Firefox Build Failure With CUDA Enabled On NixOS

Nov 1, 2025 by SLV Team 49 views

Hey everyone! Today, we're diving into a tricky issue encountered while trying to build Firefox on NixOS with CUDA enabled. If you're scratching your head over build failures and cryptic error messages, you're in the right place. Let's break down the problem, understand the root cause, and explore potential solutions. This article will help you navigate the complexities of NixOS package building, especially when hardware acceleration like CUDA is in the mix.

Understanding the Issue

The Problem

So, here’s the deal: when you try to enable Firefox in your NixOS configuration with programs.firefox.enable = true, things might go south during the build process. The error message you might encounter looks something like this:

error: output '/nix/store/vs0wp5sp52706csac3bwgmi88782nj8q-firefox-144.0' is not allowed to refer to the following paths:
       /nix/store/x8mydcgbry214s802nzvy7fdljx404ym-gcc-wrapper-14.3.0

       Shown below are chains that lead to the forbidden path(s).
       ...

This error essentially means that the Firefox build process is trying to access a path (gcc-wrapper) that it's not allowed to, due to NixOS's strict dependency isolation. This usually happens when CUDA support is enabled, which introduces a dependency on nvcc (NVIDIA CUDA Compiler).

Why Does This Happen?

To understand this, let's break it down. When CUDA support is enabled, the onnxruntime (a machine learning library) gets pulled in as a dependency. onnxruntime then depends on nvcc, which in turn requires the gcc-wrapper. NixOS, being the meticulous operating system it is, isolates build processes to ensure reproducibility. This means that if a build process tries to access something outside its allowed dependencies, it throws an error.

In simple terms, Firefox's build process isn't supposed to be poking around in CUDA's backyard, but it is, and NixOS is like, "Hey, no trespassing!"

Key Components at Play

Nixpkgs: This is the set of packages available in NixOS. Think of it as the app store for NixOS.
CUDA: NVIDIA's parallel computing platform and API. It allows software to use NVIDIA GPUs for processing.
onnxruntime: A high-performance inference engine for machine learning models. Firefox uses it for certain features.
nvcc: NVIDIA CUDA Compiler, part of the CUDA toolkit.
gcc-wrapper: A wrapper around the GCC compiler, used in the CUDA build process.

Understanding how these components interact is crucial for troubleshooting this issue.

Diving Deeper: The Dependency Chain

To really get our heads around this, let's trace the dependency chain that leads to the error. The error message provides a helpful chain of dependencies:

/nix/store/vs0wp5sp52706csac3bwgmi88782nj8q-firefox-144.0
└───/nix/store/x58gvl5746i5v293rcig9k89vb8qg2jg-firefox-unwrapped-144.0
    ├───/nix/store/9bwh9xx4y08fw2384jkz3s3ai3fzg0np-onnxruntime-1.22.2
    │   ├───/nix/store/ygd3s9zm1pf77n3q3ac63v58www5scbc-cuda12.8-cuda_nvcc-12.8.93
    │   │   ├───/nix/store/x8mydcgbry214s802nzvy7fdljx404ym-gcc-wrapper-14.3.0
    │   │   └───/nix/store/zcpdazyj1izrgf7ajqqvjr64j8bqfhjm-setup-cuda-hook
    │   │       └───/nix/store/x8mydcgbry214s802nzvy7fdljx404ym-gcc-wrapper-14.3.0
    │   ├───/nix/store/80x699lyc99dahf85iqdv6z1f0vv6vz2-cuda12.8-cuda_cudart-12.8.90
    │   │   ├───/nix/store/ygd3s9zm1pf77n3q3ac63v58www5scbc-cuda12.8-cuda_nvcc-12.8.93
    │   │   ├───/nix/store/zcpdazyj1izrgf7ajqqvjr64j8bqfhjm-setup-cuda-hook
    │   │   └───/nix/store/zmx728hvh87zip6blayazwjl7ad5vgqh-cuda12.8-cuda_cccl-12.8.90
    │   │       └───/nix/store/zcpdazyj1izrgf7ajqqvjr64j8bqfhjm-setup-cuda-hook
    │   └───/nix/store/j55nsg143a22krndzhnr9f8ji78vlrdw-cuda12.8-nccl-2.27.6-1
    │       └───/nix/store/ygd3s9zm1pf77n3q3ac63v58www5scbc-cuda12.8-cuda_nvcc-12.8.93
    └───/nix/store/j55nsg143a22krndzhnr9f8ji78vlrdw-cuda12.8-nccl-2.27.6-1

