The building of nix packages is completely sandboxed and secure. The running of them is currently an after-thought. - https://spectrum-os.org/ https://spectrum

The building of nix packages is completely sandboxed and secure. The running of them is currently an after-thought. - https://spectrum-os.org/ https://spectrum-os.org/ is a big idea for secure running of applications, which leverages Nix for some things. - I would like to see some CloudABI/Capsicum experiments, as anything that is not capability based seems baroque, difficult to, ill-fitting the problem at hand, and generally going to end in tears. - There is currently some wrapping around systemd-nspawn which could be improved. BTW when I say "The running of them is currently an after-thought" this isn't as bad as it sounds. I would say all the good solutions are not the scope of Nix, but instead the scope of NixOS, Nix home-manager, nix-darwin, etc. Still, a real problem that deserves a solution. Thanks for bringing it up.