Skip to content

fix: resolve degraded systemd user services #710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Feb 2, 2026
Merged

fix: resolve degraded systemd user services #710

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .local-binaries.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
~/ghq/github.com/Dicklesworthstone/coding_agent_session_search/target/release/cass
~/ghq/github.com/Dicklesworthstone/destructive_command_guard/target/release/dcg
~/ghq/github.com/Dicklesworthstone/ultimate_bug_scanner/ubs
~/ghq/github.com/dlorenc/multiclaude/multiclaude
~/ghq/github.com/nwiizo/ccswarm/target/release/ccswarm
~/ghq/github.com/steveyegge/beads/bd
~/ghq/github.com/steveyegge/gastown/gt
7 changes: 6 additions & 1 deletion home-manager/services/docker-postgres/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
{ pkgs, ... }:
let
inherit (pkgs) lib;
startPostgresWrapper = pkgs.writeShellScript "start-postgres-wrapper" ''
exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}"

@mesa-dot-dev mesa-dot-dev Bot Feb 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

Hardcoding /usr/bin/sg breaks Nix's reproducibility guarantees and creates a hidden dependency on the host system. This path may not exist on all NixOS/Linux distributions. Consider alternative approaches:

  1. Run the Docker daemon in rootless mode, eliminating the need for group switching
  2. Use a systemd system service instead of a user service, which would properly inherit group memberships
  3. Document this as a known limitation and add a runtime check to fail gracefully if /usr/bin/sg doesn't exist

If /usr/bin/sg is truly required, add a comment explaining why the SUID bit is necessary and why alternatives were rejected.

Fix in Cursor • Fix in Claude

Prompt for Agent 
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#710
File: home-manager/services/docker-postgres/default.nix#L5
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.

Feedback:
Hardcoding `/usr/bin/sg` breaks Nix's reproducibility guarantees and creates a hidden dependency on the host system. This path may not exist on all NixOS/Linux distributions. Consider alternative approaches:

1. Run the Docker daemon in rootless mode, eliminating the need for group switching
2. Use a systemd system service instead of a user service, which would properly inherit group memberships
3. Document this as a known limitation and add a runtime check to fail gracefully if `/usr/bin/sg` doesn't exist

If `/usr/bin/sg` is truly required, add a comment explaining why the SUID bit is necessary and why alternatives were rejected.

Copilot AI Feb 1, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a hardcoded system path /usr/bin/sg creates a dependency on the system installation outside of Nix's control. This breaks Nix's reproducibility guarantees and will fail on systems where /usr/bin/sg doesn't exist or differs. While the PR description mentions that the Nix-packaged sg lacks the SUID bit, consider one of these alternatives:

  1. Add the user to the docker group in the system configuration rather than using sg
  2. Use systemd's DynamicUser with appropriate group permissions
  3. Document that this is a system dependency requirement

This pattern is already used in cliproxyapi/default.nix (line 26), suggesting it's an accepted workaround in this codebase, but it's worth noting the limitation.

Suggested change
exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}"
exec ${pkgs.bash}/bin/bash ${./start-postgres.sh}

Copilot uses AI. Check for mistakes.

@cubic-dev-ai cubic-dev-ai Bot Feb 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Hardcoding /usr/bin/sg creates a host system dependency that breaks Nix's reproducibility guarantees. This path may not exist on pure NixOS installations or systems where sg is installed elsewhere. Consider adding a runtime check that fails gracefully with an informative error if the path doesn't exist, or make the path configurable. At minimum, add a comment explaining why the SUID-enabled system sg is required instead of the Nix-packaged version.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/services/docker-postgres/default.nix, line 5:

<comment>Hardcoding `/usr/bin/sg` creates a host system dependency that breaks Nix's reproducibility guarantees. This path may not exist on pure NixOS installations or systems where `sg` is installed elsewhere. Consider adding a runtime check that fails gracefully with an informative error if the path doesn't exist, or make the path configurable. At minimum, add a comment explaining why the SUID-enabled system `sg` is required instead of the Nix-packaged version.</comment>

<file context>
@@ -1,6 +1,9 @@
 let
   inherit (pkgs) lib;
+  startPostgresWrapper = pkgs.writeShellScript "start-postgres-wrapper" ''
+    exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}"
+  '';
 in
</file context>
Fix with Cubic

'';
Comment on lines +4 to +6

@gemini-code-assist gemini-code-assist Bot Feb 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Hardcoding /usr/bin/sg makes this configuration less portable and breaks the hermeticity that Nix aims for. It might fail on systems where sg is not at this path, such as a pure NixOS installation. While I understand from the PR description that this is a deliberate workaround for the SUID issue with the Nix-packaged sg, it's a trade-off worth highlighting. For better portability, you could consider making the path to sg configurable.

in
{
launchd.agents.docker-postgres = lib.mkIf pkgs.stdenv.isDarwin {
Expand Down Expand Up @@ -31,14 +34,16 @@ in
Service = {
Type = "oneshot";
RemainAfterExit = true;
Restart = "on-failure";

@mesa-dot-dev mesa-dot-dev Bot Feb 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

Using Restart = "on-failure" with Type = "oneshot" is unconventional. Oneshot services are designed to run once and exit successfully, then remain marked as active due to RemainAfterExit = true.

The restart logic may not behave as expected because:

  • If the service succeeds, it won't restart (by design)
  • If it fails during startup (e.g., Docker not ready), systemd will restart it
  • If it fails after success (e.g., container stops), systemd won't restart it because the service already exited successfully

Consider:

  1. Changing to Type = "simple" or Type = "forking" if you need ongoing monitoring
  2. Or, if the goal is just to retry on initial boot failures, document this specific use case in a comment

Fix in Cursor • Fix in Claude

Prompt for Agent 
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#710
File: home-manager/services/docker-postgres/default.nix#L37
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.

Feedback:
Using `Restart = "on-failure"` with `Type = "oneshot"` is unconventional. Oneshot services are designed to run once and exit successfully, then remain marked as active due to `RemainAfterExit = true`. 

The restart logic may not behave as expected because:
- If the service succeeds, it won't restart (by design)
- If it fails during startup (e.g., Docker not ready), systemd will restart it
- If it fails after success (e.g., container stops), systemd won't restart it because the service already exited successfully

Consider:
1. Changing to `Type = "simple"` or `Type = "forking"` if you need ongoing monitoring
2. Or, if the goal is just to retry on initial boot failures, document this specific use case in a comment

RestartSec = 30;
Environment = "PATH=${
lib.makeBinPath [
pkgs.bash
pkgs.coreutils
pkgs.docker
]
}";
ExecStart = "${pkgs.bash}/bin/bash ${./start-postgres.sh}";
ExecStart = "${startPostgresWrapper}";
};
Install = {
WantedBy = [ "default.target" ];
Expand Down
2 changes: 2 additions & 0 deletions home-manager/services/make-updater/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,14 @@ in
"PATH=${
lib.makeBinPath [
pkgs.bash
pkgs.cargo
pkgs.coreutils
pkgs.curl
pkgs.gawk
pkgs.git
pkgs.gnumake
pkgs.gnused
pkgs.go
pkgs.nix
pkgs.sudo
pkgs.which
Expand Down
Loading