spindle/{models,engine}: mount /etc/nix as volume; configure /etc/nix/nix.conf

Signed-off-by: Anirudh Oppiliappan <[e-mail]>

spindle/engine/engine.go

···
 					Mode: 0o1777, // world-writeable sticky bit
 				},
 			},
+			{
+				Type:   mount.TypeVolume,
+				Source: "etc-nix-" + wid.String(),
+				Target: "/etc/nix",
+			},
 		},
 		ReadonlyRootfs: false,
 		CapDrop:        []string{"ALL"},
-		SecurityOpt:    []string{"seccomp=unconfined"},
+		CapAdd:         []string{"CAP_DAC_OVERRIDE"},
+		SecurityOpt:    []string{"no-new-privileges"},
 	}
 
 	return hostConfig

spindle/models/pipeline.go

···
 		swf.addNixProfileToPath()
 		setup := &setupSteps{}
 
+		setup.addStep(nixConfStep())
 		setup.addStep(cloneStep(*twf, *pl.TriggerMetadata.Repo, cfg.Server.Dev))
 		setup.addStep(checkoutStep(*twf, *pl.TriggerMetadata))
 		setup.addStep(dependencyStep(*twf))

spindle/models/setup_steps.go

···
 	"tangled.sh/tangled.sh/core/api/tangled"
 )
 
+func nixConfStep() Step {
+	setupCmd := `echo 'extra-experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+echo 'build-users-group = ' >> /etc/nix/nix.conf`
+	return Step{
+		Command: setupCmd,
+		Name:    "Configure Nix",
+	}
+}
+
 // checkoutStep checks out the specified ref in the cloned repository.
 func checkoutStep(twf tangled.Pipeline_Workflow, tr tangled.Pipeline_TriggerMetadata) Step {
 	if twf.Clone.Skip {