SELinux, Atomic, and day-2 ops

Updated

September 4, 2026

SELinux, Atomic, and day-2 ops

Goal: Keep Fedora’s security and immutability model while running Nix—without disabling SELinux—and operate the store like an adult (disk, daemon, upgrades).

SELinux: do not “fix” Nix by disabling it

Fedora’s packaged Nix is built to work under enforcing SELinux. Prefer:

getenforce
sudo ausearch -m avc -ts recent 2>/dev/null | tail -20

If you see denials after a non-Fedora install method, switch to the Fedora package before opening policy holes.

Do Don’t
dnf install nix setenforce 0 as permanent fix
Read /usr/share/doc/nix/ Copy random chcon -R from old blog posts without understanding
File bugs against Fedora nix package when policy is wrong Disable SELinux system-wide

Atomic desktops and bootc

Problem

Image-based systems often make /usr immutable and restrict creating /nix on root.

Pattern A — bind mount

sudo mkdir -p /var/nix
# ensure /nix exists as mount point
sudo mkdir -p /nix

systemd .mount unit bind /var/nix → /nix (see Install chapter). Then install Nix packages and enable daemon if supported on that image.

Pattern B — rootless / pure user Nix

Fedora packaging notes mention pure rootless mode useful on Atomic. Follow current README.fedora.md—flags and subpackages change.

Pattern C — Nix in a toolbox/distrobox

Some Atomic users keep the host minimal and run a Fedora toolbox with classic /nix for heavy dev. Tradeoff: another layer; still teaches Nix well.

# illustrative
toolbox create -i fedora-toolbox:44 nixdev
toolbox enter nixdev
# then dnf install nix inside toolbox if appropriate

Day-2 operations checklist

Daemon health

systemctl status nix-daemon --no-pager
journalctl -u nix-daemon -b --no-pager | tail -40

Disk

df -h /nix
nix store gc
# optional deep clean of old generations
# nix-collect-garbage -d

Trust and config

nix show-config | rg -n 'substituter|trusted|sandbox|experimental'

Upgrade Nix itself (Fedora)

sudo dnf upgrade nix
sudo systemctl restart nix-daemon
nix --version

Flake-locked nixpkgs upgrades are separate from upgrading the Nix binary.

Networking / proxies / corporate TLS

If substitutes fail:

curl -I https://cache.nixos.org
# corporate MITM: may need custom CA trust for Nix — advanced; document carefully

Backup thoughts

Path Back up?
flake.nix / flake.lock / HM repo Yes — this is the real config
/nix/store Optional; can rebuild from locks (slow)
Profile generation list Nice; not required if flakes exist

On NixOS you will also back up host flake + secrets—not the entire store.

Performance tips (laptop)

  • Keep direnv projects few and GC occasionally
  • Use nix-output-monitor for readability, not speed
  • Prefer substitutes; local compiles of browsers hurt battery
  • nix settings / max-jobs and cores can be tuned in nix.conf
# example user conf — adjust to CPU
# max-jobs = auto
# cores = 0

Daemon may need matching system conf for multi-user.

Lab

  1. With SELinux enforcing, run nix run nixpkgs#hello and confirm no new AVCs.
  2. Measure df -h /nix before/after nix develop on a heavy shell; run nix store gc.
  3. If on Atomic, document your /nix strategy in the lab charter.

Checkpoint

  • SELinux remains enforcing
  • Daemon healthy after reboot
  • Disk budget monitored
  • Atomic path documented if applicable

Further depth