sandbox: add nix read-only mount if found

build.sh

@@ -34,6 +34,7 @@ PROJECT_FILES=(
     "src/sandbox/input.sh"
     "src/sandbox/kvm.sh"
     "src/sandbox/name.sh"
+    "src/sandbox/nix.sh"
     "src/sandbox/pipewire.sh"
     "src/sandbox/pulseaudio.sh"
     "src/sandbox/selinux.sh"

src/sandbox/main.sh

@@ -17,6 +17,8 @@ function sandbox_setup() {
     sandbox_setup_input
     printf "\r(%s) Finding KVM ... " "$TAG_NAME"
     sandbox_setup_kvm
+    printf "\r(%s) Finding Nix ..." "$TAG_NAME"
+    sandbox_setup_nix
     printf "\r(%s) Finding pipewire ... " "$TAG_NAME"
     sandbox_setup_pipewire
     printf "\r(%s) Finding pulseaudio ... " "$TAG_NAME"

src/sandbox/nix.sh

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: Andrew Hayzen <ahayzen@gmail.com>
+#
+# SPDX-License-Identifier: MPL-2.0
+
+function sandbox_setup_nix() {
+    # If /nix exists then mount it in as our /home config could have symlinks
+    # into /nix folders and would fail otherwise
+    #
+    # We do not source any folders so the container environment is isolated
+    if [ -d /nix ]; then
+      CONTAINER_RUN_ARGS+=(--volume=/nix:/nix:ro)
+    fi
+}