| Age | Commit message (Collapse) | Author |
|---|
|
This used to be impossible due to nix jank which has been addressed.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is for passing files between applications, similar to android /sdcard.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This generates warnings when compiling without optimisation.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Clang is better than gcc in various ways. This also pulls in clang-format which is very helpful.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This uses the Go map and is verified against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The script is from Go source of same name. The result is checked against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Remove special case and invoke hakurei out of process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This should eventually replace bwrap.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is usable on nixos now due to the static build.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Tests for fpkg is going to be in ./cmd/fpkg, so this central tests directory is no longer necessary.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This appears to be the only way to build them with different configuration. This enables static linking in the main package.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
For adding tests for fpkg.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Rulesets adapted from Flatpak for compatibility.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This takes some metadata, sandbox options, a launch script and a list of home-manager modules. The result needs to be executed in an environment with nix daemon access, and it produces the final package file.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Adapted from nixos sway integration tests.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Reduce rebuilds during development on my system.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This change makes it possible to start a devShell when tests aren't passing.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
More sandbox features will be added and this will no longer track ego's features and behaviour.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
