Change:
Nixpkgs's package of Sylabs SingularityCE () now fails to execute image. After initial examination, the known cause is the failure to substitute default FHS s for some files, but the fix is WIP. Steps to reproduce the behavior: error. should succeed. If applicable, add screenshots to help explain your problem. Add any other context about the problem here. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
singularity isn't supposed to work without setuid?
Yup. The error seems to result from failure to replace all the default paths after source file hierarchy changes.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:

Discussion:
- `appimageTools.wrapAppImage` now creates the binary at `$out/bin/${pname}` rather than `$out/bin/${pname}-${version}`, which will break downstream workarounds. <ins> - `apptainer` and `singularity` now prioritize system-wide `PATH` over those constructed from dependent packages when searching for third-party utilities. The `PATH` to search for third-party utilities, known as `defaultPath` inside Apptainer/Singularity source code, is now constructed from the following sources, ordered by their precedence: - `systemBinPaths`, a new argument introduced to specify system-wide `"/**/bin"` directories. - The FHS `defaultPath` value set by Apptainer/Singularity developers, making Apptainer/Singularity work out of the box in FHS systems. - `defaultPathInputs`, a list of packages to form the fall-back `PATH`. This change is required to enable Sylabs SingularityCE (`singularity`) to run images, as it requires a `fusermount3` commant with the SUID bit set. `newuidmapPath` and `newgidmapPath` arguments are deprecated in favour of `systemBinPaths`. Their support will be removed in future releases. `programs.singularity.systemBinPaths` option is introduced to specify the `systemBinPaths` argument of the overridden package. It includes `"/run/wrappers/bin"` even if specified empty. `programs.singularity.enableFakeroot` option is deprecated and has no effect. `--fakeroot` support is now always enabled as long as `programs.singularity.systemBinPaths` is not forcefully overridden. </ins> - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use ```nix

enableFakeroot = lib.mkOption { type = lib.types.bool; default = true; <del> example = false; </del> description = '' Whether to enable the `--fakeroot` support of Singularity/Apptainer. <ins> This option is deprecated and has no effect. `--fakeroot` support is enabled automatically, as `systemBinPaths = [ "/run/wrappers/bin" ]` is always specified. </ins> ''; }; enableSuid = lib.mkOption {

Whether to enable the SUID support of Singularity/Apptainer. ''; }; <ins> systemBinPaths = lib.mkOption { type = lib.types.listOf lib.types.path; default = [ ]; description = '' (Extra) system-wide /**/bin paths for Apptainer/Singularity to find command-line utilities in. `"/run/wrappers/bin"` is included by default to make utilities with SUID bit set available to Apptainer/Singularity. Use `lib.mkForce` to shadow the default values. ''; }; </ins> }; config = lib.mkIf cfg.enable { programs.singularity.packageOverriden = ( cfg.package.override ( <del> lib.optionalAttrs cfg.enableExternalLocalStateDir { externalLocalStateDir = "/var/lib"; } // lib.optionalAttrs cfg.enableFakeroot { newuidmapPath = "/run/wrappers/bin/newuidmap"; newgidmapPath = "/run/wrappers/bin/newgidmap"; </del> <ins> { systemBinPaths = cfg.systemBinPaths; </ins> } <ins> // lib.optionalAttrs cfg.enableExternalLocalStateDir { externalLocalStateDir = "/var/lib"; } </ins> // lib.optionalAttrs cfg.enableSuid { enableSuid = true; starterSuidPath = "/run/wrappers/bin/${cfg.package.projectName}-suid"; } ) ); <ins> programs.singularity.systemBinPaths = [ "/run/wrappers/bin" ]; </ins> environment.systemPackages = [ cfg.packageOverriden ]; security.wrappers."${cfg.packageOverriden.projectName}-suid" = lib.mkIf cfg.enableSuid { setuid = true;

