Describe the bug

On an Apple Silicon Mac, Nix builds fail inside an OrbStack amd64 Debian machine using Rosetta translation.

Environment:

• OrbStack 2.2.1 (2020100)
• macOS 27.0 (26A5378n)
• Debian 13/trixie x86_64 guest
• Nix 2.26.3
• Lix 2.95.2
• Strict Nix sandbox enabled
• filter-syscalls = false because Rosetta separately rejects Nix's seccomp BPF program with Invalid argument

Two implementations fail differently:

1. The Nix 2.26.3 daemon worker crashes:

Unexpected condition in operator() at ../src/libutil/unix/monitor-fd.hh:44

The client reports:

Nix daemon disconnected unexpectedly

That source location is immediately after poll(fds, 1, -1) returns -1:
https://github.com/NixOS/nix/blob/2.26.3/src/libutil/unix/monitor-fd.hh#L42-L44

2. Lix 2.95.2 in local mode repeatedly fails while launching a builder:

error: vfork child unexpectedly did not produce a value

The relevant Lix path uses clone() with CLONE_VM | CLONE_VFORK:
https://github.com/lix-project/lix/blob/2.95.2/lix/libstore/platform/linux.cc#L145-L202

These may be separate translation failures. I am reporting them together because both occur while starting Nix builders in the same translated amd64 environment. This evidence suggests an OrbStack/Rosetta translation-path problem, but it does not establish which layer is responsible.

To Reproduce

1. On an Apple Silicon Mac, create an OrbStack Debian 13 amd64 machine.

2. Install Nix 2.26.3, enable its daemon, and use:

experimental-features = nix-command flakes
sandbox = true
sandbox-fallback = false
filter-syscalls = false
build-users-group = nixbld
max-jobs = 2
cores = 2
substituters = https://cache.nixos.org/
trusted-users = root

3. Clone nixpkgs and run a derivation through the daemon:

NIX_PATH=nixpkgs=$HOME/nixpkgs \
nix-build -E 'with import <nixpkgs> {}; runCommand "sandbox-smoke" {} "echo ok > $out"'

The daemon worker exits at monitor-fd.hh:44.

4. Install Lix 2.95.2 and run from the nixpkgs checkout:

env -C "$HOME/nixpkgs" \
  PATH=/nix/var/nix/profiles/default/bin:/usr/bin:/bin \
  NIX_REMOTE=local \
  /nix/var/nix/profiles/default/bin/nix-shell \
  --run 'nixpkgs-review pr 542688'

This repeatedly produces:

error: vfork child unexpectedly did not produce a value

Expected behavior

Nix and Lix should be able to launch sandboxed builders in an amd64 OrbStack machine.

As a control, Lix 2.95.2 with sandbox = true, sandbox-fallback = false, and NIX_REMOTE=local on a native ARM64 OrbStack NixOS machine successfully started the same nixpkgs-review command, fetched the PR, and prepared its worktree. I stopped it at that point. The control guest used a different distribution, so this is strong evidence for a translation/architecture dependency rather than a fully identical A/B test.

Diagnostic report (REQUIRED)

https://orbstack.dev/_admin/diag/orbstack-diagreport_2026-07-21T12-17-56.754337Z.zip

Screenshots and additional context (optional)

Possibly related open reports involving amd64/Rosetta behavior:

• mmdebstrap container build fails with Bad fd number when running with Rosetta #2543
• GNU tar fails to extract nested directories in amd64 Rosetta machine #2588

I think failures originate in OrbStack's Rosetta wrapper, the guest kernel integration, or Apple's translation layer. and unclear if the translation path supports the required poll() and CLONE_VM | CLONE_VFORK behavior