Subject: [bug#75810] [PATCH 0/6] Rootless guix-daemon

From: Noé Lopez <[email-masked]>
Date: Mon, 27 Jan 2025 22:51:08 +0100

Hi Ludovic,

If the store is not read-only, is there not a risk of applications
running as root modifying their own files in the store?

As a possible solution, maybe it is possible to have a modifiable store
directory for the daemon and a read-only bind mount as /gnu/store.  If
it does not have performance implications, applications would be started
from /gnu/store as usual and the builder can still use the other
directory.

What do you think?
Noé