Difficulty to jail `bottles` with jail.nix in X11 environment

Is it impossible to jail bottles or lutris with jail.nix?
I tried something like this but it crash while launch

# https://alexdav.id/projects/jail-nix/#provide-jailnix-as-a-module-arg-in-a-nixos-configuration
{
  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
  inputs.jail-nix.url = "sourcehut:~alexdavid/jail.nix";
  outputs = { nixpkgs, jail-nix, ... }: {
    nixosConfigurations.my-nixos-host = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ({ pkgs, ... }: {
          # https://alexdav.id/projects/jail-nix/advanced-configuration/#additionalcombinators
          _module.args.jail = inputs.jail-nix.lib.extend {
            inherit pkgs;
            additionalCombinators =
              builtinCombinators: with builtinCombinators; {
                # This is just "gui" in jail.nix with "wayland" replaced by "unsafe-x11"
                gui-x11 = compose [
                  (add-runtime "mkdir -p ~/.config/dconf")
                  pulse
                  pipewire
                  # wayland
                  unsafe-x11
                  (runtime-deep-ro-bind (noescape "/etc/fonts"))
                  (readonly (noescape "~/.config/dconf"))
                  (fwd-env "XDG_RUNTIME_DIR")
                  (fwd-env "XDG_DATA_DIRS")
                  (readonly-paths-from-var "XDG_DATA_DIRS" ":")

                  # Cursor
                  (try-fwd-env "XCURSOR_THEME")
                  (try-fwd-env "XCURSOR_PATH")
                  (try-fwd-env "XCURSOR_SIZE")
                  (readonly-paths-from-var "XCURSOR_PATH" " ")
                ];
              };
          };
        })

        # Now all modules have `jail` passed into them:
        ({ jail, ... }: {
          environment.systemPackages = [
            (jail "bottles-jailed" pkgs.bottles (
              with jail.combinators;
              # https://git.sr.ht/~alexdavid/jail.nix#example
              [
                network
                gui-x11
                gpu
                (readonly "/var/log/journal")
              ]
            ))
          ];
        })
      ];
    };
  };
}

error message:

Authorization required, but no authorization protocol specified


(process:10): Gtk-CRITICAL **: 18:04:44.745: gtk_icon_theme_get_for_display: assertion 'GDK_IS_DISPLAY (display)' failed

(process:10): Gtk-CRITICAL **: 18:04:44.745: gtk_icon_theme_add_resource_path: assertion 'GTK_IS_ICON_THEME (self)' failed
/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/views/list.py:36: Warning: invalid (NULL) pointer instance
  Adw.init()
/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/views/list.py:36: Warning: g_signal_connect_object: assertion 'G_TYPE_CHECK_INSTANCE (instance)' failed
  Adw.init()

(bottles:10): Gtk-CRITICAL **: 18:04:44.771: gtk_icon_theme_get_for_display: assertion 'GDK_IS_DISPLAY (display)' failed

(bottles:10): Gtk-CRITICAL **: 18:04:44.771: gtk_icon_theme_add_resource_path: assertion 'GTK_IS_ICON_THEME (self)' failed

(bottles:10): Gtk-CRITICAL **: 18:04:44.771: gtk_icon_theme_get_for_display: assertion 'GDK_IS_DISPLAY (display)' failed

(bottles:10): Gtk-CRITICAL **: 18:04:44.771: gtk_icon_theme_has_icon: assertion 'GTK_IS_ICON_THEME (self)' failed
/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/main.py:255: Warning: g_object_get: assertion 'G_IS_OBJECT (object)' failed
  Adw.Application.do_startup(self)
/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/main.py:255: Warning: value "((GtkReducedMotion) 29109)" of type 'GtkReducedMotion' is invalid or out of range for property 'prefers-reduced-motion' of type 'GtkReducedMotion'
  Adw.Application.do_startup(self)

(bottles:10): Adwaita-WARNING **: 18:04:44.772: The resource style-dark.css is deprecated and shouldn't be used anymore. Use style.css with media queries instead.

(bottles:10): Gtk-CRITICAL **: 18:04:44.772: gtk_style_context_remove_provider_for_display: assertion 'GDK_IS_DISPLAY (display)' failed
18:04:44 (INFO) Launching with URI: None
18:04:44 (INFO) [Activate] request received.
Traceback (most recent call last):
  File "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/main.py", line 204, in do_command_line
    self.do_activate()
    ~~~~~~~~~~~~~~~~^^
  File "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/main.py", line 270, in do_activate
    win = BottlesWindow(application=self, arg_bottle=self.arg_bottle)
  File "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-bottles-unwrapped-63.2/share/bottles/bottles/frontend/windows/window.py", line 85, in __init__
    super().__init__(**kwargs, default_width=width, default_height=height)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-python3.13-pygobject-3.56.3/lib/python3.13/site-packages/gi/overrides/Gtk.py", line 571, in __init__
    raise RuntimeError(
    ...<2 lines>...
    )
RuntimeError: Gtk couldn't be initialized. Use Gtk.init_check() if you want to handle this case.
18:04:44 (INFO) [Shutdown] cleanup starting.

The main issue in this stage is this line:

Fixed by

(fwd-env "XAUTHORITY")
(unsafe-add-raw-args "--bind-try \"$XAUTHORITY\" \"$XAUTHORITY\"")

Still a lot of errors need to be overcome though

Just noticed bottles already wrap with buildFHSEnv which have bwrap builtin.

1 Like