corpix / nix-cage Goto Github PK

View Code? Open in Web Editor NEW

27.0 3.0 5.0 157 KB

Sandboxed environments with bwrap and nix-shell

License: The Unlicense

Python 78.91% Nix 9.41% Makefile 11.68%

development-environment nixos bwrap nix-shell namespaces nix command-line-tool

nix-cage's Introduction

nix-cage

Sandboxed environments with bwrap and nix package manager.

Requirements

Python
Bubblewrap
Nix

Basics

For basic usage there are 2 steps:

create shell.nix with settings you need
start nix-cage

Example of shell.nix:

with import <nixpkgs> {};
stdenv.mkDerivation {
  name = "nix-shell";
  buildInputs = [
    python3
  ];
}

Now start nix-cage:

$ nix-cage
bwrap --ro-bind / / --dev-bind /dev /dev ...

[user@localhost:~/projects/src/github.com/corpix/nix-cage]$ cat nix-cage.json
{
    "mounts": {"rw": ["~/.emacs.d"]}
}

Each time you start nix-cage it will print bwrap command which you could use to get the same result while running it manually or for debug. After that the nix-shell will be started.

License

Unlicense

nix-cage's People

Contributors

Stargazers

Watchers

Forkers

vjoki j3t4r0 thiagokokada mlaradji pedohorse

nix-cage's Issues

Undefined environment variables causes KeyError

If we have this nix-cage.json:

cat nix-cage.json
{
    "mounts": {
        "rw": [
            ["~/.emacs.d",       "~/.emacs.d"],
            [".",                "."],
            ["${SSH_AUTH_SOCK}", "${SSH_AUTH_SOCK}"]
        ],
...

When nix-cage invoked:

nix-cage
Traceback (most recent call last):
  File "/run/current-system/sw/bin/nix-cage", line 424, in <module>
    rest
  File "/run/current-system/sw/bin/nix-cage", line 323, in main
    rest
  File "/run/current-system/sw/bin/nix-cage", line 203, in expand_config
    for v in config["mounts"][k]
  File "/run/current-system/sw/bin/nix-cage", line 203, in <listcomp>
    for v in config["mounts"][k]
  File "/run/current-system/sw/bin/nix-cage", line 22, in expand
    return Template(expanduser(v)).substitute(ctx)
  File "/nix/store/4wqa1whb42khic67rv9jgip30nxmaii8-python3-3.6.4/lib/python3.6/string.py", line 130, in substitute
    return self.pattern.sub(convert, self.template)
  File "/nix/store/4wqa1whb42khic67rv9jgip30nxmaii8-python3-3.6.4/lib/python3.6/string.py", line 123, in convert
    return str(mapping[named])
  File "/nix/store/4wqa1whb42khic67rv9jgip30nxmaii8-python3-3.6.4/lib/python3.6/os.py", line 669, in __getitem__
    raise KeyError(key) from None
KeyError: 'SSH_AUTH_SOCK'

Make entrypoint `rw`

At this moment entrypoint is ro, I have made it ro for some paranoid reasons, now I see, this is pointless and make life painful in some circumstances

nix pkgs.buildFHSUserEnv support

nix-shell has a pretty awesome ability to create a FHS compatible environment. However the shell hook current breaks nix-cage.

IE the following shell.nix:

# shell.nix
{ pkgs ? import <nixpkgs> {} }:

(pkgs.buildFHSUserEnv {
  name = "simple-x11-env";
  targetPkgs = pkgs: (with pkgs; [
    python3
  ]);
  multiPkgs = pkgs: (with pkgs; [
    python3
  ]);
  runScript = "bash";
}).env

Empty mount source for "ro" section results in mounting everything read-only

{
  "mounts": {
    "rw": [
      "~/code",
      "~/dotfiles",
      "~/.emacs.d",
      "~/.cache/emacs",
      "~/.cache",
      "~/.config",
      "~/.local",
      "/tmp"
    ],
    "ro": [
      "$XAUTHORITY",
      "~/.ssh",
      "~/.gitconfig",
      "/"
    ],
    "tmpfs": [
      "/tmp",
      "/home",
      "/run/user",
      "/run/user/$UID"
    ]
  },
  "environment": {
     "SHELL": "$SHELL",
     "NIX_REMOTE": "daemon",
     "DISPLAY": "$DISPLAY"
  },
  "arguments": {
    "mode": "replace",
    "bwrap": [
      "--die-with-parent"
    ]
  }
}

Reproducible when XAUTHORITY is empty or unset

Easy way to mount subset of directories

At this time you need to modify config file, there should be a way to mount a list of directories from command-line

Nix shell integration

Think about the nix-shell intergration

Store nix-cage.json inside shell.nix?

We could store arbitrary attributes in shell.nix, so separate nix-cage.json is not required. Why not use something like this?

λ cat shell.nix
with import <nixpkgs> {};
stdenv.mkDerivation {
  name = "deploy-shell";
  buildInputs = [
    (import ./pkgs/nix-employ/nix-employ.nix)
  ];
  nix-cage = {
    mounts = {
      rw = [
        "do u nou de wei"
      ];
    };
  };
}
λ  nix-instantiate --eval --expr 'builtins.toJSON (import ./shell.nix).nix-cage'
"{\"mounts\":{\"rw\":[\"do u nou de wei\"]}}"
λ  nix-instantiate --eval --expr 'builtins.toJSON (import ./shell.nix).nix-cage' | jq -r . | jq .
{
  "mounts": {
    "rw": [
      "do u nou de wei"
    ]
  }
}

nix-cage could fallback to configuration stored in shell.nix which could be retrieved with nix-instantiate.