Using user-space packages with sudo

[suimong]

Hi @ryan4yin, in the section Home Manager vs NixOS you mentioned that a good rule of thumb for choosing package management location is by considering whether the package needs to be accessible by all users (including root). This got me thinking, does that mean that as long as some program might have a chance to be used in a "sudo" context, then it must be specified as a systemPackage in configuration.nix? In "traditional" Linux this problem (i.e. sudo a program that is installed under a user's home directory) can be solved by hooking the user's various "bin paths" (~/.local/bin etc.) into system-level profile files, I wonder what's the most idiomatic and ergonomic way to achieve that in NixOS?

Forget to say thank you for putting up this wonderful tutorial, tremendous effort!

[ryan4yin]

Good question, let me explain it.
If you switch to another user, the packages installed by the current user will be unavailable:

# kubectl is available
› kubectl | head
kubectl controls the Kubernetes cluster manager.

 Find more information at: https://kubernetes.io/docs/reference/kubectl/
......

# switch user to `root`
› sudo su

# kubectl is no longer available
> kubectl                                                                                                                                                               08/17/2023 10:32:20 PM
Error: nu::shell::external_command

  × External command failed
   ╭─[entry #1:1:1]
 1 │ kubectl
   · ───┬───
   ·    ╰── executable was not found
   ╰────
  help: No such file or directory (os error 2)

But you can still use kubectl by sudo:

/home/ryan/nix-config> exit                                                                                                                                                                1 08/17/2023 10:32:23 PM


› sudo kubectl
kubectl controls the Kubernetes cluster manager.
...

As far as I understand, sudo temporarily grant the current user privileged access to system resources, it does not directly switch the current user to root.

Conclusion

On NixOS, there many ways to let you use a package with privileged access:

1. Using sudo to run a command with privileged access.
2. Commands for running programs temporarily: nix run & nix shell
3. "bin paths" (~/.local/bin etc.) is also available on NixOS, you can add your "bin paths" to PATH.
4. Install the packages via NixOS module.

It is recommended to give priority to the first two methods.

[suimong]

Thanks for the quick reply! As I experimented a little bit just now (sorry for not trying out before asking the question since I didn't have a NixOS host at hand at the time), sudo will indeed pickup whatever is installed by nix, which is a very neat feature since the opposite behavior is a very common gotcha for new users of non-NixOS linux users.

Digging a little bit, I think it might have something to do with the "security wrapper" feature, as pointed out in this thread.

Thanks again for the help.