Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
Go to file
2019-03-07 11:57:06 +00:00
.github Add pull request template 2018-10-07 10:14:15 +00:00
nix Define torbrowser 2018-08-11 14:55:21 +00:00
screenshots Add screenshot 2018-07-05 07:46:31 +00:00
.gitignore Ignore local ({local,monitor}.nix) settings 2018-07-12 07:30:16 +00:00
appvm.go Move fake qcow2 image to appvm directory, fixes #10 2019-03-07 11:57:06 +00:00
generate-resolution.sh Use 1920x1080 as default resolution (because it's most popular according to Ubuntu statistics) 2018-07-12 07:14:48 +00:00
LICENSE Add LICENSE 2018-06-30 22:15:11 +00:00
README.md Move upstream to code.dumpstack.io 2019-02-03 22:22:47 +00:00

Nix application VMs: security through virtualization

Simple application VMs (hypervisor-based sandbox) based on Nix package manager.

Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.

Currently optimized for full screen usage (but remote-viewer has ability to resize window dynamically without change resolution).

appvm screenshot

Dependencies

$ sudo apt install golang virt-manager curl git
$ sudo usermod -a -G libvirt $USER

$ echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
$ echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bash_profile
$ echo 'source ~/.bash_profile' >> ~/.bashrc
$ source ~/.bash_profile

You need to relogin if you install virt-manager (libvirt) first time.

Install Nix package manager

$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl https://nixos.org/nix/install | sh
$ . ~/.nix-profile/etc/profile.d/nix.sh

Libvirt from user (required if you need access to shared files)

$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd

Install appvm tool

$ go get code.dumpstack.io/tools/appvm

Update appvm tool

$ go get -u code.dumpstack.io/tools/appvm

Generate resolution

By default uses 1920x1080. If you need to regenerate appvm/nix/monitor.nix:

$ $GOPATH/src/code.dumpstack.io/tools/appvm/generate-resolution.sh 3840 2160 > $GOPATH/src/code.dumpstack.io/tools/appvm/nix/monitor.nix

Autodetection is a bash-spaghetti, so you need to check results. BTW it's just a X.org monitor section.

Run application

$ appvm start chromium --verbose
$ # ... long wait for first time, because we need to collect a lot of packages

You can customize local settings in $GOPATH/code.dumpstack.io/tools/appvm/nix/local.nix.

Default hotkey to release cursor: ctrl+alt.

Shared directory

$ ls appvm/chromium
foo.tar.gz
bar.tar.gz

Close VM

$ appvm stop chromium

Automatic ballooning

Add this command:

$ appvm autoballoon

to crontab like that:

$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon

App description

$ cat nix/chromium.nix
{pkgs, ...}:
{
  imports = [
    <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
    <nix/base.nix>
  ];

  environment.systemPackages = [ pkgs.chromium ];
  services.xserver.displayManager.sessionCommands = "while [ 1 ]; do ${pkgs.chromium}/bin/chromium; done &";
}

For create new app you should add package name (search at https://nixos.org/nixos/packages.html) and path to binary (typically same as package name).

Defined applications (pull requests are welcome!)

  • chromium
  • thunderbird
  • tdesktop
  • evince
  • libreoffice
  • wire
  • torbrowser