Skip Navigation
Nix / NixOS @programming.dev
innocentz3r0 @programming.dev

How can I correctly sandbox iamb with nixpak?

Pretty much the title. Please bear with me, since I'm sort of a beginner 😅

I am trying to use nixpak to sandbox iamb, but for whatever reason, it doesn't start up and run properly. Here's the relevant section of the config

 
    
environment.systemPackages = [
      (mkNixPak {
        config = { pkgs, sloth, ... }: {
          app.package = pkgs.iamb;

          bubblewrap = {
            network = true;
            shareIpc = false;
            dieWithParent = true;

            bind.rw = [
              [
                (sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
                (sloth.concat' sloth.homeDir "/Downloads")
              ]

              (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))

            ];

            bind.ro = [
            "/etc"
            "/usr"
            # To mount the systemd resolution stuff and so on
            "/run/systemd"
            ];

            apivfs = {
              proc = true;
              dev = true;
            };

            bind.dev = [
              "/dev"
            ];

            tmpfs = [
              (sloth.mkdir "/tmp/iamb")
            ];

            env = {
                TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
            };
          };

        };
      }).config.env
];

The full config can be found here

The following bubblewrap command works as-is on nixos, and doesn't lead to any errors whatsoever:

 
    
bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb

However, executing the nixpak wrapped iamb produces the following (including the control characters):

^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...

Any ideas/suggestions? I'm not sure how exactly to get this to work. From what I see in the nixpak module, the generated command should be about the same. Any help is appreciated. Thanks!

Comments

2