emmatherock/nix-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: pin Flatpak to 1.16.6 to work around sandbox env leak bug

Browse Source 
Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox,
breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package
to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped
to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
emmatherock
2026-07-10 23:29:34 -03:00
co-authored by Claude Sonnet 5
parent 5b77b0debb
commit ed36775cf0
3 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+8
View File
@@ -18,6 +18,14 @@
vscode-server.url = "github:nix-community/nixos-vscode-server";
llm-agents.url = "github:numtide/llm-agents.nix";
nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
# TEMPORARY: pinned to the last nixpkgs revision known to ship Flatpak 1.16.6.
# Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox and breaks
# glycin-svg icon loading (e.g. OpenDeck). Remove this input, the overlay-less
# services.flatpak.package override below, and this comment once
# https://github.com/flatpak/flatpak/issues/6721 is fixed upstream and merged
# into nixpkgs (see also flatpak/flatpak#6717, NixOS/nixpkgs#534376).
nixpkgs-flatpak.url = "github:NixOS/nixpkgs/51effaf9783e0226281ad10e95a4af6c8a145316";
};
outputs = { self, nixpkgs, apple-fonts, home-manager, sidra, vscode-server, nix-vscode-extensions, ... }@inputs: {