appvm/README.md

104 lines
2.7 KiB
Markdown
Raw Normal View History

2018-07-12 21:03:28 +00:00
# Nix application VMs: security through virtualization
2018-06-29 21:59:28 +00:00
2018-07-12 21:03:28 +00:00
Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
2018-06-30 21:03:16 +00:00
2018-07-01 08:21:15 +00:00
Uses one **read-only** /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.
2018-07-01 07:25:27 +00:00
2018-07-12 17:43:42 +00:00
Currently optimized for full screen usage (but remote-viewer has ability to resize window dynamically without change resolution).
2018-06-30 21:03:16 +00:00
2018-07-05 07:46:31 +00:00
![appvm screenshot](screenshots/2018-07-05.png)
2018-06-30 21:03:16 +00:00
## Dependencies
2018-06-30 08:39:47 +00:00
2018-07-12 07:05:53 +00:00
$ sudo apt install golang virt-manager curl git
2018-07-12 07:19:09 +00:00
$ sudo usermod -a -G libvirt $USER
$ echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
$ echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bash_profile
$ echo 'source ~/.bash_profile' >> ~/.bashrc
$ source ~/.bash_profile
You need to **relogin** if you install virt-manager (libvirt) first time.
2018-06-30 08:39:47 +00:00
## Install Nix package manager
$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl https://nixos.org/nix/install | sh
$ . ~/.nix-profile/etc/profile.d/nix.sh
2018-07-11 23:34:36 +00:00
## Libvirt from user (required if you need access to shared files)
2018-07-11 23:39:30 +00:00
$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd
2018-06-30 08:39:47 +00:00
2018-07-11 23:34:36 +00:00
## Install appvm tool
2018-06-30 08:39:47 +00:00
2018-07-11 23:34:36 +00:00
$ go get github.com/jollheef/appvm
2018-06-30 21:03:16 +00:00
## Update appvm tool
$ go get -u github.com/jollheef/appvm
## Generate resolution
By default uses 1920x1080. If you need to regenerate `appvm/nix/monitor.nix`:
$ $GOPATH/src/github.com/jollheef/appvm/generate-resolution.sh 3840 2160 > $GOPATH/src/github.com/jollheef/appvm/nix/monitor.nix
Autodetection is a bash-spaghetti, so you need to check results. BTW it's just a X.org monitor section.
2018-07-11 23:34:36 +00:00
## Run application
2018-06-30 21:03:16 +00:00
2018-07-11 23:34:36 +00:00
$ appvm start chromium
$ # ... long wait for first time, because we need to collect a lot of packages
2018-06-30 08:39:47 +00:00
2018-07-11 23:34:36 +00:00
You can customize local settings in `$GOPATH/github.com/jollheef/appvm/nix/local.nix`.
2018-06-30 08:39:47 +00:00
2018-07-01 07:58:42 +00:00
Default hotkey to release cursor: ctrl+alt.
2018-06-30 21:03:16 +00:00
## Shared directory
2018-06-29 21:59:28 +00:00
2018-07-11 23:34:36 +00:00
$ ls appvm/chromium
2018-06-30 21:03:16 +00:00
foo.tar.gz
bar.tar.gz
2018-06-30 22:08:41 +00:00
## Close VM
2018-07-11 23:34:36 +00:00
$ appvm stop chromium
2018-06-30 22:10:39 +00:00
2018-07-12 20:00:57 +00:00
## Automatic ballooning
Add this command:
$ appvm autoballoon
to crontab like that:
$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon
2018-06-30 22:10:39 +00:00
# App description
$ cat nix/chromium.nix
{pkgs, ...}:
{
imports = [
<nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
<nix/base.nix>
];
environment.systemPackages = [ pkgs.chromium ];
services.xserver.displayManager.sessionCommands = "while [ 1 ]; do ${pkgs.chromium}/bin/chromium; done &";
}
For create new app you should add package name (search at https://nixos.org/nixos/packages.html) and path to binary (typically same as package name).
2018-07-01 08:35:25 +00:00
## Defined applications (pull requests are welcome!)
* chromium
* thunderbird
* tdesktop
2018-07-01 20:51:07 +00:00
* evince
2018-07-05 06:06:48 +00:00
* libreoffice
2018-07-11 07:41:15 +00:00
* wire