In reply to @connorbaker:matrix.org
Ah, okay.
The think addDriverRunpath.driverLink links to is /run/opengl-driver. That is in turn a symlink, created by this: https://github.com/NixOS/nixpkgs/blob/c82d9d313d5107c6ad3a92fc7d20343f45fa5ace/nixos/modules/hardware/graphics.nix#L5-L8
That derivation isn't expose except as a path, used here:
https://github.com/NixOS/nixpkgs/blob/c82d9d313d5107c6ad3a92fc7d20343f45fa5ace/nixos/modules/hardware/graphics.nix#L112-L121
I updated my nixos config as follows, and it seems to work.
{
programs.nix-required-mounts = {
enable = true;
presets.nvidia-gpu.enable = true;
allowedPatterns.nvidia-gpu = {
onFeatures = [
"gpu"
"nvidia-gpu"
"opengl"
"cuda"
];
# It exposes these paths in the sandbox:
paths =
let
inherit (pkgs.addOpenGLRunpath) driverLink;
thingDriverLinkLinksTo =
config.systemd.tmpfiles.settings.graphics-driver."/run/opengl-driver"."L+".argument;
in
[
driverLink
thingDriverLinkLinksTo
"/dev/dri"
"/dev/nvidia*"
];
};
};
}
Of course, that same process would need to be repeated for anything in there which is in turn a symlink (which is the purpose of unsafeFollowSymlinks, I suppose), but I'm not getting that odd systemd bin error any more.
Answering from a phone, curt. That's the reason the module mounts the closure of hardware.opengl.package by default. If you used mkForce somewhere you.could've overridden that accidentally. The symlink branch is for non-nixos but I don't trust it. I was thinking maybe a runtime closure computation (nix-store --query --rewuisites) might be a reasonable future alternative. We'll have to come up with something stable anyway, for cdi