add preStartHooks option to landrunApp, to allow executing code before starting the sandbox

[adrian-gierakowski]

this would allow creating landrunModules which:

1. add specific dir to sandbox and create it (before starting the sandbox) if they it does not exist, to avoid an error: Failed to apply sandbox: failed to apply Landlock filesystem restrictions: populating ruleset for...
2. set cli.env = [ "MY_SECRET"], and then decrypt the secrets and export the env var before starting the sandbox

[adrian-gierakowski]

POC here: https://github.com/adrian-gierakowski/landrun-nix/pull/11/changes

[adrian-gierakowski]

I started usingpreStartHooks on my fork and noticed that most of the time I'm using it to create rw(x) dirs, before an agents starts (like $HOME/.cache/something), since lanlock needs the dir to exist before the sandbox is created (for ro we simply omit the non-existent paths ).

Maybe we should add new rw(x)Dirs options which both add dir to the sandbox and create them via preStartHook?

@srid

[srid]

Maybe we should add new rw(x)Dirs options which both add dir to the sandbox and create them via preStartHook?

Yes, and moroever why not have an option for autocreating as well, so we don't need a preStartHook?

set cli.env = [ "MY_SECRET"], and then decrypt the secrets and export the env var before starting the sandbox

Umm, not sure if I understand this. What's the actual use case here?

[adrian-gierakowski]

set cli.env = [ "MY_SECRET"], and then decrypt the secrets and export the env var before starting the sandbox

Umm, not sure if I understand this. What's the actual use case here?

I've got a secret in a secret manager. I dynamically decrypt it before the sandbox is created and export it as env var. The agent gets access to the secret via the env var.

[srid]

Okay that makes sense then. We can call it preHook, like https://community.flake.parts/process-compose-flake#prehook