diff --git a/README.md b/README.md index 480b140..571e580 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ -[![GitHub Discussions](https://img.shields.io/github/discussions/srid/landrun-nix)](https://github.com/srid/landrun-nix/discussions) +[![GitHub Discussions](https://img.shields.io/github/discussions/srid/sandnix)](https://github.com/srid/sandnix/discussions) -# landrun-nix +# sandnix -A Nix flake-parts module for wrapping programs with [landrun](https://github.com/Zouuup/landrun) (Landlock) sandbox. +A Nix flake-parts module for wrapping programs with a sandboxed environment using [landrun](https://github.com/Zouuup/landrun) (Landlock) on Linux, and `sandbox-exec` on macOS. ## Usage @@ -10,14 +10,14 @@ In your `flake.nix`: ```nix { - inputs.landrun-nix.url = "github:srid/landrun-nix"; + inputs.sandnix.url = "github:srid/sandnix"; - outputs = { flake-parts, landrun-nix, ... }: + outputs = { flake-parts, sandnix, ... }: flake-parts.lib.mkFlake { inherit inputs; } { - imports = [ landrun-nix.flakeModule ]; + imports = [ sandnix.flakeModule ]; perSystem = { pkgs, ... }: { - landrunApps.my-app-sandboxed = { + sandnixApps.my-app-sandboxed = { program = "${pkgs.my-app}/bin/my-app"; features = { tty = true; # Terminal support @@ -40,20 +40,20 @@ Run with: `nix run .#my-app-sandboxed` ## Reusable Modules -landrun-nix provides reusable modules for common applications via `landrunModules.*`. These can be imported into your app configurations: +sandnix provides reusable modules for common applications via `sandnixModules.*`. These can be imported into your app configurations: ```nix { - inputs.landrun-nix.url = "github:srid/landrun-nix"; + inputs.sandnix.url = "github:srid/sandnix"; - outputs = { flake-parts, landrun-nix, ... }: + outputs = { flake-parts, sandnix, ... }: flake-parts.lib.mkFlake { inherit inputs; } { - imports = [ landrun-nix.flakeModule ]; + imports = [ sandnix.flakeModule ]; perSystem = { pkgs, ... }: { - landrunApps.my-app = { + sandnixApps.my-app = { imports = [ - landrun-nix.landrunModules.gh # Import GitHub CLI module + sandnix.sandnixModules.gh # Import GitHub CLI module ]; program = "${pkgs.my-app}/bin/my-app"; features.network = true; @@ -67,10 +67,10 @@ landrun-nix provides reusable modules for common applications via `landrunModule | Module | Description | |--------|-------------| -| `landrunModules.gh` | GitHub CLI (`gh`) configuration with D-Bus keyring support | -| `landrunModules.git` | Git configuration with TTY support and repository access | -| `landrunModules.haskell` | Haskell tooling with Cabal configuration and state directory access | -| `landrunModules.markitdown` | Markitdown configuration with `/proc/cpuinfo` access | +| `sandnixModules.gh` | GitHub CLI (`gh`) configuration with D-Bus keyring support | +| `sandnixModules.git` | Git configuration with TTY support and repository access | +| `sandnixModules.haskell` | Haskell tooling with Cabal configuration and state directory access | +| `sandnixModules.markitdown` | Markitdown configuration with `/proc/cpuinfo` access | ## Examples @@ -83,7 +83,7 @@ See [examples/claude-sandboxed](./examples/claude-sandboxed/flake.nix) for a com Try it: ```sh -nix run github:srid/landrun-nix?dir=examples/claude-sandboxed +nix run github:srid/sandnix?dir=examples/claude-sandboxed ``` ## Features @@ -114,7 +114,7 @@ Fine-grained control via `cli.