A few things which might count as "escape hatches":
The `runCommand` function lets us define a "package" by just executing bash code. This avoids all the "phase" machinery that most nixpkgs definitions use (those phases are great for fine-grained overriding; but we don't usually needed to override our own definitions). It takes 3 arguments: the output name, a set of env vars (including `buildInputs` which will populate $PATH) and a string of bash code (which can be multi-line using ''two quotes''):
$ nix-build -E '(with import {}; runCommand "hello.txt" { buildInputs = [ foo bar baz ]; } "echo hello > $out")'
these derivations will be built:
/nix/store/z6ffwc1jb70zwz2ly42gaalxnvm7q0gk-hello.txt.drv
building '/nix/store/z6ffwc1jb70zwz2ly42gaalxnvm7q0gk-hello.txt.drv'...
/nix/store/l6sd75hj4854pdzv4044ma42axc2v5v4-hello.txt
The sandbox can be selectively disabled (via whitelists), or turned off altogether, which allows builders to access arbitrary filesystem locations and the network. For example, if we have a Python pip project, and we want to take a baby step towards Nix, we could do this (assuming the sandbox is disabled):
with import {};
runCommand "my-app"
{
buildInputs = [ (python3.withPackages (p: [ p.pip ])) ];
}
''
echo "Making mutable copy of app" 1>&2
cp -r ${./.} "$out"
chmod +x -R "$out"
echo "Putting dependencies in place" 1>&2
pip3 install -r ${./requirements.txt} --target "$out"/
''
There are all sorts of other tricks. For example, Nix will make immutable copies of files if we reference them directly like ./foo (these copies are stored in /nix/store). If we don't want that, we can reference a symlink instead, since the resulting "immutable snapshot" is just a link to our mutable, non-/nix/store path.
We can avoid having to hard-code hashes for "fixed output derivations" (like downloaded URLs) by overriding their `outputHash`, `outputHashAlgo`, `outputHashMode` and `sha256` to `null`.
I wrote up a bunch of these sorts of hacks at http://chriswarbo.net/projects/nixos/useful_hacks.html (although its a few years old, so might not be up to date)
Of course, these things aren't advisable; but they're very useful to get up and running quickly, and things can be made "more Nixy" later.