Error when refreshing page on immutable systems (e.g., NixOS)

The issue #1184 has been closed however the bug seems to still be present.

We came across this problem when running the following R code using the last commit as of today of bslib and version 1.12.1.9 of shiny :

library(shiny)
library(bslib)

ui <- page_fillable(
  # App title ----
  title = "Hello Shiny!",
  # Sidebar panel for inputs ----

  selectizeInput(
    "inSelect",
    "Select input",
    choices = c("Item A", "Item B", "Item C"),
    options = list(create = TRUE, maxItems = 3, placeholder = 'hi there')
  )
)

server <- function(input, output) {}

shinyApp(ui = ui, server = server, options = list(launch.browser = FALSE, port = 6565, host = "0.0.0.0"))

Running this code works but when refreshing the page it returns the following error:

Warning in file.copy(script, dirname(outfile), overwrite = TRUE) :
  problem copying /nix/store/cdg2njsw8vgq14s0rh97zhqx0zfmzqjz-r-shiny/library/shiny/www/shared/selectize//js/selectize.min.js to /tmp/nix-shell.QtkK6m/Rtmp96D4mJ/selectize712f0895bef4f0695ce5aa23269b4ebe/selectize.min.js: Permission denied
Warning in file.copy(script, dirname(outfile), overwrite = TRUE) :
  problem copying /nix/store/cdg2njsw8vgq14s0rh97zhqx0zfmzqjz-r-shiny/library/shiny/www/shared/selectize//accessibility/js/selectize-plugin-a11y.min.js to /tmp/nix-shell.QtkK6m/Rtmp96D4mJ/selectize712f0895bef4f0695ce5aa23269b4ebe/selectize-plugin-a11y.min.js: Permission denied
Warning: Error in bslib::bs_dependency: Failed to copy the following script(s): /nix/store/cdg2njsw8vgq14s0rh97zhqx0zfmzqjz-r-shiny/library/shiny/www/shared/selectize//js/selectize.min.js, /nix/store/cdg2njsw8vgq14s0rh97zhqx0zfmzqjz-r-shiny/library/shiny/www/shared/selectize//accessibility/js/selectize-plugin-a11y.min.js.

Important to know is that we are running the code on NixOS which implies that users have read-only permissions on the file of installed packages.

To reproduce the problem you can find below a flake.nix file:

{
  inputs = {
    utils.url = "github:numtide/flake-utils";
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  };

  outputs = { self, nixpkgs, utils }:
    utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [
            (final: prev: {
                rPackages = prev.rPackages.override {
                  overrides = {
                    shiny = prev.rPackages.buildRPackage {
                      name = "shiny";
                      src = prev.fetchFromGitHub {
                        owner = "rstudio";
                        repo = "shiny";
                        rev = "e161f2e4a866c3b3ac1f7d669661786a814641c1";
                        hash = "sha256-ATg8/whRxBzim8JVAvSAcN2hzC8aenGHb9YmHxOEV3M=";
                      };
                      propagatedBuildInputs = with prev.rPackages; 
                      [ final.rPackages.otel 
                        final.rPackages.promises 
                        final.rPackages.bslib
                        cachem
                        cli
                        commonmark fontawesome glue htmltools httpuv jsonlite lifecycle mime sourcetools withr xtable];
                    };
                    bslib = prev.rPackages.buildRPackage {
                      name = "bslib";
                      src = prev.fetchFromGitHub {
                        owner = "rstudio";
                        repo = "bslib";
                        rev = "bc56d8e7671b6c1c41c041b6992e24cf1a4bc05f";
                        hash = "sha256-dhGtf1GRqOBAvn/7abHqnWn9yD+qaj+sfopjnr3tO0s=";
                      };
                      propagatedBuildInputs = prev.rPackages.bslib.propagatedBuildInputs;
                    };
                    promises = prev.rPackages.buildRPackage {
                      name = "promises";
                      src = prev.fetchFromGitHub {
                        owner = "rstudio";
                        repo = "promises";
                        rev = "2f70615f8c38f0b28f1088a08911ce2b1b0aa176";
                        hash = "sha256-gKAtbCE1scwhasQWldh2Cf78zXaXFeLlgeWuCu1GKiY=";
                      };
                      propagatedBuildInputs = prev.rPackages.promises.propagatedBuildInputs ++ [ final.rPackages.otel prev.rPackages.lifecycle ];
                    };
                    otel = prev.rPackages.buildRPackage {
                      name = "otel";
                      src = prev.fetchFromGitHub {
                          owner = "r-lib";
                          repo = "otel";
                          rev = "afc31bc1f4bd177870d44b051ada1d9e4e685346";
                          hash = "sha256-554JJsegzwGfdfUNErAceUX7bzgQimqNxR1oGFKBN40=";
                      };
                      propagatedBuildInputs = prev.rPackages.otel.propagatedBuildInputs;
                    };
                  };
                };
              })
          ];
        };
        rpackages = with pkgs.rPackages; [ shiny ];
        rLocal = (pkgs.rWrapper.override { packages = rpackages; });
      in {
        devShell = pkgs.mkShell {
          packages = with pkgs; [ jq rLocal ];
        };
      });
}

