Network access in external linux builders

[jonathanmorley]

Describe the bug

I am using the external-builders feature on MacOS, and I have a derivation that requires network access (but is not a FOD).

On MacOS, this derivation works, as the sandbox does not impose network restrictions. When running in linux, I can use __impure = true; and --impure to escape the sandbox.

However, in the external-builders' VM, I cannot get network access that way.

Steps To Reproduce

1. Clone https://github.com/jonathanmorley/asdf-pnpm at commit 7f0101649f64f32e63bb4a26f7080dba11d31353
2. From a MacOS host, configured with external-builders run nix flake check --system x86_64-linux --print-build-logs --impure
3. Observe that it fails (as expected) with 'curl: (6) Could not resolve host: registry.npmjs.org (Could not contact DNS servers)'

Expected behavior

Should fail with:

>   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
       >                                  Dload  Upload   Total   Spent    Left  Speed
       >   0  5066k   0  6832   0     0 52592     0   0:01:38 --:--:--  0:01:38 52961"_id":"pnpm","_rev":"2519-94fdc0d9899196b5f194dbb799f5176a","name":"pnpm","dist-tags":{"latest-1":"
       > curl: (23) Failure writing output to destination, passed 1369 returned 1360

Metadata

determinate-nixd version
Determinate Nixd daemon version: 3.14.0
Determinate Nixd client version: 3.14.0

You are running the latest version of Determinate Nix.

The following features are enabled:

 * lazy-trees
 * native-linux-builder
 * parallel-evaluation

Visit https://dtr.mn/features for more information.

nix --version
nix (Determinate Nix 3.14.0) 2.32.4

Additional context

Checklist

• checked latest Determinate Nix manual (source)
• checked open bug issues and pull requests for possible duplicates