Sharang ParnerkarandClaude Opus 4.8
c2d43c55e7
CI / Check (pull_request) Successful in 5m26s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
nix-portable fell back to proot in the deployment (user namespaces are blocked by the container's default seccomp/apparmor profile, and orca can't relax it), and proot corrupts the nix build's file-permission syscalls — every firmware build failed at `cp: setting permissions … No such file or directory` and fell back to the analysis-only SBOM. Ship a real nix instead and disable its build sandbox (`sandbox = false`): a plain gcc/make firmware build needs no user namespace, so it runs under the locked-down profile with no proot at all. The store ships as a compressed bootstrap tarball (built in a throwaway `nixos/nix` stage) and is seeded onto /nix at first start by docker/agent-entrypoint.sh, so a persistent /nix volume survives redeploys. Seeding and the whole path are best-effort — a broken nix just falls back to analysis-only, never breaking a scan. No agent code change: NixBackend::detect() already prefers the system `nix`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>