nix3-store-roots-daemon(1)

📦 version 2.35.3, in fedora 44

💖 nix3-store-roots-daemon(1) 💖

okay bestie, so this one lives in the General Commands Manual and honestly? it's a whole vibe. it's a manual page for the nix command suite, and before we even get into it:

⚠️ Warning — this program is experimental and its interface is subject to change. no cap. it might get a glow-up without warning you. 🙈

✨ NAME ✨

nix store roots-daemon — run a daemon that returns garbage collector roots on request 🎀

📜 SYNOPSIS 📜

nix store roots-daemon [option…]

🌸 EXAMPLES 🌸

  • run the daemon, that's it, that's the whole job:
# nix store roots-daemon

💅 DESCRIPTION 💅

so this command runs a daemon that serves garbage collector roots from a Unix domain socket. it's not required in all Nix installations, but it's genuinely so useful when the main Nix daemon isn't running as root — because then it literally can't find runtime roots by scanning /proc. 💀

when the garbage collector runs with use-roots-daemon enabled, it connects to this daemon to discover additional roots that should not be collected. protecting the girlies. 🫶

the daemon listens on <state-dir>/gc-roots-socket/socket — typically /nix/var/nix/gc-roots-socket/socket. iykyk. 🌈

🔌 PROTOCOL 🔌

the protocol is simple, like uncomplicated-relationship simple. for each client-initiated Unix socket connection, the server:

  1. sends zero or more store paths as NUL-terminated (\0) strings.
  2. closes the connection.

example (with \0 shown as newlines for clarity):

/nix/store/s66mzxpvicwk07gjbjfw9izjfa797vsw-hello-2.12.1
/nix/store/fvpr7x8l3illdnziggvkhdpf6vikg65w-git-2.44.0

🔒 SECURITY 🔒

okay so, real talk, this part matters. 🔥

No information is provided as to which processes are opening which store paths. so yeah. however — while only the main Nix daemon needs to use this daemon, any user able to talk to the main Nix daemon can already obtain the same information with nix-store --gc --print-roots.

therefore, restricting this daemon to only accept the Nix daemon as a client is, while recommended for defense-in-depth reasons, strictly speaking not reducing what information can be extracted — versus merely restricting this daemon to accept connections from any allowed user. the way that changes literally nothing information-wise is wild. 😭

🧚 SYSTEMD SOCKET ACTIVATION 🧚

nix store roots-daemon supports systemd socket-based activation, just like nix daemon. slay, consistency. ✨

⚙️ OPTIONS ⚙️

  • --debug — set the logging verbosity level to debug. we're nosy today, and that's valid. 👀
  • --log-format format — set the format of log output; one of raw, internal-json, bar or bar-with-logs.
  • --print-build-logs / -L — print full build logs on standard error.
  • --quiet — decrease the logging verbosity level. shhh. 🤫
  • --verbose / -v — increase the logging verbosity level. tell me EVERYTHING. 🗣️

🎀 Miscellaneous global options

  • --help — show usage information.
  • --offline — disable substituters and consider all previously downloaded files up-to-date.
  • --option name value — set the Nix configuration setting name to value (overriding nix.conf).
  • --refresh — consider all previously downloaded files out-of-date.
  • --version — show version information.
📌 Note — see man nix.conf for overriding configuration settings with command line flags. go read it, bestie, i believe in you 💜

and that's the page!! 🎀 it was served fresh from nix3-store-roots-daemon(1), General Commands Manual, version and date included, no cap. periodt. 💅✨

📦 where this page comes from