Changelog: a native Linux builder for macOS

Determinate Nix version 3.8.4 is now available and we’re extremely happy to report that it introduces one of our most vital features yet: a native Linux builder for macOS. That’s right: with Determinate Nix you can now build Linux derivations on macOS without pulling from a cache or running a remote builder, a Docker image, or a Linux virtual machine—a massive step up in cross-platform collaboration and a testament to Determinate Systems’ deep commitment to making macOS a first-class platform for Nix.

Imagine being on your MacBook Air and being able to build an ARM Linux package without even thinking about it:

nix build nixpkgs#legacyPackages.aarch64-linux.cowsay

Or even an x86 Linux package:

nix build nixpkgs#legacyPackages.x86_64-linux.cowsay

This is now possible with Determinate Nix. The native Linux builder is currently in developer preview mode and will slowly be rolled out to Determinate Nix users over the coming weeks. But if you’re eager to try it out now, reach out to us at support@determinate.systems.

Why we did it

Why a native Linux builder for Nix? Because fundamentally, all Nix derivations are system specific, which means that, generally speaking, Nix can only build for the current host system (the one you get when you evaluate builtins.currentSystem). Are you on a recent macOS system? Then you can only build for aarch64-darwin.

Want to build something for Linux, like a NixOS system or a Docker image? Then you generally need to build on a remote builder, pull from a cache, or even spin up a Docker container. These solutions do work but they all require varying levels of setup and they’re far less ergonomic than a straightforward nix build.

How it works

In a nutshell, Determinate Nix uses macOS’s recently introduced built-in Virtualization framework. Determinate Nixd, a helper tool for Determinate Nix, calls some Swift code that uses that framework to realise your derivation.

In terms of configuration, the Determinate Nix CLI now has an external-builders experimental feature that needs to be enabled as well as an external-builders setting that enables you to pass an external builders configuration as JSON (note that “external” in this case means external to Nix and not remote).

Here’s an example Nix configuration that would delegate Linux builds to the Virtualization framework via Determinate Nixd:

extra-experimental-features = external-builders
external-builders = [{"systems":["aarch64-linux","x86_64-linux"],"program":"/usr/local/bin/determinate-nixd","args":["builder"]}]

Please note that this configuration snippet does not yet work for most Determinate Nix users, as we’ll be rolling this feature out incrementally over time (and only to macOS systems, of course). At any time, you can see if this feature is enabled by either checking your configuration at /etc/nix/nix.conf for lines like the ones above or, better, by running this Determinate Nixd command:

determinate-nixd version

If you see the message The feature native-linux-builder is enabled then you can start building for Linux now.

You can see some of the work that went into the Nix side of this in these pull requests:

As always, don’t hesitate to reach out to us with questions or feedback on Discord or via email at hello@determinate-systems.

Finally, special thanks go to Determinate Systems engineer Cole Helbling, whose concerted efforts were the driving force behind this feature.

How to get Determinate Nix

If you already have Determinate Nix installed, you can upgrade to 3.8.4 with one Determinate Nixd command:

sudo determinate-nixd upgrade

If you don’t yet have Determinate Nix installed, you can upgrade or migrate to Determinate Nix on macOS using our graphical installer:

Install Determinate Nix on macOS now

Apple Silicon and Intel

On Linux:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
  sh -s -- install --determinate

On NixOS, we recommend using our dedicated NixOS module or our NixOS ISO (NixOS installer for x86_64, NixOS installer for ARM) with Determinate Nix pre-installed.

On GitHub Actions:

on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  nix-ci:
    runs-on: ubuntu-latest
    # Include this block to log in to FlakeHub and access private flakes
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/determinate-nix-action@v3
      - uses: DeterminateSystems/flakehub-cache-action@main
      - uses: DeterminateSystems/nix-flake-checker-action@main
      - run: nix flake check

In Amazon Web Services:

data "aws_ami" "detsys_nixos" {
  most_recent = true
  owners      = ["535002876703"]

  filter {
    name   = "name"
    values = ["determinate/nixos/epoch-1/*"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}