and a Dockerfile:

FROM ubuntu:latest

RUN apt update \
    && apt install -y curl xz-utils \
    && mkdir -m 0755 /nix && chown ubuntu /nix

# Use non root user
USER ubuntu

# Install nix
ENV PATH="/home/ubuntu/.nix-profile/bin:${PATH}"
RUN curl -sL https://nixos.org/nix/install | sh -s -- --no-daemon

# Activate installed nix for user to be able to use nix-shell command
RUN . /home/ubuntu/.nix-profile/etc/profile.d/nix.sh

WORKDIR /home/ubuntu

COPY example.R example.R

COPY flake.nix flake.nix

EXPOSE 6565

CMD nix develop --extra-experimental-features flakes --extra-experimental-features nix-command --command bash -c "Rscript example.R"

Once you have this three files (i.e., example.R with the shiny app code, flake.nix with the package specifications and Dockerfile), you can test as follows:

docker build -t bslibshiny-nixos . && docker run --rm -p 6565:6565 bslibshiny-nixos:latest 

The error does not occur when using fluidPage (shiny) instead of page_fillable (bslib).

Session Info

R version 4.5.1 (2025-06-13)
Platform: x86_64-pc-linux-gnu
Running under: NixOS 25.11 (Xantusia)

Matrix products: default
BLAS/LAPACK: /nix/store/bxzh4js1lrshwlc13cjn86w71jzmdqcz-blas-3/lib/libblas.so.3;  LAPACK version 3.12.0

locale:
 [1] LC_CTYPE=en_US.UTF-8       LC_NUMERIC=C              
 [3] LC_TIME=en_US.UTF-8        LC_COLLATE=en_US.UTF-8    
 [5] LC_MONETARY=en_US.UTF-8    LC_MESSAGES=en_US.UTF-8   
 [7] LC_PAPER=en_US.UTF-8       LC_NAME=C                 
 [9] LC_ADDRESS=C               LC_TELEPHONE=C            
[11] LC_MEASUREMENT=en_US.UTF-8 LC_IDENTIFICATION=C       

time zone: NA
tzcode source: system (glibc)

attached base packages:
[1] stats     graphics  grDevices utils     datasets  methods   base     

other attached packages:
[1] bslib_0.9.0.9002  shiny_1.12.1.9000

loaded via a namespace (and not attached):
 [1] digest_0.6.37       later_1.4.2         R6_2.6.1           
 [4] httpuv_1.6.16       fastmap_1.2.0       magrittr_2.0.3     
 [7] cachem_1.1.0        memoise_2.0.1       htmltools_0.5.8.1  
[10] lifecycle_1.0.4     promises_1.5.0.9000 cli_3.6.5          
[13] xtable_1.8-4        sass_0.4.10         jquerylib_0.1.4    
[16] compiler_4.5.1      tools_4.5.1         mime_0.13          
[19] Rcpp_1.1.0          otel_0.2.0.9000     fs_1.6.6           
[22] jsonlite_2.0.0      rlang_1.1.6 

Reproduce the refresh failure with example.R, flake.nix, and Dockerfile, then start at bslib::bs_dependency and the page_fillable dependency path. Confirm the behavior on a read-only Nix store and compare it with fluidPage. Done means refreshing the example no longer raises the copy-permission error on immutable systems.