Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
Go to file
2020-01-05 06:43:55 +00:00
.github GitHub Actions: Nix environment 2020-01-05 06:20:51 +00:00
docs Init docs 2020-01-05 05:57:55 +00:00
os Initial implementation of appvm-based OS 2020-01-04 20:58:00 +00:00
screenshots Add screenshot 2018-07-05 07:46:31 +00:00
.envrc [feat] added environment files 2019-12-29 18:27:02 +03:00
.gitignore Update .gitignore 2020-01-05 06:12:18 +00:00
appvm.go Implements stateless VMs 2020-01-03 22:56:27 +00:00
base.nix.go Use lightdm (slim is removed from NixOS) 2020-01-05 06:43:55 +00:00
builtin.go Update builtin chromium appvm description 2020-01-02 17:52:22 +00:00
default.nix Add Nix package 2020-01-04 18:20:27 +00:00
deps.nix Add Nix package 2020-01-04 18:20:27 +00:00
generate.go Use only nixos.org channels if guess 2020-01-04 11:23:40 +00:00
go.mod go modules 2019-12-30 15:55:00 +00:00
go.sum go modules 2019-12-30 15:55:00 +00:00
LICENSE Add LICENSE 2018-06-30 22:15:11 +00:00
local.nix.template.go Embed base nix configuration to binary 2019-12-29 17:41:44 +00:00
Makefile Use go build by default 2020-01-05 06:12:05 +00:00
README.md Add Documentation Status 2020-01-05 06:03:59 +00:00
shell.nix [feat] added environment files 2019-12-29 18:27:02 +03:00
xml.go Implements stateless VMs 2020-01-03 22:56:27 +00:00

Documentation Status Donate Donate

Nix application VMs: security through virtualization

Simple application VMs (hypervisor-based sandbox) based on Nix package manager.

Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.

appvm screenshot

Dependencies

$ sudo apt install golang virt-manager curl git
$ sudo usermod -a -G libvirt $USER

$ echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
$ echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bash_profile
$ echo 'source ~/.bash_profile' >> ~/.bashrc
$ source ~/.bash_profile

You need to relogin if you install virt-manager (libvirt) first time.

Install Nix package manager

$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl https://nixos.org/nix/install | sh
$ . ~/.nix-profile/etc/profile.d/nix.sh

Libvirt from user (required if you need access to shared files)

$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd

Install appvm tool

$ go get code.dumpstack.io/tools/appvm

Update appvm tool

$ go get -u code.dumpstack.io/tools/appvm

Search for applications

$ appvm search chromium

Generate new application

$ nix-channel --list
nix https://nixos.org/channels/nixos-unstable
$ appvm generate nix.firefox

Run application

$ appvm start chromium
$ # ... long wait for first time, because we need to collect a lot of packages

Synchronize remote repos for applications

$ appvm sync

You can customize local settings in ~/.config/appvm/nix/local.nix.

Default hotkey to release cursor: ctrl+alt.

Shared directory

$ ls appvm/chromium
foo.tar.gz
bar.tar.gz

Close VM

$ appvm stop chromium

Automatic ballooning

Add this command:

$ appvm autoballoon

to crontab like that:

$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon