Open PedroRegisPOAR opened 2 years ago
xhost + \
&& { podman \
run \
--cap-add=SYS_ADMIN \
--device=/dev/kvm \
--device=/dev/fuse \
--log-level=error \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--interactive=true \
--privileged=false \
--tty=false \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume="$(pwd)":/code \
--workdir=/code \
docker.io/nixpkgs/nix-flakes \
<< COMMANDS
nix \
profile \
install \
nixpkgs#nettools \
nixpkgs#coreutils \
nixpkgs#xorg.xclock \
nixpkgs#file
timeout 10 xclock || test $? -eq 124 || echo 'Error, some thing went wrong in xclock test!'
hostname
hostname abc123
hostname
touch example-file.txt
stat example-file.txt
COMMANDS
} && xhost -
stat example-file.txt
podman \
run \
--cap-add SYS_ADMIN \
--cap-add SYS_RESOURCE \
--device=/dev/kvm \
--device=/dev/fuse \
--log-level=error \
--env STORAGE_DRIVER=vfs \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--interactive=true \
--privileged=true \
--tty=true \
--rm=true \
--security-opt seccomp=unconfined \
--security-opt label=disable \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:rw \
--volume=/proc/:/proc/:rw \
--volume="$(pwd)":/code \
--workdir=/code \
docker.io/nixpkgs/nix-flakes
stat /proc/1/environ
xhost + \
&& { podman \
run \
--cap-add=SYS_ADMIN \
--device=/dev/kvm \
--device=/dev/fuse \
--log-level=error \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--interactive=true \
--privileged=false \
--tty=false \
--rm=true \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume="$(pwd)":/code \
--workdir=/code \
docker.io/nixpkgs/nix-flakes \
<< COMMANDS
nix \
profile \
install \
nixpkgs#nettools \
nixpkgs#coreutils \
nixpkgs#xorg.xclock \
nixpkgs#file
timeout 10 xclock || test $? -eq 124 || echo 'Error, some thing went wrong in xclock test!'
hostname
hostname abc123
hostname
touch example-file.txt
stat example-file.txt
COMMANDS
} && xhost -
stat example-file.txt
podman \
run \
--device=/dev/kvm \
--device=/dev/fuse \
--log-level=error \
--env STORAGE_DRIVER=vfs \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env=PATH=/root/.nix-profile/bin:/usr/bin:/bin \
--interactive=true \
--privileged=true \
--tty=true \
--rm=true \
--security-opt seccomp=unconfined \
--security-opt label=disable \
--user=0 \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--volume=/etc/localtime:/etc/localtime:ro \
--volume=/proc/:/proc/:rw \
--volume="$(pwd)":/code \
--workdir=/code \
docker.io/nixpkgs/nix-flakes \
bash \
-c \
'stat /proc/1/environ'
podman run --user 200:200 -it -v $(pwd):/mnt:Z busybox sh -c 'id'
Jörg 'Mic92' Thalheim - About Nix sandboxes and breakpoints (NixCon 2018), start=903&end=916
Jörg 'Mic92' Thalheim - About Nix sandboxes and breakpoints (NixCon 2018), start=853&end=963
TODO: test it
Refs.:
Refs.:
Magic command:
It would be so easy, but it is broken: