1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

{ depot, pkgs, ... }:

let
  inherit (depot.nix) writeExecline;

  # lightweight sandbox; execute any command in an unshared
  # namespace that only has access to /nix and the specified
  # directories from `extraMounts`.
  sandbox = { extraMounts ? [] }:
    let
      pathsToMount = [ "/nix" "/dev" "/proc" "/sys" ] ++ extraMounts;
      all = builtins.concatMap (c: [ "if" c ]);
      mount = "${pkgs.util-linux}/bin/mount";
      unshare = "${pkgs.util-linux}/bin/unshare";
      newroot = pkgs.runCommandLocal "sandbox-root" {} ''mkdir "$out"'';
    in writeExecline "sandbox" {} (builtins.concatLists [
      [ unshare "--mount" "--map-root-user" ]
      (all
        ([ [ mount "-t" "tmpfs" "container_root" newroot ] ]
        ++ builtins.concatMap
             (rootPath: [
               [ "${pkgs.coreutils}/bin/mkdir" "-p" "${newroot}${rootPath}" ]
               [ mount "--rbind" rootPath "${newroot}${rootPath}" ]
             ])
             pathsToMount))
      [ "${pkgs.coreutils}/bin/chroot" newroot "$@" ]
    ]);

in sandbox