Pretty much the title. Please bear with me, since I’m sort of a beginner 😅

I am trying to use nixpak to sandbox iamb, but for whatever reason, it doesn’t start up and run properly. Here’s the relevant section of the config

environment.systemPackages = [
      (mkNixPak {
        config = { pkgs, sloth, ... }: {
          app.package = pkgs.iamb;

          bubblewrap = {
            network = true;
            shareIpc = false;
            dieWithParent = true;

            bind.rw = [
              [
                (sloth.mkdir (sloth.concat' sloth.homeDir "/Downloads/iamb"))
                (sloth.concat' sloth.homeDir "/Downloads")
              ]

              (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgDataHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgStateHome "/iamb"))
              (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/iamb"))

            ];

            bind.ro = [
            "/etc"
            "/usr"
            # To mount the systemd resolution stuff and so on
            "/run/systemd"
            ];

            apivfs = {
              proc = true;
              dev = true;
            };

            bind.dev = [
              "/dev"
            ];

            tmpfs = [
              (sloth.mkdir "/tmp/iamb")
            ];

            env = {
                TERMINFO = "${pkgs.kitty}/lib/kitty/terminfo";
            };
          };

        };
      }).config.env
];

The full config can be found here

The following bubblewrap command works as-is on nixos, and doesn’t lead to any errors whatsoever:

bwrap --ro-bind /usr /usr \
--ro-bind /etc /etc \
--proc /proc \
--ro-bind /home/innocentzero/.local/state/nix/profile /home/innocentzero/.local/state/nix/profile \
--ro-bind /nix/store /nix/store \
--ro-bind /run/systemd /run/systemd \
--dev /dev \
--tmpfs /tmp \
--unshare-all \
--share-net \
--die-with-parent \
--bind /home/innocentzero/.config/iamb /home/innocentzero/.config/iamb \
--bind /home/innocentzero/.cache/iamb /home/innocentzero/.cache/iamb \
--bind /home/innocentzero/.local/share/iamb /home/innocentzero/.local/share/iamb \
iamb

However, executing the nixpak wrapped iamb produces the following (including the control characters):

^[[?62;4;22;28;52c^[[6;25;11t^[[0n* Logging in for @innocentzer0:cyberia.club...

Any ideas/suggestions? I’m not sure how exactly to get this to work. From what I see in the nixpak module, the generated command should be about the same. Any help is appreciated. Thanks!

  • moonpiedumplings@programming.devEnglish
    3·
    28 days ago

    Firstly, did you get it working? I notice your latest commit seems to mention that you got it working

    One thing I would recommend is to declare the iamb package separately in a let... in statement.

    let
   iamb = (mknixpak blah blah blah)

....
....

in

 userconfig.programs.iamb = {
      enable = true;
      # By using "iamb", instead of pkgs.iamb, it means we are using the nixpak wrapped version here
      package = iamb
      settings = {
        profiles.user.user_id = "@username:instance.com";
        settings = {
          image_preview = { };
          username_display = "displayname";
          user_gutter_width = 15;
        };
      };
    };

    This make it so that iamb is the nixpak wrapped version instead, in the userconfig. This would probably also make it so that you don’t need to declare it explicitly in your systemPackages.

  • innocentz3r0@programming.devOPEnglish
    2·
    29 days ago

    Ah yes, I got it working, the issue was unshare-pgid which had already been sort of raised in nixpak.

    In my case, I used bubblewrap.newSession (which is equivalent of --new-session). Idk why that worked out finally with --unshare-pgid, but I’d rather not spend more time on this.

    I like the idea of let binding the package declaration to use it in the config as well. I’ll probably use that. Thanks!