Egregoros

@pernia @Hyperhidrosis

so this is part of it and i honestly cant say i wrote it anymore because i lost control of the repo to qwen he took it over because its way too annoying for me to debug goofy ass shit like /dev/kvm or gpu passthrough or seccomp or selinux but basically this guy is oci image. i'd recommend running it with bocker. https://github.com/p8952/bocker


{
description = "OCI image from flake";

inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
flake-parts.url = "github:hercules-ci/flake-parts";
claude-code.url = "github:sadjow/claude-code-nix";
claude-code.inputs.nixpkgs.follows = "nixpkgs";
};

outputs = inputs @ { nixpkgs, flake-parts, claude-code, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "aarch64-linux" ];
perSystem = { config, system, ... }:
let
pkgs = import nixpkgs {
inherit system;
config.allowUnfree = true;
};

imageTag = pkgs.lib.fileContents ./config/image-tag;

agentSubuid = pkgs.writeText "subuid" "agent:100000:65536\n";
agentSubgid = pkgs.writeText "subgid" "agent:100000:65536\n";

agentJailProfile = pkgs.writeText "agent-jail.sh" ''
# slop-env agent hardening
umask 077
export HISTSIZE=100000
export HISTFILESIZE=100000
export HISTCONTROL=""
export HISTTIMEFORMAT="%F %T "
export PROMPT_COMMAND='history -a'
'';

podmanRegistriesConf = pkgs.writeText "registries.conf" ''
[registries.search]
registries = ["docker.io"]

[registries.insecure]
registries = []
'';

podmanPolicyJson = pkgs.writeText "policy.json" ''
{"default":[{"type":"insecureAcceptAnything"}]}
'';

flakeRegistry = pkgs.writeText "registry.json" (builtins.toJSON {
version = 2;
flakes = [{
from = { type = "indirect"; id = "nixpkgs"; };
to = {
type = "github";
owner = "NixOS";
repo = "nixpkgs";
inherit (nixpkgs) rev;
};
}];
});

baseEnv = pkgs.buildEnv {
name = "base-slop-env";
paths = with pkgs; [
glibc
nix
bashInteractive
dash
uutils-coreutils-noprefix
uutils-findutils
uutils-diffutils
which
less
nushell
cacert
moreutils
fish

ripgrep
fd
gawk
gnused
jq
yq

git
curl
wget
openssh
rsync
netcat
tcpdump

gnutar
gzip
zstd
libarchive

vim
ed
claude-code.packages.${system}.default

gcc
gnumake
cmake
python313
nodejs_24
perl
uv
ruff
bc
clang
meson
ninja
gnum4
lua
tcl
ruby_3_4
clisp
calc
jupyter

ffmpeg-full
imagemagick
pandoc
exiftool
yt-dlp
tealdeer
powershell

kubectl
kubernetes-helm

buildah
podman
podman-compose
shadow
slirp4netns
fuse-overlayfs
bubblewrap
iptables
nftables
conmon
crun
runit
procps
util-linux
trash-cli # we use this instead of rm

qemu_kvm
libvirt
cloud-utils
OVMF
swtpm
cdrkit
packer

playwright-driver
playwright-driver.browsers
texliveFull # lol
];
pathsToLink = [ "/bin" "/lib" "/share" "/etc" ];
ignoreCollisions = true;
};

customRoot = pkgs.runCommand "custom-root" { } ''
mkdir -p $out/tmp/home/.local/bin
mkdir -p $out/tmp/home/.local/share/Trash/files
mkdir -p $out/tmp/home/.config/vim
mkdir -p $out/tmp/home/.config/nushell
# mkdir -p $out/home/linuxbrew/.linuxbrew
mkdir -p $out/bin
mkdir -p $out/etc/profile.d

# rtk is NOT copied here: /tmp/home is the persistent volume and would
# shadow/stale it. It's baked to /etc/slop-env/rtk below and re-seeded
# into ~/.local/bin by slop-entrypoint on every boot.

