Implement macOS support using sandbox-exec and refactor for multi-platform support by adrian-gierakowski · Pull Request #18 · srid/sandnix

adrian-gierakowski · 2026-02-23T11:22:27Z

This PR implements macOS support for landrun-nix using the native sandbox-exec utility and refactors the codebase to better support multiple platforms.

Key Changes:

Refactoring for Multi-Platform Support:
- Separated features and wrappers into common, linux, and darwin subdirectories.
- Centralized shared feature definitions in modules/flake-parts/landrun/common/features.nix.
macOS Implementation (sandbox-exec):
- Introduced a new wrapper for Darwin that generates Sandbox Profile Language (SBPL) profiles on the fly.
- Implemented fine-grained access control for files (read, write, execute) and networking.
- Added logic to handle path resolution and environment variable isolation compatible with macOS.
Linux Improvements:
- Moved Linux-specific logic to its own directory for better isolation.
Enhanced Testing:
- Updated tests/test.bats with more robust test cases.
- Improved tests/flake.nix for better testing of the landrun modules.

Verification:

Verified that the Linux implementation continues to work as expected.
Verified the macOS implementation.

Extracted Darwin-specific implementation from `features.nix` and `wrapper.nix` into `modules/flake-parts/landrun/sandbox-exec/`. Common configuration was extracted to `modules/flake-parts/landrun/common.nix`. The original files now import these modules and conditionally apply configurations based on `pkgs.stdenv.isDarwin`. This improves code organization and maintainability by separating platform-specific logic. Co-authored-by: adrian-gierakowski <330177+adrian-gierakowski@users.noreply.github.com>

srid · 2026-02-26T23:31:09Z

CI (nix run github:juspay/vira -- ci -b) fails:

