Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 19 additions & 19 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
[![GitHub Discussions](https://img.shields.io/github/discussions/srid/landrun-nix)](https://github.com/srid/landrun-nix/discussions)
[![GitHub Discussions](https://img.shields.io/github/discussions/srid/sandnix)](https://github.com/srid/sandnix/discussions)

# landrun-nix
# sandnix

A Nix flake-parts module for wrapping programs with [landrun](https://github.com/Zouuup/landrun) (Landlock) sandbox.
A Nix flake-parts module for wrapping programs with a sandboxed environment using [landrun](https://github.com/Zouuup/landrun) (Landlock) on Linux, and `sandbox-exec` on macOS.

## Usage

In your `flake.nix`:

```nix
{
inputs.landrun-nix.url = "github:srid/landrun-nix";
inputs.sandnix.url = "github:srid/sandnix";

outputs = { flake-parts, landrun-nix, ... }:
outputs = { flake-parts, sandnix, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
imports = [ landrun-nix.flakeModule ];
imports = [ sandnix.flakeModule ];

perSystem = { pkgs, ... }: {
landrunApps.my-app-sandboxed = {
sandnixApps.my-app-sandboxed = {
program = "${pkgs.my-app}/bin/my-app";
features = {
tty = true; # Terminal support
Expand All @@ -40,20 +40,20 @@ Run with: `nix run .#my-app-sandboxed`

## Reusable Modules

landrun-nix provides reusable modules for common applications via `landrunModules.*`. These can be imported into your app configurations:
sandnix provides reusable modules for common applications via `sandnixModules.*`. These can be imported into your app configurations:

```nix
{
inputs.landrun-nix.url = "github:srid/landrun-nix";
inputs.sandnix.url = "github:srid/sandnix";

outputs = { flake-parts, landrun-nix, ... }:
outputs = { flake-parts, sandnix, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
imports = [ landrun-nix.flakeModule ];
imports = [ sandnix.flakeModule ];

perSystem = { pkgs, ... }: {
landrunApps.my-app = {
sandnixApps.my-app = {
imports = [
landrun-nix.landrunModules.gh # Import GitHub CLI module
sandnix.sandnixModules.gh # Import GitHub CLI module
];
program = "${pkgs.my-app}/bin/my-app";
features.network = true;
Expand All @@ -67,10 +67,10 @@ landrun-nix provides reusable modules for common applications via `landrunModule

| Module | Description |
|--------|-------------|
| `landrunModules.gh` | GitHub CLI (`gh`) configuration with D-Bus keyring support |
| `landrunModules.git` | Git configuration with TTY support and repository access |
| `landrunModules.haskell` | Haskell tooling with Cabal configuration and state directory access |
| `landrunModules.markitdown` | Markitdown configuration with `/proc/cpuinfo` access |
| `sandnixModules.gh` | GitHub CLI (`gh`) configuration with D-Bus keyring support |
| `sandnixModules.git` | Git configuration with TTY support and repository access |
| `sandnixModules.haskell` | Haskell tooling with Cabal configuration and state directory access |
| `sandnixModules.markitdown` | Markitdown configuration with `/proc/cpuinfo` access |

## Examples

Expand All @@ -83,7 +83,7 @@ See [examples/claude-sandboxed](./examples/claude-sandboxed/flake.nix) for a com
Try it:

```sh
nix run github:srid/landrun-nix?dir=examples/claude-sandboxed
nix run github:srid/sandnix?dir=examples/claude-sandboxed
```

## Features
Expand Down Expand Up @@ -114,7 +114,7 @@ Fine-grained control via `cli.*`:

## Discussions

https://github.com/srid/landrun-nix/discussions
https://github.com/srid/sandnix/discussions

## License

Expand Down
26 changes: 13 additions & 13 deletions examples/claude-sandboxed/flake.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 8 additions & 8 deletions examples/claude-sandboxed/flake.nix
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,28 @@
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
flake-parts.url = "github:hercules-ci/flake-parts";
landrun-nix.url = "path:../../";
sandnix.url = "path:../../";
};

outputs = inputs@{ flake-parts, landrun-nix, ... }:
outputs = inputs@{ flake-parts, sandnix, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];

imports = [ landrun-nix.flakeModule ];
imports = [ sandnix.flakeModule ];

perSystem = { pkgs, system, ... }: {
_module.args.pkgs = import inputs.nixpkgs {
inherit system;
config.allowUnfree = true;
};

landrunApps.default = {
sandnixApps.default = {
name = "claude";
imports = [
landrun-nix.landrunModules.gh # So, Claude can run `gh` CLI
landrun-nix.landrunModules.git # So, Claude can run `git` CLI
landrun-nix.landrunModules.markitdown # So, Claude can run `markitdown` with CPU info access
landrun-nix.landrunModules.haskell # So, Claude can use Haskell tooling
sandnix.sandnixModules.gh # So, Claude can run `gh` CLI
sandnix.sandnixModules.git # So, Claude can run `git` CLI
sandnix.sandnixModules.markitdown # So, Claude can run `markitdown` with CPU info access
sandnix.sandnixModules.haskell # So, Claude can use Haskell tooling
];
program = "${pkgs.claude-code}/bin/claude";
features = {
Expand Down
26 changes: 13 additions & 13 deletions examples/standalone/flake.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions examples/standalone/flake.nix
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
landrun-nix.url = "path:../../";
sandnix.url = "path:../../";
};

