Repository navigation
Conversation
A host with nix had no route to a working sandbox: the nixpkgs brig package is the CLI alone, and the bundle wants a tarball under /var/lib/brig and systemd units it writes itself. The flake builds brig, urunc from the pinned commit and the guest assets, and wraps them with the same environment and config the bundle generates, so `nix build` plus one systemd unit boots a sandbox. Three choices are not obvious from the files. urunc is pinned to the commit pins.env records, not the one the README names, because brig asks for the hvi monitor on Linux and only that branch knows it. The shim's default OCI runtime is sed'd in the vendored go-runc, as the upstream Makefile does, because go-runc v1.0.0 makes it a const. virtiofsd and cloud-hypervisor come from the bundle tarball rather than nixpkgs, because urunc pivots into a monitor rootfs before it spawns them and the nixpkgs builds are dynamically linked. Verified on Debian 12 with nested virtualization: doctor green, the ubuntu profile boots, guest DNS and apt work, the unit survives a reboot. Signed-off-by: Panagiotis Moustafellos <pmoust@nofire.ai>
pmoust
marked this pull request as ready for review
November 1, 2026 17:40
On NixOS the Debian recipe, copying the unit from the store by hand, is the wrong shape. The module declares the unit, the kernel modules and the state directories, and puts brig on PATH, so services.brig.enable is the whole install. The VM test boots a NixOS machine from the module alone and checks the unit, the socket, /dev/vhost-vsock and brig doctor. The test machine has no network, so it pulls no image and boots no sandbox; a real boot is still a manual check on a host with KVM. Passed on a Debian host with nested virtualization. Signed-off-by: Panagiotis Moustafellos <pmoust@nofire.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A host with nix had no route to a working sandbox. The nixpkgs
brigpackage (NixOS/nixpkgs#581828) is the CLI alone, and this bundle wants a tarball under/var/lib/brigand the systemd units it writes itself.The flake builds
brig,uruncfrom the commitpins.envrecords, and the guest assets, and wraps them with the same environment and configbuild-bundle.shgenerates. containerd, nerdctl and the CNI plugins come from nixpkgs.nix build .#brig-runtimeplus one systemd unit boots a sandbox.nix/README.mdhas the steps.Three choices are not obvious from the files, and each has a comment:
feat/linux-hvi-v050at 3c00b69, what rc21'spins.envrecords, not the f6d54d6 the README names. brig asks urunc for thehvimonitor on Linux, and only that branch knows it.Tested on Debian 12 on GCP with nested virtualization and single-user nix:
brig doctorall ok, the ubuntu profile boots, DNS and apt work in the guest, a file written under/workappears on the host, the unit comes back after a reboot. Not tested: aarch64, NixOS.A NixOS module (
nixosModules.default,services.brig.enable) and a NixOS VM test (nix flake check) are on the branch too. The VM test passed on the same Debian host: unit up, socket present,brig doctorall ok inside the NixOS machine. The test machine has no network, so it boots no sandbox.