*`: ## Discussions -https://github.com/srid/landrun-nix/discussions +https://github.com/srid/sandnix/discussions ## License diff --git a/examples/claude-sandboxed/flake.lock b/examples/claude-sandboxed/flake.lock index 20a19bd..509c879 100644 --- a/examples/claude-sandboxed/flake.lock +++ b/examples/claude-sandboxed/flake.lock @@ -18,17 +18,6 @@ "type": "github" } }, - "landrun-nix": { - "locked": { - "path": "../../", - "type": "path" - }, - "original": { - "path": "../../", - "type": "path" - }, - "parent": [] - }, "nixpkgs": { "locked": { "lastModified": 1760038930, @@ -63,9 +52,20 @@ "root": { "inputs": { "flake-parts": "flake-parts", - "landrun-nix": "landrun-nix", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sandnix": "sandnix" } + }, + "sandnix": { + "locked": { + "path": "../../", + "type": "path" + }, + "original": { + "path": "../../", + "type": "path" + }, + "parent": [] } }, "root": "root", diff --git a/examples/claude-sandboxed/flake.nix b/examples/claude-sandboxed/flake.nix index 4a858d4..24667f2 100644 --- a/examples/claude-sandboxed/flake.nix +++ b/examples/claude-sandboxed/flake.nix @@ -2,14 +2,14 @@ inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; flake-parts.url = "github:hercules-ci/flake-parts"; - landrun-nix.url = "path:../../"; + sandnix.url = "path:../../"; }; - outputs = inputs@{ flake-parts, landrun-nix, ... }: + outputs = inputs@{ flake-parts, sandnix, ... }: flake-parts.lib.mkFlake { inherit inputs; } { systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; - imports = [ landrun-nix.flakeModule ]; + imports = [ sandnix.flakeModule ]; perSystem = { pkgs, system, ... }: { _module.args.pkgs = import inputs.nixpkgs { @@ -17,13 +17,13 @@ config.allowUnfree = true; }; - landrunApps.default = { + sandnixApps.default = { name = "claude"; imports = [ - landrun-nix.landrunModules.gh # So, Claude can run `gh` CLI - landrun-nix.landrunModules.git # So, Claude can run `git` CLI - landrun-nix.landrunModules.markitdown # So, Claude can run `markitdown` with CPU info access - landrun-nix.landrunModules.haskell # So, Claude can use Haskell tooling + sandnix.sandnixModules.gh # So, Claude can run `gh` CLI + sandnix.sandnixModules.git # So, Claude can run `git` CLI + sandnix.sandnixModules.markitdown # So, Claude can run `markitdown` with CPU info access + sandnix.sandnixModules.haskell # So, Claude can use Haskell tooling ]; program = "${pkgs.claude-code}/bin/claude"; features = { diff --git a/examples/standalone/flake.lock b/examples/standalone/flake.lock index a24d391..cc98c66 100644 --- a/examples/standalone/flake.lock +++ b/examples/standalone/flake.lock @@ -1,16 +1,5 @@ { "nodes": { - "landrun-nix": { - "locked": { - "path": "../../", - "type": "path" - }, - "original": { - "path": "../../", - "type": "path" - }, - "parent": [] - }, "nixpkgs": { "locked": { "lastModified": 1769461804, @@ -29,9 +18,20 @@ }, "root": { "inputs": { - "landrun-nix": "landrun-nix", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sandnix": "sandnix" } + }, + "sandnix": { + "locked": { + "path": "../../", + "type": "path" + }, + "original": { + "path": "../../", + "type": "path" + }, + "parent": [] } }, "root": "root", diff --git a/examples/standalone/flake.nix b/examples/standalone/flake.nix index 113e796..92161fe 100644 --- a/examples/standalone/flake.nix +++ b/examples/standalone/flake.nix @@ -1,17 +1,17 @@ { inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; - landrun-nix.url = "path:../../"; + sandnix.url = "path:../../"; }; - outputs = { self, nixpkgs, landrun-nix }: + outputs = { self, nixpkgs, sandnix }: let system = "x86_64-linux"; pkgs = import nixpkgs { inherit system; }; - landrunLib = import landrun-nix.lib { inherit pkgs; }; + sandnixLib = import sandnix.lib { inherit pkgs; }; in { - packages.