outputs = { self, nixpkgs, landrun-nix }:
outputs = { self, nixpkgs, sandnix }:
let
system = "x86_64-linux";
pkgs = import nixpkgs { inherit system; };
landrunLib = import landrun-nix.lib { inherit pkgs; };
sandnixLib = import sandnix.lib { inherit pkgs; };
in
{
packages.${system}.default = landrunLib.makeLandrun {
packages.${system}.default = sandnixLib.makeSandnix {
name = "hello-wrapped";
modules = [
{
Expand Down
16 changes: 8 additions & 8 deletions flake.nix
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@
outputs = { self }: {
lib = ./nix/lib.nix;

flakeModule = ./modules/flake-parts/landrun;
flakeModule = ./modules/flake-parts/sandnix;

landrunModules = {
gh = import ./modules/landrun/gh.nix;
git = import ./modules/landrun/git.nix;
haskell = import ./modules/landrun/haskell.nix;
markitdown = import ./modules/landrun/markitdown.nix;
landrun = ./modules/flake-parts/landrun/landrun.nix;
landrunApps = ./modules/flake-parts/landrun/landrunApps.nix;
sandnixModules = {
gh = import ./modules/sandnix/gh.nix;
git = import ./modules/sandnix/git.nix;
haskell = import ./modules/sandnix/haskell.nix;
markitdown = import ./modules/sandnix/markitdown.nix;
sandnix = ./modules/flake-parts/sandnix/sandnix.nix;
sandnixApps = ./modules/flake-parts/sandnix/sandnixApps.nix;
};
};
}
6 changes: 3 additions & 3 deletions justfile
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Run the claude-sandboxed example with local landrun-nix override
# Run the claude-sandboxed example with local sandnix override
run-example:
nix run ./examples/claude-sandboxed --override-input landrun-nix .
nix run ./examples/claude-sandboxed --override-input sandnix .

# Run integration tests
test:
Expand All @@ -12,4 +12,4 @@ test:
# Linux: util-linux script syntax: script -qec <command> <output>
SCRIPT_ARGS="-qec ./tests/test.bats /dev/null"
fi
nix develop ./tests --override-input landrun-nix path:./. -c script $SCRIPT_ARGS
nix develop ./tests --override-input sandnix path:./. -c script $SCRIPT_ARGS
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ in
config = lib.mkIf pkgs.stdenv.isDarwin {
wrappedPackage =
if config.cli.extraArgs != [ ] then
lib.warn "landrun-nix: extraArgs are ignored on Darwin as sandbox-exec does not support them." pkg
lib.warn "sandnix: extraArgs are ignored on Darwin as sandbox-exec does not support them." pkg
else
pkg;
};
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,20 @@ in
options = {
perSystem = mkPerSystemOption
({ config, ... }: {
imports = [ ./landrunApps.nix ];
imports = [ ./sandnixApps.nix ];

config = {
packages = lib.mapAttrs
(name: cfg: cfg.wrappedPackage)
config.landrunApps;
config.sandnixApps;

apps = lib.mapAttrs
(name: cfg: {
type = "app";
program = lib.getExe cfg.wrappedPackage;
meta = cfg.meta;
})
config.landrunApps;
config.sandnixApps;
};
});
};
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ in

program = mkOption {
type = types.str;
description = "The program to wrap with landrun (e.g., \${pkgs.foo}/bin/foo)";
description = "The program to wrap with sandnix (e.g., \${pkgs.foo}/bin/foo)";
};

preHook = mkOption {
Expand Down Expand Up @@ -114,12 +114,12 @@ in
extraArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = "Additional landrun arguments";
description = "Additional sandnix arguments";
};
};
};
default = { };
description = "Landrun CLI arguments configuration";
description = "Sandnix CLI arguments configuration";
};

meta = mkOption {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ let
types;
in
{
options.landrunApps = mkOption {
options.sandnixApps = mkOption {
type = types.attrsOf (types.submoduleWith {
modules = [
./options.nix
Expand All @@ -15,6 +15,6 @@ in
];
});
default = { };
description = "Applications to wrap with landrun sandbox";
description = "Applications to wrap with sandnix sandbox";
};
}
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
6 changes: 3 additions & 3 deletions nix/lib.nix
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
{ pkgs, lib ? pkgs.lib, ... }:

rec {
evalModules = { name ? "landrun", modules }: (lib.evalModules {
evalModules = { name ? "sandnix", modules }: (lib.evalModules {
modules = [
../modules/flake-parts/landrun/landrun.nix
../modules/flake-parts/sandnix/sandnix.nix
{ _module.args = { inherit pkgs name; }; }
] ++ modules;
});

makeLandrun = { name, modules }: (evalModules {
makeSandnix = { name, modules }: (evalModules {
inherit name modules;
}).config.wrappedPackage;
}
Loading