attrpath is interpreted as relative to one or more prefixes; for most subcommands, these arepackages.
system,legacyPackages.*system*
and the empty prefix. Thus, onx86_64-linux
nix build nixpkgs#hello
will try to build the attributespackages.x86_64-linux.hello
,legacyPackages.x86_64-linux.hello
andhello
. -
-
Store paths:
/nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10
These are paths inside the Nix store, or symlinks that resolve to a path in the Nix store.
-
Store derivations:
/nix/store/p7gp6lxdg32h4ka1q398wd9r2zkbbz2v-hello-2.10.drv
By default, if you pass a store derivation path to a
nix
subcommand, the command will operate on the output paths of the derivation.For example,
nix path-info
prints information about the output paths:# nix path-info --json /nix/store/p7gp6lxdg32h4ka1q398wd9r2zkbbz2v-hello-2.10.drv [{"path":"/nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10",…}]
If you want to operate on the store derivation itself, pass the
--derivation
flag. -
Nix attributes:
--file /path/to/nixpkgs hello
When the
-f
/--file
path option is given, installables are interpreted as attribute paths referencing a value returned by evaluating the Nix file path. -
Nix expressions:
--expr '(import <nixpkgs> {}).hello.overrideDerivation (prev: { name = "my-hello"; })'
.When the
--expr
option is given, all installables are interpreted as Nix expressions. You may need to specify--impure
if the expression references impure inputs (such as<nixpkgs>
).
For most commands, if no installable is specified, the default is .
,
i.e. Nix will operate on the default flake output attribute of the
flake in the current directory.
Derivation output selection
Derivations can have multiple outputs, each corresponding to a
different store path. For instance, a package can have a bin
output
that contains programs, and a dev
output that provides development
artifacts like C/C++ header files. The outputs on which nix
commands
operate are determined as follows:
-
You can explicitly specify the desired outputs using the syntax installable
^
output1,
...,
outputN. For example, you can obtain thedev
andstatic
outputs of theglibc
package:# nix build 'nixpkgs#glibc^dev,static' # ls ./result-dev/include/ ./result-static/lib/ …
and likewise, using a store path to a "drv" file to specify the derivation:
# nix build '/nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^dev,static' …
-
You can also specify that all outputs should be used using the syntax installable
^*
. For example, the following shows the size of all outputs of theglibc
package in the binary cache:# nix path-info -S --eval-store auto --store https://cache.nixos.org 'nixpkgs#glibc^*' /nix/store/g02b1lpbddhymmcjb923kf0l7s9nww58-glibc-2.33-123 33208200 /nix/store/851dp95qqiisjifi639r0zzg5l465ny4-glibc-2.33-123-bin 36142896 /nix/store/kdgs3q6r7xdff1p7a9hnjr43xw2404z7-glibc-2.33-123-debug 155787312 /nix/store/n4xa8h6pbmqmwnq0mmsz08l38abb06zc-glibc-2.33-123-static 42488328 /nix/store/q6580lr01jpcsqs4r5arlh4ki2c1m9rv-glibc-2.33-123-dev 44200560
and likewise, using a store path to a "drv" file to specify the derivation:
# nix path-info -S '/nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^*' …
-
If you didn't specify the desired outputs, but the derivation has an attribute
meta.outputsToInstall
, Nix will use those outputs. For example, since the packagenixpkgs#libxml2
has this attribute:# nix eval 'nixpkgs#libxml2.meta.outputsToInstall' [ "bin" "man" ]
a command like
nix shell nixpkgs#libxml2
will provide only those two outputs by default.Note that a store derivation (given by its
.drv
file store path) doesn't have any attributes likemeta
, and thus this case doesn't apply to it. -
Otherwise, Nix will use all outputs of the derivation.
Nix stores
Most nix
subcommands operate on a Nix store.
TODO: list store types, options
Options
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix build
- build a derivation or fetch a store path
Synopsis
nix build
[option...] installables...
Examples
-
Build the default package from the flake in the current directory:
# nix build
-
Build and run GNU Hello from the
nixpkgs
flake:# nix build nixpkgs#hello # ./result/bin/hello Hello, world!
-
Build GNU Hello and Cowsay, leaving two result symlinks:
# nix build nixpkgs#hello nixpkgs#cowsay # ls -l result* lrwxrwxrwx 1 … result -> /nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10 lrwxrwxrwx 1 … result-1 -> /nix/store/rkfrm0z6x6jmi7d3gsmma4j53h15mg33-cowsay-3.03+dfsg2
-
Build GNU Hello and print the resulting store path.
# nix build nixpkgs#hello --print-out-paths /nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10
-
Build a specific output:
# nix build nixpkgs#glibc.dev # ls -ld ./result-dev lrwxrwxrwx 1 … ./result-dev -> /nix/store/dkm3gwl0xrx0wrw6zi5x3px3lpgjhlw4-glibc-2.32-dev
-
Build attribute
build.x86_64-linux
from (non-flake) Nix expressionrelease.nix
:# nix build -f release.nix build.x86_64-linux
-
Build a NixOS system configuration from a flake, and make a profile point to the result:
# nix build --profile /nix/var/nix/profiles/system \ ~/my-configurations#nixosConfigurations.machine.config.system.build.toplevel
(This is essentially what
nixos-rebuild
does.) -
Build an expression specified on the command line:
# nix build --impure --expr \ 'with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ hello ]; } "hello > $out"' # cat ./result Hello, world!
Note that
--impure
is needed because we're using<nixpkgs>
, which relies on the$NIX_PATH
environment variable. -
Fetch a store path from the configured substituters, if it doesn't already exist:
# nix build /nix/store/rkfrm0z6x6jmi7d3gsmma4j53h15mg33-cowsay-3.03+dfsg2
Description
nix build
builds the specified installables. Installables that
resolve to derivations are built (or substituted if possible). Store
path installables are substituted.
Unless --no-link
is specified, after a successful build, it creates
symlinks to the store paths of the installables. These symlinks have
the prefix ./result
by default; this can be overridden using the
--out-link
option. Each symlink has a suffix -<N>-<outname>
, where
N is the index of the installable (with the left-most installable
having index 0), and outname is the symbolic derivation output name
(e.g. bin
, dev
or lib
). -<N>
is omitted if N = 0, and
-<outname>
is omitted if outname = out
(denoting the default
output).
Options
-
--dry-run
Show what this command would do without doing it.
-
--json
Produce output in JSON format, suitable for consumption by another program.
-
--no-link
Do not create symlinks to the build results.
-
--out-link
/-o
pathUse path as prefix for the symlinks to the build results. It defaults to
result
. -
--print-out-paths
Print the resulting output paths
-
--profile
pathThe profile to operate on.
-
--rebuild
Rebuild an already built package and compare the result to the existing store paths.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix bundle
- bundle an application so that it works outside of the Nix store
Synopsis
nix bundle
[option...] installable
Examples
-
Bundle Hello:
# nix bundle nixpkgs#hello # ./hello Hello, world!
-
Bundle a specific version of Nix:
# nix bundle github:NixOS/nix/e3ddffb27e5fc37a209cfd843c6f7f6a9460a8ec # ./nix --version nix (Nix) 2.4pre20201215_e3ddffb
-
Bundle a Hello using a specific bundler:
# nix bundle --bundler github:NixOS/bundlers#toDockerImage nixpkgs#hello # docker load < hello-2.10.tar.gz # docker run hello-2.10:latest hello Hello, world!
Description
nix bundle
, by default, packs the closure of the installable into a single
self-extracting executable. See the bundlers
homepage for more details.
Note
This command only works on Linux.
Flake output attributes
If no flake output attribute is given, nix bundle
tries the following
flake output attributes:
bundlers.<system>.default
If an attribute name is given, nix bundle
tries the following flake
output attributes:
bundlers.<system>.<name>
Bundlers
A bundler is specified by a flake output attribute named
bundlers.<system>.<name>
. It looks like this:
bundlers.x86_64-linux = rec {
identity = drv: drv;
blender_2_79 = drv: self.packages.x86_64-linux.blender_2_79;
default = identity;
};
A bundler must be a function that accepts an arbitrary value (typically a derivation or app definition) and returns a derivation.
Options
-
--bundler
flake-urlUse a custom bundler instead of the default (
github:NixOS/bundlers
). -
--out-link
/-o
pathOverride the name of the symlink to the build result. It defaults to the base name of the app.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix copy
- copy paths between Nix stores
Synopsis
nix copy
[option...] installables...
