Install Nix in the web sandbox

Nix is the most general way to install tools in the Claude Code web sandbox. The sandbox network is locked to package registries plus this session's GitHub repos, but two facts make Nix work anyway:

• apt reaches the main Ubuntu archive, and nix-bin is in it.
• cache.nixos.org and channels.nixos.org are reachable through the proxy, so

Nix substitutes prebuilt binaries and pulls the nixpkgs expression without any GitHub access.

Scope: web sandbox only (CLAUDE_CODE_REMOTE=true). On a real machine Nix is already the system package manager — do not run this there.

Step 0 — Verify the network path (usually already open)

bash
curl -sSI -o /dev/null -w "cache:    %{http_code}\n" https://cache.nixos.org
curl -sSI -o /dev/null -w "channels: %{http_code}\n" https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz

200/302 on both → proceed. If either is blocked, the environment's network policy is stricter than default; widen it (claude.ai environment editor → network / allowed hosts) to include cache.nixos.org and channels.nixos.org.

Step 1 — Install Nix (via apt)

Refresh the apt index, then install nix-bin:

bash
apt-get update
apt-get install -y --no-install-recommends nix-bin
# Single-user (rootless-build) mode: the sandbox has no 'nixbld' build-users
# group, so disable multi-user builds or nix-env operations fail.
mkdir -p /etc/nix
grep -q '^build-users-group' /etc/nix/nix.conf 2>/dev/null \
  || echo 'build-users-group =' >> /etc/nix/nix.conf
nix --version

Step 2 — Install packages

Use classic nix-env against the channel tarball. Do not use flakes / nix run nixpkgs#pkg here: the nixpkgs flake reference resolves to github.com/NixOS/nixpkgs, which the proxy blocks. The channel tarball is served from the reachable channels.nixos.org, so this needs no GitHub:

bash
TARBALL=https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz
nix-env -f "$TARBALL" -iA ripgrep     # attribute name = nixpkgs attr path
export PATH="$HOME/.nix-profile/bin:$PATH"
rg --version

Finding an attribute name quickly — query the single attribute, not all of nixpkgs (a bare nix-env -qaP evaluates everything and is very slow):

bash
nix-env -f "$TARBALL" -qaP -A ripgrep   # -> "ripgrep  ripgrep-14.x"

Using the tools in later Bash calls

Each Bash call is a fresh shell whose environment is snapshotted at session start, and ~/.bashrc is not re-run per call (its non-interactive return guard exits early), so appending an export there does not put the tool on PATH in later calls. Either call the binary by its full path:

bash
~/.nix-profile/bin/rg --version

or prepend the profile to PATH at the start of any call that needs it:

bash
export PATH="$HOME/.nix-profile/bin:$PATH"
rg --version

Caveats

• Ephemeral. The install lives only for this environment's lifetime; nothing

is committed. Re-run in a fresh environment.

• nixpkgs-unstable is a moving target. The version you get today may differ

tomorrow. Pin a specific channel (e.g. a nixos-XX.YY tarball URL) if you need reproducibility.

• GitHub-sourced packages still need GitHub. Anything Nix fetches from

github.com at build time (flake inputs, fetchFromGitHub on a cache miss) is subject to the proxy's GitHub scoping. Prebuilt substitutes from cache.nixos.org avoid this for anything already cached — which is the common case for nixpkgs packages.