DerivationBuilder, extracting Nix's sandboxing logic for library use (nixcon2025)

The most subtle part of Nix's store layer is the exact logic used to sandbox derivations. Mess up the daemon protocol, Local Store SQLite usage, drv file parsing, or other such things, and things should blow up immediately. Fail Fast helps a lot! Mess up the sandboxing logic, however, and you might not notice for a while until you try to build just the right sort of derivation. For most of Nix's history, the sandboxing logic has been embedded within the build scheduling logic (which builds or downloades dependencies) thus entangling it with hefty other machinery that makes all sorts of assumption about how IO, concurrency, etc. should work. In other words, it was not written in a way that made it easy to use from any other program but Nix itself. In the last few months, however, we've finally untangled it and moved it into its own component, and then reworked it to give it a simple interface for FFI. In this talk, we'll briefly go over that work, and then demonstrate its use a simple example executable written in a friendlier language than C++. about this event: https://talks.nixcon.org/nixcon-2025/talk/ZAHLMN/