2020-01-26 19:15:53 +00:00
2020-01-05 05:57:55 +00:00
2020-01-22 01:18:25 +00:00
2018-07-05 07:46:31 +00:00
2019-12-29 18:27:02 +03:00
2020-01-05 06:12:18 +00:00
2020-01-07 20:01:52 +00:00
2020-01-08 11:16:14 +00:00
2019-12-30 15:55:00 +00:00
2019-12-30 15:55:00 +00:00
2018-06-30 22:15:11 +00:00
2020-01-08 20:52:29 +00:00
2020-01-26 19:15:53 +00:00
2019-12-29 18:27:02 +03:00
2020-01-03 22:56:27 +00:00

Documentation Status Donate Donate

Nix application VMs: security through virtualization

Simple application VMs (hypervisor-based sandbox) based on Nix package manager.

Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.

appvm screenshot

Installation

Requirements

$ sudo apt install virt-manager curl git
$ sudo usermod -a -G libvirt $USER # group can also be "libvirtd"
$ newgrp libvirt
$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd

Install Nix package manager

$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl https://nixos.org/nix/install | sh
$ nix-channel --add https://nixos.org/channels/nixos-19.09 nixpkgs
$ . ~/.nix-profile/etc/profile.d/nix.sh

Install appvm

$ nix-env -if https://code.dumpstack.io/tools/appvm/archive/master.tar.gz

Usage

Search for applications

$ appvm search chromium

Run application

$ appvm start chromium
$ # ... long wait for first time, because we need to collect a lot of packages

Synchronize remote repos for applications

$ appvm sync

You can customize local settings in ~/.config/appvm/nix/local.nix.

Default hotkey to release cursor: ctrl+alt.

Shared directory

$ ls appvm/chromium
foo.tar.gz
bar.tar.gz

Close VM

$ appvm stop chromium

Automatic ballooning

Add this command:

$ appvm autoballoon

to crontab like that:

$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon
Description
Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
Readme 6 MiB
Languages
Go 84.5%
Nix 13.3%
Makefile 2.2%