container: optionally isolate host abstract UNIX domain sockets via landlock

2025-08-18 12:00:52 +09:00
parent 69a4ab8105
commit 5db0714072
17 changed files with 375 additions and 9 deletions
--- a/options.nix
+++ b/options.nix
@@ -182,6 +182,7 @@ in
              net = mkEnableOption "network access" // {
                default = true;
              };
+              abstract = mkEnableOption "abstract unix domain socket access";

              nix = mkEnableOption "nix daemon access";
              mapRealUid = mkEnableOption "mapping to priv-user uid";