${system}.default = landrunLib.makeLandrun { + packages.${system}.default = sandnixLib.makeSandnix { name = "hello-wrapped"; modules = [ { diff --git a/flake.nix b/flake.nix index 920512a..296ab29 100644 --- a/flake.nix +++ b/flake.nix @@ -4,15 +4,15 @@ outputs = { self }: { lib = ./nix/lib.nix; - flakeModule = ./modules/flake-parts/landrun; + flakeModule = ./modules/flake-parts/sandnix; - landrunModules = { - gh = import ./modules/landrun/gh.nix; - git = import ./modules/landrun/git.nix; - haskell = import ./modules/landrun/haskell.nix; - markitdown = import ./modules/landrun/markitdown.nix; - landrun = ./modules/flake-parts/landrun/landrun.nix; - landrunApps = ./modules/flake-parts/landrun/landrunApps.nix; + sandnixModules = { + gh = import ./modules/sandnix/gh.nix; + git = import ./modules/sandnix/git.nix; + haskell = import ./modules/sandnix/haskell.nix; + markitdown = import ./modules/sandnix/markitdown.nix; + sandnix = ./modules/flake-parts/sandnix/sandnix.nix; + sandnixApps = ./modules/flake-parts/sandnix/sandnixApps.nix; }; }; } diff --git a/justfile b/justfile index 45611fa..1141258 100644 --- a/justfile +++ b/justfile @@ -1,6 +1,6 @@ -# Run the claude-sandboxed example with local landrun-nix override +# Run the claude-sandboxed example with local sandnix override run-example: - nix run ./examples/claude-sandboxed --override-input landrun-nix . + nix run ./examples/claude-sandboxed --override-input sandnix . # Run integration tests test: @@ -12,4 +12,4 @@ test: # Linux: util-linux script syntax: script -qec SCRIPT_ARGS="-qec ./tests/test.bats /dev/null" fi - nix develop ./tests --override-input landrun-nix path:./. -c script $SCRIPT_ARGS + nix develop ./tests --override-input sandnix path:./. -c script $SCRIPT_ARGS diff --git a/modules/flake-parts/landrun/common/features.nix b/modules/flake-parts/sandnix/common/features.nix similarity index 100% rename from modules/flake-parts/landrun/common/features.nix rename to modules/flake-parts/sandnix/common/features.nix diff --git a/modules/flake-parts/landrun/darwin/features.nix b/modules/flake-parts/sandnix/darwin/features.nix similarity index 100% rename from modules/flake-parts/landrun/darwin/features.nix rename to modules/flake-parts/sandnix/darwin/features.nix diff --git a/modules/flake-parts/landrun/darwin/wrapper.nix b/modules/flake-parts/sandnix/darwin/wrapper.nix similarity index 98% rename from modules/flake-parts/landrun/darwin/wrapper.nix rename to modules/flake-parts/sandnix/darwin/wrapper.nix index 21c7b65..6365fb4 100644 --- a/modules/flake-parts/landrun/darwin/wrapper.nix +++ b/modules/flake-parts/sandnix/darwin/wrapper.nix @@ -152,7 +152,7 @@ in config = lib.mkIf pkgs.stdenv.isDarwin { wrappedPackage = if config.cli.extraArgs != [ ] then - lib.warn "landrun-nix: extraArgs are ignored on Darwin as sandbox-exec does not support them." pkg + lib.warn "sandnix: extraArgs are ignored on Darwin as sandbox-exec does not support them." pkg else pkg; }; diff --git a/modules/flake-parts/landrun/default.nix