#!/usr/bin/env bash
set -euo pipefail

socket=/var/guix/daemon-socket/socket

# /var/guix is a persistent volume, so a stale socket from a previous
# (now-dead) container can still be sitting there; always start a fresh
# daemon, which unlinks and rebinds the socket itself, rather than
# skipping startup just because the path exists.
# --disable-chroot: sandboxed builds normally isolate via Linux namespaces
# (unshare/clone), which Docker blocks by default even for root ("clone:
# Operation not permitted") and which also seems to cut off DNS for the
# substituter subprocess. We're already isolated by the outer container,
# so skip guix-daemon's own sandboxing rather than granting --privileged.
rm -f "$socket"
guix-daemon --build-users-group=guixbuild --disable-chroot &

for _ in $(seq 1 30); do
  [ -S "$socket" ] && break
  sleep 1
done
[ -S "$socket" ] || { echo "guix-daemon did not come up" >&2; exit 1; }

exec "$@"