Commands should not require a network connection if all dependencies are available locally

[mightybyte]

I've encountered situations where I am somewhere with no internet connection and tools like nix-build, nix-shell, nix-env, etc. fail with some kind of network error even though I know all the dependencies exist locally. It would be really nice if the default behavior didn't make any network requests if all the dependencies are already in the local nix cache.

[copumpkin]

They fail? Commands like nix-build will try to see if the build you're requesting is already available in upstream binary caches (this can be disabled easily) and spit out an admittedly ugly warning if it can't get that, but I've never seen Nix fail due to lack of network if indeed all needed dependencies are available. Do you have a log of the situation you encountered?

[mightybyte]

Yep, I just ran nix-build on a local project. Then I disconnected from the network and ran nix-build again. Here's what I got:

$ nix-build
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 298 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 673 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 1290 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 2414 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 5301 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 9163 ms
warning: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6); retrying in 16052 ms
error: unable to download 'https://cache.nixos.org/3ri6rw1mpz82v8y804f5hsyigsd8d31a.narinfo': Couldn't resolve host name (6)
$

[teto]

when I (often) lose the network, nix-build stays stuck for minutes too (I kill it before being able to see anything). I do think I have all inputs locally.

@mightybyte maybe try with keep-derivations = true in your config ?

    nix.extraOptions = ''
      # careful will prevent from fetching local git !
      build-use-sandbox = true
      gc-keep-outputs = true
      # http-connections = 25 is the default
      http2 = true
      keep-derivations = true
      keep-failed = true
      show-trace = true
    '';

[mightybyte]

@teto Setting keep-derivations didn't seem to make a difference.

[edolstra]

Try --no-substitute.

[mightybyte]

Using --no-substitute seems to work, but only with nix 2.0. I also was unable to find it mentioned in any of the documentation anywhere. It doesn't show up in nix --help or nix build --help. Also, it seems to me that this should be the default behavior and not require a special command line flag.

[no-longer-on-githu-b]

Another problem with --no-substitute is that it doesn’t use the cache if a network is available.

There should be an option satisfying both these constraints, for sometimes-offline development workflows:

• If there is no network access, build from source.
• If there is network access, try cache first.

When I got back online and forgot to remove the flag, and I added a new dependency, I spent an hour figuring out why it wouldn’t take the dependency from the cache.

[nomeata]

I was just on a train without network, and was not able to do the hacking I wanted, so I was about to report something like this, but I guess not worth opening a duplicate issue.

In fact, what I would like is a flag --offline that makes nix works without any network access, and just does as much as possible (i.e. don’t use substitutes, don’t use remote builders, don’t fetch stuff from the network).

But maybe that would not actually be needed if nix would simply fail more gracefully (and more quickly) if, say, a cache is not available.

[nomeata]

Possible duplicate or related issue: #1195

Also related: #2022

[ggreif]

nix build --no-net will do what you want, potentially. Can you verify? (The flag is present in v2.3.3, maybe earlier too.)

[fzakaria]

Here is a current example of how nix-shell requires internet access; I was looking into an issue for Zoran Bošnjak zoran.bosnjak@via.si.

First let's create a really simple/dummy shell.nix file.

let nixpkgs = import <nixpkgs> {};
in
with nixpkgs;
with stdenv;
with stdenv.lib;
mkShell {
  name = "example-shell";
  buildInputs = [ python ];
  TEST="${chromium}";
  shellHook = ''
    export WORLD=hello;
  '';
}

I then produce the runtime closure for the shell using @infinisil new inputDerivation feature.

❯ nix-build shell.nix -A inputDerivation -I nixpkgs=/home/fmzakari/code/github.com/NixOS/nixpkgs
these derivations will be built:
  /nix/store/zcws9rkx2l3dvx11ic1qf4n54fa4dvf5-example-shell.drv
building '/nix/store/zcws9rkx2l3dvx11ic1qf4n54fa4dvf5-example-shell.drv'...

/nix/store/s8j0jd9c378zlp09c6sk6awdd39mwp1r-example-shell

I then copy the closure to another machine.

❯ nix-copy-closure --to fmzakari@my-other-machine /nix/store/s8j0jd9c378zlp09c6sk6awdd39mwp1r-example-shell

Now I create a Network Namespace on the other machine. This is to test not having Internet access.

❯ ssh my-other-machine
❯ sudo ip netns add nixshell
❯ sudo ip netns exec zsh
❯ sudo ip netns exec nixshell zsh
❯ su fmzakari

❯ ping google.com
ping: google.com: Temporary failure in name resolution

I now try to nix-shell shell.nix on the other machine. This should work; since I have copied over the whole closure.
However I face the dreaded failure above.

❯ nix-shell shell.nix
warning: unable to download 'https://cache.nixos.org/8g173sw8sbxizjsidybwd1vs3zbq1n8x.narinfo': Couldn't resolve host name (6); retrying in 264 ms
warning: unable to download 'https://cache.nixos.org/8g173sw8sbxizjsidybwd1vs3zbq1n8x.narinfo': Couldn't resolve host name (6); retrying in 668 ms
warning: unable to download 'https://cache.nixos.org/8g173sw8sbxizjsidybwd1vs3zbq1n8x.narinfo': Couldn't resolve host name (6); retrying in 1119 ms
warning: unable to download 'https://cache.nixos.org/8g173sw8sbxizjsidybwd1vs3zbq1n8x.narinfo': Couldn't resolve host name (6); retrying in 2490 ms
error: unable to download 'https://cache.nixos.org/8g173sw8sbxizjsidybwd1vs3zbq1n8x.narinfo': Couldn't resolve host name (6)

Using --no-substitute is not helpful either, since the sources don't exist.

[teto]

you could try nixUnstable, there is a --no-net option and the default is also much better, with automatic fallback on --not-net with a warning.