A Nix flake-parts module for wrapping programs with a sandboxed environment using landrun (Landlock) on Linux, and sandbox-exec on macOS.

In your flake.nix:

{
  inputs.sandnix.url = "github:srid/sandnix";

  outputs = { flake-parts, sandnix, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [ sandnix.flakeModule ];

      perSystem = { pkgs, ... }: {
        sandnixApps.my-app-sandboxed = {
          program = "${pkgs.my-app}/bin/my-app";
          features = {
            tty = true;      # Terminal support
            nix = true;      # Nix store access (default)
            network = true;  # Network access
            tmp = true;      # /tmp access (default)
          };
          # Raw arguments to pass to `landrun` CLI
          cli = {
            rw = [ "$HOME/.config/my-app" ];
            rox = [ "/etc/hosts" ];
          };
        };
      };
    };
}

Run with: nix run .#my-app-sandboxed

sandnix provides reusable modules for common applications via sandnixModules.*. These can be imported into your app configurations:

{
  inputs.sandnix.url = "github:srid/sandnix";

  outputs = { flake-parts, sandnix, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [ sandnix.flakeModule ];

      perSystem = { pkgs, ... }: {
        sandnixApps.my-app = {
          imports = [
            sandnix.sandnixModules.gh  # Import GitHub CLI module
          ];
          program = "${pkgs.my-app}/bin/my-app";
          features.network = true;
        };
      };
    };
}

Sandbox Claude Code with access to project directory, config files, and network.

See examples/claude-sandboxed for a complete working example.

Try it:

nix run 'github:srid/sandnix?dir=examples/claude-sandboxed'

High-level feature flags automatically configure common sandboxing patterns:

Fine-grained control via cli.*:

On Linux, sandnix generates an alternative binary variant named <name>-with-args. This variant allows you to dynamically pass sandbox configuration arguments directly to the underlying landrun executable at runtime.

When using this variant, arguments passed before a -- separator are provided to landrun, while all arguments after the -- separator are passed to the wrapped program. If no -- is provided, all arguments are passed to landrun.

Example:

nix run .#my-app-sandboxed-with-args -- --rw /my/dynamic/path -- arg1 arg2

Important: In scripts or wrappers that may provide program arguments dynamically, you should always explicitly include the -- separator. This ensures that a -- meant for the wrapped program (or a wrapper within it) is not misinterpreted by the sandnix wrapper as the delimiter for sandbox arguments.

https://github.com/srid/sandnix/discussions

GPL-3.0

• nixpak: a fancy declarative wrapper around bubblewrap.
• jail.nix: helper to make it easy and ergonomic to wrap your derivations in bubblewrap.