Examples
-
Copy Firefox from the local store to a binary cache in
/tmp/cache
:# nix copy --to file:///tmp/cache $(type -p firefox)
Note the
file://
- without this, the destination is a chroot store, not a binary cache. -
Copy the entire current NixOS system closure to another machine via SSH:
# nix copy -s --to ssh://server /run/current-system
The
-s
flag causes the remote machine to try to substitute missing store paths, which may be faster if the link between the local and remote machines is slower than the link between the remote machine and its substituters (e.g.https://cache.nixos.org
). -
Copy a closure from another machine via SSH:
# nix copy --from ssh://server /nix/store/a6cnl93nk1wxnq84brbbwr6hxw9gp2w9-blender-2.79-rc2
-
Copy Hello to a binary cache in an Amazon S3 bucket:
# nix copy --to s3://my-bucket?region=eu-west-1 nixpkgs#hello
or to an S3-compatible storage system:
# nix copy --to s3://my-bucket?region=eu-west-1&endpoint=example.com nixpkgs#hello
Note that this only works if Nix is built with AWS support.
-
Copy a closure from
/nix/store
to the chroot store/tmp/nix/nix/store
:# nix copy --to /tmp/nix nixpkgs#hello --no-check-sigs
Description
nix copy
copies store path closures between two Nix stores. The
source store is specified using --from
and the destination using
--to
. If one of these is omitted, it defaults to the local store.
Options
-
--from
store-uriURL of the source Nix store.
-
--no-check-sigs
Do not require that paths are signed by trusted keys.
-
--substitute-on-destination
/-s
Whether to try substitutes on the destination store (only supported by SSH stores).
-
--to
store-uriURL of the destination Nix store.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--all
Apply the operation to every store path.
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
. -
--no-recursive
Apply operation to specified paths only.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix daemon
- daemon to perform store operations on behalf of non-root clients
Synopsis
nix daemon
[option...]
Example
-
Run the daemon in the foreground:
# nix daemon
Description
This command runs the Nix daemon, which is a required component in
multi-user Nix installations. It runs build tasks and other
operations on the Nix store on behalf of non-root users. Usually you
don't run the daemon directly; instead it's managed by a service
management framework such as systemd
.
Note that this daemon does not fork into the background.
Warning
This program is experimental and its interface is subject to change.
Name
nix describe-stores
- show registered store types and their available options
Synopsis
nix describe-stores
[option...]
Options
-
--json
Produce output in JSON format, suitable for consumption by another program.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix develop
- run a bash shell that provides the build environment of a derivation
Synopsis
nix develop
[option...] installable
Examples
-
Start a shell with the build environment of the default package of the flake in the current directory:
# nix develop
Typical commands to run inside this shell are:
# configurePhase # buildPhase # installPhase
Alternatively, you can run whatever build tools your project uses directly, e.g. for a typical Unix project:
# ./configure --prefix=$out # make # make install
-
Run a particular build phase directly:
# nix develop --unpack # nix develop --configure # nix develop --build # nix develop --check # nix develop --install # nix develop --installcheck
-
Start a shell with the build environment of GNU Hello:
# nix develop nixpkgs#hello
-
Record a build environment in a profile:
# nix develop --profile /tmp/my-build-env nixpkgs#hello
-
Use a build environment previously recorded in a profile:
# nix develop /tmp/my-build-env
-
Replace all occurrences of the store path corresponding to
glibc.dev
with a writable directory:# nix develop --redirect nixpkgs#glibc.dev ~/my-glibc/outputs/dev
Note that this is useful if you're running a
nix develop
shell fornixpkgs#glibc
in~/my-glibc
and want to compile another package against it. -
Run a series of script commands:
# nix develop --command bash -c "mkdir build && cmake .. && make"
Description
nix develop
starts a bash
shell that provides an interactive build
environment nearly identical to what Nix would use to build
installable. Inside this shell, environment variables and shell
functions are set up so that you can interactively and incrementally
build your package.
Nix determines the build environment by building a modified version of
the derivation installable that just records the environment
initialised by stdenv
and exits. This build environment can be
recorded into a profile using --profile
.
The prompt used by the bash
shell can be customised by setting the
bash-prompt
, bash-prompt-prefix
, and bash-prompt-suffix
settings in
nix.conf
or in the flake's nixConfig
attribute.
Flake output attributes
If no flake output attribute is given, nix develop
tries the following
flake output attributes:
-
devShells.<system>.default
-
packages.<system>.default
If a flake output name is given, nix develop
tries the following flake
output attributes:
-
devShells.<system>.<name>
-
packages.<system>.<name>
-
legacyPackages.<system>.<name>
Options
-
--build
Run the
build
phase. -
--check
Run the
check
phase. -
--command
/-c
command argsInstead of starting an interactive shell, start the specified command and arguments.
-
--configure
Run the
configure
phase. -
--ignore-environment
/-i
Clear the entire environment (except those specified with
--keep
). -
--install
Run the
install
phase. -
--installcheck
Run the
installcheck
phase. -
--keep
/-k
nameKeep the environment variable name.
-
--phase
phase-nameThe stdenv phase to run (e.g.
build
orconfigure
). -
--profile
pathThe profile to operate on.
-
--redirect
installable outputs-dirRedirect a store path to a mutable location.
-
--unpack
Run the
unpack
phase. -
--unset
/-u
nameUnset the environment variable name.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix doctor
- check your system for potential problems and print a PASS or FAIL for each check
Synopsis
nix doctor
[option...]
Warning
This program is experimental and its interface is subject to change.
Name
nix edit
- open the Nix expression of a Nix package in $EDITOR
Synopsis
nix edit
[option...] installable
Examples
-
Open the Nix expression of the GNU Hello package:
# nix edit nixpkgs#hello
-
Get the filename and line number used by
nix edit
:# nix eval --raw nixpkgs#hello.meta.position /nix/store/fvafw0gvwayzdan642wrv84pzm5bgpmy-source/pkgs/applications/misc/hello/default.nix:15
Description
This command opens the Nix expression of a derivation in an
editor. The filename and line number of the derivation are taken from
its meta.position
attribute. Nixpkgs' stdenv.mkDerivation
sets
this attribute to the location of the definition of the
meta.description
, version
or name
derivation attributes.
The editor to invoke is specified by the EDITOR
environment
variable. It defaults to cat
. If the editor is emacs
, nano
,
vim
or kak
, it is passed the line number of the derivation using
the argument +<lineno>
.
Options
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix eval
- evaluate a Nix expression
Synopsis
nix eval
[option...] installable
Examples
-
Evaluate a Nix expression given on the command line:
# nix eval --expr '1 + 2'
-
Evaluate a Nix expression to JSON:
# nix eval --json --expr '{ x = 1; }' {"x":1}
-
Evaluate a Nix expression from a file:
# nix eval -f ./my-nixpkgs hello.name
-
Get the current version of the
nixpkgs
flake:# nix eval --raw nixpkgs#lib.version
-
Print the store path of the Hello package:
# nix eval --raw nixpkgs#hello
-
Get a list of checks in the
nix
flake:# nix eval nix#checks.x86_64-linux --apply builtins.attrNames
-
Generate a directory with the specified contents:
# nix eval --write-to ./out --expr '{ foo = "bar"; subdir.bla = "123"; }' # cat ./out/foo bar # cat ./out/subdir/bla 123
Description
This command evaluates the Nix expression installable and prints the result on standard output.
Output format
nix eval
can produce output in several formats:
-
By default, the evaluation result is printed as a Nix expression.
-
With
--json
, the evaluation result is printed in JSON format. Note that this fails if the result contains values that are not representable as JSON, such as functions. -
With
--raw
, the evaluation result must be a string, which is printed verbatim, without any quoting. -
With
--write-to
path, the evaluation result must be a string or a nested attribute set whose leaf values are strings. These strings are written to files named path/attrpath. path must not already exist.
Options
-
--apply
exprApply the function expr to each argument.
-
--json
Produce output in JSON format, suitable for consumption by another program.
-
--raw
Print strings without quotes or escaping.
-
--read-only
Do not instantiate each evaluated derivation. This improves performance, but can cause errors when accessing store paths of derivations during evaluation.
-
--write-to
pathWrite a string or attrset of strings to path.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake
- manage Nix flakes
Synopsis
nix flake
[option...] subcommand
where subcommand is one of the following:
nix flake archive
- copy a flake and all its inputs to a storenix flake check
- check whether the flake evaluates and run its testsnix flake clone
- clone flake repositorynix flake info
- show flake metadatanix flake init
- create a flake in the current directory from a templatenix flake lock
- create missing lock file entriesnix flake metadata
- show flake metadatanix flake new
- create a flake in the specified directory from a templatenix flake prefetch
- download the source tree denoted by a flake reference into the Nix storenix flake show
- show the outputs provided by a flakenix flake update
- update flake lock file
Description
nix flake
provides subcommands for creating, modifying and querying
Nix flakes. Flakes are the unit for packaging Nix code in a
reproducible and discoverable way. They can have dependencies on other
flakes, making it possible to have multi-repository Nix projects.
A flake is a filesystem tree (typically fetched from a Git repository
or a tarball) that contains a file named flake.nix
in the root
directory. flake.nix
specifies some metadata about the flake such as
dependencies (called inputs), as well as its outputs (the Nix
values such as packages or NixOS modules provided by the flake).
Flake references
Flake references (flakerefs) are a way to specify the location of a flake. These have two different forms:
Attribute set representation
Example:
{
type = "github";
owner = "NixOS";
repo = "nixpkgs";
}
The only required attribute is type
. The supported types are
listed below.
URL-like syntax
Example:
github:NixOS/nixpkgs
These are used on the command line as a more convenient alternative to the attribute set representation. For instance, in the command
# nix build github:NixOS/nixpkgs#hello
github:NixOS/nixpkgs
is a flake reference (while hello
is an
output attribute). They are also allowed in the inputs
attribute
of a flake, e.g.
inputs.nixpkgs.url = github:NixOS/nixpkgs;
is equivalent to
inputs.nixpkgs = {
type = "github";
owner = "NixOS";
repo = "nixpkgs";
};
Examples
Here are some examples of flake references in their URL-like representation:
.
: The flake in the current directory./home/alice/src/patchelf
: A flake in some other directory.nixpkgs
: Thenixpkgs
entry in the flake registry.nixpkgs/a3a3dda3bacf61e8a39258a0ed9c924eeca8e293
: Thenixpkgs
entry in the flake registry, with its Git revision overridden to a specific value.github:NixOS/nixpkgs
: Themaster
branch of theNixOS/nixpkgs
repository on GitHub.github:NixOS/nixpkgs/nixos-20.09
: Thenixos-20.09
branch of thenixpkgs
repository.github:NixOS/nixpkgs/a3a3dda3bacf61e8a39258a0ed9c924eeca8e293
: A specific revision of thenixpkgs
repository.github:edolstra/nix-warez?dir=blender
: A flake in a subdirectory of a GitHub repository.git+https://github.com/NixOS/patchelf
: A Git repository.git+https://github.com/NixOS/patchelf?ref=master
: A specific branch of a Git repository.git+https://github.com/NixOS/patchelf?ref=master&rev=f34751b88bd07d7f44f5cd3200fb4122bf916c7e
: A specific branch and revision of a Git repository.https://github.com/NixOS/patchelf/archive/master.tar.gz
: A tarball flake.
Flake reference attributes
The following generic flake reference attributes are supported:
-
dir
: The subdirectory of the flake in whichflake.nix
is located. This parameter enables having multiple flakes in a repository or tarball. The default is the root directory of the flake. -
narHash
: The hash of the NAR serialisation (in SRI format) of the contents of the flake. This is useful for flake types such as tarballs that lack a unique content identifier such as a Git commit hash.
In addition, the following attributes are common to several flake reference types:
-
rev
: A Git or Mercurial commit hash. -
ref
: A Git or Mercurial branch or tag name.
Finally, some attribute are typically not specified by the user, but can occur in locked flake references and are available to Nix code:
-
revCount
: The number of ancestors of the commitrev
. -
lastModified
: The timestamp (in seconds since the Unix epoch) of the last modification of this version of the flake. For Git/Mercurial flakes, this is the commit time of commit rev, while for tarball flakes, it's the most recent timestamp of any file inside the tarball.
Types
Currently the type
attribute can be one of the following:
-
path
: arbitrary local directories, or local Git trees. The required attributepath
specifies the path of the flake. The URL form is[path:]<path>(\?<params)?
where path is an absolute path.
path must be a directory in the file system containing a file named
flake.nix
.path generally must be an absolute path. However, on the command line, it can be a relative path (e.g.
.
or./foo
) which is interpreted as relative to the current directory. In this case, it must start with.
to avoid ambiguity with registry lookups (e.g.nixpkgs
is a registry lookup;./nixpkgs
is a relative path). -
git
: Git repositories. The location of the repository is specified by the attributeurl
.They have the URL form
git(+http|+https|+ssh|+git|+file|):(//<server>)?<path>(\?<params>)?
The
ref
attribute defaults to resolving theHEAD
reference.The
rev
attribute must denote a commit that exists in the branch or tag specified by theref
attribute, since Nix doesn't do a full clone of the remote repository by default (and the Git protocol doesn't allow fetching arev
without a knownref
). The default is the commit currently pointed to byref
.When
git+file
is used without specifyingref
orrev
, files are fetched directly from the localpath
as long as they have been added to the Git repository. If there are uncommitted changes, the reference is treated as dirty and a warning is printed.For example, the following are valid Git flake references:
git+https://example.org/my/repo
git+https://example.org/my/repo?dir=flake1
git+ssh://git@github.com/NixOS/nix?ref=v1.2.3
git://github.com/edolstra/dwarffs?ref=unstable&rev=e486d8d40e626a20e06d792db8cc5ac5aba9a5b4
git+file:///home/my-user/some-repo/some-repo
-
mercurial
: Mercurial repositories. The URL form is similar to thegit
type, except that the URL schema must be one ofhg+http
,hg+https
,hg+ssh
orhg+file
. -
tarball
: Tarballs. The location of the tarball is specified by the attributeurl
.In URL form, the schema must be
tarball+http://
,tarball+https://
ortarball+file://
. If the extension corresponds to a known archive format (.zip
,.tar
,.tgz
,.tar.gz
,.tar.xz
,.tar.bz2
or.tar.zst
), then thetarball+
can be dropped. -
file
: Plain files or directory tarballs, either over http(s) or from the local disk.In URL form, the schema must be
file+http://
,file+https://
orfile+file://
. If the extension doesn’t correspond to a known archive format (as defined by thetarball
fetcher), then thefile+
prefix can be dropped. -
github
: A more efficient way to fetch repositories from GitHub. The following attributes are required:-
owner
: The owner of the repository. -
repo
: The name of the repository.
These are downloaded as tarball archives, rather than through Git. This is often much faster and uses less disk space since it doesn't require fetching the entire history of the repository. On the other hand, it doesn't allow incremental fetching (but full downloads are often faster than incremental fetches!).
The URL syntax for
github
flakes is:github:<owner>/<repo>(/<rev-or-ref>)?(\?<params>)?
<rev-or-ref>
specifies the name of a branch or tag (ref
), or a commit hash (rev
). Note that unlike Git, GitHub allows fetching by commit hash without specifying a branch or tag.Some examples:
github:edolstra/dwarffs
github:edolstra/dwarffs/unstable
github:edolstra/dwarffs/d3f2baba8f425779026c6ec04021b2e927f61e31
-
-
sourcehut
: Similar togithub
, is a more efficient way to fetch SourceHut repositories. The following attributes are required:-
owner
: The owner of the repository (including leading~
). -
repo
: The name of the repository.
Like
github
, these are downloaded as tarball archives.The URL syntax for
sourcehut
flakes is:sourcehut:<owner>/<repo>(/<rev-or-ref>)?(\?<params>)?
<rev-or-ref>
works the same asgithub
. Either a branch or tag name (ref
), or a commit hash (rev
) can be specified.Since SourceHut allows for self-hosting, you can specify
host
as a parameter, to point to any instances other thangit.sr.ht
.Currently,
ref
name resolution only works for Git repositories. You can refer to Mercurial repositories by simply changinghost
tohg.sr.ht
(or any other Mercurial instance). With the caveat that you must explicitly specify a commit hash (rev
).Some examples:
sourcehut:~misterio/nix-colors
sourcehut:~misterio/nix-colors/main
sourcehut:~misterio/nix-colors?host=git.example.org
sourcehut:~misterio/nix-colors/182b4b8709b8ffe4e9774a4c5d6877bf6bb9a21c
sourcehut:~misterio/nix-colors/21c1a380a6915d890d408e9f22203436a35bb2de?host=hg.sr.ht
-
-
indirect
: Indirections through the flake registry. These have the form[flake:]<flake-id>(/<rev-or-ref>(/rev)?)?
These perform a lookup of
<flake-id>
in the flake registry. For example,nixpkgs
andnixpkgs/release-20.09
are indirect flake references. The specifiedrev
and/orref
are merged with the entry in the registry; see nix registry for details.
