Christopher Mühl
613d015cc1
- Resolve SHELL to nix store bash path (was /bin/bash which doesn't exist in sandbox) - Inject clean SANDBOX_PATH via makeBinPath (was leaking entire host PATH) - Add --shell flag to drop into sandboxed bash for manual verification - Use nix-claude-code flake for claude-code binary instead of host PATH discovery Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
49 lines
1.3 KiB
Nix
49 lines
1.3 KiB
Nix
{
|
|
description = "claudebox - sandboxed Claude Code";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
|
nix-claude-code = {
|
|
url = "github:ryoppippi/nix-claude-code";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
nix-index-database = {
|
|
url = "github:nix-community/nix-index-database";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
outputs = { self, nixpkgs, nix-claude-code, nix-index-database, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
claude-code = nix-claude-code.packages.${system}.default;
|
|
comma-with-db = nix-index-database.packages.${system}.comma-with-db;
|
|
runtimeDeps = [
|
|
pkgs.bubblewrap
|
|
pkgs.coreutils
|
|
pkgs.git
|
|
pkgs.curl
|
|
pkgs.jq
|
|
pkgs.ripgrep
|
|
pkgs.fd
|
|
pkgs.nix
|
|
comma-with-db
|
|
pkgs.bash
|
|
pkgs.nodejs
|
|
claude-code
|
|
];
|
|
sandboxPath = pkgs.lib.makeBinPath runtimeDeps;
|
|
in {
|
|
packages.${system} = {
|
|
claudebox = pkgs.writeShellApplication {
|
|
name = "claudebox";
|
|
runtimeInputs = runtimeDeps;
|
|
text = ''
|
|
SANDBOX_PATH="${sandboxPath}"
|
|
'' + builtins.readFile ./claudebox.sh;
|
|
};
|
|
default = self.packages.${system}.claudebox;
|
|
};
|
|
};
|
|
}
|