mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-10-30 16:10:36 +00:00
89aec6e40d
The Gradle client could not connect to its single-use daemon: the
daemon binds to 127.0.0.1, but the Nix darwin sandbox denies connect()
to 127.0.0.1 on hosts where "localhost" resolves to ::1 first. Since
Nix replaced the interface-based loopback filters
`(allow network* (local ip) (local tcp) (local udp))` with
`(allow network* (remote ip "localhost:*"))`, the only permitted
loopback address in that filter is ::1, and literal IPs like
"127.0.0.1:*" are rejected by the sandbox compiler with "host must be
* or localhost in network address".
The extension is affected because its mitmCache causes the Gradle
setup hook to pass JVM system properties on the command line, which
makes Gradle fork a single-use daemon that the client must reach over
loopback TCP.
Fix it by appending an interface-based loopback allowance to the
sandbox profile on Darwin via the sandboxProfile derivation attribute:
(allow network* (local ip))
Linux builds are unaffected and keep an empty sandbox profile.
Assisted-by: OpenCode (GLM-5.3-Flash)