Back Original

How I Rescued My Unprivileged <code class="verbatim">guix-daemon</code>

First, I double checked to get the exact path to the Guix daemon executable and the flags used:

  sudo systemctl status guix-daemon
● guix-daemon.service - Build daemon for GNU Guix
     Loaded: loaded (/etc/systemd/system/guix-daemon.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-07-10 18:27:25 UTC; 21min ago
 Invocation: 5f43e0237e634071a0ec263ef4713147
    Process: 6131 ExecStartPre=systemctl stop gnu-store.mount (code=exited, status=0/SUCCESS)
    Process: 6134 ExecStartPost=systemctl start gnu-store.mount --no-block (code=exited, status=0/SUCCESS)
   Main PID: 6132 (guix-daemon)
      Tasks: 1 (limit: 8192)
     Memory: 1.8M (peak: 133.3M)
        CPU: 1.164s
     CGroup: /system.slice/guix-daemon.service
             └─6132 guix-daemon --discover=yes "--substitute-urls=https://bordeaux.guix.gnu.org https://ci.guix.gnu.org"

I can see that the unit file for my daemon service is present at /etc/systemd/system/guix-daemon.service, so let's peek inside there:

  # [snip]
  [Service]
  ExecStart=/var/guix/profiles/per-user/root/current-guix/bin/guix-daemon \
      --discover=yes \
      --substitute-urls='https://bordeaux.guix.gnu.org https://ci.guix.gnu.org'
  Environment='GUIX_STATE_DIRECTORY=/var/guix' 'GUIX_LOCPATH=/var/guix/profiles/per-user/root/guix-profile/lib/locale' LC_ALL=en_US.utf8
  # [snip]

This tells us what we need to know: the exact path to the guix-daemon binary, the exact flags used, and relevant environment variables.

So now that we've done our research, we stop the daemon and run it again as root (inside the container):

  sudo systemctl stop guix-daemon
  sudo -i [env] [guix-daemon] [args]

In my case, the latter invocation looks like:

  sudo -i \
       GUIX_STATE_DIRECTORY=/var/guix \
       GUIX_LOCPATH=/var/guix/profiles/per-user/root/guix-profile/lib/locale \
       LC_ALL=en_US.utf8 \
       /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon \
       --discover=yes \
       --substitute-urls='https://bordeaux.guix.gnu.org https://ci.guix.gnu.org'