Nix's sandbox-paths configuration is a hidden input to derivations that can silently break build repeatability. Because sandbox-paths are set outside the derivation recipe, two machines with identical .drv files can produce different outputs if their sandbox configurations differ. The default sandbox-paths value is a compile-time property of the Nix binary itself, not a constant, meaning two users running the same Nix version can have different sandboxes. A concrete example demonstrates how mounting a file into the sandbox produces a different build result while preserving the same output hash. This issue surfaced when building a source-bootstrapped OpenJDK via GuixPkgs: Guix assumes no /bin/sh exists in the build container, while Nix provides one by default, causing a build script to silently take a different code path and produce broken output that was then uploaded to a binary cache. Including sandbox-paths in the derivation hash would fix the hermeticity problem but destroy binary cache sharing across machines.
