diff --git a/README.md b/README.md index 0fa8a51..79df4b7 100644 --- a/README.md +++ b/README.md @@ -1,50 +1,49 @@ -# Brief +# unsafe-cell -`unsafe-cell` is designed with following workloads in mind: -- share a cache/binary store with the host -- share a configuration with the host -- allow limited internet access (to a set list of domains) -- jailed program might misbehave -- host must be protected from _accidental_ damage - -So this cell aims to prevent malfunction, not malice; for example: current design shares a nix daemon with the host -- a malicious code could easily exploit the build pipeline to dos, mine crypto or circumvent the web proxy. However, this kind of malfunction is extremely unlikely happen _accidentally_, while benefits of sharing the nix store with host are self-explanatory. - -Example use-cases: -- trusted CI job container -- agentic runtime (like `opencode`, for instance) - -## Parameters - -- `command` (`pkgs -> derivation`): a function to build the cell entrypoint from `nixpkgs` instantiation -- `worktreePath` (string): host path to bind as `/home/cell/worktree` inside the jail. Use this parameter to expose jailed processes primary worktree (like a repo you work on) -- `extraCombinators` (`jail-nix -> list`, default `_: []`): a function to produce additional [`jail.nix` combinators](https://alexdav.id/projects/jail-nix/combinators) you want the jail to have. -- `tinyproxyFilter` (string or null): Path to a tinyproxy filter file. `null` means "allow all", non-`null` should contain a regex list of the allowed domains. Uses [`tinyproxy`](https://tinyproxy.github.io/) (with your filter as a white-list!). -- `logDir` (string or null): directory to bind for log output. `null` means using the jail tempdir (wherever `mktemp` creates it). -- `nixDaemonSocket` (string, default `"/var/nix/daemon-socket"`): host path to nix daemon socket directory (contains `socket`). - -NOTE: if you want to pass some truly special arguments to `bwrap`, see `unsafe-add-raw-args` jail.nix combinator -- an escape hatch for adding bare os args for the `bwrap` process. -NOTE: for now, the host is expected to have a nix daemon socket. To make the cell work, at the bare minimum, you should make up a socket and point `nixDaemonSocket` to it -- cell will connect `socat` to it, but won't actually communicate with the other side, for as long as you don't use `nix` inside the jail. +A `jail-nix` container that shares user namespace and grants all capabilities (the "unsafe" part), packaging a command into a self-contained executable ("cell"). It provides nix daemon passthrough, configurable networking, and filesystem isolation — enough to run agentic workloads without the friction of full containerization. ## Capabilities -- nix daemon access: - - read-only bind of host store (`/nix/store`) - - bind of the daemon socket (`/run/nix`) - - nix client config to silence experimental feature warnings (`nix-command`, `flakes`) - - nix client substitutions enabled to allow binary cache usage (client controls that, for some reason?) -- network: - - http proxied through `tinyproxy`, with optional filter - - isolated network namespace with no interfaces -- workdir bind-mounted at a configurable host path -- optional log directory bind +Shares user/id mappings 1:1 with the host. All kernel capabilities granted. No PID namespace isolation — host PID 1 visible inside. New mount namespace with only explicitly bound paths. -planned: -- spawning a personal dockerd (blocked by some annoying stuff inside `bwrap`) -- support for MITM docker image cache (could be implemented now, but is useless without a personal dockerd) +Nix daemon access via read-only bind of host store (`/nix/store`) and daemon socket (`/run/nix`). Nix config and experimental features (`nix-command`, `flakes`) set inside the jail. Binary substitution enabled. -NOTE: unfortunately, outward communication with protocols other than HTTP(S) is not supported. Any celled app failing to interpret `{HTTP{,S},NO}_PROXY` envvars, is also likely to misbehave. +Network access is always proxied through tinyproxy with an isolated network namespace (no network routes inside the jail). A socat pair forwards TCP through a Unix socket onto tinyproxy. An optional tinyproxy filter file controls allowed domains; defaults to allow-all (`.