nix-copy-closure your nix-shell

Published 2020-09-28 on Farid Zakaria's Blog

This is a synopsis of I recommend reading it for additional detail. Many thanks to contributors on the issue like Infinisil for adding context.

Someone reached out to me over e-mail to discuss my previous post on caching your nix-shell.

“What I wish to do is to copy a particular development environment (nix-shell) from A to B, so that I could run nix-shell on server B. Server B is only accessible through SSH and does not have Internet access.”

Seems straightforward, so let’s investigate. Let’s use a very basic shell.nix file.

Very important we make sure to pin nixpkgs. In the example below I do it inline in the Nix expression but you can also use niv or pin the channel to a particular commit.

  nixpkgs = import (builtins.fetchTarball {
    name = "nixos-unstable-2020-09-24";
    url =
    sha256 = "05gawlhizp85agdpw3kpjn41vggdiywbabsbmk76r2dr513188jz";
  }) { };
in with nixpkgs;
with stdenv;
with stdenv.lib;
mkShell {
  name = "example-shell";
  buildInputs = [ hello ];
  shellHook = ''
    export MESSAGE="$(hello)";

Let’s see it in action:

❯ nix-shell shell.nix

[nix-shell:~/code/nix/playground]$ echo $MESSAGE
Hello, world!

Recently an improvement #95536 by Infinisil made the workflow to discover the transitive runtime closure much simpler than what I had blogged about.

✨ A new attribute for derivations inputDerivation is introduced that is always buildable and whose runtime dependences are it’s build dependencies; exactly what we need for nix-shell!

❯ nix-build --no-out-link shell.nix -A inputDerivation
these derivations will be built:
building '/nix/store/bjn4imm9dw7xnxpjrwyrpk0wsy0j7xwh-example-shell.drv'...

We now have a store path /nix/store/rw6i1wk9iv0286xi2b6kpw4ynk4pldyh-example-shell which we can check the immediate dependencies.

The below is simply the immediate dependencies and not the full transitive closure for brevity.

❯ nix-store --query --references \


I will now copy the shell.nix file to my other machine & copy the transitive closure to it.

❯ scp shell.nix machine-b:~

❯ nix-copy-closure --to machine-b \
copying 36 paths...

Let’s hop on machine B and create a network namespace to pretend we do not have Internet access.

A network namespace is logically another copy of the network stack, with its own routes, firewall rules, and network devices.

❯ ssh machine-b

# since we won't have any Internet access, hydrate the cache
# with our nixpkgs version
❯ nix-prefetch-url --unpack \ \
--name "nixos-unstable-2020-09-24"sudo ip netns add nixshell
# enter the namespacesudo ip netns exec nixshell su $USER -c zsh

# let's confirm we do not have Internet access
❯ ping
ping: Temporary failure in name resolution

Let’s fire up our nix-shell and see if it works.

# don't forget we are within our network namespace
# without access to the Internet
❯ nix-shell shell.nix
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell

[nix-shell:~]$ echo $MESSAGE
Hello, world!

🎆 Huzzah! We have now copied over our development environment hermetically with the help of Nix. This is a great demonstration of the power of Nix & reproducibility.

An important take-away though is that it’s important to make sure we pin the exact version of nixpkgs otherwise the nix-shell may calculate different hashes.

Do you have an interesting workflow or innovative use of Nix with development environments? Let me know about it.