How do I correctly sandbox iamb using nixpak

Help
1

Hello everyone, I’m a beginner at nix, so please bear with me

I am trying to use nixpak for sandboxing iamb, a terminal matrix client

I am currently stuck because iamb doesn’t start up properly when using the nixpak wrapper.

The following bubblewrap command works flawlessly, and loads iamb

bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb

I tried a similar thing with nixpak, trying to apply the same options, but that didn’t work out. Here’s my config link

Here’s the relevant version of the config

environment.systemPackages = [
      (mkNixPak {
        config = { pkgs, sloth, ... }: {
          app.package = pkgs.iamb;

          bubblewrap = {
            network = true;
            shareIpc = false;
            dieWithParent = true;

            bind.rw = [
              [
                (sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
                (sloth.concat' sloth.homeDir "/Downloads")
              ]

              (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))

            ];

            bind.ro = [
            "/etc"
            "/usr"
            # To mount the systemd resolution stuff and so on
            "/run/systemd"
            ];

            apivfs = {
              proc = true;
              dev = true;
            };

            bind.dev = [
              "/dev"
            ];

            tmpfs = [
              (sloth.mkdir "/tmp/iamb")
            ];

            env = {
                TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
            };
          };

        };
      }).config.env
];

One thing that stood out was the fact that when starting iamb from the nixpak wrapper, there are control characters that show up despite them not showing up in the bwrap command or the regular iamb.

The startup looked like this:

^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...

Any help regarding this? Or any better methods? Anything that fixes the issues really Thanks

2 Likes
2

Looks like you figured this out but for anyone going here in the future:

1 Like