Let's break this down:

It starts with firefox-144.0, which is our main build target.
It depends on firefox-unwrapped-144.0, an intermediate build step.
firefox-unwrapped depends on onnxruntime-1.22.2, the machine learning library.
onnxruntime depends on various CUDA components like cuda_nvcc, cuda_cudart, and nccl.
Finally, these CUDA components depend on gcc-wrapper, which is the forbidden path.

So, the issue arises because Firefox indirectly depends on CUDA through onnxruntime, and this dependency chain violates NixOS's isolation principles.

Potential Solutions and Workarounds

Okay, so we know why it's happening. Now, what can we do about it? Here are a few potential avenues to explore:

1. Patching or Overriding the Firefox Package

One approach is to modify the Firefox package definition in Nixpkgs to remove or alter the CUDA dependency. This can be done using Nix overrides. Overrides allow you to change the attributes of a package definition. For example, you might try disabling onnxruntime or providing a version that doesn't depend on CUDA.

This might involve diving into the Nixpkgs source code and figuring out how to tweak the build process. It's like being a chef and modifying a recipe to remove an ingredient that's causing problems.

Example of an Override

Here’s a conceptual example of how you might try to override the Firefox package in your configuration.nix:

{ pkgs, ... }:

{
  nixpkgs.config.packageOverrides = pkgs: {
    firefox = pkgs.firefox.overrideAttrs (oldAttrs: {
      # Attempt to disable onnxruntime or use a non-CUDA version
      # This is just a conceptual example; the actual implementation might vary.
      buildInputs = pkgs.lib.filter (dep: dep != pkgs.onnxruntime) oldAttrs.buildInputs;
    });
  };

  programs.firefox.enable = true;
}

Disclaimer: This is a simplified example. The actual implementation might require more detailed knowledge of Nixpkgs and the Firefox build process.

2. Conditional Package Building

Another approach is to conditionally build Firefox with or without CUDA support based on whether CUDA is enabled in your system configuration. This involves checking for CUDA-related flags and modifying the build process accordingly.

This is like having a fork in the road: if CUDA is enabled, we take one path; if not, we take another. It requires a bit more logic in the build definition.

3. Reporting the Issue to Nixpkgs Maintainers

If you've hit a wall and can't figure out a solution yourself, don't hesitate to reach out to the Nixpkgs maintainers. They are the gurus of all things NixOS and can provide valuable insights and guidance.

In fact, this issue was initially reported to the Nixpkgs maintainers, specifically @mweinelt (firefox), @puffnfresh (onnxruntime), and @ck3d (onnxruntime). Reporting issues helps the community improve Nixpkgs for everyone.

4. Investigating Hydra Builds

Hydra is NixOS's continuous integration system. It automatically builds packages and reports failures. Checking Hydra can give you clues about whether this issue is widespread or specific to your configuration. Unfortunately, in this case, Hydra wasn’t building the package with CUDA enabled, so no pre-existing Hydra logs were available.

Real-World Context: Why This Matters

This issue isn't just a theoretical problem; it has real-world implications. If you're a NixOS user who relies on CUDA for development, gaming, or other GPU-intensive tasks, you want your system to play nicely with all your applications, including Firefox. A build failure like this can be a major roadblock.

Moreover, it highlights the challenges of managing complex dependencies in a reproducible build environment like NixOS. While NixOS's strict isolation is a strength, it can also lead to tricky dependency conflicts.

System Metadata and Debugging Tips

When reporting or debugging issues like this, it's crucial to provide detailed system metadata. This includes:

System type (x86_64-linux)
Host OS (including kernel version and NixOS version)
Multi-user status
Sandbox status
Nix version
Nixpkgs version

This information helps maintainers reproduce the issue and identify potential causes.

Example System Metadata

- system: `