bubblebox
nix + bwrap + rstrict + $CLI = ${CLI}box!
bubblebox
generalizes numtide’s claudebox over an arbitrary CLI binary, so one sandboxing
wrapper serves every CLI from one builder. Each gets a generic NixOS environment with an isolated
$HOME, the working directory read-write, and parent directories hidden by default. Verified on
NixOS, Ubuntu WSL and macOS via Seatbelt.
{
inputs.bubblebox.url = "github:nix-tools/bubblebox";
outputs = { nixpkgs, flake-parts, bubblebox, ... }@inputs:
flake-parts.lib.mkFlake { inherit inputs; } {
perSystem = { pkgs, system, ... }: {
_module.args.pkgs = import nixpkgs {
inherit system;
overlays = [ bubblebox.overlays.default ];
};
devshells.default.packages = [
pkgs.claudebox
pkgs.opencodebox
];
};
};
}hk-nix
hk-nix
is a Nix wrapper for hk, the fast git hook manager and project linter — what
lefthook.nix is to lefthook: declare your hooks in Nix, pin the linters with Nix, and enable
them by entering a devshell.
It is always on, because entering the devshell installs the hooks, so they run on a fresh clone
too. And it is always in sync with CI, because every command a hook runs names its linter by
absolute /nix/store path — so nix flake check runs the very same tools your hooks did.
{
inputs.hk-nix.url = "github:nix-tools/hk-nix";
outputs = { flake-parts, hk-nix, treefmt-nix, ... }@inputs:
flake-parts.lib.mkFlake { inherit inputs; } {
imports = [ hk-nix.flakeModules.default treefmt-nix.flakeModule ];
perSystem = { config, pkgs, ... }:
let
hk = config.hk-nix;
fmt = config.treefmt.build.wrapper;
in
{
hk-nix.settings.hooks = {
# formatting is cheap; fix it on every commit
"pre-commit" = {
fix = true;
stash = "git";
steps.treefmt = {
glob = "*.nix";
fix = "${fmt}/bin/treefmt {{files}}";
};
};
# a secret scan can wait for the push
"pre-push".steps.betterleaks.builtin =
hk.builtins.betterleaks;
};
devShells.default = pkgs.mkShell {
packages = [ hk.wrappedPackage pkgs.git ];
shellHook = hk.shellHook;
};
};
};
}nix-roadmaps
nix-roadmaps turns the sprawl of Nix documentation into ordered learning paths — from your first derivation to flakes, overlays and deployment — each step written as a checkable milestone with a runnable example, so you always know what to learn next and can prove you learned it.
$ roadmaps list flakes-101 packaging nixos-deploy $ roadmaps next flakes-101 → 05 · Pinning inputs
About
nix.tools is maintained by Simon Shine.