Isolate the Evaluator

[nrdxp]

It's quite simple:

#!/usr/bin/env bash

cmd="$(readlink -f "$(command -v "$1")")"

shift

NIX_CONFIG="$(nix config show)"
export NIX_CONFIG

bwrap --ro-bind /nix /nix \
      --bind "$PWD" /work \
      --chdir /work \
      --dev /dev \
      --proc /proc \
      --tmpfs /tmp \
      "$cmd" "$@"

to put the evaluator into a context where it has no access to the host file-system beside the current directory. This example uses bubblewrap, but eka should be smart enough to perform certain operations in isolation in general, while also extending this concept to the future Eos backend.

[nrdxp]

see the nixec crate for a very rough PoC (unfinished) of the general idea, however this will probably move to Eos eventually