@@ -142,11 +142,17 @@
142142 fishRoot
143143 pkgsLinux.nix
144144 pkgsLinux.cacert
145+ # Networking glue glibc needs: /etc/nsswitch.conf (+passwd,
146+ # group) so DNS/host lookups resolve, and /etc/protocols,
147+ # /etc/services. Without these, hostname resolution fails.
148+ pkgsLinux.fakeNss
149+ pkgsLinux.iana-etc
145150 ];
151+ # Link all of /etc so the above files (nsswitch.conf, protocols,
152+ # services, passwd, group, ssl certs, fish prompt) are present.
146153 pathsToLink = [
147154 "/bin"
148− "/etc/fish"
149− "/etc/ssl"
155+ "/etc"
150156 ];
151157 };
152158
@@ -168,9 +174,11 @@
168174 "HOME=/root"
169175 # Marker so shells/scripts can detect they're in here.
170176 "NIX_CONTAINER=1"
171− # Make the bundled Nix usable: TLS for substituters/flakes,
172− # flake commands on, and single-user (no daemon/nixbld).
177+ # CA trust for every TLS client (curl/git/…) and Nix.
178+ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
173179 "NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
180+ # Make the bundled Nix usable: flake commands on, and
181+ # single-user (no daemon/nixbld).
174182 "NIX_CONFIG=experimental-features = nix-command flakes\nbuild-users-group =\nsandbox = false"
175183 ];
176184 };