[..]
tests> BW01: `run`'s command `test-unrestricted-fs -c ls -d /etc` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
tests>       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
tests>        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 284)
error: Cannot build '/nix/store/nf1nrsp6akkg8vny538znxbdlp85dfwp-tests.drv'.
       Reason: builder failed with exit code 1.
       Last 167 log lines:
       > 1..26
       > not ok 1 test-true runs successfully
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 26)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/n5w2wnmygf9ig0qsvqpv8b48v928qarw-test-true/bin/test-true: line 169: exec: sandbox-exec: not found
       > ok 2 test-no-nix-fail: program cannot exec if it cannot access libs from nix store
       > ok 3 test-no-nix-ldd-ok: program can exec if libs are made accessible with --ldd flag # skip landrun specific flag --ldd is not supported on Darwin
       > ok 4 test-add-exec-disabled-fail: program cannot exec if not explicitly allowed
       > ok 5 test-add-exec-disabled-ldd-ok: script can exec if not explicitly allowed but interpreter and libs are # skip landrun specific flag --ldd is not supported on Darwin
       > ok 6 test-extra-args: passes extra arguments to landrun # skip landrun specific flag -v (version) is not supported on Darwin
       > not ok 7 test-ls can list /tmp
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 79)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/pmm66kq3x89jn98zyygkwbz9irpra6gd-test-ls/bin/test-ls: line 169: exec: sandbox-exec: not found
       > not ok 8 test-mktemp can write to /tmp
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 85)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/invdmz0vqy5vfssvf00m7hsvp3vanlsr-test-mktemp/bin/test-mktemp: line 169: exec: sandbox-exec: not found
       > not ok 9 test-mktemp can write to default tmp directory
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 93)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/invdmz0vqy5vfssvf00m7hsvp3vanlsr-test-mktemp/bin/test-mktemp: line 169: exec: sandbox-exec: not found
       > ok 10 test-mktemp-no-tmp fails to write to /tmp
       > not ok 11 test-exec-tmp can execute script in /tmp
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 124)
       > #   `false' failed
       > # Status: 127
       > # Output: /nix/store/dg7f24h4z3lwr79zmgablnrfg0sqldvm-test-env-var/bin/test-env-var: line 170: exec: sandbox-exec: not found
       > # Execution denied
       > not ok 12 test-ls can list /nix/store
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 131)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/pmm66kq3x89jn98zyygkwbz9irpra6gd-test-ls/bin/test-ls: line 169: exec: sandbox-exec: not found
       > ok 13 test-ls cannot list / (restricted by default)
       > not ok 14 test-tty can access terminal info
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 144)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/ncm457jnbvn9my1a2aawcq9k8dar9bkg-test-tty/bin/test-tty: line 177: exec: sandbox-exec: not found
       > ok 15 test-curl-deny fails to connect to google.com
       > not ok 16 test-curl-allow can connect to google.com
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 162)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/3na3741ws5406m4bcg58i485i81m2595-test-curl-allow/bin/test-curl-allow: line 169: exec: sandbox-exec: not found
       > not ok 17 test-env-var cannot access arbitrary env vars
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 169)
       > #   `[[ "$output" = *"SOME_VAR: unbound variable"* ]]' failed
       > # Status: 127
       > # Output: /nix/store/dg7f24h4z3lwr79zmgablnrfg0sqldvm-test-env-var/bin/test-env-var: line 170: exec: sandbox-exec: not found
       > not ok 18 test-env-var inherits configured env var
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 176)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/dg7f24h4z3lwr79zmgablnrfg0sqldvm-test-env-var/bin/test-env-var: line 170: exec: sandbox-exec: not found
       > not ok 19 test-read-access: can read allowed file
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 183)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/1b8ll8341mymlcas9998mw962q9c3rqk-test-read-access/bin/test-read-access: line 169: exec: sandbox-exec: not found
       > not ok 20 test-write-access: can write allowed file
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 190)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/mxljgn1napx4cl7nz44gr3ibh4h1qvhx-test-write-access/bin/test-write-access: line 169: exec: sandbox-exec: not found
       > ok 21 test-no-access: cannot read file not allowed # skip this test fails in nix sanbox on CI runner
       > not ok 22 test-multi-paths: respects multiple paths
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 212)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/dx90xkgcippihl88q8w778z6bawy0fv4-test-multi-paths/bin/test-multi-paths: line 169: exec: sandbox-exec: not found
       > not ok 23 test-nested-paths: rw inside ro works
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 250)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/w13vlan434dvrxgfd57jd53v8n9ygsqz-test-nested-paths/bin/test-nested-paths: line 168: exec: sandbox-exec: not found
       > not ok 24 test-multi-env: passes multiple variables
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 268)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/wflk72klsdk9wd501ljskilfba6909v2-test-multi-env/bin/test-multi-env: line 171: exec: sandbox-exec: not found
       > not ok 25 test-special-env: passes special characters and multiline
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 279)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/36vxplkacrxfmn7wbmh6b77xby10mfh9-test-special-env/bin/test-special-env: line 170: exec: sandbox-exec: not found
       > not ok 26 test-unrestricted-fs: can access /
       > # (in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 286)
       > #   `[ "$status" -eq 0 ]' failed
       > # Status: 127
       > # Output: /nix/store/5rilcbzzciq6wad7ns3aw52p4b7hbrdq-test-unrestricted-fs/bin/test-unrestricted-fs: line 169: exec: sandbox-exec: not found
       >
       > The following warnings were encountered during tests:
       > BW01: `run`'s command `test-true` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 24)
       > BW01: `run`'s command `test-no-nix-fail -c echo ok` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 30)
       > BW01: `run`'s command `test-add-exec-disabled-fail -c echo ok` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 46)
       > BW01: `run`'s command `test-ls /tmp` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 77)
       > BW01: `run`'s command `test-mktemp /tmp/test.XXXXXX` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 83)
       > BW01: `run`'s command `test-mktemp` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 91)
       > BW01: `run`'s command `test-mktemp-no-tmp /tmp/test.XXXXXX` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 101)
       > BW01: `run`'s command `test-env-var -c
       >     SCRIPT=$(mktemp /tmp/test-script.XXXXXX)
       >     echo "#!$BASH" > "$SCRIPT"
       >     echo "echo executed" >> "$SCRIPT"
       >     chmod +x "$SCRIPT"
       >     "$SCRIPT"
       >   ` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 108)
       > BW01: `run`'s command `test-ls -d /nix/store` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 129)
       > BW01: `run`'s command `test-ls /etc` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 135)
       > BW01: `run`'s command `test-tty -a` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 142)
       > BW01: `run`'s command `test-curl-deny --connect-timeout 2 https://google.com` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 154)
       > BW01: `run`'s command `test-curl-allow -I https://google.com` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 160)
       > BW01: `run`'s command `test-env-var -c set -u; echo $MY_TEST_VAR` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 174)
       > BW01: `run`'s command `test-read-access -c cat test_secret` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 181)
       > BW01: `run`'s command `test-write-access -c echo hi > test_secret && cat test_secret` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 188)
       > BW01: `run`'s command `test-multi-paths -c cat ro1 && cat ro2` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 210)
       > BW01: `run`'s command `test-nested-paths -c cat parent/file` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 248)
       > BW01: `run`'s command `test-multi-env -c echo $VAR1 && echo $VAR2` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 266)
       > BW01: `run`'s command `test-special-env -c echo "$SPECIAL_VAR"` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 277)
       > BW01: `run`'s command `test-unrestricted-fs -c ls -d /etc` exited with code 127, indicating 'Command not found'. Use run's return code checks, e.g. `run -127`, to fix this message.
       >       (from function `run' in file /nix/store/74n0f84mjwi2x1bn12fc4kz8pw94dnhy-bats-1.12.0/lib/bats-core/test_functions.bash, line 418,
       >        in test file /nix/store/b4mq61ah64r1z9d8gcnc5pi1fqjidglk-test.bats, line 284)
       For full logs, run:
         nix log /nix/store/nf1nrsp6akkg8vny538znxbdlp85dfwp-tests.drv
error: build of resolved derivation '/nix/store/nf1nrsp6akkg8vny538znxbdlp85dfwp-tests.drv' failed
error: Cannot build '/nix/store/3lyb0i0xmd5gbmbr3706zjn7j8dl6by0-devour-output.json.drv'.
       Reason: 1 dependency failed.
❌  Task failed with exit code 1 {cmd=/nix/store/0hch2sag3vx5q35zgn954b8p7bk56fma-nix-2.32.4/bin/nix build /nix/store/0ihykf5ilwihmcgbilaxgiic6fph2hli-devour-flake#default -L --print-out-paths --no-write-lock-file --override-input flake ./tests --override-input flake/landrun-nix . --out-link ./tests/result}
18:29 ❌ ERROR [🛞 ;13] Process failed: ExitFailure 1
18:29 ❌ ERROR [🛞 ;13] CI pipeline failed

I do have sandbox-exec:

❯ which sandbox-exec
/usr/bin/sandbox-exec

adrian-gierakowski · 2026-02-27T13:43:52Z

@srid unfortunately one cannot run sandbox-exec inside nix sandbox on macos. I tried with sandboxing disabled, __noChroot=true; and with sandbox-exec copied in nix store. Could run the sandbox-exec binary but got an error

       > # Status: 71
       > # Output: sandbox-exec: sandbox_apply: Operation not permitted

the only way to test this on macos is to run:

nix develop ./tests -c ./tests/test.bats

you should be able to run this for free on gh actions

srid · 2026-03-03T19:36:59Z

@adrian-gierakowski I think we can just use GitHub Actions for this project. Would you be able to address the CI errors?

Also seeing your interest I just added you as collaborator to this repo. No particular responsibilities or expectations; but this way at least you can trigger CI without me approving it each time.

srid · 2026-03-03T19:37:22Z

Aside: I'm planning to switch from Antigravity back to Claude Code, so this PR would be use to me personally as well on macOS!

This reverts commit b4ccd84.

adrian-gierakowski · 2026-03-04T09:52:46Z

@srid all fixed

bumped nixbuild/nix-quick-install-action@v34 (installs nix 2.29.x vs 2.24.x before)
I also tried cachix/install-nix-action@v31 (which installs 2.34) but that's a bit slower.

adrian-gierakowski · 2026-03-04T09:54:21Z

btw. looks like I can merge without approval, so not sure if you want to change the settings to always require at least 1 approval (as owner you can always override)

…wrapper.nix

and use it to set name = "claude" in claude example

adrian-gierakowski · 2026-03-05T18:00:08Z

sw_vers

I'm testing on:

> sw_vers
ProductName:		macOS
ProductVersion:		15.6.1
BuildVersion:		24G90

not sure why unset would be called with an option cause it is not:

# We save allowed variables, unset all, then restore allowed.
    unset "$var"

is there an env var which starts with "--" ?

maybe this helps (in since it's currently using cut from your system)

(Also, the script should be called something other default)

default comes from here and here (it's the same on linux on main)

fixed in last commit

adrian-gierakowski · 2026-03-05T18:01:25Z

ah, still broken:

nix --refresh run "github:adrian-gierakowski/landrun-nix/darwin-implementation-via-sandbox-exec?dir=examples/claude-sandboxed"
error: unable to execute '/nix/store/ssxbbwjn6jq3rwk9k7magji98gpwmhvf-claude/bin/default': No such file or directory

needs meta.mainProgram

adrian-gierakowski · 2026-03-05T18:08:04Z

ah, still broken:

nix --refresh run "github:adrian-gierakowski/landrun-nix/darwin-implementation-via-sandbox-exec?dir=examples/claude-sandboxed"
error: unable to execute '/nix/store/ssxbbwjn6jq3rwk9k7magji98gpwmhvf-claude/bin/default': No such file or directory

needs meta.mainProgram

Still no luck, looks like nix run does not respect meta.mainProgram when running package via flakes (it does when running non-flake code with -f). Which is lame. I'd even say it's a bug.

This reverts commit 905091f. see: srid#18 (comment)

This reverts commit 074dc3d. see: srid#18 (comment)

This reverts commit bd596a4. see: srid#18 (comment)

adrian-gierakowski · 2026-03-05T18:12:14Z

reverted the attempts to fix bin name in the claude example, you'll either have to live with default or have to run with: nix run ./examples/claude-sandboxed#claude

btw. I'm running nix (Nix) 2.32.4, maybe on your side nix run behaves differently

adrian-gierakowski · 2026-03-05T18:17:24Z

reverted the attempts to fix bin name in the claude example, you'll either have to live with default or have to run with: nix run ./examples/claude-sandboxed#claude

btw. I'm running nix (Nix) 2.32.4, maybe on your side nix run behaves differently

actually, something else is at play, just tested with minimal flake and it works with mainProgram etc

adrian-gierakowski · 2026-03-05T18:23:15Z

it was this

all done now

This reverts commit 905091f. not needed as it's set by writeShellApplication

adrian-gierakowski · 2026-03-05T18:25:38Z

all done now, if you still get this weird unset error I will not be able to help since it works on my side :D

srid · 2026-03-05T19:03:15Z

I still get it.

Maybe you want to try making the cut here rigorous:

What is it supposed to return?

Anyway, I just discovered something. This errors happens only when I try to run from a direnv activated environment. Have you tried that case?

srid · 2026-03-05T19:05:17Z

I see env returning scripts in a direnv activated environment:

(And, no, shellHook is just single-line)

srid · 2026-03-05T19:06:09Z

(And, no, shellHook is just single-line)

Nevermind, it is actually shellHook. So you want to account for env vars with multi-line value, it seems:

srid · 2026-03-05T19:07:00Z

To reproduce this, clone https://github.com/srid/haskell-template and run direnv allow in it. I think pre-commit hook is the one that's setting this shellHook.

adrian-gierakowski · 2026-03-06T09:46:05Z

@srid should be fixed now, managed to reproduce locally and latest commit fixes it

srid · 2026-03-06T14:27:58Z

Great; I've tested it and it works. The only thing left to do is update the README (otherwise it will become misleading).

Do you want to do the project rename in this PR or in next PR?

adrian-gierakowski · 2026-03-06T16:07:09Z

Great; I've tested it and it works. The only thing left to do is update the README (otherwise it will become misleading).

Do you want to do the project rename in this PR or in next PR?

