commit 7e6566062ea85527b01283e70a92ea673eb7374f parent f22acc58464ee7bf5f0a718654d7c78cd727f695 Author: mtmn <miro@haravara.org> Date: Sat, 25 Apr 2026 19:40:33 +0200 dotfiles: add `isolate` binary Diffstat:
| A | modules/mixins/dotfiles/bin/isolate | | | 72 | ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
1 file changed, 72 insertions(+), 0 deletions(-)
diff --git a/modules/mixins/dotfiles/bin/isolate b/modules/mixins/dotfiles/bin/isolate @@ -0,0 +1,72 @@ +#!/usr/bin/env bash +# https://dpc.pw/posts/bubblewrap-your-dev-env-and-agents/ + +set -euo pipefail + +# Skip re-isolating if already inside an isolated environment +if [[ -n "${ISOLATE_ENV:-}" ]]; then + >&2 echo "warning: already isolated" + exec "$@" +fi + +tiocsti_path="/proc/sys/dev/tty/legacy_tiocsti" +if [ ! -f "$tiocsti_path" ] || [ "$(cat "$tiocsti_path")" != "0" ]; then + >&2 echo "warning: TIOCSTI not disabled" +fi + +args=() + +args+=( + --dev-bind /dev /dev + --proc /proc + --tmpfs /tmp + --tmpfs /run + --setenv PROMPT_ENV_INDICATOR "isolated" + --setenv ISOLATE_ENV "$(pwd)" +) + +for p in \ + /bin \ + /lib \ + /lib64 \ + /usr/bin \ + /usr/lib \ + /etc \ + /nix \ + "$HOME/bin" \ + "$HOME/.config" \ + "$HOME/.gitconfig" \ + "$HOME/.nix-profile"; do + args+=(--ro-bind "$p" "$p") +done + +for p in \ + "$HOME/.cargo" \ + "$HOME/.claude" \ + "$HOME/.claude.json" \ + "$(pwd)"; do + args+=(--bind "$p" "$p") +done + +if [[ -n "${WAYLAND_DISPLAY:-}" ]]; then + wayland_sock="${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" + args+=(--bind "$wayland_sock" "$wayland_sock") + args+=(--setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY") +fi + +args+=( + --dir "$HOME/.gnupg" + --chmod 0700 "$HOME/.gnupg" +) + +# Source extra config (e.g. set by auto-isolate) to allow +# project-specific additions to args +if [[ -n "${ISOLATE_EXTRA_CONFIG:-}" && -f "$ISOLATE_EXTRA_CONFIG" ]]; then + source "$ISOLATE_EXTRA_CONFIG" + # Hide the config file inside the sandbox by overlaying /dev/null + args+=(--ro-bind /dev/null "$ISOLATE_EXTRA_CONFIG") +fi + +exec bwrap \ + "${args[@]}" \ + "$@"