.png)
1 month ago
6
A Nix flake-parts module for wrapping programs with landrun (Landlock) sandbox.
In your flake.nix:
{
inputs.landrun-nix.url = "github:srid/landrun-nix";
outputs = { flake-parts, landrun-nix, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
imports = [ landrun-nix.flakeModule ];
perSystem = { pkgs, ... }: {
landrunApps.my-app-sandboxed = {
program = "${pkgs.my-app}/bin/my-app";
features = {
tty = true; # Terminal support
nix = true; # Nix store access (default)
network = true; # Network access
tmp = true; # /tmp access (default)
};
# Raw arguments to pass to `landrun` CLI
cli = {
rw = [ "$HOME/.config/my-app" ];
rox = [ "/etc/hosts" ];
};
};
};
};
}
Run with: nix run .#my-app-sandboxed
landrun-nix provides reusable modules for common applications via landrunModules.*. These can be imported into your app configurations:
{
inputs.landrun-nix.url = "github:srid/landrun-nix";
outputs = { flake-parts, landrun-nix, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
imports = [ landrun-nix.flakeModule ];
perSystem = { pkgs, ... }: {
landrunApps.my-app = {
imports = [
landrun-nix.landrunModules.gh # Import GitHub CLI module
];
program = "${pkgs.my-app}/bin/my-app";
features.network = true;
};
};
};
}
| landrunModules.gh | GitHub CLI (gh) configuration with D-Bus keyring support |
Sandbox Claude Code with access to project directory, config files, and network.
See examples/claude-sandboxed for a complete working example.
Try it:
nix run github:srid/landrun-nix?dir=examples/claude-sandboxed
High-level feature flags automatically configure common sandboxing patterns:
| features.tty | false | TTY devices, terminfo, locale env vars |
| features.nix | true | Nix store, system paths, PATH env var |
| features.network | false | DNS resolution, SSL certificates, unrestricted network |
| features.tmp | true | Read-write access to /tmp |
| features.dbus | false | D-Bus session bus, keyring access for Secret Service API |
Fine-grained control via cli.*:
| rox | Read-only + execute paths |
| ro | Read-only paths |
| rwx | Read-write-execute paths |
| rw | Read-write paths |
| env | Environment variables to pass through |
| unrestrictedNetwork | Allow all network access |
| addExec | Auto-add executable to rox (default: true) |
https://github.com/srid/landrun-nix/discussions
GPL-3.0
