Skip to content
Nix-based app vm's
Branch: master
Clone or download
Latest commit bb5a352 May 12, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
nix Remove state version May 12, 2019
screenshots Add screenshot Jul 5, 2018
.gitignore Ignore local ({local,monitor}.nix) settings Jul 12, 2018
LICENSE Add LICENSE Jun 30, 2018
appvm.go Refactor prefix search May 12, 2019

Nix application VMs: security through virtualization

Simple application VMs (hypervisor-based sandbox) based on Nix package manager.

Uses one read-only /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.

Currently optimized for full screen usage (but remote-viewer has ability to resize window dynamically without change resolution).

appvm screenshot


$ sudo apt install golang virt-manager curl git
$ sudo usermod -a -G libvirt $USER

$ echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
$ echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bash_profile
$ echo 'source ~/.bash_profile' >> ~/.bashrc
$ source ~/.bash_profile

You need to relogin if you install virt-manager (libvirt) first time.

Install Nix package manager

$ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
$ curl | sh
$ . ~/.nix-profile/etc/profile.d/

Libvirt from user (required if you need access to shared files)

$ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
$ sudo systemctl restart libvirtd

Install appvm tool

$ go get

Update appvm tool

$ go get -u

Generate resolution

By default uses 1920x1080. If you need to regenerate appvm/nix/monitor.nix:

$ $GOPATH/src/ 3840 2160 > $GOPATH/src/

Autodetection is a bash-spaghetti, so you need to check results. BTW it's just a monitor section.

Run application

$ appvm start chromium --verbose
$ # ... long wait for first time, because we need to collect a lot of packages

You can customize local settings in $GOPATH/

Default hotkey to release cursor: ctrl+alt.

Shared directory

$ ls appvm/chromium

Close VM

$ appvm stop chromium

Automatic ballooning

Add this command:

$ appvm autoballoon

to crontab like that:

$ crontab -l
* * * * * /home/user/dev/go/bin/appvm autoballoon

App description

$ cat nix/chromium.nix
{pkgs, ...}:
  imports = [

  environment.systemPackages = [ pkgs.chromium ];
  services.xserver.displayManager.sessionCommands = "while [ 1 ]; do ${pkgs.chromium}/bin/chromium; done &";

For create new app you should add package name (search at and path to binary (typically same as package name).

Defined applications (pull requests are welcome!)

  • chromium
  • thunderbird
  • tdesktop
  • evince
  • libreoffice
  • wire
  • torbrowser
You can’t perform that action at this time.