{
  config,
  pkgs,
  lib,
  ...
}:
{
  microvm.host.useNotifySockets = true;
  microvm.vms."sandbox" = {
    config = {
      users.users.root = {
        password = "";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
        ];
      };
      users.users.sandbox = {
        isNormalUser = true;
        uid = 1001;
        group = "users";
        extraGroups = [
          "video"
          "render"
        ];
        password = "";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
        ];
      };
      services.openssh.enable = true;

      boot.kernelModules = [
        "drm"
        "virtio_gpu"
      ];
      boot.blacklistedKernelModules = lib.mkForce [ ];

      environment.sessionVariables = {
        WAYLAND_DISPLAY = "wayland-1";
        DISPLAY = ":0";
        QT_QPA_PLATFORM = "wayland";
        GDK_BACKEND = "wayland";
        XDG_SESSION_TYPE = "wayland";
      };

      hardware.graphics.enable = true;
      system.stateVersion = lib.trivial.release;

      environment.systemPackages = with pkgs; [
        xdg-utils
        ungoogled-chromium
        ghostty
        tmux
        waypipe
        pciutils
      ];

      microvm = {
        vsock = {
          cid = 3;
          ssh.enable = true;
        };
        writableStoreOverlay = "/nix/.rw-store";
        # graphics.enable = true;
        mem = 4096;
        interfaces = [
          {
            type = "user";
            id = "vm-1";
            mac = "02:00:00:01:01:01";
          }
        ];
        volumes = [
          {
            mountPoint = "/var";
            image = "var.img";
            size = 256;
          }
          {
            mountPoint = "/nix/.rw-store";
            image = "nix-store-overlay.img";
            size = 512;
          }
        ];
        shares = [
          {
            proto = "virtiofs";
            tag = "projects";
            source = "/home/user/dev";
            mountPoint = "/home/user/dev";
          }
          {
            proto = "virtiofs";
            tag = "ro-store";
            source = "/nix/store";
            mountPoint = "/nix/.ro-store";
            readOnly = true;
          }
        ];
        hypervisor = "qemu";
      };
    };
  };
}