fix store rw, pass user account to cc sandbox
This commit is contained in:
illustris
213
flake.nix
213
flake.nix
@@ -1,10 +1,10 @@
|
||||
{
|
||||
description = "Sandboxed MicroVMs";
|
||||
|
||||
nixConfig = {
|
||||
extra-substituters = [ "https://microvm.cachix.org" ];
|
||||
extra-trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ];
|
||||
};
|
||||
# nixConfig = {
|
||||
# extra-substituters = [ "https://microvm.cachix.org" ];
|
||||
# extra-trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ];
|
||||
# };
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
|
||||
@@ -12,51 +12,39 @@
|
||||
url = "github:microvm-nix/microvm.nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nullclaw.url = "github:nullclaw/nullclaw";
|
||||
nullclaw.url = "github:illustris/nullclaw?ref=fix-nix";
|
||||
nix-mcp.url = "github:illustris/nix-mcp";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, microvm, nullclaw }: let
|
||||
outputs = { self, nixpkgs, microvm, nullclaw, nix-mcp }: let
|
||||
system = "x86_64-linux";
|
||||
in {
|
||||
packages.${system} = {
|
||||
cc-sandbox = self.nixosConfigurations.claude-code.config.microvm.declaredRunner;
|
||||
nullclaw = self.nixosConfigurations.nullclaw.config.microvm.declaredRunner;
|
||||
};
|
||||
|
||||
nixosConfigurations.claude-code = nixpkgs.lib.nixosSystem {
|
||||
macFromName = name: let
|
||||
hash = builtins.hashString "sha256" name;
|
||||
b = i: builtins.substring (i * 2) 2 hash;
|
||||
in "02:${b 0}:${b 1}:${b 2}:${b 3}:${b 4}";
|
||||
|
||||
mkMicrovm = name: {
|
||||
vcpu ? 2,
|
||||
mem ? 2048,
|
||||
extraModules ? []
|
||||
}: nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
microvm.nixosModules.microvm
|
||||
({ pkgs, ... }: {
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
networking.hostName = "claude-code";
|
||||
networking.hostName = name;
|
||||
users.users.root.password = "";
|
||||
services.getty.autologinUser = "root";
|
||||
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
claude-code-bin
|
||||
git
|
||||
curl
|
||||
vim
|
||||
];
|
||||
|
||||
microvm = {
|
||||
hypervisor = "qemu";
|
||||
vcpu = 4;
|
||||
mem = 4096;
|
||||
socket = "claude-code.socket";
|
||||
|
||||
writableStoreOverlay = "/nix/.rw-store";
|
||||
|
||||
inherit vcpu mem;
|
||||
socket = "${name}.socket";
|
||||
interfaces = [{
|
||||
type = "user";
|
||||
id = "usernet";
|
||||
mac = "02:00:00:00:00:01";
|
||||
mac = macFromName name;
|
||||
}];
|
||||
|
||||
shares = [
|
||||
{
|
||||
proto = "9p";
|
||||
@@ -64,6 +52,56 @@
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
}
|
||||
{
|
||||
proto = "9p";
|
||||
tag = "${name}-data";
|
||||
source = "/home/illustris/Documents/microvms/data/${name}";
|
||||
mountPoint = "/var/lib/${name}";
|
||||
}
|
||||
];
|
||||
# qemu.extraArgs = [
|
||||
# "-fw_cfg" "name=opt/claude-auth,file=/home/illustris/.claude.json"
|
||||
# ];
|
||||
};
|
||||
nix = {
|
||||
nixPath = [ "nixpkgs=${pkgs.path}" ];
|
||||
settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
};
|
||||
system.stateVersion = "25.11";
|
||||
})
|
||||
] ++ extraModules;
|
||||
};
|
||||
in {
|
||||
packages.${system} = nixpkgs.lib.mapAttrs (_: v: v.config.microvm.declaredRunner) self.nixosConfigurations;
|
||||
|
||||
nixosModules.storeOverlay = {
|
||||
microvm.writableStoreOverlay = "/nix/.rw-store";
|
||||
fileSystems."/nix/.rw-store" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=4G" "mode=0755" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations = nixpkgs.lib.mapAttrs mkMicrovm {
|
||||
cc-sandbox = {
|
