👍. I started setting -DNO_SETCAP_OR_SUID=true to be clear since those won't work in our sandbox anyway, but since they don't cause problems when we don't set that flag it's good as-is too :). Thanks for the patch! LGTM.

@dtzWill thanks for the feedback. Yes, setting NO_SETCAP_OR_SUID is a good idea, IIRC I've added another workaround for that during the last update so I can probably drop that as well.

I'll finish it tomorrow and marked it as work-in-progress to avoid confusion (would like to run a few more tests and the musl build - and I should also upstream that patch if no one beats me to it, but I want to generalize it first).

❤️ -- musl build is less convenient now that we have systemd as a dep for iputils, but it's optional and not used for anything we want from iputils AFAIK so not problematic. (more concretely: musl build looks good but was done by dropping systemd dep).

@dtzWill great, thanks for testing the musl build, I was also about to do that without systemd. We should maybe also make an upstream PR for that as systemd isn't really required (it's only checked to determine whether systemd units should be installed or not). Could be something like this (but IIRC that patch was only for our use-case and needs to be generalized first):
https://github.com/NixOS/nixpkgs/blob/3b079fdf77b7ce8953a22477086ec8d25473deaa/pkgs/os-specific/linux/iputils/use-systemd.patch

Edit: BTW, I submitted a modified version of the new patch and a few additional patches upstream: iputils/iputils#178. We could use one of them to drop libcap from nativeBuildInputs , but personally, I'd wait for the next release as it's required for buildInputs anyway.