If I try to run with only the unmask, then I get that:

$ podman run --security-opt unmask=/proc/* --rm -it foo unshare -r nix-build
error: changing ownership of path '/nix/store': Invalid argument

In reply to @jlamur:matrix.org
mhh I think that's because /nix/store is root:nogroup in the new user ns

In reply to @weethet:catgirl.cloud
WYM?

Some more cursed observations. Given file:

# foo.nix
{
  foo = "hi from outside";
  __functor = _: {
    foo = "hi from inside";
  };
}

We can observe:

$ nix-instantiate --eval foo.nix
{ __functor = <CODE>; foo = "hi from outside"; }
$ nix-instantiate --eval foo.nix -A foo
"hi from inside"

I guess this is kinda expected given how nix-build works, but still. I don't like this. And better yet:

# foo.nix
{
  __functor = _: {
    foo = "hi from inside";
  };
}
# bar.nix
{
  __functor = _: {}: {
    foo = "hi from inside";
  };
}
# baz.nix
{
  __functor = _: _: {
    foo = "hi from inside";
  };
}

$ nix-instantiate --eval foo.nix -A foo
"hi from inside"
$ nix-instantiate --eval bar.nix -A foo
"hi from inside"
$ nix-instantiate --eval baz.nix -A foo
error: the value being indexed in the selection path 'foo' at '' should be a set but is a function: «lambda __functor @ baz.nix:2:18»

In reply to @niko:nrab.lol
and this is even more unexpected: nix-building a file like this { __functor = self: <derivation>; }, which obviously isn't "valid" nix code (technically valid, but for the sake of brevity let's just say it's invalid), actually builds the derivation... what? Surely this is not expected, that's not how functors work