modules/darwin/hercules-ci: add sandbox workaround

2024-06-10 13:10:25 +10:00 · 2024-06-10 13:10:25 +10:00 · 1f6af7ef75
commit 1f6af7ef75
parent 9cb0daaa63
1 changed files with 4 additions and 0 deletions
--- a/modules/darwin/hercules-ci/default.nix
+++ b/modules/darwin/hercules-ci/default.nix
@ -20,4 +20,8 @@
    binaryCachesPath = config.age.secrets.binary-caches.path;
    clusterJoinTokenPath = config.age.secrets.cluster-join-token.path;
  };
+
+  system.systemBuilderArgs.sandboxProfile = ''
+    (allow file-read* file-write* process-exec mach-lookup (subpath "${builtins.storeDir}"))
+  '';
 }