microsandbox-flake

Nix flake for the microsandbox msb CLI — a lightweight VM-based sandboxing tool.

Quick start

# Run directly
nix run github:kasuboski/microsandbox-flake

# Or install into a profile
nix profile install github:kasuboski/microsandbox-flake

Supported platforms

System	Status
x86_64-linux	✅
aarch64-linux	✅
aarch64-darwin	✅
x86_64-darwin	❌ not supported upstream

What you get

Output	Description
msb (default)	The sandbox CLI binary
agentd	VM guest init process (static Linux binary)
libkrunfw	Shared library containing a compressed Linux kernel

msb is self-contained — the other two outputs are rolled into it at build time.

Build approach

The goal is to get msb into Nix, not to rebuild everything from source. Two of the three components are fetched as pre-built binaries from upstream GitHub releases:

Component	Method	Why
msb	Built from source via rustPlatform.buildRustPackage	The actual CLI; needs Rust toolchain but is straightforward
agentd	Fetched from release	Tiny static Linux/musl binary; building it requires a musl cross-toolchain and is not worth the complexity
libkrunfw	Fetched from release	Contains a compiled Linux kernel; building from source takes 20+ minutes and requires Docker

This is a pragmatic tradeoff — the alternative is maintaining Nix expressions for a musl cross-compilation toolchain and an in-Nix kernel build, for no real benefit.

Pinned version

The flake pins v0.4.6 of microsandbox. To update, change the src input URL and update the hashes in flake.nix.

Notes

• No ssh feature: v0.4.6 doesn't ship it. The build uses --no-default-features --features net, matching the upstream release configuration.
• macOS entitlements: The binary is ad-hoc codesigned with com.apple.security.hypervisor and com.apple.security.cs.disable-library-validation entitlements so it can use the Apple Hypervisor Framework and load libkrunfw from the Nix store.
• Tests disabled: Some unit tests reference a debug-only helper function and don't compile in release mode.