bubblewrap: try to mount /nix/store readonly

Similar to most usrmerged systems, NixOS stores all installed
binaries and libraries in /nix/store.
To make mkosi work on NixOS, the nix store should be mounted by default.

Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

diff --git a/mkosi/bubblewrap.py b/mkosi/bubblewrap.py
index 13f9517b5d3cd057725e66131677ed8ba186d4e2..7c1550bca85a30e3c6aabebd7950588c013479eb 100644 (file)
--- a/mkosi/bubblewrap.py
+++ b/mkosi/bubblewrap.py
@@ -79,6 +79,7 @@ def bwrap(
     cmdline: list[PathString] = [
         "bwrap",
         "--ro-bind", "/usr", "/usr",
+        "--ro-bind-try", "/nix/store", "/nix/store",
         "--bind", "/var/tmp", "/var/tmp",
         "--bind", "/tmp", "/tmp",
         "--bind", Path.cwd(), Path.cwd(),