Notes on software, systems, and the occasional proof. Zola 2026-09-06T00:00:00+00:00 https://hamidr.github.io/atom.xml 2026-09-06T00:00:00+00:00 2026-09-06T00:00:00+00:00 Hamid https://hamidr.github.io/posts/nixcage/ <p><a rel="external" href="https://github.com/hamidr/nixcage">nixcage</a> gives every project its own systemd-nspawn container, built from the project's own <code>devShells.default</code>. There is no <code>nixcage init</code> and no nixcage file in the repository: the devShell is the entire interface.</p> <p>Inside the container a project sees only its own directory, its own persistent home, and the Nix store read-only. Two projects on the same machine cannot reach each other's source, and neither can whatever their toolchains decide to run.</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#24292E, #E1E4E8); background-color: light-dark(#FFFFFF, #24292E);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#6F42C1, #B392F0);">nix</span><span style="color: light-dark(#032F62, #9ECBFF);"> profile</span><span style="color: light-dark(#032F62, #9ECBFF);"> install</span><span style="color: light-dark(#032F62, #9ECBFF);"> github:hamidr/nixcage</span></span> <span class="giallo-l"><span style="color: light-dark(#005CC5, #79B8FF);">cd</span><span style="color: light-dark(#032F62, #9ECBFF);"> ~/Src/some-project</span></span> <span class="giallo-l"><span style="color: light-dark(#6F42C1, #B392F0);">nixcage</span><span style="color: light-dark(#032F62, #9ECBFF);"> enter</span></span></code></pre> <p>On Linux the container runs natively on the host. macOS has no containers, so the same container runs inside one shared NixOS microVM whose only job is to provide a Linux kernel. That boots once and serves every project, and it adds a VM boundary between the containers and the host.</p> <p>The CLI is small: <code>enter</code>, <code>exec</code>, <code>rm</code>, <code>status</code>, plus <code>rebuild</code> and <code>down</code> on macOS where the VM lifecycle is yours to manage. Configuration is a NixOS module on Linux and a config flake at <code>~/.config/nixcage</code> on macOS, so the VM is an ordinary NixOS system you own.</p> <p>Secrets come from sops-nix and are injected per session:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#24292E, #E1E4E8); background-color: light-dark(#FFFFFF, #24292E);"><code data-lang="nix"><span class="giallo-l"><span style="color: light-dark(#E36209, #FFAB70);">nixcage</span><span style="color: light-dark(#D73A49, #F97583);">.</span><span style="color: light-dark(#E36209, #FFAB70);">secretEnv</span><span style="color: light-dark(#D73A49, #F97583);">.</span><span style="color: light-dark(#E36209, #FFAB70);">ANTHROPIC_API_KEY</span><span style="color: light-dark(#B31D28, #FDAEB7);font-style: italic;"> =</span><span style="color: light-dark(#032F62, #9ECBFF);"> &quot;</span><span style="color: light-dark(#032F62, #9ECBFF);">anthropic</span><span style="color: light-dark(#032F62, #9ECBFF);">&quot;</span><span style="color: light-dark(#B31D28, #FDAEB7);font-style: italic;">;</span></span></code></pre> <p>Four exported primitives (<code>enter</code>, <code>uid</code>, <code>storage ensure</code>, and <code>exec</code>) are the whole interface for tools built on top; you name paths and principals, nixcage names datasets and numbers.</p> <p>GPLv3. README and ADRs are in the repository.</p> 2026-08-12T00:00:00+00:00 2026-08-12T00:00:00+00:00 Hamid https://hamidr.github.io/posts/hello/ <p>This site is a Zola project built inside a Nix flake, so the toolchain is pinned and the output is reproducible.</p> <p>Preview it locally:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#24292E, #E1E4E8); background-color: light-dark(#FFFFFF, #24292E);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#6F42C1, #B392F0);">nix</span><span style="color: light-dark(#032F62, #9ECBFF);"> develop</span><span style="color: light-dark(#005CC5, #79B8FF);"> -</span><span style="color: light-dark(#005CC5, #79B8FF);">-command</span><span style="color: light-dark(#032F62, #9ECBFF);"> zola</span><span style="color: light-dark(#032F62, #9ECBFF);"> serve</span></span></code></pre> <p>Build the deployable tree:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#24292E, #E1E4E8); background-color: light-dark(#FFFFFF, #24292E);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#6F42C1, #B392F0);">nix</span><span style="color: light-dark(#032F62, #9ECBFF);"> build</span></span></code></pre> <p>The result is a plain directory of HTML under <code>./result</code>, which any static host will serve as-is.</p>