# Whether to compile with SUID support enableSuid ? false, starterSuidPath ? null, <del> # newuidmapPath and newgidmapPath are to support --fakeroot # where those SUID-ed executables are unavailable from the FHS system PATH. </del> <ins> # Extra system-wide /**/bin paths to prefix, # useful to specify directories containing binaries with SUID bit set. # The paths take higher precedence over the FHS system PATH specified # inside the upstream source code. # Include "/run/wrappers/bin" by default for the convenience of NixOS users. systemBinPaths ? [ "/run/wrappers/bin" ], </ins> # Path to SUID-ed newuidmap executable <ins> # Deprecated in favour of systemBinPaths # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off </ins> newuidmapPath ? null, # Path to SUID-ed newgidmap executable <ins> # Deprecated in favour of systemBinPaths # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off </ins> newgidmapPath ? null, # External LOCALSTATEDIR externalLocalStateDir ? null,

vendorHash ? _defaultGoVendorArgs.vendorHash, deleteVendor ? _defaultGoVendorArgs.deleteVendor, proxyVendor ? _defaultGoVendorArgs.proxyVendor, <del> }: </del> <ins> }@args: </ins> let <ins> # Backward compatibility for privileged-un-utils. # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off. </ins> privileged-un-utils = if ((newuidmapPath == null) && (newgidmapPath == null)) then null else <del> (runCommandLocal "privileged-un-utils" { } '' mkdir -p "$out/bin" ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap" ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap" ''); </del> <ins> lib.warn "${pname}: arguments newuidmapPath and newgidmapPath is deprecated in favour of systemBinPaths." ( runCommandLocal "privileged-un-utils" { } '' mkdir -p "$out/bin" ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap" ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap" '' ); # Backward compatibility for privileged-un-utils. # TODO(@ShamrockLee): Remove after Nixpkgs 24.05 branch-off. systemBinPaths = lib.optional (privileged-un-utils != null) (lib.makeBinPath [ privileged-un-utils ]) ++ args.systemBinPaths or [ "/run/wrappers/bin" ]; </ins> concatMapStringAttrsSep = sep: f: attrs:

# causes redefinition of _FORTIFY_SOURCE hardeningDisable = [ "fortify3" ]; <del> # Packages to prefix to the Apptainer/Singularity container runtime default PATH # Use overrideAttrs to override </del> <ins> # Packages to provide fallback bin paths # to the Apptainer/Singularity container runtime default PATHs. # Override with `<pkg>.overrideAttrs`. </ins> defaultPathInputs = [ bash coreutils

fuse2fs # Mount ext3 filesystems go mount # mount <del> privileged-un-utils </del> squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges ] ++ lib.optional enableNvidiaContainerCli nvidia-docker;

lib.concatStringsSep " " [ "--replace-fail" (addShellDoubleQuotes (lib.escapeShellArg originalDefaultPath)) <del> (addShellDoubleQuotes ''$inputsDefaultPath''${inputsDefaultPath:+:}${lib.escapeShellArg originalDefaultPath}'') </del> <ins> (addShellDoubleQuotes ''$systemDefaultPath''${systemDefaultPath:+:}${lib.escapeShellArg originalDefaultPath}''${inputsDefaultPath:+:}$inputsDefaultPath'') </ins> ] ) originalDefaultPaths }

postFixup = '' substituteInPlace "$out/bin/run-singularity"  --replace "/usr/bin/env ${projectName}" "$out/bin/${projectName}" <ins> # Respect PATH from the environment/the user. # Fallback to bin paths provided by Nixpkgs packages. </ins> wrapProgram "$out/bin/${projectName}"  <del> --prefix PATH : "$inputsDefaultPath" </del> <ins> --suffix PATH : "$systemDefaultPath"  --suffix PATH : "$inputsDefaultPath" </ins> # Make changes in the config file ${lib.optionalString forceNvcCli '' substituteInPlace "$out/etc/${projectName}/${projectName}.conf" 

}).overrideAttrs ( finalAttrs: prevAttrs: { <ins> systemDefaultPath = lib.concatStringsSep ":" systemBinPaths; </ins> inputsDefaultPath = lib.makeBinPath finalAttrs.defaultPathInputs; passthru = prevAttrs.passthru or { } // { inherit sourceFilesWithDefaultPaths;