mirror of
https://code.dumpstack.io/tools/appvm.git
synced 2024-11-04 15:33:18 +00:00
.github | ||
docs | ||
dot-desktop-fuse | ||
os | ||
patches | ||
screenshots | ||
.envrc | ||
.gitignore | ||
appvm.go | ||
base.nix.go | ||
builtin.go | ||
default.nix | ||
deps.nix | ||
generate.go | ||
go.mod | ||
go.sum | ||
LICENSE | ||
local.nix.template.go | ||
Makefile | ||
README.md | ||
shell.nix | ||
xml.go |
Nix application VMs: security through virtualization
Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.
Installation
Requirements
$ sudo apt install virt-manager curl git
$ sudo usermod -a -G libvirt $USER
$ newgrp libvirt
$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd
Install Nix package manager
$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl https://nixos.org/nix/install | sh
$ . ~/.nix-profile/etc/profile.d/nix.sh
Install appvm
$ nix-env -if https://code.dumpstack.io/tools/appvm/archive/master.tar.gz
Usage
Search for applications
$ appvm search chromium
Run application
$ appvm start chromium
$ # ... long wait for first time, because we need to collect a lot of packages
Synchronize remote repos for applications
$ appvm sync
You can customize local settings in ~/.config/appvm/nix/local.nix.
Default hotkey to release cursor: ctrl+alt.
Shared directory
$ ls appvm/chromium
foo.tar.gz
bar.tar.gz
Close VM
$ appvm stop chromium
Automatic ballooning
Add this command:
$ appvm autoballoon
to crontab like that:
$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon