@@ -1,20 +1,27 @@
1−{ callPackage, runCommandLocal, writeShellScriptBin, stdenv, coreutils, bubblewrap }:
2−
3−let buildFHSEnv = callPackage ./env.nix { }; in
1+{ lib, callPackage, runCommandLocal, writeShellScriptBin, stdenv, coreutils, bubblewrap }:
42
53args @ {
6− name,
7− runScript ? "bash",
8− extraInstallCommands ? "",
9− meta ? {},
10− passthru ? {},
11− ...
4+ name
5+, runScript ? "bash"
6+, extraInstallCommands ? ""
7+, meta ? {}
8+, passthru ? {}
9+, unshareUser ? true
10+, unshareIpc ? true
11+, unsharePid ? true
12+, unshareNet ? false
13+, unshareUts ? true
14+, unshareCgroup ? true
15+, ...
1216}:
1317
1418with builtins;
1519let
20+ buildFHSEnv = callPackage ./env.nix { };
21+
1622 env = buildFHSEnv (removeAttrs args [
1723 "runScript" "extraInstallCommands" "meta" "passthru"
24+ "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
1825 ]);
1926
2027 chrootenv = callPackage ./chrootenv {};
@@ -92,8 +99,12 @@ let
9299 --dev-bind /dev /dev
93100 --proc /proc
94101 --chdir "$(pwd)"
95− --unshare-all
96− --share-net
102+ ${lib.optionalString unshareUser "--unshare-user"}
103+ ${lib.optionalString unshareIpc "--unshare-ipc"}
104+ ${lib.optionalString unsharePid "--unshare-pid"}
105+ ${lib.optionalString unshareNet "--unshare-net"}
106+ ${lib.optionalString unshareUts "--unshare-uts"}
107+ ${lib.optionalString unshareCgroup "--unshare-cgroup"}
97108 --die-with-parent
98109 --ro-bind /nix /nix
99110 ${etcBindFlags}