Flake format
As an example, here is a simple flake.nix
that depends on the
Nixpkgs flake and provides a single package (i.e. an installable
derivation):
{
description = "A flake for building Hello World";
inputs.nixpkgs.url = github:NixOS/nixpkgs/nixos-20.03;
outputs = { self, nixpkgs }: {
packages.x86_64-linux.default =
# Notice the reference to nixpkgs here.
with import nixpkgs { system = "x86_64-linux"; };
stdenv.mkDerivation {
name = "hello";
src = self;
buildPhase = "gcc -o hello ./hello.c";
installPhase = "mkdir -p $out/bin; install -t $out/bin hello";
};
};
}
The following attributes are supported in flake.nix
:
-
description
: A short, one-line description of the flake. -
inputs
: An attrset specifying the dependencies of the flake (described below). -
outputs
: A function that, given an attribute set containing the outputs of each of the input flakes keyed by their identifier, yields the Nix values provided by this flake. Thus, in the example above,inputs.nixpkgs
contains the result of the call to theoutputs
function of thenixpkgs
flake.In addition to the outputs of each input, each input in
inputs
also contains some metadata about the inputs. These are:-
outPath
: The path in the Nix store of the flake's source tree. -
rev
: The commit hash of the flake's repository, if applicable. -
revCount
: The number of ancestors of the revisionrev
. This is not available forgithub
repositories, since they're fetched as tarballs rather than as Git repositories. -
lastModifiedDate
: The commit time of the revisionrev
, in the format%Y%m%d%H%M%S
(e.g.20181231100934
). UnlikerevCount
, this is available for both Git and GitHub repositories, so it's useful for generating (hopefully) monotonically increasing version strings. -
lastModified
: The commit time of the revisionrev
as an integer denoting the number of seconds since 1970. -
narHash
: The SHA-256 (in SRI format) of the NAR serialization of the flake's source tree.
The value returned by the
outputs
function must be an attribute set. The attributes can have arbitrary values; however, variousnix
subcommands require specific attributes to have a specific value (e.g.packages.x86_64-linux
must be an attribute set of derivations built for thex86_64-linux
platform). -
-
nixConfig
: a set ofnix.conf
options to be set when evaluating any part of a flake. In the interests of security, only a small set of whitelisted options (currentlybash-prompt
,bash-prompt-prefix
,bash-prompt-suffix
, andflake-registry
) are allowed to be set without confirmation so long asaccept-flake-config
is not set in the global configuration.
Flake inputs
The attribute inputs
specifies the dependencies of a flake, as an
attrset mapping input names to flake references. For example, the
following specifies a dependency on the nixpkgs
and import-cargo
repositories:
# A GitHub repository.
inputs.import-cargo = {
type = "github";
owner = "edolstra";
repo = "import-cargo";
};
# An indirection through the flake registry.
inputs.nixpkgs = {
type = "indirect";
id = "nixpkgs";
};
Alternatively, you can use the URL-like syntax:
inputs.import-cargo.url = github:edolstra/import-cargo;
inputs.nixpkgs.url = "nixpkgs";
Each input is fetched, evaluated and passed to the outputs
function
as a set of attributes with the same name as the corresponding
input. The special input named self
refers to the outputs and source
tree of this flake. Thus, a typical outputs
function looks like
this:
outputs = { self, nixpkgs, import-cargo }: {
... outputs ...
};
It is also possible to omit an input entirely and only list it as
expected function argument to outputs
. Thus,
outputs = { self, nixpkgs }: ...;
without an inputs.nixpkgs
attribute is equivalent to
inputs.nixpkgs = {
type = "indirect";
id = "nixpkgs";
};
Repositories that don't contain a flake.nix
can also be used as
inputs, by setting the input's flake
attribute to false
:
inputs.grcov = {
type = "github";
owner = "mozilla";
repo = "grcov";
flake = false;
};
outputs = { self, nixpkgs, grcov }: {
packages.x86_64-linux.grcov = stdenv.mkDerivation {
src = grcov;
...
};
};
Transitive inputs can be overridden from a flake.nix
file. For
example, the following overrides the nixpkgs
input of the nixops
input:
inputs.nixops.inputs.nixpkgs = {
type = "github";
owner = "my-org";
repo = "nixpkgs";
};
It is also possible to "inherit" an input from another input. This is
useful to minimize flake dependencies. For example, the following sets
the nixpkgs
input of the top-level flake to be equal to the
nixpkgs
input of the dwarffs
input of the top-level flake:
inputs.nixpkgs.follows = "dwarffs/nixpkgs";
The value of the follows
attribute is a /
-separated sequence of
input names denoting the path of inputs to be followed from the root
flake.
Overrides and follows
can be combined, e.g.
inputs.nixops.inputs.nixpkgs.follows = "dwarffs/nixpkgs";
sets the nixpkgs
input of nixops
to be the same as the nixpkgs
input of dwarffs
. It is worth noting, however, that it is generally
not useful to eliminate transitive nixpkgs
flake inputs in this
way. Most flakes provide their functionality through Nixpkgs overlays
or NixOS modules, which are composed into the top-level flake's
nixpkgs
input; so their own nixpkgs
input is usually irrelevant.
Lock files
Inputs specified in flake.nix
are typically "unlocked" in the sense
that they don't specify an exact revision. To ensure reproducibility,
Nix will automatically generate and use a lock file called
flake.lock
in the flake's directory. The lock file contains a graph
structure isomorphic to the graph of dependencies of the root
flake. Each node in the graph (except the root node) maps the
(usually) unlocked input specifications in flake.nix
to locked input
specifications. Each node also contains some metadata, such as the
dependencies (outgoing edges) of the node.
For example, if flake.nix
has the inputs in the example above, then
the resulting lock file might be:
{
"version": 7,
"root": "n1",
"nodes": {
"n1": {
"inputs": {
"nixpkgs": "n2",
"import-cargo": "n3",
"grcov": "n4"
}
},
"n2": {
"inputs": {},
"locked": {
"owner": "edolstra",
"repo": "nixpkgs",
"rev": "7f8d4b088e2df7fdb6b513bc2d6941f1d422a013",
"type": "github",
"lastModified": 1580555482,
"narHash": "sha256-OnpEWzNxF/AU4KlqBXM2s5PWvfI5/BS6xQrPvkF5tO8="
},
"original": {
"id": "nixpkgs",
"type": "indirect"
}
},
"n3": {
"inputs": {},
"locked": {
"owner": "edolstra",
"repo": "import-cargo",
"rev": "8abf7b3a8cbe1c8a885391f826357a74d382a422",
"type": "github",
"lastModified": 1567183309,
"narHash": "sha256-wIXWOpX9rRjK5NDsL6WzuuBJl2R0kUCnlpZUrASykSc="
},
"original": {
"owner": "edolstra",
"repo": "import-cargo",
"type": "github"
}
},
"n4": {
"inputs": {},
"locked": {
"owner": "mozilla",
"repo": "grcov",
"rev": "989a84bb29e95e392589c4e73c29189fd69a1d4e",
"type": "github",
"lastModified": 1580729070,
"narHash": "sha256-235uMxYlHxJ5y92EXZWAYEsEb6mm+b069GAd+BOIOxI="
},
"original": {
"owner": "mozilla",
"repo": "grcov",
"type": "github"
},
"flake": false
}
}
}
This graph has 4 nodes: the root flake, and its 3 dependencies. The
nodes have arbitrary labels (e.g. n1
). The label of the root node of
the graph is specified by the root
attribute. Nodes contain the
following fields:
-
inputs
: The dependencies of this node, as a mapping from input names (e.g.nixpkgs
) to node labels (e.g.n2
). -
original
: The original input specification fromflake.lock
, as a set ofbuiltins.fetchTree
arguments. -
locked
: The locked input specification, as a set ofbuiltins.fetchTree
arguments. Thus, in the example above, when we build this flake, the inputnixpkgs
is mapped to revision7f8d4b088e2df7fdb6b513bc2d6941f1d422a013
of theedolstra/nixpkgs
repository on GitHub.It also includes the attribute
narHash
, specifying the expected contents of the tree in the Nix store (as computed bynix hash-path
), and may include input-type-specific attributes such as thelastModified
orrevCount
. The main reason for these attributes is to allow flake inputs to be substituted from a binary cache:narHash
allows the store path to be computed, while the other attributes are necessary because they provide information not stored in the store path. -
flake
: A Boolean denoting whether this is a flake or non-flake dependency. Corresponds to theflake
attribute in theinputs
attribute inflake.nix
.
The original
and locked
attributes are omitted for the root
node. This is because we cannot record the commit hash or content hash
of the root flake, since modifying flake.lock
will invalidate these.
The graph representation of lock files allows circular dependencies between flakes. For example, here are two flakes that reference each other:
{
inputs.b = ... location of flake B ...;
# Tell the 'b' flake not to fetch 'a' again, to ensure its 'a' is
# *this* 'a'.
inputs.b.inputs.a.follows = "";
outputs = { self, b }: {
foo = 123 + b.bar;
xyzzy = 1000;
};
}
and
{
inputs.a = ... location of flake A ...;
inputs.a.inputs.b.follows = "";
outputs = { self, a }: {
bar = 456 + a.xyzzy;
};
}
Lock files transitively lock direct as well as indirect dependencies. That is, if a lock file exists and is up to date, Nix will not look at the lock files of dependencies. However, lock file generation itself does use the lock files of dependencies by default.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake archive
- copy a flake and all its inputs to a store
Synopsis
nix flake archive
[option...] flake-url
Examples
-
Copy the
dwarffs
flake and its dependencies to a binary cache:# nix flake archive --to file:///tmp/my-cache dwarffs
-
Fetch the
dwarffs
flake and its dependencies to the local Nix store:# nix flake archive dwarffs
-
Print the store paths of the flake sources of NixOps without fetching them:
# nix flake archive --json --dry-run nixops
Description
FIXME
Options
-
--dry-run
Show what this command would do without doing it.
-
--json
Produce output in JSON format, suitable for consumption by another program.
-
--to
store-uriURI of the destination Nix store
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake check
- check whether the flake evaluates and run its tests
Synopsis
nix flake check
[option...] flake-url
Examples
-
Evaluate the flake in the current directory, and build its checks:
# nix flake check
-
Verify that the
patchelf
flake evaluates, but don't build its checks:# nix flake check --no-build github:NixOS/patchelf
Description
This command verifies that the flake specified by flake reference
flake-url can be evaluated successfully (as detailed below), and
that the derivations specified by the flake's checks
output can be
built successfully.
If the keep-going
option is set to true
, Nix will keep evaluating as much
as it can and report the errors as it encounters them. Otherwise it will stop
at the first error.
Evaluation checks
The following flake output attributes must be derivations:
checks.
system.
namedefaultPackage.
systemdevShell.
systemdevShells.
system.
namenixosConfigurations.
name.config.system.build.toplevel
packages.
system.
name
The following flake output attributes must be app definitions:
apps.
system.
namedefaultApp.
system
The following flake output attributes must be template definitions:
defaultTemplate
templates.
name
The following flake output attributes must be Nixpkgs overlays:
overlay
overlays.
name
The following flake output attributes must be NixOS modules:
nixosModule
nixosModules.
name
The following flake output attributes must be bundlers:
bundlers.
namedefaultBundler
In addition, the hydraJobs
output is evaluated in the same way as
Hydra's hydra-eval-jobs
(i.e. as a arbitrarily deeply nested
attribute set of derivations). Similarly, the
legacyPackages
.system output is evaluated like nix-env -qa
.
Options
-
--no-build
Do not build checks.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake clone
- clone flake repository
Synopsis
nix flake clone
[option...] flake-url
Examples
-
Check out the source code of the
dwarffs
flake and build it:# nix flake clone dwarffs --dest dwarffs # cd dwarffs # nix build
Description
This command performs a Git or Mercurial clone of the repository containing the source code of the flake flake-url.
Options
-
--dest
/-f
pathClone the flake to path dest.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake info
- show flake metadata
Synopsis
nix flake info
[option...] flake-url
Examples
-
Show what
nixpkgs
resolves to:# nix flake metadata nixpkgs Resolved URL: github:edolstra/dwarffs Locked URL: github:edolstra/dwarffs/f691e2c991e75edb22836f1dbe632c40324215c5 Description: A filesystem that fetches DWARF debug info from the Internet on demand Path: /nix/store/769s05vjydmc2lcf6b02az28wsa9ixh1-source Revision: f691e2c991e75edb22836f1dbe632c40324215c5 Last modified: 2021-01-21 15:41:26 Inputs: ├───nix: github:NixOS/nix/6254b1f5d298ff73127d7b0f0da48f142bdc753c │ ├───lowdown-src: github:kristapsdz/lowdown/1705b4a26fbf065d9574dce47a94e8c7c79e052f │ └───nixpkgs: github:NixOS/nixpkgs/ad0d20345219790533ebe06571f82ed6b034db31 └───nixpkgs follows input 'nix/nixpkgs'
-
Show information about
dwarffs
in JSON format:# nix flake metadata dwarffs --json | jq . { "description": "A filesystem that fetches DWARF debug info from the Internet on demand", "lastModified": 1597153508, "locked": { "lastModified": 1597153508, "narHash": "sha256-VHg3MYVgQ12LeRSU2PSoDeKlSPD8PYYEFxxwkVVDRd0=", "owner": "edolstra", "repo": "dwarffs", "rev": "d181d714fd36eb06f4992a1997cd5601e26db8f5", "type": "github" }, "locks": { ... }, "original": { "id": "dwarffs", "type": "indirect" }, "originalUrl": "flake:dwarffs", "path": "/nix/store/hang3792qwdmm2n0d9nsrs5n6bsws6kv-source", "resolved": { "owner": "edolstra", "repo": "dwarffs", "type": "github" }, "resolvedUrl": "github:edolstra/dwarffs", "revision": "d181d714fd36eb06f4992a1997cd5601e26db8f5", "url": "github:edolstra/dwarffs/d181d714fd36eb06f4992a1997cd5601e26db8f5" }
Description
This command shows information about the flake specified by the flake reference flake-url. It resolves the flake reference using the flake registry, fetches it, and prints some meta data. This includes:
-
Resolved URL
: If flake-url is a flake identifier, then this is the flake reference that specifies its actual location, looked up in the flake registry. -
Locked URL
: A flake reference that contains a commit or content hash and thus uniquely identifies a specific flake version. -
Description
: A one-line description of the flake, taken from thedescription
field inflake.nix
. -
Path
: The store path containing the source code of the flake. -
Revision
: The Git or Mercurial commit hash of the locked flake. -
Revisions
: The number of ancestors of the Git or Mercurial commit of the locked flake. Note that this is not available forgithub
flakes. -
Last modified
: For Git or Mercurial flakes, this is the commit time of the commit of the locked flake; for tarball flakes, it's the most recent timestamp of any file inside the tarball. -
Inputs
: The flake inputs with their corresponding lock file entries.
With --json
, the output is a JSON object with the following fields:
-
original
andoriginalUrl
: The flake reference specified by the user (flake-url) in attribute set and URL representation. -
resolved
andresolvedUrl
: The resolved flake reference (see above) in attribute set and URL representation. -
locked
andlockedUrl
: The locked flake reference (see above) in attribute set and URL representation. -
description
: SeeDescription
above. -
path
: SeePath
above. -
revision
: SeeRevision
above. -
revCount
: SeeRevisions
above. -
lastModified
: SeeLast modified
above. -
locks
: The contents offlake.lock
.
Options
-
--json
Produce output in JSON format, suitable for consumption by another program.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake init
- create a flake in the current directory from a template
Synopsis
nix flake init
[option...]
Examples
-
Create a flake using the default template:
# nix flake init
-
List available templates:
# nix flake show templates
-
Create a flake from a specific template:
# nix flake init -t templates#simpleContainer
Description
This command creates a flake in the current directory by copying the
files of a template. It will not overwrite existing files. The default
template is templates#templates.default
, but this can be overridden
using -t
.
Template definitions
A flake can declare templates through its templates
output
attribute. A template has two attributes:
-
description
: A one-line description of the template, in CommonMark syntax. -
path
: The path of the directory to be copied. -
welcomeText
: A block of markdown text to display when a user initializes a new flake based on this template.
Here is an example:
outputs = { self }: {
templates.rust = {
path = ./rust;
description = "A simple Rust/Cargo project";
welcomeText = ''
# Simple Rust/Cargo Template
## Intended usage
The intended usage of this flake is...
## More info
- [Rust language](https://www.rust-lang.org/)
- [Rust on the NixOS Wiki](https://nixos.wiki/wiki/Rust)
- ...
'';
};
templates.default = self.templates.rust;
}
Options
-
--template
/-t
templateThe template to use.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake lock
- create missing lock file entries
Synopsis
nix flake lock
[option...] flake-url
Examples
-
Update the
nixpkgs
andnix
inputs of the flake in the current directory:# nix flake lock --update-input nixpkgs --update-input nix * Updated 'nix': 'github:NixOS/nix/9fab14adbc3810d5cc1f88672fde1eee4358405c' -> 'github:NixOS/nix/8927cba62f5afb33b01016d5c4f7f8b7d0adde3c' * Updated 'nixpkgs': 'github:NixOS/nixpkgs/3d2d8f281a27d466fa54b469b5993f7dde198375' -> 'github:NixOS/nixpkgs/a3a3dda3bacf61e8a39258a0ed9c924eeca8e293'
Description
This command updates the lock file of a flake (flake.lock
) so that
it contains a lock for every flake input specified in
flake.nix
. Existing lock file entries are not updated unless
required by a flag such as --update-input
.
Note that every command that operates on a flake will also update the lock file if needed, and supports the same flags. Therefore,
# nix flake lock --update-input nixpkgs
# nix build
is equivalent to:
# nix build --update-input nixpkgs
Thus, this command is only useful if you want to update the lock file separately from any other action such as building.
