Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
c0801541b3
There is a race condition, when good behaving VMs will temporarily truncate .memory_used to 0 bytes (update is not atomic). Also, as a matter of principle, VMs should not crash the host, ever. Co-authored-by: msm <msm@cert.pl> |
||
|---|---|---|
| .github | ||
| docs | ||
| dot-desktop-fuse | ||
| os | ||
| patches | ||
| .envrc | ||
| .gitignore | ||
| appvm.go | ||
| base.nix.go | ||
| builtin.go | ||
| default.nix | ||
| deps.nix | ||
| generate.go | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| local.nix.template.go | ||
| Makefile | ||
| README.md | ||
| shell.nix | ||
| xml.go | ||
Nix application VMs: security through virtualization
Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.
Installation
Usage
Search for applications
$ appvm search chromium
Run application
$ appvm start chromium
$ # ... long wait for first time, because we need to collect a lot of packages
Synchronize remote repos for applications
$ appvm sync
You can customize local settings in ~/.config/appvm/nix/local.nix.
Default hotkey to release cursor: ctrl+alt.
Shared directory
$ ls appvm/chromium
foo.tar.gz
bar.tar.gz
Close VM
$ appvm stop chromium
Automatic ballooning
Add this command:
$ appvm autoballoon
to crontab like that:
$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon