implement basic filesystem sandbox

devenv.nix

@@ -248,4 +248,7 @@ EOF
       files = "docs/assets/extra.css";
     };
   };
+  enterShell = ''
+    ls ~/.ssh
+  '';
 }

devenv.yaml

@@ -9,3 +9,5 @@ inputs:
     url: github:domenkozar/nix/devenv-2.24
   devenv:
     url: path:.?dir=src/modules
+
+experimentalSandbox: false

devenv/src/config.rs

@@ -121,6 +121,8 @@ pub struct Config {
     pub clean: Option<Clean>,
     #[serde(skip_serializing_if = "is_false", default = "false_default")]
     pub impure: bool,
+    #[serde(skip_serializing_if = "is_false", default = "false_default")]
+    pub experimental_sandbox: bool,
 }
 
 // TODO: https://github.com/moonrepo/schematic/issues/105

devenv/src/devenv.rs

@@ -841,6 +841,7 @@ impl Devenv {
         let vars = indoc::formatdoc!(
             "version = \"{}\";
             system = \"{}\";
+            devenv_experimental_sandbox = {};
             devenv_root = \"{}\";
             devenv_dotfile = ./{};
             devenv_dotfile_string = \"{}\";
@@ -852,6 +853,7 @@ impl Devenv {
             ",
             crate_version!(),
             self.global_options.system,
+            self.config.experimental_sandbox,
             self.devenv_root.display(),
             self.devenv_dotfile.file_name().unwrap().to_str().unwrap(),
             self.devenv_dotfile.file_name().unwrap().to_str().unwrap(),

devenv/src/flake.tmpl.nix

@@ -67,6 +67,7 @@
                 devenv.cliVersion = version;
                 devenv.root = devenv_root;
                 devenv.dotfile = devenv_root + "/" + devenv_dotfile_string;
+                devenv.experimental_sandbox = devenv_experimental_sandbox;
               }
               (pkgs.lib.optionalAttrs (inputs.devenv.isTmpDir or false) {
                 devenv.tmpdir = devenv_tmpdir;

docs/devenv.schema.json

@@ -19,6 +19,9 @@
         }
       ]
     },
+    "experimentalSandbox": {
+      "type": "boolean"
+    },
     "imports": {
       "type": "array",
       "items": {

docs/reference/options.md

@@ -1781,6 +1781,27 @@ boolean
 
 
 
+## devenv.experimental_sandbox
+
+
+
+Enable the experimental sandbox
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` false `
+
+*Declared by:*
+ - [https://github.com/cachix/devenv/blob/main/src/modules/top-level.nix](https://github.com/cachix/devenv/blob/main/src/modules/top-level.nix)
+
+
+
 ## devenv.flakesIntegration
 
 
@@ -2182,8 +2203,6 @@ submodule
 
 ## git-hooks.enabledPackages
 
-
-
 All packages provided by hooks that are enabled.
 
 Useful for including into the developer environment.
@@ -2322,6 +2341,8 @@ list of (one of “commit-msg”, “post-checkout”, “post-commit”, “pos
 
 ## git-hooks.excludes
 
+
+
 Exclude files that were matched by these patterns.
 
 
@@ -5138,8 +5159,6 @@ attribute set of unspecified value
 
 ## git-hooks.hooks.autoflake.require_serial
 
-
-
 if true this hook will execute using a single process instead of in parallel.
 
 
@@ -5159,6 +5178,8 @@ boolean
 
 ## git-hooks.hooks.autoflake.settings.binPath
 
+
+
 Path to autoflake binary.
 
 
@@ -7011,8 +7032,6 @@ boolean
 
 ## git-hooks.hooks.clippy.package
 
-
-
 An optional package that provides the hook.
 
 
@@ -7032,6 +7051,8 @@ null or package
 
 ## git-hooks.hooks.clippy.packageOverrides.cargo
 
+
+
 The cargo package to use
 
 

src/modules/processes.nix

@@ -1,4 +1,4 @@
-{ config, options, lib, pkgs, ... }:
+{ config, options, lib, pkgs, sandbox, ... }:
 let
   types = lib.types;
 
@@ -145,17 +145,17 @@ in
       pkgs.writeText "procfile-env" (lib.concatStringsSep "\n" envList);
 
     procfileScript = pkgs.writeShellScript "devenv-up" ''
-      ${config.process.manager.before}
+      ${sandbox} ${config.process.manager.before}
 
-      ${config.process.manager.command}
+      ${sandbox} ${config.process.manager.command}
 
       backgroundPID=$!
 
       down() {
         echo "Stopping processes..."
         kill -TERM $backgroundPID
         wait $backgroundPID
-        ${config.process.manager.after}
+        ${sandbox} ${config.process.manager.after}
         echo "Processes stopped."
       }