nixos-image.nix:
- sandbox = true is a request; nix builds impurely whenever the namespaces are missing
- it reports that at debug level only, so the build passes and the problem surfaces later
- the later symptom is /homeless-shelter already existing, which names nothing useful
justfile:
- assert both settings in the image, since the cost of losing them is paid elsewhere
d441c4c added sandbox = true in May for exactly the /homeless-shelter error, and it did
work under dind, whose privileged job containers could set up namespaces. The Kubernetes
backend runs jobs in ordinary pods, so the setting silently stopped taking effect and the
same error came back without the config having changed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Simon Shine
5c2baec37b