# copy local homebrew from manually updated scripts dir
# cp -r ./scripts/homebrew $out/home/linuxbrew/.linuxbrew/Homebrew

# config files
cp ${./config/vimrc} $out/tmp/home/.config/vim/vimrc
cp ${./config/config.nu} $out/tmp/home/.config/nushell/config.nu

# inner podman configs
mkdir -p $out/etc/containers $out/tmp/home/.config/containers
cp ${./config/containers.conf} $out/etc/containers/containers.conf
cp ${./config/storage.conf} $out/tmp/home/.config/containers/storage.conf
cp ${podmanRegistriesConf} $out/etc/containers/registries.conf
cp ${podmanPolicyJson} $out/etc/containers/policy.json
cp ${agentSubuid} $out/etc/subuid
cp ${agentSubgid} $out/etc/subgid
cp ${agentJailProfile} $out/etc/profile.d/agent-jail.sh

# pin nixpkgs flake-registry id (see flakeRegistry comment above)
mkdir -p $out/etc/nix
cp ${flakeRegistry} $out/etc/nix/registry.json

# JAIL.md (agent jail/env guide) baked read-only. slop-entrypoint
# re-seeds it into ~/.claude/JAIL.md each boot, since ~ is the
# persistent /tmp/home volume and an image copy placed there would be
# shadowed (and could go stale) on subsequent boots.
mkdir -p $out/etc/slop-env
cp ${./config/JAIL.md} $out/etc/slop-env/JAIL.md
# rtk baked read-only; slop-entrypoint re-seeds it into ~/.local/bin each
# boot. rtk is an x86_64-only static binary, so on other arches bake a
# nushell passthrough shim instead — that keeps a registered rtk hook
# from crashing tool calls (TODO.md tracks a real per-arch rtk).
cp ${if pkgs.stdenv.hostPlatform.isx86_64 then ./scripts/rtk else ./scripts/rtk-shim} $out/etc/slop-env/rtk
chmod +x $out/etc/slop-env/rtk

for cmd in sudo su doas run0 sudo-rs gosu su-exec chpst; do
cat > $out/bin/$cmd << 'EOF'
#!/bin/dash
echo "slop-env: $0 is not available. you are jailed. focus on /workspace." >&2
exit 1
EOF
chmod +x $out/bin/$cmd
done

# Helper scripts live in /workspace/scripts/ so they're git-trackable
# and editable without re-running nix build for trivial fixes.
#
# They install to /usr/local/bin (image filesystem, on PATH) rather
# than /tmp/home/.local/bin because /tmp/home is a persistent volume
# — anything installed there from the image is shadowed by the
# volume's old content on the second and subsequent boots, so new
# helpers added in a rebuild would silently never appear.
mkdir -p $out/usr/local/bin
install -m 755 ${./scripts/nix-wrapper} $out/usr/local/bin/nix
install -m 755 ${./scripts/slop-entrypoint} $out/usr/local/bin/slop-entrypoint
install -m 755 ${./scripts/libvirt-up} $out/usr/local/bin/libvirt-up
install -m 755 ${./scripts/doctor} $out/usr/local/bin/doctor
install -m 755 ${./scripts/slop-claude-init} $out/usr/local/bin/slop-claude-init

# runit service templates. Copied into /tmp/services/ at container
# startup by slop-entrypoint so runit can write its supervise state
# there (read-only /etc/ prevents in-place use).
mkdir -p $out/etc/service-template/virtqemud
install -m 755 ${./scripts/runit-services/virtqemud/run} \
$out/etc/service-template/virtqemud/run

# jail banner for bash login shells
cat > $out/etc/profile.d/slop-jail.sh << 'EOF'
# slop-env jail notice
if [ -z "$SLOP_JAIL_SHOWN" ]; then
export SLOP_JAIL_SHOWN=1
echo "=== SLOP-ENV JAIL ==="
echo "sandboxed. writable: /workspace /tmp /tmp/home"
echo "read-only rootfs. no sudo. focus on the code."
echo "nix overlay: 'nix run nixpkgs#<pkg>' or 'nix shell nixpkgs#<pkg> -c bash'"
echo "====================="
fi
EOF
'';

in
{
packages.baseImage = pkgs.dockerTools.buildLayeredImage {
name = "localhost/slop-env";
tag = imageTag;
maxLayers = 67;

contents = [ customRoot baseEnv ];

uid = 1000;
gid = 1000;
uname = "agent";
gname = "agent";

fakeRootCommands = ''