Options
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake metadata
- show flake metadata
Synopsis
nix flake metadata
[option...] flake-url
Examples
-
Show what
nixpkgs
resolves to:# nix flake metadata nixpkgs Resolved URL: github:edolstra/dwarffs Locked URL: github:edolstra/dwarffs/f691e2c991e75edb22836f1dbe632c40324215c5 Description: A filesystem that fetches DWARF debug info from the Internet on demand Path: /nix/store/769s05vjydmc2lcf6b02az28wsa9ixh1-source Revision: f691e2c991e75edb22836f1dbe632c40324215c5 Last modified: 2021-01-21 15:41:26 Inputs: ├───nix: github:NixOS/nix/6254b1f5d298ff73127d7b0f0da48f142bdc753c │ ├───lowdown-src: github:kristapsdz/lowdown/1705b4a26fbf065d9574dce47a94e8c7c79e052f │ └───nixpkgs: github:NixOS/nixpkgs/ad0d20345219790533ebe06571f82ed6b034db31 └───nixpkgs follows input 'nix/nixpkgs'
-
Show information about
dwarffs
in JSON format:# nix flake metadata dwarffs --json | jq . { "description": "A filesystem that fetches DWARF debug info from the Internet on demand", "lastModified": 1597153508, "locked": { "lastModified": 1597153508, "narHash": "sha256-VHg3MYVgQ12LeRSU2PSoDeKlSPD8PYYEFxxwkVVDRd0=", "owner": "edolstra", "repo": "dwarffs", "rev": "d181d714fd36eb06f4992a1997cd5601e26db8f5", "type": "github" }, "locks": { ... }, "original": { "id": "dwarffs", "type": "indirect" }, "originalUrl": "flake:dwarffs", "path": "/nix/store/hang3792qwdmm2n0d9nsrs5n6bsws6kv-source", "resolved": { "owner": "edolstra", "repo": "dwarffs", "type": "github" }, "resolvedUrl": "github:edolstra/dwarffs", "revision": "d181d714fd36eb06f4992a1997cd5601e26db8f5", "url": "github:edolstra/dwarffs/d181d714fd36eb06f4992a1997cd5601e26db8f5" }
Description
This command shows information about the flake specified by the flake reference flake-url. It resolves the flake reference using the flake registry, fetches it, and prints some meta data. This includes:
-
Resolved URL
: If flake-url is a flake identifier, then this is the flake reference that specifies its actual location, looked up in the flake registry. -
Locked URL
: A flake reference that contains a commit or content hash and thus uniquely identifies a specific flake version. -
Description
: A one-line description of the flake, taken from thedescription
field inflake.nix
. -
Path
: The store path containing the source code of the flake. -
Revision
: The Git or Mercurial commit hash of the locked flake. -
Revisions
: The number of ancestors of the Git or Mercurial commit of the locked flake. Note that this is not available forgithub
flakes. -
Last modified
: For Git or Mercurial flakes, this is the commit time of the commit of the locked flake; for tarball flakes, it's the most recent timestamp of any file inside the tarball. -
Inputs
: The flake inputs with their corresponding lock file entries.
With --json
, the output is a JSON object with the following fields:
-
original
andoriginalUrl
: The flake reference specified by the user (flake-url) in attribute set and URL representation. -
resolved
andresolvedUrl
: The resolved flake reference (see above) in attribute set and URL representation. -
locked
andlockedUrl
: The locked flake reference (see above) in attribute set and URL representation. -
description
: SeeDescription
above. -
path
: SeePath
above. -
revision
: SeeRevision
above. -
revCount
: SeeRevisions
above. -
lastModified
: SeeLast modified
above. -
locks
: The contents offlake.lock
.
Options
-
--json
Produce output in JSON format, suitable for consumption by another program.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake new
- create a flake in the specified directory from a template
Synopsis
nix flake new
[option...] dest-dir
Examples
-
Create a flake using the default template in the directory
hello
:# nix flake new hello
-
List available templates:
# nix flake show templates
-
Create a flake from a specific template in the directory
hello
:# nix flake new hello -t templates#trivial
Description
This command creates a flake in the directory dest-dir
, which must
not already exist. It's equivalent to:
# mkdir dest-dir
# cd dest-dir
# nix flake init
Options
-
--template
/-t
templateThe template to use.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake prefetch
- download the source tree denoted by a flake reference into the Nix store
Synopsis
nix flake prefetch
[option...] flake-url
Examples
-
Download a tarball and unpack it:
# nix flake prefetch https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.5.tar.xz Downloaded 'https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.5.tar.xz?narHash=sha256-3XYHZANT6AFBV0BqegkAZHbba6oeDkIUCDwbATLMhAY=' to '/nix/store/sl5vvk8mb4ma1sjyy03kwpvkz50hd22d-source' (hash 'sha256-3XYHZANT6AFBV0BqegkAZHbba6oeDkIUCDwbATLMhAY=').
-
Download the
dwarffs
flake (looked up in the flake registry):# nix flake prefetch dwarffs --json {"hash":"sha256-VHg3MYVgQ12LeRSU2PSoDeKlSPD8PYYEFxxwkVVDRd0=" ,"storePath":"/nix/store/hang3792qwdmm2n0d9nsrs5n6bsws6kv-source"}
Description
This command downloads the source tree denoted by flake reference
flake-url. Note that this does not need to be a flake (i.e. it does
not have to contain a flake.nix
file).
Options
-
--json
Produce output in JSON format, suitable for consumption by another program.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake show
- show the outputs provided by a flake
Synopsis
nix flake show
[option...] flake-url
Examples
-
Show the output attributes provided by the
patchelf
flake:github:NixOS/patchelf/f34751b88bd07d7f44f5cd3200fb4122bf916c7e ├───checks │ ├───aarch64-linux │ │ └───build: derivation 'patchelf-0.12.20201207.f34751b' │ ├───i686-linux │ │ └───build: derivation 'patchelf-0.12.20201207.f34751b' │ └───x86_64-linux │ └───build: derivation 'patchelf-0.12.20201207.f34751b' ├───packages │ ├───aarch64-linux │ │ └───default: package 'patchelf-0.12.20201207.f34751b' │ ├───i686-linux │ │ └───default: package 'patchelf-0.12.20201207.f34751b' │ └───x86_64-linux │ └───default: package 'patchelf-0.12.20201207.f34751b' ├───hydraJobs │ ├───build │ │ ├───aarch64-linux: derivation 'patchelf-0.12.20201207.f34751b' │ │ ├───i686-linux: derivation 'patchelf-0.12.20201207.f34751b' │ │ └───x86_64-linux: derivation 'patchelf-0.12.20201207.f34751b' │ ├───coverage: derivation 'patchelf-coverage-0.12.20201207.f34751b' │ ├───release: derivation 'patchelf-0.12.20201207.f34751b' │ └───tarball: derivation 'patchelf-tarball-0.12.20201207.f34751b' └───overlay: Nixpkgs overlay
Description
This command shows the output attributes provided by the flake
specified by flake reference flake-url. These are the top-level
attributes in the outputs
of the flake, as well as lower-level
attributes for some standard outputs (e.g. packages
or checks
).
With --json
, the output is in a JSON representation suitable for automatic
processing by other tools.
Options
-
--json
Produce output in JSON format, suitable for consumption by another program.
-
--legacy
Show the contents of the
legacyPackages
output.
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix flake update
- update flake lock file
Synopsis
nix flake update
[option...] flake-url
Examples
-
Recreate the lock file (i.e. update all inputs) and commit the new lock file:
# nix flake update --commit-lock-file * Updated 'nix': 'github:NixOS/nix/9fab14adbc3810d5cc1f88672fde1eee4358405c' -> 'github:NixOS/nix/8927cba62f5afb33b01016d5c4f7f8b7d0adde3c' * Updated 'nixpkgs': 'github:NixOS/nixpkgs/3d2d8f281a27d466fa54b469b5993f7dde198375' -> 'github:NixOS/nixpkgs/a3a3dda3bacf61e8a39258a0ed9c924eeca8e293' … warning: committed new revision '158bcbd9d6cc08ab859c0810186c1beebc982aad'
Description
This command recreates the lock file of a flake (flake.lock
), thus
updating the lock for every unlocked input (like nixpkgs
) to its
current version. This is equivalent to passing --recreate-lock-file
to any command that operates on a flake. That is,
# nix flake update
# nix build
is equivalent to:
# nix build --recreate-lock-file
Options
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix fmt
- reformat your code in the standard style
Synopsis
nix fmt
[option...] args...
