srid/sandnix

---

srid/sandnix.json

{
  "createdAt": "2025-10-10T23:09:16Z",
  "defaultBranch": "master",
  "description": "A Nix flake-parts module for wrapping programs with a sandboxed environment using landrun (Landlock) on Linux, and sandbox-exec on macOS.",
  "fullName": "srid/sandnix",
  "homepage": "",
  "language": "Nix",
  "name": "sandnix",
  "pushedAt": "2026-03-06T20:00:16Z",
  "stargazersCount": 39,
  "topics": [],
  "updatedAt": "2026-03-16T14:29:50Z",
  "url": "https://github.com/srid/sandnix"
}

sandnix

A Nix flake-parts module for wrapping programs with a sandboxed environment using landrun (Landlock) on Linux, and sandbox-exec on macOS.

Usage

In your flake.nix:

{
  inputs.sandnix.url = "github:srid/sandnix";

  outputs = { flake-parts, sandnix, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [ sandnix.flakeModule ];

      perSystem = { pkgs, ... }: {
        sandnixApps.my-app-sandboxed = {
          program = "${pkgs.my-app}/bin/my-app";
          features = {
            tty = true;      # Terminal support
            nix = true;      # Nix store access (default)
            network = true;  # Network access
            tmp = true;      # /tmp access (default)
          };
          # Raw arguments to pass to `landrun` CLI
          cli = {
            rw = [ "$HOME/.config/my-app" ];
            rox = [ "/etc/hosts" ];
          };
        };
      };
    };
}

Run with: nix run .#my-app-sandboxed

Reusable Modules

sandnix provides reusable modules for common applications via sandnixModules.*. These can be imported into your app configurations:

{
  inputs.sandnix.url = "github:srid/sandnix";

  outputs = { flake-parts, sandnix, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [ sandnix.flakeModule ];

      perSystem = { pkgs, ... }: {
        sandnixApps.my-app = {
          imports = [
            sandnix.sandnixModules.gh  # Import GitHub CLI module
          ];
          program = "${pkgs.my-app}/bin/my-app";
          features.network = true;
        };
      };
    };
}

Available Modules

Module	Description
sandnixModules.gh	GitHub CLI (gh) configuration with D-Bus keyring support
sandnixModules.git	Git configuration with TTY support and repository access
sandnixModules.haskell	Haskell tooling with Cabal configuration and state directory access
sandnixModules.markitdown	Markitdown configuration with /proc/cpuinfo access

Examples

Claude Code

Sandbox Claude Code with access to project directory, config files, and network.

See [examples/claude-sandboxed]!(./examples/claude-sandboxed/flake.nix) for a complete working example.

Try it:

nix run 'github:srid/sandnix?dir=examples/claude-sandboxed'

Features

High-level feature flags automatically configure common sandboxing patterns:

Feature	Default	Description
features.tty	false	TTY devices, terminfo, locale env vars
features.nix	true	Nix store, system paths, PATH env var
features.network	false	DNS resolution, SSL certificates, unrestricted network
features.tmp	true	Read-write access to /tmp
features.dbus	false	D-Bus session bus, keyring access for Secret Service API

CLI Options

Fine-grained control via cli.*:

Option	Description
rox	Read-only + execute paths
ro	Read-only paths
rwx	Read-write-execute paths
rw	Read-write paths
env	Environment variables to pass through
unrestrictedNetwork	Allow all network access
addExec	Auto-add executable to rox (default: true)

Discussions

https://github.com/srid/sandnix/discussions

License

GPL-3.0

Similar projects

• nixpak: a fancy declarative wrapper around bubblewrap.
• jail.nix: helper to make it easy and ergonomic to wrap your derivations in bubblewrap.