system/desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sandboxing

Browse source
This commit is contained in:
root 2026-07-18 11:45:31 -03:00
parent 5f70e8be94
commit 0f1a81c2aa
No known key found for this signature in database
13 changed files with 230 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

104
microvm/sandbox.nix Normal file
View file

@ -0,0 +1,104 @@
{
config,
pkgs,
lib,
...
}:
{
microvm.host.useNotifySockets = true;
microvm.vms."sandbox" = {
config = {
users.users.root = {
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
users.users.sandbox = {
isNormalUser = true;
uid = 1001;
group = "users";
extraGroups = [
"video"
"render"
];
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
services.openssh.enable = true;
boot.kernelModules = [
"drm"
"virtio_gpu"
];
boot.blacklistedKernelModules = lib.mkForce [ ];
environment.sessionVariables = {
WAYLAND_DISPLAY = "wayland-1";
DISPLAY = ":0";
QT_QPA_PLATFORM = "wayland";
GDK_BACKEND = "wayland";
XDG_SESSION_TYPE = "wayland";
};
hardware.graphics.enable = true;
system.stateVersion = lib.trivial.release;
environment.systemPackages = with pkgs; [
xdg-utils
ungoogled-chromium
ghostty
tmux
waypipe
pciutils
];
microvm = {
vsock = {
cid = 3;
ssh.enable = true;
};
writableStoreOverlay = "/nix/.rw-store";
# graphics.enable = true;
mem = 4096;
interfaces = [
{
type = "user";
id = "vm-1";
mac = "02:00:00:01:01:01";
}
];
volumes = [
{
mountPoint = "/var";
image = "var.img";
size = 256;
}
{
mountPoint = "/nix/.rw-store";
image = "nix-store-overlay.img";
size = 512;
}
];
shares = [
{
proto = "virtiofs";
tag = "projects";
source = "/home/user/dev";
mountPoint = "/home/user/dev";
}
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
readOnly = true;
}
];
hypervisor = "qemu";
};
};
};
}