Examples
With nixpkgs-fmt:
# flake.nix
{
outputs = { nixpkgs, self }: {
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
};
}
-
Format the current flake:
$ nix fmt
-
Format a specific folder or file:
$ nix fmt ./folder ./file.nix
With nixfmt:
# flake.nix
{
outputs = { nixpkgs, self }: {
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt;
};
}
- Format specific files:
$ nix fmt ./file1.nix ./file2.nix
With Alejandra:
# flake.nix
{
outputs = { nixpkgs, self }: {
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.alejandra;
};
}
-
Format the current flake:
$ nix fmt
-
Format a specific folder or file:
$ nix fmt ./folder ./file.nix
Description
nix fmt
will rewrite all Nix files (*.nix) to a canonical format
using the formatter specified in your flake.
Options
Common evaluation options:
-
--arg
name exprPass the value expr as the argument name to Nix functions.
-
--argstr
name stringPass the string string as the argument name to Nix functions.
-
--debugger
Start an interactive environment if evaluation fails.
-
--eval-store
store-urlThe Nix store to use for evaluations.
-
--impure
Allow access to mutable paths and repositories.
-
--include
/-I
pathAdd path to the Nix search path. The Nix search path is initialized from the colon-separated
NIX_PATH
environment variable, and is used to look up the location of Nix expressions using paths enclosed in angle brackets (i.e.,<nixpkgs>
).For instance, passing
-I /home/eelco/Dev -I /etc/nixos
will cause Nix to look for paths relative to
/home/eelco/Dev
and/etc/nixos
, in that order. This is equivalent to setting theNIX_PATH
environment variable to/home/eelco/Dev:/etc/nixos
It is also possible to match paths against a prefix. For example, passing
-I nixpkgs=/home/eelco/Dev/nixpkgs-branch -I /etc/nixos
will cause Nix to search for
<nixpkgs/path>
in/home/eelco/Dev/nixpkgs-branch/path
and/etc/nixos/nixpkgs/path
.If a path in the Nix search path starts with
http://
orhttps://
, it is interpreted as the URL of a tarball that will be downloaded and unpacked to a temporary location. The tarball must consist of a single top-level directory. For example, passing-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/master.tar.gz
tells Nix to download and use the current contents of the
master
branch in thenixpkgs
repository.The URLs of the tarballs from the official
nixos.org
channels (see the manual page fornix-channel
) can be abbreviated aschannel:<channel-name>
. For instance, the following two flags are equivalent:-I nixpkgs=channel:nixos-21.05 -I nixpkgs=https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz
You can also fetch source trees using flake URLs and add them to the search path. For instance,
-I nixpkgs=flake:nixpkgs
specifies that the prefix
nixpkgs
shall refer to the source tree downloaded from thenixpkgs
entry in the flake registry. Similarly,-I nixpkgs=flake:github:NixOS/nixpkgs/nixos-22.05
makes
<nixpkgs>
refer to a particular branch of theNixOS/nixpkgs
repository on GitHub. -
--override-flake
original-ref resolved-refOverride the flake registries, redirecting original-ref to resolved-ref.
Common flake-related options:
-
--commit-lock-file
Commit changes to the flake's lock file.
-
--inputs-from
flake-urlUse the inputs of the specified flake as registry entries.
-
--no-registries
Don't allow lookups in the flake registries. This option is deprecated; use
--no-use-registries
. -
--no-update-lock-file
Do not allow any updates to the flake's lock file.
-
--no-write-lock-file
Do not write the flake's newly generated lock file.
-
--override-input
input-path flake-urlOverride a specific flake input (e.g.
dwarffs/nixpkgs
). This implies--no-write-lock-file
. -
--recreate-lock-file
Recreate the flake's lock file from scratch.
-
--update-input
input-pathUpdate a specific flake input (ignoring its previous entry in the lock file).
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options that change the interpretation of installables:
-
--derivation
Operate on the store derivation rather than its outputs.
-
--expr
exprInterpret installables as attribute paths relative to the Nix expression expr.
-
--file
/-f
fileInterpret installables as attribute paths relative to the Nix expression stored in file. If file is the character -, then a Nix expression will be read from standard input. Implies
--impure
.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix hash
- compute and convert cryptographic hashes
Synopsis
nix hash
[option...] subcommand
where subcommand is one of the following:
nix hash file
- print cryptographic hash of a regular filenix hash path
- print cryptographic hash of the NAR serialisation of a pathnix hash to-base16
- convert a hash to base-16 representationnix hash to-base32
- convert a hash to base-32 representationnix hash to-base64
- convert a hash to base-64 representationnix hash to-sri
- convert a hash to SRI representation
Warning
This program is experimental and its interface is subject to change.
Name
nix hash file
- print cryptographic hash of a regular file
Synopsis
nix hash file
[option...] paths...
Options
-
--base16
Print the hash in base-16 format.
-
--base32
Print the hash in base-32 (Nix-specific) format.
-
--base64
Print the hash in base-64 format.
-
--sri
Print the hash in SRI format.
-
--type
hash-algohash algorithm ('md5', 'sha1', 'sha256', or 'sha512')
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix hash path
- print cryptographic hash of the NAR serialisation of a path
Synopsis
nix hash path
[option...] paths...
Options
-
--base16
Print the hash in base-16 format.
-
--base32
Print the hash in base-32 (Nix-specific) format.
-
--base64
Print the hash in base-64 format.
-
--sri
Print the hash in SRI format.
-
--type
hash-algohash algorithm ('md5', 'sha1', 'sha256', or 'sha512')
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix hash to-base16
- convert a hash to base-16 representation
Synopsis
nix hash to-base16
[option...] strings...
Options
-
--type
hash-algohash algorithm ('md5', 'sha1', 'sha256', or 'sha512'). Optional as can also be gotten from SRI hash itself.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix hash to-base32
- convert a hash to base-32 representation
Synopsis
nix hash to-base32
[option...] strings...
Options
-
--type
hash-algohash algorithm ('md5', 'sha1', 'sha256', or 'sha512'). Optional as can also be gotten from SRI hash itself.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size
valueSet the
nar-buffer-size
setting. -
--narinfo-cache-negative-ttl
valueSet the
narinfo-cache-negative-ttl
setting. -
--narinfo-cache-positive-ttl
valueSet the
narinfo-cache-positive-ttl
setting. -
--netrc-file
valueSet the
netrc-file
setting. -
--nix-path
valueSet the
nix-path
setting. -
--no-accept-flake-config
Disable the
accept-flake-config
setting. -
--no-allow-dirty
Disable the
allow-dirty
setting. -
--no-allow-import-from-derivation
Disable the
allow-import-from-derivation
setting. -
--no-allow-new-privileges
Disable the
allow-new-privileges
setting. -
--no-allow-symlinked-store
Disable the
allow-symlinked-store
setting. -
--no-allow-unsafe-native-code-during-evaluation
Disable the
allow-unsafe-native-code-during-evaluation
setting. -
--no-auto-allocate-uids
Disable the
auto-allocate-uids
setting. -
--no-auto-optimise-store
Disable the
auto-optimise-store
setting. -
--no-builders-use-substitutes
Disable the
builders-use-substitutes
setting. -
--no-compress-build-log
Disable the
compress-build-log
setting. -
--no-eval-cache
Disable the
eval-cache
setting. -
--no-fallback
Disable the
fallback
setting. -
--no-filter-syscalls
Disable the
filter-syscalls
setting. -
--no-fsync-metadata
Disable the
fsync-metadata
setting. -
--no-http2
Disable the
http2
setting. -
--no-ignore-try
Disable the
ignore-try
setting. -
--no-impersonate-linux-26
Disable the
impersonate-linux-26
setting. -
--no-keep-build-log
Disable the
keep-build-log
setting. -
--no-keep-derivations
Disable the
keep-derivations
setting. -
--no-keep-env-derivations
Disable the
keep-env-derivations
setting. -
--no-keep-failed
Disable the
keep-failed
setting. -
--no-keep-going
Disable the
keep-going
setting. -
--no-keep-outputs
Disable the
keep-outputs
setting. -
--no-preallocate-contents
Disable the
preallocate-contents
setting. -
--no-print-missing
Disable the
print-missing
setting. -
--no-pure-eval
Disable the
pure-eval
setting. -
--no-require-sigs
Disable the
require-sigs
setting. -
--no-restrict-eval
Disable the
restrict-eval
setting. -
--no-run-diff-hook
Disable the
run-diff-hook
setting. -
--no-sandbox
Disable sandboxing.
