Native Linux builder: `cp --no-preserve=mode` fails with "Permission denied"

[tjni]

Summary

cp --no-preserve=mode fails with "Permission denied" when building derivations via the native Linux builder on macOS.

Claude's research suggests it might be related to Apple's VirtioFS passthrough enforcing host permission semantics when guest/host UIDs don't match.

Reproducer

On an aarch64-darwin Mac with the native Linux builder enabled:

# flake.nix
{
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";

  outputs = { nixpkgs, ... }:
    let
      pkgs = import nixpkgs { system = "x86_64-linux"; };
      srcFile = pkgs.writeText "testfile" "hello world";
    in
    {
      packages.x86_64-linux.default = pkgs.runCommand "cp-no-preserve-test" {} ''
        mkdir -p $out
        cp --no-preserve=mode ${srcFile} $out/testfile
      '';
    };
}

$ nix build .#packages.x86_64-linux.default
error: Cannot build '/nix/store/6x7k20wwhgzykp972lnffck3p6r23f7i-cp-no-preserve-test.drv'.
       Reason: builder failed with exit code 1.
       Output paths:
         /nix/store/rahrnx5bl5c4h2hxb6a7ssrvbvwrfnwi-cp-no-preserve-test
       Last 1 log lines:
       > cp: setting permissions for '/nix/store/rahrnx5bl5c4h2hxb6a7ssrvbvwrfnwi-cp-no-preserve-test/testfile': Permission denied

Real use case

Building any NixOS configuration with Caddy enabled fails, as the NixOS Caddy module uses cp --no-preserve=mode internally:

nix build --impure --expr '
  (import <nixpkgs/nixos> {
    system = "x86_64-linux";
    configuration = {
      services.caddy.enable = true;
      services.caddy.virtualHosts."localhost".extraConfig = "respond \"hello\"";
      fileSystems."/".device = "none";
      fileSystems."/".fsType = "ext4";
      boot.loader.grub.device = "nodev";
      system.stateVersion = "25.11";
    };
  }).config.system.build.toplevel
'

error: Cannot build '/nix/store/...-Caddyfile-formatted.drv'.
       Reason: builder failed with exit code 1.
       Output paths:
         /nix/store/...-Caddyfile-formatted
       Last 1 log lines:
       > cp: setting permissions for '/nix/store/...-Caddyfile-formatted/Caddyfile': Permission denied

Environment

• macOS (aarch64-darwin)
• Determinate Nix 3.17.2
• Native Linux builder feature enabled

[simonzkl]

I've ran into the exact same issue with Caddyfile-formatted.

[cole-h]

Unfortunately, this is a shortcoming of macOS's Virtualization.framework (specifically, the virtio driver they give us) combined with, IMVHO, weird behavior in cp. I wrote up my findings when I fixed this bug in ipetkov/crane#964, which has some more context on what the actual issue is.

The only thing we can do is fix the places that do --no-preserve=mode (like I did in that PR) -- there are no knobs in Virtualization.framework that we can use to help us fix this, unfortunately :/