# Nested chrooting in daemonless rootless Nix? **URL:** \ **Category:** Ask Fedora\ **Tags:** nix, silverblue\ **Created:** [October 18, 2026, 2:27pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330 "2026-10-18T14:27:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![antrmn](https://avatars.discourse-cdn.com/v4/letter/a/db3279/32.png) [@antrmn](https://discussion.fedoraproject.org/u/antrmn)\ **Post date:** [October 18, 2026, 2:27pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/1 "2026-10-18T14:27:37Z")
I’m using Silverblue with nix-coire. If i run a program from a flake (Say, Emacs), can’t I open another nix shell inside it? This is what I get when trying to `nix shell` inside Emacs (which is installed from a flake): ```plaintext antonio@X13:~/nix/devenv$ nix shell error: setting up a private mount namespace: Operation not permitted ``` So it seems that a downside of rootless chroot is that they can’t be nested. Is there no workaround? ---
**Author:** ![ssynxx](https://sea1.discourse-cdn.com/fedoraproject/user_avatar/discussion.fedoraproject.org/ssynxx/32/57658_2.png) [@ssynxx](https://discussion.fedoraproject.org/u/ssynxx)\ **Post date:** [October 18, 2026, 3:38pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/2 "2026-10-18T15:38:18Z")
The error comes from Nix trying to set up its own private mount namespace, which isn’t permitted in your current environment. One thing worth trying is: ```bash nix shell --store local ``` You can also try setting it for just that command: ```bash NIX_CONFIG='store = local' nix shell ``` This makes Nix use the local store directly, but I’m not sure it’ll fix the namespace error with nix-coire. I’d try it first rather than changing your global `nix.conf`, since that could affect your setup outside the environment too. I couldn’t find documentation for nix-coire, so if this doesn’t work, its README or the project’s author might be able to clarify how its isolation works. ---
**Author:** ![antrmn](https://avatars.discourse-cdn.com/v4/letter/a/db3279/32.png) [@antrmn](https://discussion.fedoraproject.org/u/antrmn)\ **Post date:** [October 18, 2026, 4:20pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/3 "2026-10-18T16:20:35Z")
> nix-coire It actually is `nix-core`. Sorry for the typo. It’s in the Fedora repository ([here](https://packages.fedoraproject.org/pkgs/nix/nix-core/)) and some documentation is [here](https://fedoraproject.org/wiki/Changes/Nix_package_tool). Trying to `nix shell --store local` results in the following: ```plaintext antonio@X13:~/nix/devenv$ nix shell --store local error: creating directory "/nix/store": Read-only file system ``` ---
**Author:** ![chillzone](https://sea1.discourse-cdn.com/fedoraproject/user_avatar/discussion.fedoraproject.org/chillzone/32/56762_2.png) [@chillzone](https://discussion.fedoraproject.org/u/chillzone)\ **Post date:** [October 18, 2026, 4:54pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/4 "2026-10-18T16:54:20Z")
> [@antrmn](#): > > So it seems that a downside of rootless chroot is that they can’t be nested. Is there no workaround? This is a **hard kernel restriction** , not a configuration issue. Since Linux 3.9, the kernel returns `EPERM` when `CLONE_NEWUSER` is requested and the caller is in a chroot environment (i.e., the caller’s root directory doesn’t match the mount namespace root). So once you’re inside a `chroot`, you cannot create another user namespace — and therefore cannot do a second `unshare -r`. I’ve had success using something like this:(Never on a Atomic system though) **use `pivot_root` instead of `chroot`.