*`). -## Usage example +Working directory bind-mounted at a configurable host path. Optional log directory bind. -See `tests.nix`. +Entrypoint runs the command derivation supplied via the `command` parameter. `PATH` includes `nix`, `coreutils`. -Will probably add my `opencode` run script, once it's complete. +## Parameters + +`command` (`pkgs -> derivation`): Builds the jailed entrypoint. Receives nixpkgs. + +`worktreePath` (string): Host path to bind as `/home/cell/worktree` inside the jail. Required, no default. + +`extraCombinators` (`jail-nix -> list`, default `_: []`): jail-nix combinators appended to the default set. + +`tinyproxyFilter` (string or null): Path to a tinyproxy filter file. `null` = default allow-all filter (`.*`); non-null = use the specified filter file. + +`logDir` (string or null): Directory to bind for log output. `null` = use jail tempdir (`$JD`). + +`nixDaemonSocket` (string, default `"/var/nix/daemon-socket"`): Host path to nix daemon socket directory (contains `socket`). + +## Implicit assumptions + +`mkCell` builds its output for every system in `systems.flakeExposed`. Requires `nixpkgs` and `jail-nix` as flake inputs. + +The nix daemon socket path is assumed to be a **directory** containing a `socket` entry — the `NIX_REMOTE` env var always resolves `/run/nix/socket` regardless of `nixDaemonSocket`. + +`/nix/store` is assumed present and readable on the host. `NIX_PATH` hardcoded to `/home/cell/.nix-defexpr/channels`. + +`NIX_CONFIG` unconditionally overrides host nix config — forces `nix-command`, `flakes`, and `substitute = true`. + +Host-side packages required at nixpkgs evaluation time: `socat`, `coreutils`, `nix`, `iproute2`, `gawk`, `tinyproxy`. + +`worktreePath` is resolved relative to the host-script's CWD at runtime (shell expansion applies). + +The default combinator set does not include SSL certificates, app config/state directories, nix registry mapping, nix config files, or secret tokens — these must be supplied by the consumer via `extraCombinators`. + +The host script always creates `$JD` (temp dir) with tinyproxy config, SSL overlay dirs, and Unix socket — all cleaned up on exit. The SSL overlay dirs are created but unused (dead code from original hardcoded version). + +No IPC namespace isolation — inherits from host. diff --git a/flake.lock b/flake.lock deleted file mode 100644 index 75d7b51..0000000 --- a/flake.lock +++ /dev/null @@ -1,41 +0,0 @@ -{ - "nodes": { - "jail-nix": { - "locked": { - "lastModified": 1772137954, - "narHash": "sha256-h4MGNbOo7L3RHi4uNFmsg5g17/DHXEfnv/xiG6BrNFQ=", - "owner": "~alexdavid", - "repo": "jail.nix", - "rev": "42b355c38ca63dab4904acc5c0d95f17954a8c9b", - "type": "sourcehut" - }, - "original": { - "owner": "~alexdavid", - "repo": "jail.nix", - "type": "sourcehut" - } - }, - "nixpkgs": { - "locked": { - "lastModified": 1778869304, - "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "d233902339c02a9c334e7e593de68855ad26c4cb", - "type": "github" - }, - "original": { - "id": "nixpkgs", - "type": "indirect" - } - }, - "root": { - "inputs": { - "jail-nix": "jail-nix", - "nixpkgs": "nixpkgs" - } - } - }, - "root": "root", - "version": 7 -} diff --git a/flake.nix b/flake.nix index 7d1d4c6..6826446 100644 --- a/flake.nix +++ b/flake.nix @@ -1,5 +1,5 @@ { - description = "unsafe-cell - a reasonably-isolated environment"; + description = "unsafe-cell - isolated environment with trusted nix store access"; inputs = { nixpkgs.url = "nixpkgs"; @@ -146,12 +146,7 @@ SOCAT_PID=$! trap "${pkgs.coreutils}/bin/rm -rf $JD; ${pkgs.coreutils}/bin/kill $PROXY_PID $SOCAT_PID" EXIT - - export NIX_CONFIG=" - ''${NIX_CONFIG:-} - extra-experimental-features = nix-command flakes - substitute = true" - + export NIX_CONFIG="''${NIX_CONFIG:+$NIX_CONFIG$'\n'}extra-experimental-features = nix-command flakes"$'\n'"substitute = true" ${jailed}/bin/unsafe-cell ''; in @@ -168,7 +163,7 @@ system: let pkgs = nixpkgs.legacyPackages.${system}; - test-names = builtins.attrNames (builtins.removeAttrs self.checks.${system} [ "all" ]); + test-names = builtins.attrNames self.checks.${system}.test; in { test-logs = { @@ -178,7 +173,7 @@ failed=0 for test in ${builtins.concatStringsSep " " test-names}; do echo "=== $test ===" - if nix build ".#checks.${system}.$test" -L --no-link 2>&1; then + if nix build ".#checks.${system}.test.$test" -L --no-link 2>&1; then echo "=== PASS: $test ===" else echo "=== FAIL: $test ===" diff --git a/tests.nix b/tests.nix index e791ba9..c91064e 100644 --- a/tests.nix +++ b/tests.nix @@ -382,5 +382,8 @@ nixpkgs.lib.genAttrs ''; in - tests // { inherit all; } + { + inherit all; + test = tests; + } )