Can we merge first and do rename and readme in follow up? Thanks!

srid

Sure, let's do it.

adrian-gierakowski · 2026-03-06T16:53:11Z

Sure, let's do it.

thanks, I had this waiting, so let's merge as well and I'll prep the rename #21

adrian-gierakowski and others added 15 commits February 4, 2026 23:52

add macos support via sandbox-exec

86109c6

improve darwin impl (sandbox-exec) to pass tests added in 635ebfb

04ea4c2

sandbox-exec impl: clean up and add comments

ca9ca02

sandbox-exec fix tty

178550f

fix tty test in nix sandbox

5860fc5

fix indentation

767ae07

only include glibc on linux

03a2271

remove flake-parts debug = true

bd59345

test ls with /etc

552f39a

use pkgs.perl

619a5c9

fix missing USER

b656502

further cleanup and add test features.tmp

bfa7629

allow exec from tmp

47fb1cb

create linux, darwin and common dirs to seperate platform dependant code

1ecbf4b

adrian-gierakowski mentioned this pull request Feb 23, 2026

macos support via sandbox-exec #17

Closed

vira: add macOS

8ba32c2

srid added 2 commits February 27, 2026 10:11

ci: run tests on github actions

f78c1b3

oi

fbd88dd

adrian-gierakowski added 3 commits March 4, 2026 10:19

ci: use nixbuild/nix-quick-install-action v34

b12e3b9

ci: use cachix/install-nix-action@v31

b4ccd84

ci: fix TTY tests by providing a pseudo-terminal (PTY) via script

44e3245

adrian-gierakowski force-pushed the darwin-implementation-via-sandbox-exec branch from 1ada6e9 to 44e3245 Compare March 4, 2026 09:36

Revert "ci: use cachix/install-nix-action@v31"

9fba4a9

This reverts commit b4ccd84.

adrian-gierakowski added 2 commits March 5, 2026 18:47

add coreutils to runtimeInputs of modules/flake-parts/landrun/darwin/…

b1c3408

…wrapper.nix

allow setting name different than submodule.name

bd596a4

and use it to set name = "claude" in claude example

add meta.mainProgram to wrapper

905091f

adrian-gierakowski added a commit to adrian-gierakowski/sandnix that referenced this pull request Mar 5, 2026

Revert "add meta.mainProgram to wrapper"

074dc3d

This reverts commit 905091f. see: srid#18 (comment)

adrian-gierakowski added a commit to adrian-gierakowski/sandnix that referenced this pull request Mar 5, 2026

Reapply "add meta.mainProgram to wrapper"

f3fa36a

This reverts commit 074dc3d. see: srid#18 (comment)

adrian-gierakowski added a commit to adrian-gierakowski/sandnix that referenced this pull request Mar 5, 2026

Revert "allow setting name different than submodule.name"

18f2890

This reverts commit bd596a4. see: srid#18 (comment)

adrian-gierakowski force-pushed the darwin-implementation-via-sandbox-exec branch from f3fa36a to 18f2890 Compare March 5, 2026 18:10

use lib.getExe to get bin path of langrunApp when mapping to flake apps

aac4746

adrian-gierakowski force-pushed the darwin-implementation-via-sandbox-exec branch from 18f2890 to aac4746 Compare March 5, 2026 18:21

Revert "add meta.mainProgram to wrapper"

b4444e9

This reverts commit 905091f. not needed as it's set by writeShellApplication

improve env var handling on darwin

664d588

adrian-gierakowski force-pushed the darwin-implementation-via-sandbox-exec branch from cf33a7b to 664d588 Compare March 6, 2026 09:30

srid added a commit to srid/nixos-config that referenced this pull request Mar 6, 2026

Use srid/sandnix#18

635ed16

srid approved these changes Mar 6, 2026

View reviewed changes

srid merged commit df7e89f into srid:master Mar 6, 2026
2 checks passed

Conversation

adrian-gierakowski commented Feb 23, 2026

Key Changes:

Verification:

Uh oh!

srid commented Feb 26, 2026

Uh oh!

adrian-gierakowski commented Feb 27, 2026

Uh oh!

srid commented Mar 3, 2026

Uh oh!

srid commented Mar 3, 2026

Uh oh!

adrian-gierakowski commented Mar 4, 2026

Uh oh!

adrian-gierakowski commented Mar 4, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 5, 2026

Uh oh!

srid commented Mar 5, 2026

Uh oh!

srid commented Mar 5, 2026

Uh oh!

srid commented Mar 5, 2026

Uh oh!

srid commented Mar 5, 2026

Uh oh!

adrian-gierakowski commented Mar 6, 2026

Uh oh!

srid commented Mar 6, 2026

Uh oh!

adrian-gierakowski commented Mar 6, 2026

Uh oh!

srid left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

adrian-gierakowski commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants