4 ms·
I do wonder if some future Nix-variant which based around sandboxing first could make life easier. Nix seems to have to put lots of work into handling programs
by CJefferson 3y ago
I do wonder if some future Nix-variant which based around sandboxing first could make life easier.
Nix seems to have to put lots of work into handling programs that expect to find to find /bin/bash. An alternative would be to put programs in custom sandboxes, where /bin/bash is found exactly where they expect to find it.
- remexre 3y agoI think that still requires lots of work, since lots of programs expect to be able to pass around paths to children/parents and have those paths remain openable. For instance, if both cmake and ld get their own sandboxes, with their own view of /lib, it seems pretty likely that cmake's -L flags will get mixed up, in a way that's harder to debug than "oh, CMake passed -L/lib/foo; nothing should use /lib, so I need to find where that's hardcoded."
- awegio 3y ago> put programs in custom sandboxes, where /bin/bash is found exactly where they expect to find it NixOS can do that, I think it was necessary to get Steam games running https://nixos.org/manual/nixpkgs/stable/#sec-fhs-environments https://nixos.org/manual/nixpkgs/stable/#sec-fhs-environment...