# mkdir -p tmp/home tmp/nix/var/nix tmp/nix/chroot workspace usr/bin etc home/linuxbrew/.linuxbrew/bin
mkdir -p tmp/home tmp/nix/var/nix tmp/nix/chroot workspace usr/bin etc
ln -sf /bin/env usr/bin/env
ln -sf /bin/bash bin/sh
ln -sf /bin/rg bin/grep
chmod 1777 tmp
# chmod 755 tmp/home tmp/nix/var/nix tmp/nix/chroot workspace home/linuxbrew
chmod 755 tmp/home tmp/nix/var/nix tmp/nix/chroot workspace

# setup passwd and groups
cat > etc/passwd << 'EOF'
root:x:0:0:root:/root:/bin/bash
agent:x:1000Agent:/tmp/home:/bin/bash
EOF

cat > etc/group << 'EOF'
root:x:0:
kvm:x:104:agent
libvirt:x:993:agent
agent:x:1000:
EOF

mkdir -p etc/nix
cat > etc/nix/nix.conf << 'EOF'
experimental-features = nix-command flakes
build-users-group =
sandbox = false
EOF

# ensure /etc/profile.d scripts are sourced by login shells
cat > etc/profile << 'EOF'
for i in /etc/profile.d/*.sh; do
if [ -r "$i" ]; then
. "$i"
fi
done
unset i
EOF

# link brew into the bin path expected by the image
# ln -sf /home/linuxbrew/.linuxbrew/Homebrew/bin/brew home/linuxbrew/.linuxbrew/bin/brew

# allow agent to get serious business done
# chown -R 1000:1000 home/linuxbrew tmp workspace bin/sh
chown -R 1000:1000 tmp workspace bin/sh

# podman runtime dirs (tmpfs ephemeral)
mkdir -p tmp/home/.local/share/containers tmp/run/containers/storage
chown -R 1000:1000 tmp/home/.local tmp/run

# resolve symlinks to regular files so setuid tools and parsers work
for f in etc/subuid etc/subgid etc/containers/containers.conf; do
if [ -L "$f" ]; then
_target=$(readlink -f "$f")
rm -f "$f"
cp "$_target" "$f"
fi
done

# make newuidmap/newgidmap setuid for rootless podman
# place in /usr/local/bin and append a byte so dockerTools
# excludePaths doesn't deduplicate them back to symlinks
mkdir -p usr/local/bin
for _bin in newuidmap newgidmap; do
if [ -L bin/$_bin ]; then
_target=$(readlink -f bin/$_bin)
cp "$_target" usr/local/bin/$_bin
chmod +w usr/local/bin/$_bin
printf '\0' >> usr/local/bin/$_bin
chmod 4755 usr/local/bin/$_bin
fi
done
'';

config = {
User = "agent";
WorkingDir = "/workspace";
Env = [
"SHELL=bash"
"PATH=/tmp/home/.local/share/pnpm:/usr/local/bin:/tmp/home/.local/bin:/bin:/usr/bin"
"HOME=/tmp/home"
"XDG_CONFIG_HOME=/tmp/home/.config"
"XDG_DATA_DIRS=/usr/local/share:/usr/share:/tmp/home/.local/share"
"PNPM_HOME=/tmp/home/.local/share/pnpm"
"NIX_STATE_DIR=/tmp/nix/var/nix"
"NIX_CONF_DIR=/etc/nix"
"NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
"SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
"GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
"EDITOR=vim"
"TERM=xterm-256color"
"RTK_TELEMETRY_DISABLED=1"
"PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}"
"PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1"
"PLAYWRIGHT_NODEJS_PATH=${pkgs.nodejs_24}/bin/node"
"LIBVIRT_DEFAULT_URI=qemu:///session"
"XDG_RUNTIME_DIR=/tmp/runtime-1000"
"SVDIR=/tmp/services"
];
Cmd = [ "bash" "-l" ];
};
};

packages.default = config.packages.baseImage;

formatter = pkgs.nixpkgs-fmt;

devShells.default = pkgs.mkShell {
name = "slop-env-dev";
packages = with pkgs; [ nushell nixpkgs-fmt statix deadnix git jq yq ];
shellHook = ''
nu ${./scripts/fmt.nu} install-hook 2>/dev/null || true
echo "slop-env dev shell — format: nu scripts/fmt.nu | check: nu scripts/fmt.nu --check"
'';
};
};
};
}