Nix / NixOS

2834 readers

5 users here now

Main links

Videos

founded 3 years ago

MODERATORS

erlingur@programming.dev

ballmerpeaking@programming.dev

WhiteBlackGoose@programming.dev

How can I correctly sandbox iamb with nixpak? (programming.dev)

submitted 3 weeks ago by innocentz3r0@programming.dev to c/nix@programming.dev

2 comments fedilink hide all child comments

Pretty much the title. Please bear with me, since I'm sort of a beginner 😅

I am trying to use nixpak to sandbox iamb, but for whatever reason, it doesn't start up and run properly. Here's the relevant section of the config

environment.systemPackages = [
      (mkNixPak {
        config = { pkgs, sloth, ... }: {
          app.package = pkgs.iamb;

          bubblewrap = {
            network = true;
            shareIpc = false;
            dieWithParent = true;

            bind.rw = [
              [
                (sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
                (sloth.concat' sloth.homeDir "/Downloads")
              ]

              (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))

            ];

            bind.ro = [
            "/etc"
            "/usr"
            # To mount the systemd resolution stuff and so on
            "/run/systemd"
            ];

            apivfs = {
              proc = true;
              dev = true;
            };

            bind.dev = [
              "/dev"
            ];

            tmpfs = [
              (sloth.mkdir "/tmp/iamb")
            ];

            env = {
                TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
            };
          };

        };
      }).config.env
];

The full config can be found here

The following bubblewrap command works as-is on nixos, and doesn't lead to any errors whatsoever:

bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb

However, executing the nixpak wrapped iamb produces the following (including the control characters):

^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...

Any ideas/suggestions? I'm not sure how exactly to get this to work. From what I see in the nixpak module, the generated command should be about the same. Any help is appreciated. Thanks!

top 2 comments

sorted by: hot top controversial new old

[–] moonpiedumplings@programming.dev 3 points 3 weeks ago* (last edited 3 weeks ago)

Firstly, did you get it working? I notice your latest commit seems to mention that you got it working

One thing I would recommend is to declare the iamb package separately in a let... in statement.

let
   iamb = (mknixpak blah blah blah)

....
....

in

 userconfig.programs.iamb = {
      enable = true;
      # By using "iamb", instead of pkgs.iamb, it means we are using the nixpak wrapped version here
      package = iamb
      settings = {
        profiles.user.user_id = "@username:instance.com";
        settings = {
          image_preview = { };
          username_display = "displayname";
          user_gutter_width = 15;
        };
      };
    };

This make it so that iamb is the nixpak wrapped version instead, in the userconfig. This would probably also make it so that you don't need to declare it explicitly in your systemPackages.

[–] innocentz3r0@programming.dev 2 points 3 weeks ago

Ah yes, I got it working, the issue was unshare-pgid which had already been sort of raised in nixpak.

In my case, I used bubblewrap.newSession (which is equivalent of --new-session). Idk why that worked out finally with --unshare-pgid, but I'd rather not spend more time on this.

I like the idea of let binding the package declaration to use it in the config as well. I'll probably use that. Thanks!