||||
vcpu = 8;
|
||||
mem = 8192;
|
||||
extraModules = [({ pkgs, ... }: {
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
claude-code-bin
|
||||
git
|
||||
curl
|
||||
vim
|
||||
nix-mcp.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
microvm = {
|
||||
writableStoreOverlay = "/nix/.rw-store";
|
||||
shares = [
|
||||
{
|
||||
proto = "9p";
|
||||
tag = "claude-config";
|
||||
@@ -72,81 +110,56 @@
|
||||
readOnly = true;
|
||||
}
|
||||
];
|
||||
|
||||
volumes = [{
|
||||
image = "claude-code-data.img";
|
||||
mountPoint = "/var/lib/claude-code";
|
||||
size = 1024;
|
||||
label = "claude-code-data";
|
||||
}];
|
||||
qemu.extraArgs = [
|
||||
"-fw_cfg"
|
||||
"name=opt/claude-auth,file=/home/illustris/.claude.json"
|
||||
];
|
||||
};
|
||||
|
||||
# tmpfs backing for the writable nix store overlay
|
||||
fileSystems."/nix/.rw-store" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=2G" "mode=0755" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
# Claude config: persistent overlay on top of host's ~/.claude
|
||||
fileSystems."/root/.claude" = {
|
||||
overlay = {
|
||||
lowerdir = [ "/var/lib/claude-lower" ];
|
||||
upperdir = "/var/lib/claude-code/claude-upper";
|
||||
workdir = "/var/lib/claude-code/claude-work";
|
||||
systemd.services.claude-auth = {
|
||||
description = "Copy Claude auth token from fw_cfg";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "/bin/sh -c 'cp /sys/firmware/qemu_fw_cfg/by_name/opt/claude-auth/raw /root/.claude.json && chmod 600 /root/.claude.json'";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
})
|
||||
];
|
||||
};
|
||||
fileSystems = {
|
||||
# tmpfs backing for the writable nix store overlay
|
||||
"/nix/.rw-store" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=4G" "mode=0755" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
nixosConfigurations.nullclaw = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
microvm.nixosModules.microvm
|
||||
({ pkgs, ... }: {
|
||||
networking.hostName = "nullclaw";
|
||||
users.users.root.password = "";
|
||||
services.getty.autologinUser = "root";
|
||||
|
||||
environment.systemPackages = [
|
||||
nullclaw.packages.${system}.default
|
||||
pkgs.curl
|
||||
pkgs.vim
|
||||
];
|
||||
|
||||
microvm = {
|
||||
hypervisor = "qemu";
|
||||
vcpu = 2;
|
||||
mem = 2048;
|
||||
socket = "nullclaw.socket";
|
||||
|
||||
interfaces = [{
|
||||
type = "user";
|
||||
id = "usernet";
|
||||
mac = "02:00:00:00:00:02";
|
||||
}];
|
||||
|
||||
shares = [{
|
||||
proto = "9p";
|
||||
tag = "ro-store";
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
}];
|
||||
|
||||
volumes = [{
|
||||
image = "nullclaw-data.img";
|
||||
mountPoint = "/var/lib/nullclaw";
|
||||
size = 512;
|
||||
label = "nullclaw-data";
|
||||
}];
|
||||
# Claude config: ephemeral overlay on top of host's ~/.claude
|
||||
"/var/lib/claude-rw" = {
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=128M" "mode=0700" ];
|
||||
};
|
||||
"/root/.claude".overlay = {
|
||||
lowerdir = [ "/var/lib/claude-lower" ];
|
||||
upperdir = "/var/lib/claude-rw/upper";
|
||||
workdir = "/var/lib/claude-rw/work";
|
||||
};
|
||||
};
|
||||
})];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
})
|
||||
];
|
||||
nullclaw = {
|
||||
vcpu = 2;
|
||||
mem = 4096;
|
||||
extraModules = [({ pkgs, ... }: {
|
||||
imports = [ self.nixosModules.storeOverlay ];
|
||||
environment.systemPackages = with pkgs; [
|
||||
nullclaw.packages.${system}.default
|
||||
tmux
|
||||
];
|
||||
})];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user