Installer hangs on macOS Sequoia 15.5+ in headless CI (EAS Build)

[thenbe]

Hi. I'm trying to install nix in CI. The CI is EAS. The nix installer hangs indefinitely.

The installer worked fine on macos-sequoia-15.4-xcode-16.3 EAS images.

But when using any image that includes sequoia 15.5 (or later) the installer hangs and I cannot install nix.

Summary

The nix-installer hangs indefinitely on macOS Sequoia 15.5+ in headless CI environments (Expo EAS Build). The hang occurs during the create_fstab_entry step when executing diskutil info -plist "Nix Store".

Environment

• macOS: Sequoia 15.5 and 15.6
• CI: Expo EAS Build (headless, no TTY)
• Arch: aarch64-darwin (Apple Silicon)
• Installer version: latest (as of 2026-03-13)

Reproduction

Run the installer in a headless macOS 15.5+ environment:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install --no-confirm -vv

Verbose logs (-vv)

The installer proceeds normally until the create_fstab_entry step:

TRACE execute:execute:plan:plan:execute_command: Executing command="launchctl" "print" "system/systems.determinate.nix-store"
TRACE execute:execute:plan:plan:service_is_disabled:execute_command: Executing domain="system" service="systems.determinate.nix-store" command="launchctl" "print-disabled" "system"
TRACE execute:execute:plan:plan:service_is_disabled:execute_command: Command success stderr= stdout=
	disabled services = {
		"com.apple.CSCSupportd" => disabled
		"host.exp.worker" => enabled
		"com.apple.mdmclient.daemon.runatboot" => disabled
		"com.apple.ftpd" => disabled
		"com.openssh.sshd" => enabled
	}
 domain="system" service="systems.determinate.nix-store" command="launchctl" "print-disabled" "system"
TRACE execute:execute:plan:plan:service_is_disabled: Service disabled status is_disabled=false domain="system" service="systems.determinate.nix-store"
TRACE execute:execute:plan:plan:execute_command: Executing domain="system" service="systems.determinate.nix-store" command="launchctl" "print" "system/systems.determinate.nix-store"
DEBUG execute:execute:plan:plan:plan: `/etc/bashrc` has mode `292`, a mode of `420` was expected
DEBUG execute:execute:plan:plan:plan: `/etc/zshrc` has mode `292`, a mode of `420` was expected
TRACE execute:execute:plan:execute_command: Executing command="launchctl" "print" "system/systems.determinate.nix-installer.nix-hook"
TRACE execute:execute:plan:remove_file: Removing file on_missing=Ignore path=/Library/LaunchDaemons/org.nixos.nix-daemon.plist
TRACE execute:execute:plan:remove_file: Ignoring nonexistent file on_missing=Ignore path=/Library/LaunchDaemons/org.nixos.nix-daemon.plist
TRACE execute:execute:execute_command: Executing command="/usr/bin/profiles" "-P" "-o" "stdout-xml"
TRACE execute:execute:execute_command: Command success stderr= stdout=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict/>
</plist>
There are no configuration profiles installed
 command="/usr/bin/profiles" "-P" "-o" "stdout-xml"
TRACE execute:execute:install:execute_command: Executing command="/usr/bin/profiles" "-P" "-o" "stdout-xml"
TRACE execute:execute:install:execute_command: Command success stderr= stdout=<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict/>
</plist>
There are no configuration profiles installed
 command="/usr/bin/profiles" "-P" "-o" "stdout-xml"
INFO execute:execute:install: Step: Install Determinate Nixd
DEBUG execute:execute:install:try_execute: Executing: Install Determinate Nixd
TRACE execute:execute:install:try_execute:execute:remove_file: Removing file on_missing=Ignore path=/usr/local/bin/determinate-nixd
TRACE execute:execute:install:try_execute:execute:remove_file: Ignoring nonexistent file on_missing=Ignore path=/usr/local/bin/determinate-nixd
DEBUG execute:execute:install:try_execute: Completed: Install Determinate Nixd
 INFO execute:execute:install: Step: Create an encrypted APFS volume `Nix Store` for Nix on `disk2` and add it to `/etc/fstab` mounting on `/nix`
DEBUG execute:execute:install:try_execute: Executing: Create an encrypted APFS volume `Nix Store` for Nix on `disk2` and add it to `/etc/fstab` mounting on `/nix`
DEBUG execute:execute:install:try_execute:execute:create_directory: Executing: Create directory `/etc/nix` path=/etc/nix mode=0o755
DEBUG execute:execute:install:try_execute:execute:create_directory: Completed: Create directory `/etc/nix` path=/etc/nix mode=0o755
DEBUG execute:execute:install:try_execute:execute:create_or_insert_file: Executing: Create or insert file `/etc/synthetic.conf` path=/etc/synthetic.conf buf="nix\n"
DEBUG execute:execute:install:try_execute:execute:create_or_insert_file: Completed: Create or insert file `/etc/synthetic.conf` path=/etc/synthetic.conf buf="nix\n"
DEBUG execute:execute:install:try_execute:execute:create_synthetic_objects: Executing: Create objects defined in `/etc/synthetic.conf`
TRACE execute:execute:install:try_execute:execute:create_synthetic_objects:execute:execute_command: Executing command="/System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util" "-t"
TRACE execute:execute:install:try_execute:execute:create_synthetic_objects:execute:execute_command: Executing command="/System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util" "-B"
DEBUG execute:execute:install:try_execute:execute:create_synthetic_objects: Completed: Create objects defined in `/etc/synthetic.conf`
DEBUG execute:execute:install:try_execute:execute:unmount_volume: Executing: Unmount the `Nix Store` APFS volume disk=disk2 name="Nix Store"
TRACE execute:execute:install:try_execute:execute:unmount_volume:execute:execute_command: Executing disk=disk2 name="Nix Store" command="/usr/sbin/diskutil" "info" "-plist" "Nix Store"
DEBUG execute:execute:install:try_execute:execute:create_volume: Executing: Create an APFS volume on `disk2` named `Nix Store` disk=disk2 name=Nix Store case_sensitive=false
TRACE execute:execute:install:try_execute:execute:create_volume:execute:execute_command: Executing disk=disk2 name=Nix Store case_sensitive=false command="/usr/sbin/diskutil" "apfs" "addVolume" "disk2" "APFS" "Nix Store" "-nomount"
TRACE execute:execute:install:try_execute:execute:create_volume:execute:execute_command: Command success stderr= stdout=Will export new APFS Volume "Nix Store" from APFS Container Reference disk2
Started APFS operation on disk2
Preparing to add APFS Volume to APFS Container disk2
Creating APFS Volume
Created new APFS Volume disk2s7
Disk from APFS operation: disk2s7
Finished APFS operation on disk2
 disk=disk2 name=Nix Store case_sensitive=false command="/usr/sbin/diskutil" "apfs" "addVolume" "disk2" "APFS" "Nix Store" "-nomount"
DEBUG execute:execute:install:try_execute:execute:create_volume: Completed: Create an APFS volume on `disk2` named `Nix Store` disk=disk2 name=Nix Store case_sensitive=false
DEBUG execute:execute:install:try_execute:execute: Checking for Nix Store volume existence retry_tokens=50 command="/usr/sbin/diskutil" "info" "-plist" "Nix Store"
DEBUG execute:execute:install:try_execute:execute:create_fstab_entry: Executing: Update `/etc/fstab` to mount the APFS volume `Nix Store` apfs_volume_label="Nix Store"
TRACE execute:execute:install:try_execute:execute:create_fstab_entry:execute: Executing command="\"/usr/sbin/diskutil\" \"info\" \"-plist\" \"Nix Store\"" apfs_volume_label="Nix Store"

This is the last log line — the installer hangs here indefinitely.

Upstream Nix installer also affected

The official NixOS installer (https://nixos.org/nix/install) hangs at the same logical step:

~~> Configuring /etc/fstab to specify volume mount options

[grahamc]

Is this running on something like an AWS environment? In cases like that, it is known that users need to take an additional step to grant full disk access.

[thenbe]

Is this running on something like an AWS environment?

Yes, it is running on EAS build which is a CI for react native project (iOS and Android apps).

it is known that users need to take an additional step to grant full disk access.

Is this step something I would realistically be able to do? Or should I stop trying? I can't seem to find the magic spell (env var, flag, etc) to fix this.

[thenbe]

I tried using --use-ec2-instance-store flag after reading this blog post, but it didn't work (nix installer still hangs).

[grahamc]

Probably the best option would be to try and connect us to the Expo folks, so we can collaborate on a solution. Is that something you could help with?

[thenbe]

Hi @ide, would you be able to suggest someone from the expo team that can help us coordinate on a solution for this?

[ide]

Hi, thanks for surfacing this. I have written an internal task and assigned it to the team. Thank you for the clear issue description that pinpoints where the script hangs and includes the repro steps.

On a technical level I think this is related to changes in macOS 15.5 to the TCC system (the file access permission dialogs). We think (haven't confirmed) diskutil info -plist "Nix Store" is causing a permission dialog to pop up. We might be able to pre-configure the base image's TCC database or grant full disk access to diskutil ahead of time.

On the nix-installer side, it might be worth exploring whether /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -k could replace the diskutil info -plist call for UUID retrieval, since it goes through IOKit rather than DiskArbitration looking at the frameworks apfs.util and diskutil are linked against, respectively.