-
--no-sandbox-fallback
Disable the
sandbox-fallback
setting. -
--no-show-trace
Disable the
show-trace
setting. -
--no-substitute
Disable the
substitute
setting. -
--no-sync-before-registering
Disable the
sync-before-registering
setting. -
--no-trace-function-calls
Disable the
trace-function-calls
setting. -
--no-trace-verbose
Disable the
trace-verbose
setting. -
--no-use-case-hack
Disable the
use-case-hack
setting. -
--no-use-cgroups
Disable the
use-cgroups
setting. -
--no-use-registries
Disable the
use-registries
setting. -
--no-use-sqlite-wal
Disable the
use-sqlite-wal
setting. -
--no-warn-dirty
Disable the
warn-dirty
setting. -
--plugin-files
valueSet the
plugin-files
setting. -
--post-build-hook
valueSet the
post-build-hook
setting. -
--pre-build-hook
valueSet the
pre-build-hook
setting. -
--preallocate-contents
Enable the
preallocate-contents
setting. -
--print-missing
Enable the
print-missing
setting. -
--pure-eval
Enable the
pure-eval
setting. -
--relaxed-sandbox
Enable sandboxing, but allow builds to disable it.
-
--require-sigs
Enable the
require-sigs
setting. -
--restrict-eval
Enable the
restrict-eval
setting. -
--run-diff-hook
Enable the
run-diff-hook
setting. -
--sandbox
Enable sandboxing.
-
--sandbox-build-dir
valueSet the
sandbox-build-dir
setting. -
--sandbox-dev-shm-size
valueSet the
sandbox-dev-shm-size
setting. -
--sandbox-fallback
Enable the
sandbox-fallback
setting. -
--sandbox-paths
valueSet the
sandbox-paths
setting. -
--secret-key-files
valueSet the
secret-key-files
setting. -
--show-trace
Enable the
show-trace
setting. -
--stalled-download-timeout
valueSet the
stalled-download-timeout
setting. -
--start-id
valueSet the
start-id
setting. -
--store
valueSet the
store
setting. -
--substitute
Enable the
substitute
setting. -
--substituters
valueSet the
substituters
setting. -
--sync-before-registering
Enable the
sync-before-registering
setting. -
--system
valueSet the
system
setting. -
--system-features
valueSet the
system-features
setting. -
--tarball-ttl
valueSet the
tarball-ttl
setting. -
--timeout
valueSet the
timeout
setting. -
--trace-function-calls
Enable the
trace-function-calls
setting. -
--trace-verbose
Enable the
trace-verbose
setting. -
--trusted-public-keys
valueSet the
trusted-public-keys
setting. -
--trusted-substituters
valueSet the
trusted-substituters
setting. -
--trusted-users
valueSet the
trusted-users
setting. -
--use-case-hack
Enable the
use-case-hack
setting. -
--use-cgroups
Enable the
use-cgroups
setting. -
--use-registries
Enable the
use-registries
setting. -
--use-sqlite-wal
Enable the
use-sqlite-wal
setting. -
--user-agent-suffix
valueSet the
user-agent-suffix
setting. -
--warn-dirty
Enable the
warn-dirty
setting.
Warning
This program is experimental and its interface is subject to change.
Name
nix hash to-base64
- convert a hash to base-64 representation
Synopsis
nix hash to-base64
[option...] strings...
Options
-
--type
hash-algohash algorithm ('md5', 'sha1', 'sha256', or 'sha512'). Optional as can also be gotten from SRI hash itself.
Logging-related options:
-
--debug
Set the logging verbosity level to 'debug'.
-
--log-format
formatSet the format of log output; one of
raw
,internal-json
,bar
orbar-with-logs
. -
--print-build-logs
/-L
Print full build logs on standard error.
-
--quiet
Decrease the logging verbosity level.
-
--verbose
/-v
Increase the logging verbosity level.
Miscellaneous global options:
-
--help
Show usage information.
-
--offline
Disable substituters and consider all previously downloaded files up-to-date.
-
--option
name valueSet the Nix configuration setting name to value (overriding
nix.conf
). -
--refresh
Consider all previously downloaded files out-of-date.
-
--version
Show version information.
Options to override configuration settings:
-
--accept-flake-config
Enable the
accept-flake-config
setting. -
--access-tokens
valueSet the
access-tokens
setting. -
--allow-dirty
Enable the
allow-dirty
setting. -
--allow-import-from-derivation
Enable the
allow-import-from-derivation
setting. -
--allow-new-privileges
Enable the
allow-new-privileges
setting. -
--allow-symlinked-store
Enable the
allow-symlinked-store
setting. -
--allow-unsafe-native-code-during-evaluation
Enable the
allow-unsafe-native-code-during-evaluation
setting. -
--allowed-impure-host-deps
valueSet the
allowed-impure-host-deps
setting. -
--allowed-uris
valueSet the
allowed-uris
setting. -
--allowed-users
valueSet the
allowed-users
setting. -
--auto-allocate-uids
Enable the
auto-allocate-uids
setting. -
--auto-optimise-store
Enable the
auto-optimise-store
setting. -
--bash-prompt
valueSet the
bash-prompt
setting. -
--bash-prompt-prefix
valueSet the
bash-prompt-prefix
setting. -
--bash-prompt-suffix
valueSet the
bash-prompt-suffix
setting. -
--build-hook
valueSet the
build-hook
setting. -
--build-poll-interval
valueSet the
build-poll-interval
setting. -
--build-users-group
valueSet the
build-users-group
setting. -
--builders
valueSet the
builders
setting. -
--builders-use-substitutes
Enable the
builders-use-substitutes
setting. -
--commit-lockfile-summary
valueSet the
commit-lockfile-summary
setting. -
--compress-build-log
Enable the
compress-build-log
setting. -
--connect-timeout
valueSet the
connect-timeout
setting. -
--cores
valueSet the
cores
setting. -
--diff-hook
valueSet the
diff-hook
setting. -
--download-attempts
valueSet the
download-attempts
setting. -
--download-speed
valueSet the
download-speed
setting. -
--eval-cache
Enable the
eval-cache
setting. -
--experimental-features
valueSet the
experimental-features
setting. -
--extra-access-tokens
valueAppend to the
access-tokens
setting. -
--extra-allowed-impure-host-deps
valueAppend to the
allowed-impure-host-deps
setting. -
--extra-allowed-uris
valueAppend to the
allowed-uris
setting. -
--extra-allowed-users
valueAppend to the
allowed-users
setting. -
--extra-experimental-features
valueAppend to the
experimental-features
setting. -
--extra-extra-platforms
valueAppend to the
extra-platforms
setting. -
--extra-hashed-mirrors
valueAppend to the
hashed-mirrors
setting. -
--extra-ignored-acls
valueAppend to the
ignored-acls
setting. -
--extra-nix-path
valueAppend to the
nix-path
setting. -
--extra-platforms
valueSet the
extra-platforms
setting. -
--extra-plugin-files
valueAppend to the
plugin-files
setting. -
--extra-sandbox-paths
valueAppend to the
sandbox-paths
setting. -
--extra-secret-key-files
valueAppend to the
secret-key-files
setting. -
--extra-substituters
valueAppend to the
substituters
setting. -
--extra-system-features
valueAppend to the
system-features
setting. -
--extra-trusted-public-keys
valueAppend to the
trusted-public-keys
setting. -
--extra-trusted-substituters
valueAppend to the
trusted-substituters
setting. -
--extra-trusted-users
valueAppend to the
trusted-users
setting. -
--fallback
Enable the
fallback
setting. -
--filter-syscalls
Enable the
filter-syscalls
setting. -
--flake-registry
valueSet the
flake-registry
setting. -
--fsync-metadata
Enable the
fsync-metadata
setting. -
--gc-reserved-space
valueSet the
gc-reserved-space
setting. -
--hashed-mirrors
valueSet the
hashed-mirrors
setting. -
--http-connections
valueSet the
http-connections
setting. -
--http2
Enable the
http2
setting. -
--id-count
valueSet the
id-count
setting. -
--ignore-try
Enable the
ignore-try
setting. -
--ignored-acls
valueSet the
ignored-acls
setting. -
--impersonate-linux-26
Enable the
impersonate-linux-26
setting. -
--keep-build-log
Enable the
keep-build-log
setting. -
--keep-derivations
Enable the
keep-derivations
setting. -
--keep-env-derivations
Enable the
keep-env-derivations
setting. -
--keep-failed
Enable the
keep-failed
setting. -
--keep-going
Enable the
keep-going
setting. -
--keep-outputs
Enable the
keep-outputs
setting. -
--log-lines
valueSet the
log-lines
setting. -
--max-build-log-size
valueSet the
max-build-log-size
setting. -
--max-free
valueSet the
max-free
setting. -
--max-jobs
valueSet the
max-jobs
setting. -
--max-silent-time
valueSet the
max-silent-time
setting. -
--min-free
valueSet the
min-free
setting. -
--min-free-check-interval
valueSet the
min-free-check-interval
setting. -
--nar-buffer-size