isolate (1663B)
1 #!/usr/bin/env bash 2 # https://dpc.pw/posts/bubblewrap-your-dev-env-and-agents 3 4 set -euo pipefail 5 6 # Skip re-isolating if already inside an isolated environment 7 if [[ -n "${ISOLATE_ENV:-}" ]]; then 8 >&2 echo "warning: already isolated" 9 exec "$@" 10 fi 11 12 tiocsti_path="/proc/sys/dev/tty/legacy_tiocsti" 13 if [ ! -f "$tiocsti_path" ] || [ "$(cat "$tiocsti_path")" != "0" ]; then 14 >&2 echo "warning: TIOCSTI not disabled" 15 fi 16 17 args=() 18 19 args+=( 20 --dev-bind /dev /dev 21 --proc /proc 22 --tmpfs /tmp 23 --tmpfs /run 24 --setenv PROMPT_ENV_INDICATOR "isolated" 25 --setenv ISOLATE_ENV "$(pwd)" 26 ) 27 28 for p in \ 29 /bin \ 30 /lib \ 31 /lib64 \ 32 /usr/bin \ 33 /usr/lib \ 34 /etc \ 35 /nix \ 36 "$HOME/bin" \ 37 "$HOME/.zvm" \ 38 "$HOME/.cargo" \ 39 "$HOME/.config" \ 40 "$HOME/.gitconfig" \ 41 "$HOME/.local/bin" \ 42 "$HOME/.local/share/tools" \ 43 "$HOME/.cache/zig" \ 44 "$HOME/.rustup" \ 45 "$HOME/.nix-profile"; do 46 args+=(--ro-bind "$p" "$p") 47 done 48 49 for p in \ 50 "$HOME/.codex" \ 51 "$HOME/.cache/opencode" \ 52 "$HOME/.config/opencode" \ 53 "$HOME/.local/share/opencode" \ 54 "$HOME/.local/state/opencode" \ 55 "$(pwd)"; do 56 args+=(--bind "$p" "$p") 57 done 58 59 if [[ -n "${WAYLAND_DISPLAY:-}" ]]; then 60 wayland_sock="${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" 61 args+=(--bind "$wayland_sock" "$wayland_sock") 62 args+=(--setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY") 63 fi 64 65 args+=() 66 67 # Source extra config (e.g. set by auto-isolate) to allow 68 # project-specific additions to args 69 if [[ -n "${ISOLATE_EXTRA_CONFIG:-}" && -f "$ISOLATE_EXTRA_CONFIG" ]]; then 70 source "$ISOLATE_EXTRA_CONFIG" 71 # Hide the config file inside the sandbox by overlaying /dev/null 72 args+=(--ro-bind /dev/null "$ISOLATE_EXTRA_CONFIG") 73 fi 74 75 exec bwrap \ 76 "${args[@]}" \ 77 "$@"