** `pivot_root` actually changes the mount namespace root, so the kernel’s “is the caller in a chroot?” check doesn’t trigger. You can then create nested user namespaces freely (the kernel allows up to 32 levels). A minimal pattern: ```plaintext # Outer level unshare -rm bash -c ' # pivot_root into the first rootfs mkdir /mnt/newroot /mnt/oldroot mount --bind /path/to/rootfs1 /mnt/newroot cd /mnt/newroot pivot_root . /mnt/oldroot umount -l /mnt/oldroot # Now you can create a SECOND user namespace inside unshare -rm bash -c " # pivot_root into the second rootfs mkdir /mnt/newroot /mnt/oldroot mount --bind /path/to/rootfs2 /mnt/newroot cd /mnt/newroot pivot_root . /mnt/oldroot umount -l /mnt/oldroot exec /bin/bash " ' ``` **Practical caveats:** - You need `mount --bind` to make the target a proper mount point before `pivot_root`. - You must clean up the old root (`umount -l /mnt/oldroot`) to avoid leaking. - If you’re on a hardened system, check `user.max_user_namespaces` (or `kernel.unprivileged_userns_clone` on Debian/Ubuntu) — if set to 0, even the first `unshare -U` will fail regardless of nesting. **Alternative approach:** avoid nesting entirely. If the goal is to run Nix inside a sandbox, do all the mount setup (including the Nix store) in a single namespace rather than trying to layer chroots. Reading my notes I did use some AI suggests. ---
**Author:** ![ssynxx](https://sea1.discourse-cdn.com/fedoraproject/user_avatar/discussion.fedoraproject.org/ssynxx/32/57658_2.png) [@ssynxx](https://discussion.fedoraproject.org/u/ssynxx)\ **Post date:** [October 19, 2026, 4:42am UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/5 "2026-10-19T04:42:24Z")
Thanks for the explanation, and sorry, my earlier suggestion about `--store local` was wrong for this setup. Starting Emacs from the dev shell is a possible workaround if you just need the development environment: ```bash cd ~/nix/devenv nix develop --command emacs ``` The `pivot_root` approach is interesting too, though I’m not sure how practical it would be to implement in nix-core on Silverblue. ---
**Author:** ![antrmn](https://avatars.discourse-cdn.com/v4/letter/a/db3279/32.png) [@antrmn](https://discussion.fedoraproject.org/u/antrmn)\ **Post date:** [October 19, 2026, 1:35pm UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/6 "2026-10-19T13:35:31Z")
> nix develop --command emacs I don’t really understand how Nix works, but it seems that `develop` does not bring flake-defined utilities in PATH. ```plaintext antonio@X13:~/nix/devenv$ nix develop --command emacs error (ignored): package 'nixpkgs#bashInteractive' does not provide a 'bin/bash' /tmp/nix-shell.kGrXbO: line 2009: exec: emacs: not found ``` I’m using Nix to install Emacs in Fedora along with some additional toolings like ripgrep. Such are defined in `~/.nix/devenv/flake.nix`. Inside of Emacs I want to be able to use Nix to make use of flakes for different projects. Thus the need for nested chroots: I can’t `nix shell` (or similar) since Emacs is itself ran with `nix shell`. `pivot_root` seems like a complex setup. I might try it as a last resort. ---
**Author:** ![ssynxx](https://sea1.discourse-cdn.com/fedoraproject/user_avatar/discussion.fedoraproject.org/ssynxx/32/57658_2.png) [@ssynxx](https://discussion.fedoraproject.org/u/ssynxx)\ **Post date:** [October 20, 2026, 7:24am UTC](https://discussion.fedoraproject.org/t/nested-chrooting-in-daemonless-rootless-nix/205330/7 "2026-10-20T07:24:00Z")
yeah, my `nix develop` suggestion wasn’t the right fit here. It won’t automatically put Emacs from your tools flake on PATH. The issue is that `nix-core`’s rootless chroot prevents Nix from creating the nested user namespace it needs. I don’t know of a reliable fix for nesting Nix this way on Silverblue. The practical workaround is to run Emacs outside the chroot and let it use `nix develop` or direnv for each project. If you specifically need Emacs to run inside the chroot, `pivot_root` might be worth investigating