b/modules/flake-parts/sandnix/default.nix similarity index 81% rename from modules/flake-parts/landrun/default.nix rename to modules/flake-parts/sandnix/default.nix index ee4d68f..3334c0b 100644 --- a/modules/flake-parts/landrun/default.nix +++ b/modules/flake-parts/sandnix/default.nix @@ -7,12 +7,12 @@ in options = { perSystem = mkPerSystemOption ({ config, ... }: { - imports = [ ./landrunApps.nix ]; + imports = [ ./sandnixApps.nix ]; config = { packages = lib.mapAttrs (name: cfg: cfg.wrappedPackage) - config.landrunApps; + config.sandnixApps; apps = lib.mapAttrs (name: cfg: { @@ -20,7 +20,7 @@ in program = lib.getExe cfg.wrappedPackage; meta = cfg.meta; }) - config.landrunApps; + config.sandnixApps; }; }); }; diff --git a/modules/flake-parts/landrun/features.nix b/modules/flake-parts/sandnix/features.nix similarity index 100% rename from modules/flake-parts/landrun/features.nix rename to modules/flake-parts/sandnix/features.nix diff --git a/modules/flake-parts/landrun/linux/features.nix b/modules/flake-parts/sandnix/linux/features.nix similarity index 100% rename from modules/flake-parts/landrun/linux/features.nix rename to modules/flake-parts/sandnix/linux/features.nix diff --git a/modules/flake-parts/landrun/linux/wrapper.nix b/modules/flake-parts/sandnix/linux/wrapper.nix similarity index 100% rename from modules/flake-parts/landrun/linux/wrapper.nix rename to modules/flake-parts/sandnix/linux/wrapper.nix diff --git a/modules/flake-parts/landrun/options.nix b/modules/flake-parts/sandnix/options.nix similarity index 95% rename from modules/flake-parts/landrun/options.nix rename to modules/flake-parts/sandnix/options.nix index 384e888..4eed735 100644 --- a/modules/flake-parts/landrun/options.nix +++ b/modules/flake-parts/sandnix/options.nix @@ -13,7 +13,7 @@ in program = mkOption { type = types.str; - description = "The program to wrap with landrun (e.g., \${pkgs.foo}/bin/foo)"; + description = "The program to wrap with sandnix (e.g., \${pkgs.foo}/bin/foo)"; }; preHook = mkOption { @@ -114,12 +114,12 @@ in extraArgs = mkOption { type = types.listOf types.str; default = [ ]; - description = "Additional landrun arguments"; + description = "Additional sandnix arguments"; }; }; }; default = { }; - description = "Landrun CLI arguments configuration"; + description = "Sandnix CLI arguments configuration"; }; meta = mkOption { diff --git a/modules/flake-parts/landrun/landrun.nix b/modules/flake-parts/sandnix/sandnix.nix similarity index 100% rename from modules/flake-parts/landrun/landrun.nix rename to modules/flake-parts/sandnix/sandnix.nix diff --git a/modules/flake-parts/landrun/landrunApps.nix b/modules/flake-parts/sandnix/sandnixApps.nix similarity index 74% rename from modules/flake-parts/landrun/landrunApps.nix rename to modules/flake-parts/sandnix/sandnixApps.nix index f4b1a5f..6652ccb 100644 --- a/modules/flake-parts/landrun/landrunApps.nix +++ b/modules/flake-parts/sandnix/sandnixApps.nix @@ -5,7 +5,7 @@ let types; in { - options.landrunApps = mkOption { + options.sandnixApps = mkOption { type = types.attrsOf (types.submoduleWith { modules = [ ./options.nix @@ -15,6 +15,6 @@ in ]; }); default = { }; - description = "Applications to wrap with landrun sandbox"; + description = "Applications to wrap with sandnix sandbox"; }; } diff --git a/modules/flake-parts/landrun/wrapper.nix b/modules/flake-parts/sandnix/wrapper.nix similarity index 100% rename