New Base Snap: nix-base

@pedronis, this is a new and unique base snap where it only contains empty directories (meta/snap.yaml notwithstanding) for the required snapd mount points, plus /nix. This is needed because of the way nix operates-- @zyga-snapd and @grahamc came up with the idea that the snaps built which specify base: nix-base provide a /nix directory that has everything it needs to run and the bind layout ties them together. This all works in terms of security because the snap only executes what is in /nix (which is analgous to the snap executing anything in $SNAP) and therefore seccomp, apparmor (capabilities, signals, etc, etc) all work like normal. (Think of snaps that use base: nix-base sorta like statically linked binaries that use the bare base snap-- they need nothing else from the system or base and only use what they ship).

This snap is owned by the nix foundation and otherwise meets our base snap criteria as defined in Process for reviewing base snaps.

IMO, this is fine to approve as a base snap.

3 Likes