from modules/flake-parts/landrun/wrapper.nix rename to modules/flake-parts/sandnix/wrapper.nix diff --git a/modules/landrun/gh.nix b/modules/sandnix/gh.nix similarity index 100% rename from modules/landrun/gh.nix rename to modules/sandnix/gh.nix diff --git a/modules/landrun/git.nix b/modules/sandnix/git.nix similarity index 100% rename from modules/landrun/git.nix rename to modules/sandnix/git.nix diff --git a/modules/landrun/haskell.nix b/modules/sandnix/haskell.nix similarity index 100% rename from modules/landrun/haskell.nix rename to modules/sandnix/haskell.nix diff --git a/modules/landrun/markitdown.nix b/modules/sandnix/markitdown.nix similarity index 100% rename from modules/landrun/markitdown.nix rename to modules/sandnix/markitdown.nix diff --git a/nix/lib.nix b/nix/lib.nix index 3c9d9fc..5c37f67 100644 --- a/nix/lib.nix +++ b/nix/lib.nix @@ -1,14 +1,14 @@ { pkgs, lib ? pkgs.lib, ... }: rec { - evalModules = { name ? "landrun", modules }: (lib.evalModules { + evalModules = { name ? "sandnix", modules }: (lib.evalModules { modules = [ - ../modules/flake-parts/landrun/landrun.nix + ../modules/flake-parts/sandnix/sandnix.nix { _module.args = { inherit pkgs name; }; } ] ++ modules; }); - makeLandrun = { name, modules }: (evalModules { + makeSandnix = { name, modules }: (evalModules { inherit name modules; }).config.wrappedPackage; } diff --git a/tests/flake.lock b/tests/flake.lock index 27a2f9c..2b5e396 100644 --- a/tests/flake.lock +++ b/tests/flake.lock @@ -18,17 +18,6 @@ "type": "github" } }, - "landrun-nix": { - "locked": { - "path": "../", - "type": "path" - }, - "original": { - "path": "../", - "type": "path" - }, - "parent": [] - }, "nixpkgs": { "locked": { "lastModified": 1769461804, @@ -63,9 +52,20 @@ "root": { "inputs": { "flake-parts": "flake-parts", - "landrun-nix": "landrun-nix", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sandnix": "sandnix" } + }, + "sandnix": { + "locked": { + "path": "../", + "type": "path" + }, + "original": { + "path": "../", + "type": "path" + }, + "parent": [] } }, "root": "root", diff --git a/tests/flake.nix b/tests/flake.nix index 266613c..8d296c2 100644 --- a/tests/flake.nix +++ b/tests/flake.nix @@ -1,14 +1,14 @@ { inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; - landrun-nix.url = "path:../"; + sandnix.url = "path:../"; flake-parts.url = "github:hercules-ci/flake-parts"; }; outputs = inputs@{ flake-parts, ... }: flake-parts.lib.mkFlake { inherit inputs; } { systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; - imports = [ inputs.landrun-nix.flakeModule ]; + imports = [ inputs.sandnix.flakeModule ]; perSystem = { config, pkgs, ... }: let @@ -17,7 +17,7 @@ ++ pkgs.lib.optionals pkgs.stdenv.isLinux [ pkgs.util-linux ]; in { - landrunApps = { + sandnixApps = { test-true = { program = "${pkgs.coreutils}/bin/true"; }; diff --git a/vira.hs b/vira.hs index df967f4..33f5a4c 100644 --- a/vira.hs +++ b/vira.hs @@ -11,9 +11,9 @@ ] , build.flakes = [ "." - , "./examples/claude-sandboxed" { overrideInputs = [("landrun-nix", ".")] } - , "./examples/standalone" { overrideInputs = [("landrun-nix", ".")] } - , "./tests" { overrideInputs = [("landrun-nix", ".")] } + , "./examples/claude-sandboxed" { overrideInputs = [("sandnix", ".")] } + , "./examples/standalone" { overrideInputs = [("sandnix", ".")] } + , "./tests" { overrideInputs = [("sandnix", ".")] } ] , signoff.enable = True }